On 9 December 2021, the Gambling Commission (“Commission“) published its annual Compliance and Enforcement Report for the financial year 2020 – 2021 (“Report“).

The Report, which is the first under the stewardship of the Commission’s new (if not interim) Chief Executive Andrew Rhodes, highlights that the Commission’s Enforcement and Compliance team faced one of its busiest years in that the Commission:

• suspended five operator licences;
• revoked the licences for one operator and nine personal management licence holders;
• conducted 25 full assessments of online operators and five targeted assessments of land-based operators;
• carried out 83 website reviews and 262 security audits; and
• commenced 29 personal licence reviews and finalised a further 57.

In addition, 15 gambling businesses paid, in aggregate, a record sum of £32.1 million as a result of fines or regulatory settlements.

In the foreword of the Report, Rhodes acknowledges that operators “have had a difficult 18 months” due to Covid-19 but that the Commission was still seeing “far too many breaches of regulations”.

The Report is broadly split into five topics, which we consider below.

1. Anti-money laundering and counter terrorist financing

Much of the Report focuses on the Commission’s concern that the industry is not going far enough to ensure that gambling stays free from crime and the proceeds of crime.

The Report states that the Commission’s casework reveals two broad issues:

• First, the Commission points out that, despite numerous case publications and guidance on anti-money laundering (“AML“) and counter-terrorist financing (“CTF“), its compliance activity identified that the risk assessments, controls, policies and procedures of some operators remain “not fit for purpose“; and
• Second, the Commission is identifying, in increasing numbers, instances whereby operators are failing to consider how problem gambling might be linked to money laundering and terrorist financing despite Commission guidance on the subject.

‘Common poor practice’

The Report goes on to specify ‘common poor practices’ among operators, as summarised below:

• Repeated instances of inadequate and insufficient checks undertaken relating to customer due diligence (“CDD“), enhanced due diligence (“EDD“), and know your customer (“KYC“).
• With respect to EDD, the Commission points out that operators are not taking into account all relevant factors when determining if EDD is to be applied – for example, the Commission points to failures to apply EDD on PEPs (or Politically Exposed Persons) and customers residing in high-risk jurisdictions.
• Operators failing to take account of: (i) the various Commission-issued guidance on AML, the Proceeds of Crime Act, and HVCs (or High Value Customers); (ii) the risks identified in the Commission’s own risk assessment; (iii) broadly, money laundering and terrorist financing risk within the British gambling industry; and (iv) the requirement under Licence Condition 12.1.1(3) of the Licence Conditions and Codes of Practice (“LCCP“) to take into account learnings or guidelines published by the Commission.
• Linked to the point above, the Commission also identified that some operators’ policies, procedures and risk assessments referenced dated Commission-issued guidance and advice, and that there was a requirement for operators to ensure that such documents are kept up to date.
• An overreliance on third-party providers to conduct due diligence checks – the Commission pointed to one operator it identified that had no controls in place to oversee third-party activities.
• Operators carrying out identification checks after customers are able to gamble (in breach of LCCP 17.1.1(1)).
• Instances of the presence of commercial considerations within operators’ AML and CTF risk assessments. For example, the risk of an operator suffering adverse media coverage and reputational damage flowing from AML and CTF (and social responsibility) responsibility failures. The Commission points out that operators’ primary concern in risk assessments should be risk mitigation with respect to money laundering and terrorist financing.
• A lack of clear methodology within risk assessments to mitigate risks relevant to the operator. The Commission also points to examples of “vague” references to mitigation measures (such as ‘pre-paid cards and or cryptoassets not accepted’ or ‘KYC checks’) without giving specific detail as to what those measures consist of or how, for example, the operator would prevent cryptoassets from being accepted if their risk assessment determines they should.
• Lack of synergy between, on the one hand, risk assessment and, on the other hand, policies, procedures and controls. The Commission reiterated that operators’ risks assessments should be used as the starting point to develop and implement their AML and CTF policies, procedures and controls.
• Operators setting ‘high and arbitrary’ financial threshold trigger limits ‘with no underpinning rationale’ leading to CDD and EDD checks being delayed, which also resulted in financial crime that could have been identified at an earlier stage.
• Operators setting financial thresholds based only on losses, deposits, or winnings, and not taking account of other relevant transaction activity.

Paying attention to emerging risks

The Report reiterates the Commission’s expectation that operators comply with the terms of their licence, AML and CTF legislation. In so doing, the Commission points out that operators are also required to take account of the Commission-issued guidance on AML and CTF available on its website, as well as the regular updates and e-bulletins it publishes.

With respect to the latter, the Commission has highlighted that it appears operators are failing to incorporate within their risk assessments issues raised in the Commission’s emerging risk publications. The Commission warns that a failure to fully understand and have countermeasures in place against emerging risks leaves operators vulnerable to potential criminal breaches of the Proceeds of Crime Act 2002 and the Terrorism Act 2000 by not being able to sufficiently discharge their obligation to report and submit Suspicious Activity Reports (“SARs“) to the UK Financial Intelligence Unit. Accordingly, the Commission has stressed that operators should monitor emerging risk bulletins and to update their risk assessments, policies, procedures and controls and to provide training to staff as necessary.

Case studies

The Report sets out examples of issues identified by the Commission over the past year. Examples include:

• A customer depositing more than £100,000 and losing more than £65,000 in seven days. The customer was known to have a salaried income of less than £20,000 but had not provided appropriate source of funds or source of wealth evidence.
• Operators accepting, without independent verification, customers’ assertions that funds were recycled winnings.
• Acceptance of heavily redacted bank statements as sufficient evidence.
• SARs being filtered through team leaders instead of being sent directly to the Money Laundering Reporting Officer (“MLRO“).

The Commission did, however, point to what it considers as good practice following a compliance assessment of one online casino operator in that:

• “a newly registered customer had their account blocked when they reached total deposits of £250 on the day of account opening.
• information was requested to build a customer profile and the account remained blocked until the information was provided.
• the customer provided basic occupation and salary information.
• using the information provided, a monthly net loss limit was placed on the account which factored in discretionary income.
• a positive customer interaction was conducted, and the account was reopened.
• the customer repeatedly asked for their monthly net loss limit to be increased, the operator identified this as a marker of harm and suspended the account until an interaction could take place.
• the account will not be reopened until a successful interaction is conducted.”

 2. Licensed operators and financial stability

Given the impact of Covid-19 on business generally, it is perhaps unsurprising that the Report addresses how operators (in particular land-based based operators that have been hardest hit by the pandemic) should conduct themselves when faced with financial difficulty, and to ensure that operators keep in mind the licensing objectives and consumer protection during such times.

Much of this section of the Report goes over old ground and reiterates the obligations on licensed operators when there is a planned wind-down of a business. Notably, the Commission highlights that there has been an increase in the number of businesses that it regulates that have entered into administration and points out that, in such a scenario, the regulatory responsibilities transfer to the administrator. Administrators are reminded that they “should ensure that commercial considerations do not hinder regulatory responsibilities”.

3. Special measures and licence suspensions

Special measures

Since September 2020, we have seen a number of operators enter into ‘special measures’ – a new pilot concept developed by the Commission, which the Report describes as an “additional process… to ensure non-compliant operators could raise standards, at pace, to meet the full requirements of the LCCP“.

The Commission notes that the special measures process has been introduced for ‘isolated situations’ as an alternative to a full s116 compliance review. However, special measures would only be reserved for operators where the Commission had a high level of confidence that such a licensee had “accepted its failings, committed to raising standards, mitigated risks to consumer harm, offered redress where appropriate, and had no history of protracted non-compliance”.

It is interesting that the Commission sets out its requirements in connection with the special measures process. This includes seemingly formal deadlines surrounding the creation of an ‘Action Plan’, which is to detail the steps an operator is to take to make improvements within a three-month period, and weekly reporting obligations on progress during that three-month period.

The Report gives an example of an operator that had been placed into special measures due to AML concerns immediately implementing safeguards such as securing KYC documentation and carrying out source of wealth checks on customers at £250 lifetime deposits, with various other steps undertaken during the lifecycle of the ‘Action Plan’.

Of the eight operators placed into special measures since September 2020, seven have, according to the Commission, “demonstrated significant improvements with only very minor failings identified after three months”.

The special measures pilot concept has been extended to Spring 2022 and the Commission is currently consulting on whether to make it a permanent fixture of the regulatory tools available to it.

Licence suspensions

In the last financial year, the Commission has suspended the licences of:

• two online operators and commenced reviews for a failure to fully integrate with GAMSTOP – the self-exclusion scheme;
• a casino operator for AML and safer gambling failures;
• a casino operator for ‘fair and open’ failures;
• an external Lottery provider as activities may have been carried out contrary to the Gambling Act 2005; and
• a Personal Management Licence holder as a result of suitability concerns.

When determining whether a suspension is a proportionate and appropriate response to a failing, the Commission will factor in whether the licence holder: (i) has breached the conditions of its licence; (ii) is otherwise ‘unsuitable’ to carry on licensed activities; or (iii) has carried on licensed activities in a manner inconsistent with the licensing objectives.

4. Personal Licence Review

Personal licence holders must take all reasonable steps to ensure the way in which they carry out their responsibilities in relation to licensed activities does not place the holder of the operating (or any relevant premises) licence in breach of their licence conditions. Personal licence holders must also ensure that they keep themselves informed of developments in gambling legislation, codes of practice and any Commission-issued guidance relevant to their role, and to also ensure their technical competence is up to date.

In the 2020 – 2021 period covered by the Report, the Commission has:

• revoked eight Personal Functional Licences;
• revoked two Personal Management Licences (“PMLs“);
• issued 11 warnings to PML holders;
• issued one warning with conditions placed on the licence of a PML holder; and
• issued 21 ‘advice to conduct’ letters to PML holders.

Over the course of the last year, the Commission has identified evidence of PML holders “not maintaining oversight and not being sufficiently curious in respect of source of funds or source of wealth used to gamble by their customers”. The Commission has also taken issue with the lack of oversight demonstrated by the senior management of businesses with respect to AML and CTF.

The Commission’s casework has also revealed issues with PML holders not maintaining records adequately to demonstrate how decisions were arrived at as well as delays in reporting criminal offences as key events.  In addition, Nominated Officers and MLROs who are also PML holders have been the subject of criticism from the Commission for failing to discharge their duties, including, for example, with regard to the submission of SARs and allowing commercial considerations to override AML and CTF obligations.

5. Illegal gambling

The Report concludes with a summary of steps the Commission has taken to achieve the licensing objective of keeping crime out of gambling.

The Commission notes the harms consumers may subject themselves to by accessing unlicensed websites as consumers do not benefit from the same protections as they would find when visiting Commission-licensed websites. In attempting to tackle such unlicensed sites, the Commission would typically first issue cease & desist letters and, if that proves unsuccessful, then go on to utilise other disruption methods, such as website blocking and requesting that payment providers withdraw their services from such operators.

The Report details that in the past financial year, the Commission identified 99 unlicensed remote gambling operators taking business from Great Britain. It appears that, of those, 47 unlicensed websites are no longer accessible either because they have been removed, suspended or blocked in Great Britain.

In the past year, the Commission also continued to engage with international regulators to share information and learnings to improve upon its efforts to keep crime out of gambling.

Summary

The Report is important as it is a representation of the key issues facing the industry at present and outlines the Commission’s approach to dealing with operators that are, in the Commission’s view, falling short of their responsibilities.

In that sense, operators should take on board the content of the Report – particularly with regard to the issues highlighted by the Commission in that operators should avail themselves of the various resources on the Commission’s website and ensure that their risk assessments, policies and procedures address risk. It is clear that one area in which the industry is perhaps falling behind is ensuring that the Commission’s emerging risk bulletins are reflected in risk assessments (and policies, procedures, and controls).

Aside from the Commission’s commentary surrounding the impact of Covid-19, many of the issues and topics addressed in the Report will not come as a surprise to operators. The Report is arguably more surprising for what it does not cover – affordability and dual-regulated products. With respect to the latter, it is now well documented that the Commission fell short in understanding where its regulatory remit started and ended, and the sharing of its learnings and experience with operators would have perhaps been welcome – especially at a time where operators are looking to diversify their product range. With respect to the former – affordability – in our experience as advisers, clients have, for quite some time now, been asked how they are approaching affordability by the Commission and are subject to Commission enforcement action based on such approach. It is therefore surprising that the Commission does not make any attempt to highlight this topic in the Report.

The Report may be accessed here.