The Gambling Commission: AML, License Requirements, Responsible Gambling and More

Name: The Gambling Commission
Role: Gambling regulator
Country: Great Britain (England, Scotland and Wales). The Commission doesn’t regulate Northern Ireland.
Year Founded: 2005

The field of responsibility

Great Britain is one of the most respected gambling jurisdictions in the world. The country’s regulator, the Gambling Commission, is known for its particularly high standards for AML/CFT and responsible gambling compliance.

The Commission’s primary objective is to make gambling a safe leisure activity. Its work towards this goal can be broken down into two main functions:

1. The protection of gamblers. The Commission emphasizes that it oversees gambling primarily in the interests of consumers. Therefore, the main goal of the regulator is to protect players from gambling-related harm.
2. Control over gambling providers. The supervisory functions of the Commission can be broadly divided into four categories: Licensing, overseeing compliance, providing guidance, and enforcement.

A concise version of this article can be found here. If you want a thorough breakdown of AML and licensing requirements, continue reading.

The legal landscape

To understand the legal landscape of gambling in Britain, let’s go through the principal gambling, AML/CFT, and criminal legislation.

• The Gambling Act 2005 provides us with all of the key gambling-related definitions and sets out the main requirements for all gambling operators. It establishes the Gambling Commission as a regulatory body for gambling and specifies its functions.

• The National Lottery etc. Act 1993 creates requisites for running the National Lottery.

• The Licence Conditions and Codes of Practice establish requirements for gambling licenses. In addition, the Conditions require operators to keep money laundering and other crimes out of gambling. To do that, operators are obliged to adopt a risk-based approach for money laundering assessment and implement procedures to prevent financial crimes. This regulation also imposes responsible gambling obligations.

• The Proceeds of Crime Act 2002 subjects all gambling businesses and their staff to prevent crime within the gambling arena. Such crimes include money laundering and terrorist financing.

• The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 and the Regulations 2019 (amendments) require operators to implement AML and KYC procedures including due diligence checks, employee training, etc.

• The Terrorism Act 2000 sets out the offenses connected to engaging in, or supporting, terrorism for all sectors, including gambling.

• The Sanctions and Anti-Money Laundering Act 2018 enables authorities to impose sanctions for money laundering.

• The Gambling (Licensing and Advertising) Act 2014 requires foreign operators to hold a UK operating license in order to offer and advertise remote gambling on UK soil.
• The 4th and 5th Anti-Money Laundering Directives regulate AML compliance throughout the EU. In January 2020, the 5th AMLD, was transposed into national law in the UK. However, the country decided not to implement the 6th AMLD, which came at the end of 2020.
• The FATF recommendations. The UK is a member of the Financial Action Task Force (FATF), which is the global AML/CFT watchdog. The Commission used FATF’s framework to create its risk assessment methodology.

For more information, check out other gambling-related legislation.

In keeping crime outside of gambling, the Commission cooperates with various UK regulators, such as the FCA, the HMRC, the NSA, the SFO, and the RGSB.

The gambling landscape

Since definitions of “gambling” differ from jurisdiction to jurisdiction, we need to understand what exactly the term means in Great Britain. We’re only talking about Britain here, since the Gambling Act, which provides key definitions for gambling, applies solely to England, Scotland, and Wales. Northern Ireland is regulated separately from Britain by the Betting, Gaming, Lotteries & Amusements Order 1985.

Gambling

In this Act “gambling” means—(a)gaming (within the meaning of section 6), (b)betting (within the meaning of section 9), and (c)participating in a lottery (within the meaning of section 14 and subject to section 15).

(The Gambling Act 2005, §3)

In short, gambling in Britain is divided into gaming, betting, and participation in the National Lottery.

Gaming

In this Act “gaming” means playing a game of chance for a prize. (2) In this Act “game of chance”—(a)includes—(i)a game that involves both an element of chance and an element of skill, (ii)a game that involves an element of chance that can be eliminated by superlative skill, and (iii)a game that is presented as involving an element of chance, but (b)does not include a sport.

(The Gambling Act 2005, §6

Gaming includes such activities as casino games, poker, and bingo. Games that don’t offer a monetary reward, and games where the outcome depends purely on the skill of the player (not luck), aren’t considered gaming.

Betting

In this Act “betting” means making or accepting a bet on—(a)the outcome of a race, competition or other event or process, (b)the likelihood of anything occurring or not occurring, or (c)whether anything is or is not true.

(The Gambling Act 2005, §9)

Betting comprises sports betting, fantasy betting, and other activities. Spread betting and betting on the National Lottery aren’t allowed in Britain.

The lottery

(1)For the purposes of this Act an arrangement is a lottery, irrespective of how it is described, if it satisfies one of the descriptions of lottery in subsections (2) and (3). (2)An arrangement is a simple lottery if—(a)persons are required to pay in order to participate in the arrangement, (b)in the course of the arrangement one or more prizes are allocated to one or more members of a class, and (c)the prizes are allocated by a process which relies wholly on chance. (3)An arrangement is a complex lottery if—(a)persons are required to pay in order to participate in the arrangement, (b)in the course of the arrangement one or more prizes are allocated to one or more members of a class, (c)the prizes are allocated by a series of processes, and (d)the first of those processes relies wholly on chance.

(The Gambling Act 2005, §14)

The National Lottery has an absolute monopoly on commercial lotteries; only charitable ones are permitted.

Licensing

If a company wants to provide services for British citizens, it must get a British license regardless of its location.

There are four main types of licenses: operating, personal management, personal functional, and premises. The latter type, however, is issued by local authorities, not the Gambling commission.

Each license type can be subdivided into remote and non-remote. Remote gambling operators don’t have to place any of their equipment in the UK to provide online services.

The Commission requires all licensees to meet these three objectives:

1. Prevent gambling from being associated with crime
2. Ensure that gambling is conducted fairly and openly
3. Protect customers

The Commission always conducts a thorough inspection of applicants before granting them a license. Now let’s talk about each type of license in detail.

Operating license

An operating license authorizes a company to provide gambling facilities. There is a particular type of operating license for each kind of gambling activity. Check out all types of operating licenses here.

Application procedure: it’s possible to apply online via the Commission’s website. Usually, operators will be informed of the regulator’s decision within a 16-week period.

Documents to submit: while each type of operating license has its own requirements, the list of documents usually includes the operator’s ID documents, policy documents, financial plans, business plans, and the management structure. It also includes beneficial ownership and documents on key people within the company.

License cost: there are two fees: application and annual. Operators can use the Commission’s fee calculator to estimate the exact cost. Annual fees can be paid through eServices (registration is needed).

Validity period: unlimited—if the Commission doesn’t revoke a license, the operator can continue to use it so long as the annual fees are paid.

Taxes: there are separate gambling duties for gaming, betting, and lotteries. Premises-based casinos pay duties from 15 to 50% of their income, depending on the size and gross gaming yield of their business. See the full list of duties here. Gambling facilities are usually exempt from VAT.

Personal management license (PML)

Staff of gambling businesses must apply for a PML if they conduct certain activities, such as financial planning, marketing, regulatory compliance, and IT security. See the full list here. Small scale operators don’t have to apply for a PML.

Application procedure: a gambling operator is required to apply for a PML for its staff when it applies for an operating license. The application is submitted online. Processing takes about 8 weeks.

Documents to submit: 

1. ID documents
2. Any gambling licenses which weren’t issued in the UK
3. A UK-based correspondence address
4. Disclosure and Barring Service form (England, Wales) or Disclosure Scotland form(Scotland)
5. Copies of your police report and credit report (or letter of good standing from your bank if you’ve lived outside the UK in the last 5 years)

License cost: £370.

Validity period: unlimited.

Taxes: none.

There is an electronic service for maintaining a PML.

Personal functional license (PFL)

A person needs a PFL if they perform certain functions at casinos, such as cashier, inspector, croupier or security. Check out the full list.

Application procedure: Online application with an 8-week review process.

Documents to submit: The list of information to submit is extensive and includes an ID document, a UK-based correspondence address and a 5-year record of all previous addresses.

License cost: £185.

Validity period: unlimited.

Taxes: none.

Maintenance of a PFL can be done here. For more information, please refer to this guidance.

Premises license

Operators that provide land-based services must apply for a premises license, which permits them to use a venue and its facilities for gambling.

Only local authorities, not the Gambling Commission, provide a premises license. Costs and requirements vary from place to place. However, as a general rule the operator must first obtain an operating license before attaining a premises license.

Operators often require a combination of licenses. For instance, if a person runs a land-based casino, they require every kind of license: operating, premises, personal management, and personal functional.

The Commission can review operator activity when it deems appropriate.

AML compliance requirements

The gambling sector is highly susceptible to money laundering, which usually takes one of two forms:

1. Criminals exchange money obtained from illegal sources to “clean” money by placing bets with low-risk outcomes. For instance, a person that received money from drug trafficking can bet on a team that will likely win a particular football match. The individual in question will not win much, but the money they get back will now appear legitimate.
2. Criminals use illegally obtained money to sponsor gambling as a leisure activity.

Let’s take a closer look at what operators must do to prevent money laundering in the gambling sector.

Risk-based approach

(1)A relevant person must take appropriate steps to identify and assess the risks of money laundering and terrorist financing to which its business is subject. (2)In carrying out the risk assessment required under paragraph (1), a relevant person must take into account—(a)information made available to them by the supervisory authority under regulations 17(9) and 47, and (b)risk factors including factors relating to—(i)its customers; (ii)the countries or geographic areas in which it operates; (iii)its products or services; (iv)its transactions; and (v)its delivery channels.

(The Regulations 2017, §18)

All gambling licensees in Britain are required to keep money laundering and other crimes out of gambling. To do so, operators must adopt a risk-based approach. This includes evaluating the risks of money laundering within a business and creating a system to manage them.

KYC procedures. A key requirement for all operators is to know their customers and continuously monitor their gambling activity. KYC checks include Simplified Due Diligence (SDD), Customer Due Diligence (CDD, the most common check type), and Enhanced Due Diligence (EDD). Generally, operators must apply KYC before customers are allowed to gamble.

AML officer. In Britain, only casinos are required to appoint an AML officer. However, the Commission recommends that all gambling operators appoint one to ensure AML compliance. All employees can and should report to an officer if they notice any suspicious activity. If there are any grounds, the officer must notify the National Crime Agency (NCA) about the matter.

Employee training. Operators must educate their employees about money laundering and how to prevent it. Employees must also be informed of the consequences of non-compliance for the business and careers of the employees.

Recording and retention. All records of client due diligence checks established business relationships and reports must be kept for 5 years.

Reporting. All operators must file a Suspicious Activity Report (SAR) if they notice any illegal activity and send it to the NCA (or, in some cases, to the local authorities).

The Commission can monitor the implementation of these internal safeguards by requesting information from operators. See the full list of supervisory practices here.

KYC compliance can be delegated to a reliable AML & KYC service provider.

Customer Due Diligence

The Commission, based on The Regulations 2017, permits three levels of due diligence checks: simplified, customer (general), and enhanced. Let’s start with the most common type—Customer Due Diligence.

Customer Due Diligence (CDD)

Both land-based and remote gambling operators cannot let any minors (persons younger than 21) participate in gambling activities. Licensees that provide online services have a minimum set of CDD requirements that they must apply before a customer is allowed to gamble. Apart from checking date of birth, these requirements include verifying the name and address of a customer.

Operators can combine the two approaches. For example, they can identify customers on admission and verify them once they reach the threshold aforementioned. CDD must be also applied when there is a suspicion of any financial crime and when the authenticity of the client’s data is questionable. In addition to this, gambling operators must perform ongoing monitoring of existing customers.

CDD must also be conducted for certain categories of transactions:

1. An occasional wire transaction of €1,000 or more
2. A single transaction, or multiple linked transactions that amount to €2,000 or more
3. A suspicious transaction

Below, you’ll find the minimum amount of information required to conduct customer verification

1. Name
2. Official document with a photograph
3. Residential address
4. Date of birth
5. Identity of a beneficial owner if there is one

Operators need this information for three reasons: 1) to confirm the client’s identity; 2) to make sure that the client is old enough to gamble; 3) to check if the client has excluded themselves from gambling.

Read more about self-exclusion in the section of our article dedicated exclusively to responsible gambling.

Whether to allow customers to have multiple accounts is up to the operator, but it’s required to identify accounts held by one person.

Here’s a list of information that can be obtained optionally. It isn’t always necessary to collect this data over the course of the standard CDD procedure, but it can help with responsible gambling and AML compliance later on:

1. Source of funds (where the funds for the transaction come from) and source of wealth (the source of a person’s overall wealth)
2. Level of legitimate income
3. Occupation

Now that we’ve understood what information there is to collect, let’s see how operators can verify a customer.

Identity verification procedures

Three methods can be used to gather clients’ information for CDD.

1. Checking original documents obtained from the client in person. An employee has to examine the document’s features and compare the photo on the document with its holder (this works for land-based operators).
2. Electronic verification. During verification, an operator must properly establish the client’s identity. This type of verification is conducted by electronic means or by using a service provider (this is suitable for remote operators).
3. Obtaining information about a client from another AML-regulated entity. For instance, an operator can confirm a client’s identity by reaching out to a bank. This method is used in combination with checking a customer’s ID documents.

There are several points to consider when choosing an electronic verification service provider.

Simplified and Enhanced Due Diligence

Simplified Due Diligence (SDD)

An operator can tone down the extent of its due diligence measures if the risk of money laundering and other crimes is determined to be low. See the full list of lower-risk factors here.

However, the presence of one or even several such factors doesn’t always mean that it’s possible to apply SDD. A thorough examination of the situation is necessary before reverting to this check.

Enhanced Due Diligence (EDD)

Enhanced Due Diligence (EDD) is a set of measures applied in situations that indicate a higher risk of money laundering and terrorist financing. EDD requires more strict verification processes than other Customer Due Diligence (CDD) requirements. 

Let’s go through the key situations when a more complex due diligence check is needed:

1. A client, or the family member/ associate of a client is a Politically Exposed Person (PEP)
2. False or stolen information has been provided
3. A client comes from a high-risk jurisdiction (see the European Commission’s list of high-risk third countries)
4. A transaction is complex, large, unusual or suspicious
5. A transaction is conducted in cryptocurrency or by a prepaid card
6. Any other situations that present a higher risk of financial crimes; for example, when a customer has been mentioned on a sanctions list

Here’s the information that needs to be collected for EDD:

1. Occupation
2. Sources of funds and wealth
3. Business interests
4. Credit checks
5. Background and purpose of a transaction

Check out the full list of high-risk factors and how to deal with them here.

Responsible gambling

Britain is well-known for its responsible gambling standards, with the Commission watching closely for shortcomings in responsible gambling compliance.

Here are some recent cases in which operators were fined for failing to protect their players: Camelot UK (£3.2m), 888 UK ltd (£9.4m), Genesis Global Limited (£3.8).

It’s the duty of every licensee (including holders of a PFL and PML) to ensure a safe gambling environment and protect all customers. Accordingly, operators are required to convey to players that gambling is a leisure activity and not an easy way to earn money.

There are several measures operators can adopt in order to comply with responsible gambling requirements:

1. Ensuring the protection of minors by checking customer age;
2. Providing all necessary information about gambling at the premises or on the website, including the rules of the game, the probability of losing or winning, and so on;
3. Making sure that a customer doesn’t spend more than they can afford by examining their sources of funds and wealth (i.e., checking publicly available information about the client’s salary) and calculating the customer’s living costs;
4. Educating customers about the dangers of irresponsible gambling;
5. Advertising mindfully, i.e., creating ads that don’t present misleading information or appeal to minors;
6. Monitoring customer activity and learning to detect the signs of irresponsible gambling;
7. Enabling customers to exclude themselves from gambling (e.g., self-exclusion forms/buttons on the website).

Special attention must be dedicated to “vulnerable persons” such as those who can’t make balanced decisions about gambling due to health problems.

Recommendations for customer interaction

In its guidance for remote and non-remote operators, the Gambling Commission recommends a three-step process for detecting and preventing gambling addiction.

1. Identify. First, operators should identify signs of problematic gambling behavior. The signs include chasing losses, playing for high stakes, and others.
2. Interact. If a gambling operator notices signs of gambling addiction in a player, it must interact with them to help mitigate the situation. This may include directly talking to the client in person or via electronic means. If the case is severe , the operator must refuse service to the customer.
3. Evaluate. The results of the interaction must be evaluated and records must be kept.

As of April 2020, the UK government has prohibited UK citizens from using credit cards to gamble to prevent players from spending more than they can afford.

Reporting

Proceeds of Crime Act 2002 (POCA) requires all gambling operators to report any suspicious activity of their customers by submitting a Suspicious Activity Report (SAR).

Person in charge of the submission: AML compliance officer or another person responsible for reporting.

Authority to submit to: the National Crime Agency (NSA). If the remote gambling equipment is located in another country, the report should be made to a respected Financial Intelligence Unit (FIU).

Means of submission: reports can be submitted online via the NCA SAR Online System.

Time: as soon as a suspicion arises. After the report has been submitted, the operator must provide the Gambling Commission with the SAR number assigned by the NSA or the relevant FIU.

Disclosing to the customer that a SAR was filed on them may be treated as an offense.

The recording and retention of data

Operators shouldn’t neglect recording and retention requirements since the Commission can, at any time, request records as a part of an investigation or regulatory compliance check.

Data to record: SARs, results of all types of due diligence checks, information on established business relationships and interactions with customers.

Recording requirements: It’s acceptable to make copies of documents and store them in scanned or electronic forms. This can also be done on microfilm.

Retention period: five years, starting from the end of the relationship with a customer. After that period, data must be deleted.

Gambling operators in Britain are subject to the GDPR and must ensure consumer rights in accordance with the regulation.

Penalties for non-compliance

The Gambling Commission has the power to take enforcement actions if a company or a person in the gambling sector fails to comply with responsible gambling, AML/CFT, and other related requirements.

The Commission’s regulatory actions vary from issuing a warning to imposing a fine or even revoking a license. However, there are other agencies like the police or the NCA that can impose additional penalties. The regulator doesn’t usually focus on crimes unrelated to the POCA, such as theft by employees. However, the Commission might be interested in how an operator handled such crimes to evaluate its suitability as a license holder.

The Commission can use various investigation tools to examine the licensee’s activity, including inspection of premises, questioning staff, and checking records.

Under the POCA, failure to comply with AML regulations can result in a fine and/or prison term of up to five years. Take a look at the lists for the taken regulatory actions against various businesses and individuals within the gambling sector.

The Commission informs operators about its decision to enforce a sanction and gives at least 28 days to contact the regulator if the operator wishes to do so. The operator can also appeal to the HM Courts & Tribunals Service to oppose the decision.

It isn’t the intention of the Commission to work against operators. The regulator understands that it’s hard to comply perfectly with all of the requirements, so it doesn’t automatically impose sanctions for every AML compliance failure.

What’s next

As of July, 2022, the British Gambling Act is under review. Among the proposed changes are stronger measures to protect people from gambling addiction.

The White Paper was expected to be released in July. However, the UK minister responsible for gambling, Chris Philp, resigned on the 7th of July. In his resignation letter, he wrote that the regulation was at the final approval stage.

According to Sumsub’s legal experts, Boris Johnson’s resignation may also delay the amendments. Since a new government will have to be formed, it’s very likely that the final approval of the Gambling Act White Paper will be postponed.

Useful resources

The Gambling Commission provides a variety of helpful materials, starting from guidance on the prevention of money laundering and extending to recommendations on customer interactions. We’ve gathered the main ones below:

AML/CFT guidelines and research.

1. Checklist to ensure AML, responsible gambling, and overall gambling compliance
2. Guide on prevention of ML/TF (for casinos)
3. The Commission’s approach to AML/CFT supervision
4. Research containing useful statistics on ML/TF in Great Britain
5. Licensing, compliance, and enforcement under the Gambling Act
6. Advice for lotteries

Necessary materials for licensees:

1. Licence Conditions and Codes of Practice
2. Duties and responsibilities of operators under POCA 
3. Personal Functional License
4. The Commission’s statement of principles for licensing and regulation

Here are some useful guides on the reporting of suspicious activity:

1. SAR for remote operators
2. Introduction to SARs (the NCA)
3. Submitting a SAR (the NCA)

Guidance on interaction with customers and responsible gambling:

1. For remote operators
2. For non-remote operators
3. Operator-Based Approaches to Harm Minimisation in Gambling (The Responsible Gambling Trust)

Sanctions and penalties:

1. Statement of principles for determining financial penalties
2. Guidance on sanctions