After years of consultation, debate, a pilot programme, and a delayed Board decision, the Gambling Commission has today confirmed its intention to introduce Financial Risk Assessments (FRAs), for what it considers to be “higher-spending” online gambling customers, in a staged approach.

The announcement confirms that the first stage of implementation will see FRAs carried out by the largest remote operators where there is significant spend over a 24-hour period. For most operators, this will mean a £5,000 net deposit over a rolling 24-hour period – described by the Commission as “a very unusually high spend pattern that less than 0.5% of customers exceed.”

The assessments will be “frictionless, document-free” checks provided by Credit Reference Agencies (CRAs), with no impact on a customer’s credit score. The Commission has reassured consumers that the “vast majority” of customers will never need an FRA, and that those placing an occasional bet or regularly spending hundreds of pounds will be unlikely to trigger one.

When commenting on the financial impact to the industry, the Commission’s blog asserts: “To be clear, any reduction in GGY will primarily come from a reduction in spend from high-spending customers who are in financial difficulties.” This remains to be seen, and it would be interesting to interrogate the evidence that supports this assertion that customers who spend at that level are “primarily” in financial difficulty. The industry is understandably concerned that the reduction in GGY will in practice come not just from those who are in financial distress, but from those customers who simply do not wish to submit to the provision of financial documents or open banking interrogation and who will instead reduce their spend or move elsewhere. The Commission’s announcement today does nothing to assuage that concern.

What we know and what we still don’t

Readers of The Front Runner will know that we have been tracking this issue closely since the Government’s White Paper first proposed these measures, and through subsequent consultations and the Commission’s evolving position. As we noted in our earlier commentary on the Commission’s consultation rounds and in our broader review of the White Paper, the concept of financial risk assessments has generally raised more questions than it has answered.

Today’s announcement, while significant, does not meaningfully address what we consider to be the central concern repeatedly voiced by the industry: what, precisely, are operators expected to do once they receive the results of an FRA?

The Commission has indicated that FRAs are intended to identify customers in financial difficulties and “streamline and improve operator processes.” It has pointed to pilot findings suggesting that customers flagged through FRAs are disproportionately more likely to have indicators of financial stress – between two and five times more likely to have experienced defaults or entered debt management plans. However, the gap between identifying such customers and knowing what action operators must take remains frustratingly opaque.

The Commission’s blog states that “we will back operators to take appropriate proportionate action, considering everything they know about the customer and using all options such as reducing marketing to vulnerable consumers, supporting customers to set deposit limits or more where needed.” The sentiment is welcome, but the language remains characteristically vague. What does “more where needed” actually mean in practice? Without specificity, operators are left to guess at expectations – and guessing in a regulated environment is a recipe for inconsistency and, ultimately, enforcement risk.

The Commission has committed to publishing guidance to help operators understand what FRA results will mean in practice, and has indicated it will consult the industry as part of that process. This is welcome, and indeed essential. Guidance on how to interpret and act upon CRA outputs will form a critical part of whether this system can be implemented in a way that is consistent, proportionate, and faithful to the White Paper’s objectives. We would encourage the Commission to treat this guidance process not as an afterthought, but as the centrepiece of practical implementation.

Inconsistency in CRA checks: the elephant in the room?

We have spoken at length about the significant concern surrounding the variance in results produced by CRAs. Our understanding is that the same customer can generate materially different outcomes depending on which CRA is consulted, or indeed when the same CRA is consulted at different points in time.

To be fair to the Commission, its Stage Two update in May 2025 did acknowledge the issue. Helen Rhodes, Director of Major Policy Projects, noted that the Commission had “extended [its] success criterion to further explore the issue of consistency and differences between credit reference agencies” and stated that “more can be done to support operator understanding of these different systems and indeed to allow credit reference agencies to make refinements to their gambling-specific models to reduce any unnecessary variation or confusion.”

But acknowledging a problem and resolving it are two different things. The Commission’s post-pilot analysis in April 2026 accepted that “differences between credit reference agencies and the consistency of their data remain an issue” while characterising the pilot as having provided “useful evidence on those variations.” With respect, useful evidence is not the same as a workable solution, and in-scope operators are now being asked to implement a system that the Commission itself concedes produces inconsistent outputs.

Critically, operators will still only receive a RAG rating from the CRA, not the underlying data. This limits their ability to interrogate the information and determine what “proportionate action” genuinely looks like for a given customer. An operator who receives a red flag for a customer but has no visibility of whether that flag relates to a historic default now resolved, an active debt management plan, or multiple current arrears is not well placed to calibrate a response. When combined with the CRA consistency problem, this problem becomes particularly acute. An operator receiving conflicting RAG ratings from different agencies for the same customer has almost no basis on which to determine the correct course of action.

A higher starting threshold (£5k/24hrs)

It is notable that the Commission has chosen to introduce FRAs at a higher threshold than was proposed in the White Paper – beginning at £5,000 net deposits over a rolling 24-hour period rather than the lower figures previously consulted upon. This is a pragmatic acknowledgment that implementation should proceed cautiously. However, given the significance of this measure and the intensity of debate surrounding it, the Commission should commit to a proper, transparent evaluation of the consequences of introduction during the phased period, and should publish the results of that evaluation process. The Commission must be faithful to the vision set out in the White Paper (which envisaged a careful, evidence-based approach) and that faithfulness requires demonstrating, not merely asserting, that the policy is achieving its aims without disproportionate collateral damage.

A staged approach – but to what end?

The decision to introduce FRAs in stages is, on one level, pragmatic and sensible. Beginning with the largest operators and the very highest spenders provides a more contained starting point. It also mirrors the phased approach taken with the light-touch financial vulnerability checks, which were introduced at the £500 threshold in August 2024 before reducing to £150 in February 2025.

However, the industry’s overarching concern has never been primarily about timing – it has been about substance. Without greater clarity on:

• what CRA data operators will be required to obtain;
• how operators should interpret potentially contradictory RAG ratings from different CRAs;
• what “proportionate action” means in the context of a customer flagged by one CRA but not another; and
• how the Commission will assess operator responses during compliance and enforcement activity,

the staged approach risks being a staggered imposition of uncertainty rather than a measured roll-out of clear requirements.

Enforcement: giving with one hand, taking with the other

The blog does offer one reassurance: no enforcement action will be taken against operators who do not take action following an FRA during the phased implementation period. This is sensible. However, the Commission immediately qualifies this by noting that “operators are still subject to all other existing licence requirements which must be met, and in relation to which action may be taken.” The practical question for operators is whether Commission officials conducting compliance assessments will, in examining adherence to existing customer interaction requirements, effectively impose FRA-adjacent expectations through the back door.

This is not a hypothetical concern. The Commission has not yet officially retracted views expressed in prior enforcement public statements and in enforcement reports suggesting that operators should obtain evidence that customers can afford to gamble at levels above the “national average” – a position that now appears even more clearly to be an overreach in light of the formal FRA framework being introduced. Commission officials conducting compliance assessments should be required to be faithful to the principles of proportionality and the stated desire for frictionless checks wherever possible, to ensure consistency and transparency across the Commission’s regulatory activities.

The broader context

It is worth noting that this announcement follows the Commission’s earlier delay of its Board decision – the Board having met but reportedly not completed its assessment of the extensive evidence base. It also comes amid a flurry of political and industry opposition to FRAs from operators, racing stakeholders, and media commentators. There have even been suggestions that the case for challenge would be compelling if the Commission moved forward without a proper assessment of impact.

The Commission has sought to defuse some of this tension by distancing FRAs from the more politically toxic concept of “affordability checks” – maintaining, as it now does, that it “does not have any requirements for affordability checks and is not proposing any.” Whether the distinction between identifying “financial risk” and assessing “affordability” is one that will survive contact with practical implementation remains to be seen.

When the Commission asserts that FRAs are not “affordability checks” and that it has never required such checks, operators would be forgiven for treating the assurance with some scepticism. The Commission’s track record on clarity of expectation in this area is, to put it charitably, imperfect. It underscores the critical importance of the promised guidance being published in clear, unambiguous terms, and of the Commission resisting the temptation to later reinterpret what it has said.

We will continue to monitor developments and provide updates as further details of the staged implementation emerge. In the meantime, please do get in touch if you would like to discuss how these requirements may affect your business.