I have lost count of the number of times over the last year that I have urged clients, potential clients, conference audiences (and, quite frankly, anyone else involved in the UK gambling industry who is prepared to listen) to read the Gambling Commission’s first-ever Enforcement Report, published back in June 2018.
I’ve told them that it is essential reading material and that, by conducting self-checks of the type identified in the report, for no external cost whatsoever they could considerably minimise the risk of regulatory investigations, enforcement action and increasingly heavy financial penalties of the type detailed on the Commission’s “Lessons learnt – compliance failings” webpage.
I am now urging them to read, digest and act on the Commission’s second annual Enforcement Report, published last week. With financial penalties and fines totalling £28 million in 2018 and £7.3 million so far this year (with more in the pipeline), it is more important than ever that UK licensed gambling operators regard this as much more than just a “Another disappointing year – must do better” report of the type that some of us will remember from our schooldays.
This year’s report shows again that the Commission is not just wielding the cane, but is genuinely trying to help its licensees – including, crucially, gambling operators licensed in the UK but located overseas – to learn from the mistakes of others and to raise their own standards based on that learning.
For all of those licensees, the report contains some extremely useful ‘health-check’ questions. Twelve are on safer gambling issues, seventeen on AML, five on marketing and advertising and fourteen on compliance generally. I have set them out collectively for ease of reference on the Clifton Davies website under the heading “Answer these self-check questions to avoid regulatory enforcement action by the Gambling Commission”.
If senior management and their compliance, marketing, responsible gambling and AML teams spend just a morning working through those 48 questions, answering them as honestly and self-critically as they can and drawing up an action list of matters arising from that exercise, it will be time extremely well spent. If you really want to roll the boat out, get in a specialist independent moderator to ensure that you probe a bit more thoroughly when doing so. My contact details can be found here!
However, I want to dig a bit deeper now into what else has been said by the Commission in its report, finding the content that has not featured so prominently in other industry media over the last few days.
The good news…
Starting with the good news, the Commission has made some complimentary comments about recent efforts made by the industry to raise standards, including:
On safer gambling initiatives:
- “…. we have …. worked with operators to raise standards by successfully launching a programme of co-creation workshops and webinars which engage with operators on a whole host of issues – encouraging ideas, debate and solutions. We have been pleased with the initial results of these initiatives, which look positive, and we expect this work to continue and grow in the coming year”;
- “There are signs of progress [on the issue of affordability, to which I refer specifically below] and pockets of developing good practice and collaboration”.
- “We continue to see positive examples where some operators have more closely integrated their VIP management teams with their AML and social responsibility management teams, and encourage other operators to consider embedding this alignment into their existing practices”;
- “We have also been encouraged by significant investment by certain operators in systems and techniques to profile customers”;
- “AML is an area where collaboration and evaluation of what works between operators can reap benefit for themselves and consumers”.
On advertising and marketing:
- “During the year, our compliance and enforcement activity on this topic has resulted in standards improving”.
The bad news…
On a less positive news front, the Commission has made the following very critical comments in its newly published report (with my own remarks following each of them):
On safer gambling:
- “We have …. discovered repeated examples of customers being allowed to gamble significant sums of money in short time frames, way beyond their personal affordability, and without any intervention from the operator. These problems can be particularly acute over weekends and during the night” – a criticism that is likely to apply particularly to smaller online operators whose customer monitoring resources are less able to operate effectively at those time;
- “Much more needs to be done and shared across sectors to ensure the welfare of customers receives the commitment it requires” – underlining the need for sharing of best practice, including that learned by larger operators who have participated in the last three years’ Annual Assurance Statement pilot process.
- “Compliance activity and enforcement cases revealed again and again that operators’ AML policies, procedures and controls are not fit for purpose” – recent enforcement activity has revealed that in some case, operators had not even undertaken money laundering risk assessments. Without one of those, how can appropriate policies, procedures and controls even be drafted, let alone implemented?
- “There has been the incorrect perception that all gambling regulators’ expectations are identical in addition to a failure to digest our guidance and implement the legislative requirements applicable to Great Britain .. this must change, for these are not just regulatory matters but breaches of UK law. Those failing to learn these lessons will face further draconian action” – a criticism clearly aimed at overseas located operators holding licences granted by other regulators, with licence-holders from Malta and Alderney having received particularly heavy financial penalties within the last year;
- “We have encountered issues and an over-reliance on thresholds integrated into operating systems, designed to trigger referrals to specialist teams. Whilst conceptually these seem logical, they are far too often based on internal capacity and commercial considerations, not the risk profile and true affordability of their customers – illustrating, in my view, why a “one size fits all” approach to financial thresholds and triggers will not work;
- “Operators have then failed to intervene as gambling becomes out of control both in short bursts or over time, and allowed criminal funds to be deposited into accounts” – which, combined with player protection concerns, is why the Commission is intending to introduce changes to the customer interaction requirements in its Licence Conditions and Codes of Practice;
- “Levels of staff training continues to be a concern with repeated instances of operators failing to provide relevant staff, including money laundering reporting officers, with regular training in how to recognise and deal with transactions and other activities which may relate to money laundering or terrorist financing” – underlining the need for operators to ensure that induction training is followed by regular and updated AML training tailored to the needs of each business and the roles of each recipient;
- “We are also concerned by the frequent disconnect between operators’ money laundering and terrorist financing risk assessments; policies, procedures and controls; customer risk profiling; customer due diligence and ongoing monitoring; and enhanced customer due diligence and enhanced ongoing monitoring. For many operators this has become a tick-box exercise, without due consideration for their importance in the risk-based approach” – it is clear that some operators have still mistakenly believed that an “off the shelf” solution is the way for them to approach their management of money laundering and terrorist financing risks, without any real thought being given to the fundamentals of a risk-based approach of the type required by not only the regulator but also by legislation.
On advertising and marketing:
- “Operators still need to do more to ensure that their marketing communications are transparent and socially responsible” – a comment no doubt based on the steps taken by the CMA to prevent unfair bonus promotions and the numbers of adverse ASA rulings against gambling operators;
- We have concerns that operators are not taking sufficient care with the imagery and words used in adverts for gambling products to ensure that they are not likely to appeal to children” – notwithstanding, it would appear, the content of new CAP guidance on “Gambling advertising: protecting children and young people” that came into force on 1 April this year;
- “We urge operators to have regard to the recently published ASA/CAP guidance to ensure marketing campaigns are socially responsible and to better understand how the rules apply in practice” – an area where I have considerable sympathy with operators who have not been alone in failing to understand the logic behind some of the ASA’s recent rulings, the Paddy Power Rewards ad featuring Ryan Giggs’ brother and the Sky Bets “Request a Bet” ad providing obvious examples.
Of particular note is that a wholly new section appears in this year’s Enforcement Report under the heading “Affordability and Consumer Protection”, in which the Commission focuses on those demonstrating gambling-related harm who have funded their gambling activity through the misappropriation of monies from businesses, the taking out of unaffordable loans or misappropriating funds from vulnerable people, adding that “common to all these cases has been the ineffective controls framework used by the operators to identify and manage the risk”.
The Commission goes on to say that “open-source data exists which can help operators assess affordability for its GB customer base and improve its risk assessment and customer interventions” and it cites in this respect (a) Office for National Statistics Annual Survey of Hours and Earnings data relating to median gross weekly earnings for full-time employees in the UK, (b) YouGov survey data on discretionary income (i.e. money left over after deducting taxes and expenditure on accommodation, utilities and food).
The Commission maintains that this suggests that the British population has disposable income per month ranging from a figure of less than £125 up to £499 (equivalent to less than £1,500 per year and £6,000 per year), without taking into account unavoidable monthly costs or annual costs such as transport, fuel, monthly contractual payments, vehicle maintenance, clothing and personal care.
From this, the Commission concludes that: “the above disposable income data identifies clear benchmarks that should drive Social Responsibility (SR) triggers which will help to identify gambling-related harm by considering affordability. SR triggers should be set at a level so that most of the customer base is monitored based on the open-source information”.
It adds that: “to date, we have seen nothing to indicate that gamblers have more disposable income than the general population and most people would consider it harmful if they were spending all their disposable income gambling. Benchmark triggers should be a starting point for engaging with customers and are not intended to definitively demonstrate a customer is suffering from gambling-related harm – but they can help identify instances when an operator needs to understand more about a customer, their play and affordability”.
In what could well be regarded as a precursor to a forthcoming LCCP requirement, the Commission concludes that: “without adopting a framework based on such data, operators are at risk of not understanding whether customers are spending an affordable amount or whether the money is from a legitimate source”.
In saying the above, it concedes that “not all business models are the same and that operators have customers with different wealth and disposable incomes. But we do expect that the operator should be able to evidence this and have developed a framework that fully reflects and incorporates the diversity of its customers base”.
This is clearly going to be a more challenging and, I strongly suspect, less straightforward issue for operators than the Commission’s remarks seem to imply.
It is also worth noting that the Commission has highlighted in its report SR issues arising in situations where operators omit from their customer monitoring activity monies withdrawn and then apparently re-deposited, mistakenly believing that no checks are required to mitigate any SR or money laundering risks. It advises that, in such circumstances, operators should (a) take into account that the customer might have misappropriated monies and that the monies re-deposited might be fresh criminal spend and (b) “obtain evidence when appropriate to satisfy themselves that this is not the case”.
It recommends that, if an operator is going to set specific triggers for a customer base not representative of the general public, various documents sources should be relied upon, but warns that “they must contain sufficient information to substantiate the trigger level set”.
In this respect, the Commission has referred in its report to attempts by operators to assess affordability for wealthy customers by obtaining financial statements from Companies House and/or by looking at property ownership, resulting in customer triggers being set at a level equal to the drawings from the companies or the net assets of the company and the value of the property combined.
It concludes that “operators applying this approach frequently fail to identify indicators of problem gambling”, giving the following examples why such triggers can be inappropriately set:
- abbreviated company accounts may contain little detail as a standalone document to support the trigger levels decided upon;
- unaudited accounts may carry a risk of not being free from material misstatement;
- companies with low cash levels and the majority of net assets tied up in fixed assets may well have insufficient liquid assets to support the ‘level of spend’ set by the operator;
- limited information may be provided on the profitability of companies and evidence of salaries or dividends paid and, where such information is available, consideration must be applied to the customer’s tax liabilities on the drawings, personal circumstances or cost of living.
Properly set benchmark triggers are clearly key to the issue of affordability checks. The Commission recommends that “operators revisit their framework on triggers and consider their customer base and their disposable income levels as a starting point for deciding benchmark triggers. This would help ensure vulnerable customers are identified as early as possible and interacted with appropriately”.
Other key comments within the Enforcement Report
Other key comments by the Commission of which UK licensed operators should take particular note are as follows (with my own remarks following each of them):
- “As part of the new [National Strategy to Reduce Gambling Harms], we will continue to take a firm regulatory enforcement approach while also further improving gambling harms research and evaluation, so there is widespread adoption of what works” – meaning that further robust enforcement action should be expected by those who fall short of achieving the required standards of compliance;
- “We have previously published guidance for the industry on customer interaction in online gambling. This is essential reading for operators, helping them identify people who may be experiencing or are at risk of developing problems with their gambling, and ensuring their systems are robust enough. Operators should use this guidance to look at their own policies and procedures. They must think about whether they meet our expectations or if more needs to be done” – the content of this same guidance, published as long ago as February 2018, is embodied within the Commission’s proposed changes to the customer interaction requirements (relating to both remote and non-remote sectors), to which I have referred above; and
- “We have also amended the way we conduct assessments for online operators. When we review operator’s websites, we ask for test accounts to access information behind the sign-in page; we also ask operators to provide live website demonstrations to show us how they are compliant” – making it very hard for a non-compliant operator to seek to disguise any systemic failings.
Now back to those 48 self-check questions, but let me add just one more: how soon can you find the time to answer them?
David Clifton – Director – Clifton Davies Consultancy Limited