The Gambling Commission: AML, Licence Requirements, Responsible Gambling and More

Today we are covering one of the stringiest gambling regulators in the world—the Gambling Commission

Enter your email address to get access to the full guide.

Name: The Gambling Commission
Role: Gambling regulator
Country: Great Britain (England, Scotland and Wales). The Commission oversees that of Northern Ireland, but only when it comes to the advertising of unlicensed and remote gambling.
Year Founded: 2005

The field of responsibility

Great Britain is one of the most respected gambling jurisdictions in the world. The Gambling Commission is known for its particularly high standards for AML/CFT and responsible gambling compliance. The regulator’s primary objective is to make gambling a safe leisure activity. The Commission’s overall work towards this goal can be broken down into two main functions:

  1. The protection of gamblers. The Commission emphasizes that it oversees gambling primarily in the interests of consumers. The main goal of the regulator is to protect players from gambling related harm.
  2. Control over gambling providers. The supervisory functions of the Commission can be broadly divided into four categories: Licensing, overseeing compliance, providing guidance, and enforcement.

Now let’s explore which laws outline the regulator’s activity and objectives.

The legal landscape

To understand the legal situation surrounding gambling in Britain, let’s go through the following: Principal gambling, AML/CFT, and criminal legislation.

  1. The Gambling Act 2005 is the central gambling law. The Act provides us with all of the key gambling-related definitions and sets out the main requirements for all gambling operators. This law establishes the Gambling Commission as a regulatory body for gambling and specifies the Commission’s functions.
  2. The National Lottery etc. Act 1993 creates requisites for running the National Lottery.
  3. The Licence Conditions and Codes of Practice establish the requirements for all types of licenses. In addition to this, the Conditions require operators to keep money laundering and other crimes out of gambling. To do that, operators are obliged to adopt a risk-based approach for money laundering assessment and implement procedures to prevent financial crimes. This regulation also imposes responsible gambling obligations.
  4. The Proceeds of Crime Act 2002. All gambling businesses, and their staff, are subject to this act and must prevent crime within the gambling arena. Such crimes could include money laundering and terrorist financing.
  5. The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 and the Regulations 2019 (amendments) require operators to implement such AML and KYC procedures as due diligence checks, employee training, etc.
  6. The Terrorism Act 2000 sets out the offenses connected to engaging in, or supporting, terrorism for all sectors, including gambling.
  7. The Sanctions and Anti-Money Laundering Act 2018 enables authorities to impose sanctions for money laundering. EU sanction lists will cease to apply in the UK come 2021.
  8. The Gambling (Licensing and Advertising) Act 2014 establishes the requirement for foreign operators to hold a UK operating licence in order to offer and advertise remote gambling on UK soil.
  9. The 4th and 5th Anti-Money Laundering Directives regulate AML compliance throughout the EU. In January 2020, the 5th AMLD, that amends certain parts of the fourth one, was transposed into national law in the UK. However, the country decided not to implement the 6th AMLD, which will come at the end of 2020.
  10. The FATF recommendations. The UK is a member of the Financial Action Task Force (FATF), which is the global AML/CFT watchdog. The Commission used FATF’s framework to create a risk assessment methodology.

For more information, check out othergambling-related legislation.

In keeping crime outside of gambling, the Commission cooperates with various UK regulators, such as the FCA, the HMRC, the NSA, the SFO, and the RGSB.

The gambling landscape

Since definitions of “gambling” differ from jurisdiction to jurisdiction, we need to understand what exactly the term means in Great Britain. We are only talking about Britain here, since the Gambling Act, which provides key definitions for gambling, applies solely to England, Scotland, and Wales. Northern Ireland is regulated separately from Britain by the Betting, Gaming, Lotteries & Amusements Order 1985.


“In this Act “gambling” means—(a)gaming (within the meaning of section 6), (b)betting (within the meaning of section 9), and (c)participating in a lottery (within the meaning of section 14 and subject to section 15).”
(The Gambling Act 2005, §3)

In short, gambling in Britain is divided into gaming, betting, and participation in the National Lottery.


“In this Act “gaming” means playing a game of chance for a prize. (2) In this Act “game of chance”—(a)includes—(i)a game that involves both an element of chance and an element of skill, (ii)a game that involves an element of chance that can be eliminated by superlative skill, and (iii)a game that is presented as involving an element of chance, but (b)does not include a sport.”
(The Gambling Act 2005, §6)

Gaming includes such activities as casino games, poker, and bingo. Games that do not offer a monetary reward, and games where the outcome depends purely on the skill of the player (not luck), are not considered gaming.


“In this Act “betting” means making or accepting a bet on—(a)the outcome of a race, competition or other event or process, (b)the likelihood of anything occurring or not occurring, or (c)whether anything is or is not true.”
(The Gambling Act 2005, §9)

Betting comprises sports betting, fantasy betting, and other betting activities. Spread betting and betting on the National Lottery are not allowed in Britain.

The lottery

“(1)For the purposes of this Act an arrangement is a lottery, irrespective of how it is described, if it satisfies one of the descriptions of lottery in subsections (2) and (3).
(2)An arrangement is a simple lottery if—(a)persons are required to pay in order to participate in the arrangement, (b)in the course of the arrangement one or more prizes are allocated to one or more members of a class, and (c)the prizes are allocated by a process which relies wholly on chance.
(3)An arrangement is a complex lottery if—(a)persons are required to pay in order to participate in the arrangement, (b)in the course of the arrangement one or more prizes are allocated to one or more members of a class, (c)the prizes are allocated by a series of processes, and (d)the first of those processes relies wholly on chance.”
(The Gambling Act 2005, §14)

The National Lottery has an absolute monopoly on commercial lotteries; only charitable ones are permitted.

Now that we’ve figured out the key terms, let’s take a look at gambling license requirements.


If a company, regardless of its location, wants to provide services for British citizens, it must get a British license. There are four main types of licenses: operating, personal management, personal functional, and premises. The latter type, however, is issued by local authorities and not the Gambling commission. Each license type can subdivide into remote and non-remote. Apropos remote gambling, operators do not have to place any of their equipment in the UK to provide online services.

The Commission requires all licensees to meet these three objectives:

  1. Prevent gambling from being associated with crime
  2. Ensure that gambling is conducted fairly and openly
  3. Protect customers

The Commission always conducts a thorough inspection of applicants before granting them a license. Now let’s talk about each type of license in detail.

Operating license

An operating license authorizes a company to provide gambling facilities. There is a particular type of operating license for each kind of gambling activity. Check out all types of operating licenses here.

Application procedure: it is possible to apply online via the Commission’s website. Usually, operators shall be privy to the regulator’s decision within a 16 week period.
Documents to submit: while each type of operating license has its own requirements, the list of documents usually includes the operator’s ID documents, policy documents, financial plans, business plans, and the management structure. It also includes beneficial ownership and documents on key people within the company.
License cost: there are two fees: application and annual. Operators can use the Commission’s fee calculator to estimate the exact cost. Annual fees can be paid through the eServices (registration is needed).
Validity period: unlimited—if the Commission does not revoke a license, the operator can continue to use it year after year (so long as the annual fees are paid).
Taxes: there are separate gambling duties for gaming, betting, and lotteries. Premises-based casinos pay duty from 15 to 50% of their income, depending on the size and gross gaming yield of their business. See the full list of duties here. Gambling facilities are usually exempted from VAT.

Apart from operating licenses, there are two kinds of personal licenses. Let’s start with a personal management one.

Personal Management License (PML)

Staff of the gambling businesses that undertake certain activities in the company must apply for a PML. These activities include financial planning, marketing, regulatory compliance, and IT security. See the full list here. Small scale operators do not have to apply for a PML.

Application procedure: a gambling operator is required to apply for PML for its staff at the same time it applies for an operating license. The application is submitted online. Processing takes about 8 weeks.
Documents to submit: here is a list of documents to provide:

  1. ID verification form
  2. A photograph
  3. Proof of ID documents for the business
  4. Any gambling licenses which were not issued in the UK
  5. A UK based correspondence address for non-residents of the UK
  6. Authorization for release of information form
  7. Reference declaration
  8. Disclosure and Barring Service form (England, Wales) or Disclosure Scotland form (Scotland)

License cost: £370.
Validity period: unlimited.
Taxes: none.

There is an electronic service for maintaining a PML.

Personal Functional License (PFL)

A person needs a PFL if they perform certain functions at casinos. . For example, a cashier, an inspector, a croupier or a member of the security staff. Check out the full list.

Application procedure: Online application. Reviewing the application takes about 8 weeks.
Documents to submit: The list of information to submit is extensive, and includes an ID document, a UK based correspondence address and a 5-year record of all previous addresses.
License cost: £185.
Validity period: unlimited.
Taxes: none.

Maintenance of a PFL can be done here. For more information, please refer to this guidance.

Premises license

Operators that provide land-based services must apply for a premises license, which permits them to use a venue and its facilities for gambling.

Only local authorities, not the Gambling Commission, provide a premises license. Costs and requirements vary from place to place. However, as a general rule, in order to attain the premises licence, the operator must first obtain an operating license.

Often an operator needs a combination of licenses. For instance, if a person runs a land-based casino, they require every kind of license: operating, premises, personal management, and personal functional.

The Commission can review operators’ activity when it deems appropriate.

AML compliance requirements

The gambling sector is highly susceptible to money laundering and other financial crimes. Money laundering in gambling usually takes one of two forms:

  1. Criminals exchange money obtained from illegal sources to “clean” money by placing bets with low-risk outcomes.For instance, a person that received money from drug trafficking can bet on a team that will likely win a particular football match. The individual in question will not win much, but the money he or she gets back will be now legitimate.
  2. Criminals use illegally obtained money to sponsor gambling as a leisure activity.This happens when criminals decide to relax and enjoy gambling, but they wager with money that came from theft, fraud, or other crimes.

Now let’s take a closer look at what operators must do to prevent money laundering in the gambling sector.

Risk-based approach

“(1)A relevant person must take appropriate steps to identify and assess the risks of money laundering and terrorist financing to which its business is subject. (2)In carrying out the risk assessment required under paragraph (1), a relevant person must take into account—(a)information made available to them by the supervisory authority under regulations 17(9) and 47, and (b)risk factors including factors relating to—(i)its customers; (ii)the countries or geographic areas in which it operates; (iii)its products or services; (iv)its transactions; and (v)its delivery channels.”
(The Regulations 2017, §18)

All gambling licensees in Britain are required to keep money laundering and other crimes out of gambling. To do that, operators must adopt a risk-based approach. This approach includes evaluating the risks of money laundering within a business and creating a system to manage them. Here are the internal safeguards that every company needs to adopt in order to prevent money laundering.

  1. KYC procedures. A key requirement for all operators is to know their customers and continuously monitor their gambling activity. KYC checks include Simplified Due Diligence (SDD), Customer Due Diligence (CDD, the most common check type), and Enhanced Due Diligence (EDD). Generally, operators must apply KYC before customers are allowed to gamble.
  2. AML officer. In Britain, only casinos are required to appoint an officer. However, the Commission recommends all operators to appoint one to ensure AML compliance. All employees can and should report to an officer if they notice any suspicious activity. He or she must look through each report to determine whether it gives ‘ground for knowledge’ (real understanding that criminal activity has occurred or is occuring at the moment) or suspicion. If there is any ground, the officer is to notify the National Crime Agency (NCA) about the matter.
  3. Employee training. Operators must teach all employees about money laundering and procedures to prevent it as well as the potential effects of non-compliance on the business and on the lives and careers of the employees.
  4. Recording and retention. All records of clients’ CDD checks, records of established business relationships and reports must be kept for 5 years.
  5. Reporting. All operators must file a Suspicious Activity Report (SAR) if they notice any illegal activity and send the report to the NCA (or, in some cases, to the local authorities).

The Commission can monitor the implementation of these internal safeguards by requesting the information from the operators. See the full list of supervisory practices here.

KYC compliance can be delegated to a reliable AML & KYC service provider.

Customer Due Diligence requirements

The Commission, based on The Regulations 2017, permits three levels of due diligence checks: simplified, customer (general), and enhanced. Let’s start with the most common type—customer due diligence.

Customer Due Diligence (CDD)

Both land-based and remote gambling operators must not let any minors (persons younger than 21) participate in gambling activities. Licensees that provide online services have a minimum set of CDD requirements that they must apply before a customer is allowed to gamble. Apart from checking the date of birth, these requirements include verifying the name and address of a customer.

For other customer identification and verification requirements, gambling operators can adopt one of the following approaches:

  1. The on-entry approach entails identifying and verifying the customer before they are allowed to gamble.
  2. The threshold approach is when a client’s identity is checked not when they enter, but when they reach the threshold of €2000, i.e., conduct a single transaction or several linked transactions that either amount to or exceed the figure of €2000. A “transaction” means buying tokens, paying to use gaming machines, depositing funds and collecting winnings. Transactions are linked if the same customer conducts them in one gaming session.

Operators can combine the two approaches. For example, they can identify customers on admission and verify them once they reach the threshold aforementioned. CDD must be also applied when there is a suspicion of any financial crime and when the authenticity of the client’s data is questionable. In addition to this, gambling operators must perform ongoing monitoring of existing customers.

CDD must also be conducted for certain categories of transaction:

  1. An occasional wire transaction of €1000 or more
  2. A single transaction, or multiple linked transactions that amount to €2000 or more
  3. A suspicious transaction

Below, you will find the minimum amount of information required to conduct customer verification:

  1. Name
  2. Photograph on an official document
  3. Residential address
  4. Date of birth
  5. Identity of a beneficial owner if there is one

Operators need this information for three reasons: 1) to confirm the client’s identity; 2) to make sure that the client is old enough to gamble; 3) to check if the client has excluded themselves from gambling.

Read more about self-exclusion in the section of our article dedicated exclusively to responsible gambling.

Whether to allow customers to have several accounts is up to the operators, but it is required to identify the accounts held by one person.

Here is a list of the information that can be obtained optionally. It is not always necessary to collect this data over the course of ordinary CDD procedures, but it can help with responsible gambling and AML compliance later on:

  1. Source of funds (where the funds for the transaction come from) and source of wealth (the source of a person’s overall wealth)
  2. Level of legitimate income
  3. Occupation

Now that we’ve understood what information there is to collect, let’s see how operators can verify a customer.

Identity verification procedures

Three methods can be used to gather clients’ information for CDD.

  1. Checking original documents obtained from the client in person. An employee has to examine the document’s features and compare the photo on the document with its holder (this works for land-based operators).
  2. Electronic verification. During verification, an operator must properly establish the client’s identity, not just the fact that a person with a certain name and address exists. This type of verification is conducted by electronic means or by using a service provider (this is suitable for remote operators).
  3. Obtaining information about a client from an organization in the regulated sector. For instance, an operator can confirm a client’s identity by reaching out to a bank and requesting the necessary information. This method is used in combination with checking a customer’s ID documents.

There are several points to consider when choosing an electronic verification service provider.

  1. Transparency: Whether the provider discloses the results of the conducted checks, including the level of certainty about the results
  2. Personal data: Operators should only use providers authorized by the Information Commissioner’s Office (ICO) to process clients’ information
  3. Coverage: The provider must have access to a broad range of data sources

Now that we’ve covered the most common type of the due diligence check, let’s move on to the other two types: simplified and enhanced.

Simplified and Enhanced Due Diligence

Since the gambling sector is significantly exposed to financial crimes, operators conduct simplified checks less often than enhanced ones. Therefore, we decided to briefly cover simplified due diligence and dedicate more attention to its enhanced counterpart.

Simplified Due Diligence (SDD)

An operator can tone down the extent of due diligence measures if the risk of coming across money laundering and other crimes is low. See the full list of lower-risk factors here. However, the presence of one or even several such factors does not always mean that it is possible to apply SDD. A thorough examination of the situation is necessary in order to decide whether it is reasonable to conduct the check.

Enhanced Due Diligence (EDD)

Let’s go through the principal situations when a more complex due diligence check is needed:

  1. A client, or the family member/ associate of a client is a Politically Exposed Person (PEP)
  2. False or stolen information has been provided
  3. A client comes from a high-risk jurisdiction (see the European Commission’s list of high-risk third countries)
  4. A transaction is complex, large, unusual or suspicious
  5. When a transaction is conducted in a cryptocurrency or by a prepaid card
  6. Any other situations that present a higher risk of financial crimes; for example, when a customer has been mentioned on a sanctions list

Here is the information that needs to be collected for EDD:

  1. Occupation
  2. Source of funds and source of wealth
  3. Business interests
  4. Credit checks
  5. In the case of a transaction—the background and purpose of the transaction

Check out the full list of high-risk factors and the ways in which you must deal with them here.

Responsible Gambling

Britain is well-known for its high responsible gambling standards, with the Commission watching closely for shortcomings in responsible gambling compliance.

Here are some recent cases in which operators were fined for failing to protect their players: Ladbrokes Coral (£5.9m), 32Red (£2m), Mr Green (£3m), Caesars Entertainment (£13m).

It is the duty of every licensee (including holders of a PFL and PML) to ensure a safe gambling environment and to protect all customers. Operators are required to convey that gambling is a leisure activity and not an easy way to earn money.

There are several measures operators can adopt in order to comply with responsible gambling requirements:

  1. Ensuring the protection of minors (persons under the age of 18) by checking a customer’s age
  2. Providing all necessary information about gambling at the premises or on the website. This information includes the rules of the game, the probability of losing or winning, and so on
  3. Making sure that a customer does not spend more than they can afford by examining the sources of funds and wealth (i.e., checking publicly available information about the client’s salary) and calculating the customer’s living costs
  4. Educating customers about the dangers of irresponsible gambling
  5. Advertising mindfully, i.e., creating ads that do not present misleading information or appear to minors
  6. Monitoring customers’ activity and learning to detect the signs of irresponsible gambling
  7. Creating ways for customers to exclude themselves from gambling (e.g., self-exclusion forms/buttons on the website)

While it is required to protect all customers, special attention must be dedicated to “vulnerable persons” such as those who cannot make balanced decisions about gambling due to health problems.

Recommendations for customer interaction

In its guidance for remote and non-remote operators, the Gambling Commission recommends a three-step way of interaction with customers to detect and prevent gambling addiction.

  1. Identify. First, operators should identify signs of problematic gambling behavior. The signs include chasing losses, playing for high stakes, and others.
  2. Interact. After spotting such signs and recognizing that the customer is experiencing harm, the licensee must start the interaction with the customer and help them to cure their addiction to gambling. The interaction may include talking with the client in person, via email, chat or phone. In the worst case scenario, an operator must refuse to service the customer with gambling addiction.
  3. Evaluate. The results of the interaction must be evaluated and records must be kept.

As of April 2020, the UK government has prohibited UK citizens from using credit cards to gamble. The main reason for this is that the cards allow gamblers to spend more than they can afford.


Proceeds of Crime Act 2002 (POCA) requires all gambling operators to report any suspicious activity of their customers by submitting a Suspicious Activity Report (SAR).

Person in charge of the submission: AML compliance officer or another person responsible for reporting.
Authority to submit to: the National Crime Agency (NSA) (if the remote gambling equipment is located in another country, the report should be made to a respected Financial Intelligence Unit (FIU)).
Means of submission: reports can be submitted online via the NCA SAR Online System.
Time: as soon as the suspicion has arisen. After the report has been submitted, the operator must provide the Gambling Commission with the SAR number assigned by the NSA or the relevant FIU.

Disclosing to the customer that a SAR was filed on them may be treated as an offense.

The recording and retention of data

Operators should not neglect recording and retention requirements since the Commission can, at any time, request the necessary records as a part of an investigation or a regulatory compliance check.

Data to record: SARs, results of all types of due diligence checks, information on established business relationships and interaction with customers.
Recording requirements: It is acceptable to make copies of documents and store them in scanned or electronic forms. This can also be done on microfilm.
Retention period: five years, starting from the end of the relationship with a customer. After that period, data is to be deleted.

Gambling operators in Britain are subject to the GDPR and are to provide their customers with all of the rights set up by the regulation.

Penalties for non-compliance

The Gambling Commission has the power to take enforcement actions if a company or a person in the gambling sector fails to comply with the responsible gambling, AML/CFT, and other related requirements.

The regulator will not usually focus on crimes unrelated to the POCA, such as theft by employees. However, the Commission might be interested in how an operator handled such a crime and subsequently make a decision on whether the operator is suitable to hold a license.

The Commission can use various investigation tools to examine the licensee’s activity, including the inspection of premises, questioning staff, and checking records.

The Commission’s regulatory actions vary from issuing a warning to imposing a fine or even revoking a license. However, there are other agencies like the police or the NCA that can impose additional penalties. Under the POCA, failure to comply with AML regulations can result in a fine and/or a prison term of up to five years. Take a look at the lists for the taken regulatory actions against various businesses and individuals within the gambling sector.

However, it is not the intention of the Commission to work against operators. The regulator understands that it is hard to comply perfectly with all of the requirements, so it does not automatically impose sanctions for every failure of AML compliance.

The Commission informs operators about its decision to enforce a sanction and gives at least 28 days to contact the regulator if the operator wishes to do so. The operator can also appeal to the HM Courts & Tribunals Service to oppose the decision.

Useful resources

The Gambling Commission provides a great variety of helpful materials, starting from guidance on the prevention of money laundering and extending to recommendations on customer interaction. We’ve gathered the main ones below:

AML/CFT guidelines and research.

  1. Checklist to ensure AML, responsible gambling, and overall gambling compliance
  2. Guide on prevention of ML/TF (for casinos)
  3. The Commission’s approach to AML/CFT supervision
  4. Research containing useful statistics on ML/TF in Great Britain
  5. Licensing, compliance, and enforcement under the Gambling Act
  6. Advice for lotteries

Necessary materials for licensees:

  1. Licence Conditions and Codes of Practice
  2. Duties and responsibilities of operators under POCA 
  3. Personal Functional License
  4. The Commission’s statement of principles for licensing and regulation

Here are some useful guides on the reporting of suspicious activity:

  1. SAR for remote operators
  2. Introduction to SARs (the NCA)
  3. Submitting a SAR (the NCA)

Guidance on interaction with customers and responsible gambling:

  1. For remote operators
  2. For non-remote operators
  3. Operator-Based Approaches to Harm Minimisation in Gambling (The Responsible Gambling Trust)

Sanctions and penalties:

  1. Statement of principles for determining financial penalties
  2. Guidance on sanctions

Sign up for our Newsletter

Thank you for subscribing to our newsletters.

The Gambling Commission: AML, Licence Requirements, Responsible Gambling and More

We are always happy to help you in case of any questions.

Feel free to contact us at [email protected]

Thanks for contacting us!

We will get in touch with you shortly.

Be up and running in minutes.

Questions? Schedule some time to talk with one of our experts.

This contact form is available only for logged in users.