Betting and Gaming horizon scanning: UK regulatory roadmap: Spring 2021 edition

The Gambling Commission has continued to monitor the impact of lockdown and the easing of lockdown on gambling behaviours, most recently publishing data showing the impact of Covid-19 on gambling behaviour in September, October and November 2020.

The research data continues to show that across the population as a whole, there is no evidence of a significant or sustained increase in gambling activity in the Covid-19 period. However, the Commission has interpreted the data as showing links between the impacts of the pandemic on people’s financial and mental wellbeing, and increased gambling.

During this period, Neil McArthur has also published two further statements warning operators of the importance of acting responsibly, especially around individual customer affordability checks and increased social responsibility interactions, during lockdown. The statements, published on 5 November 2020 and 11 January 2021, can be read here and here. 

Neil McArthur's continued reminders to the industry are indications of what the Commission expects from licensees and are clear calls for action. Although we expect most operators will have already implemented the Commission's March 2020 amendments to its customer interaction guidance, we would encourage all operators to review the effectiveness of any changes they have made - to ensure they are adequately addressing the Commission's concerns and identifying increased consumer vulnerability during the lockdown period. 

Looking forward, it remains to be seen for how long the Commission will keep its additional guidance in force. However, we anticipate that the permanency of some of these changes will be addressed in other ways shortly: for example, the response to its ongoing consultation and call for evidence on remote customer interaction. In this regard, we also note the measures now confirmed in the Commission's response to its consultation on online slots game design and reverse withdrawals, which the Commission sees as one step in reducing the risk of harm and which include permanently prohibiting reverse withdrawals – see below.

With the end of the Brexit transition period on 31 December 2020 and the UK and EU having agreed the terms of the Trade and Co-operation Agreement (TCA), there is now more certainty as to their future relationship, although there are still some issues to be resolved, of which data protection issues are perhaps the most significant for gambling businesses.

The European Gaming & Betting Association recently commented that the lack of a long-term agreement relating to data transfers between the UK and the EU is the "most concerning outstanding issue with Brexit".

In relation to digital trade, a bridging period has been put in place for four months, extendable by two months, for the EU Commission to decide whether to make an adequacy decision in relation to the UK's post-Brexit data protection regime. In the meantime, data transfers from the EEA to the UK are not subject to any additional restrictions, as the UK is effectively not being treated as a third country under GDPR for these purposes. On 19 February 2021, the European Commission published its draft adequacy decision in relation to the UK's data protection regime.  As we discuss here, the decision must now be considered further by the European Data Protection Board, and also a committee of representatives of EU Member States, and may also be subject to challenge.

In the event that the EU does not accept for any reason that the UK's data protection regime is adequate, arrangements which involve the transfer of personal data from the EU to the UK may need to be revisited (to reflect the guidance issued by the European Data Protection Board, after the Schrems II decision, in relation to international data transfers).

Our Brexit: Betting & Gaming page discusses further the ongoing implications of Brexit for gambling businesses and our Brexit hub contains more information on Brexit's implications more generally.

On 6 November 2020, the Gambling Commission published its third annual enforcement report: "Raising standards for consumers: Compliance and Enforcement report 2019 to 2020". The report covers the period from April 2019 to March 2020.

The enforcement report is more than just a report on the Commission's compliance and enforcement work over the past year. It contains indications of what the Commission expects from licensees and calls for action. Our November 2020 article discusses the key points, highlighting in particular some important differences in content and emphasis from previous years' reports.

On Friday 6 November 2020, the Gambling Commission published its first ever National Strategic Assessment (NSA) alongside its third annual enforcement report (see above).

The NSA is the Commission's assessment of the risks gambling poses to consumers and the public and should be read alongside the National Strategy to Reduce Gambling Harms (which was published in April 2019).

In preparing the NSA, the Commission has drawn on data obtained from its compliance and enforcement work, advice from the Advisory Board for Safer Gambling, its Digital Advisory Panel and the Interim Experts by Experience Group. The Commission has also engaged industry representatives and taken account of the findings of recent Parliamentary reports into gambling and its regulation. The NSA also takes account of the impact of the Covid-19 pandemic.

There is no substitute for reading the report in full and ensuring that all board members, PML holders and senior managers consider it in detail (and record that they have considered it and what actions have arisen as a result of their consideration of it).  Our November 2020 article explores (at a high level) the four pillars on which the NSA is built: the person gambling (chapter one), the place gambling occurs (chapter two), the products available to customers (chapter three) and the provider of facilities for gambling (chapter four). The Commission calls on the industry to do more to understand their customers and to develop credible affordability solutions, make products safer by design and build dynamic player-centric safeguards.

We expect the report to be used by the Commission in prioritising its enforcement activities over the coming months.

We encourage operators to review the NSA carefully and consider what (if any) impact it has on their business and whether any changes need to be made to how they allocate resources in the relevant areas and/or to any relevant policies, procedures and controls.

In December 2020, the National Risk Assessment (NRA) was published jointly by HM Treasury and the Home Office. The NRA provides a high-level assessment of money laundering and terrorist financing risk in the UK across the regulated sectors, including changes to perceived risk since its last publication in 2017.

As was the case in 2017, the gambling sector is deemed 'low risk' for money laundering and terrorist financing. According to the NRA, this is in part "due to its unattractiveness for ML purposes and the strong mitigations by the UKGC". These "strong mitigations" are evidenced in statistics shared in the NRA, including that a total of 249 licensing applications were refused by the Commission between 2017 and 2019. Common themes in those rejections included inadequate evidence for source of funds (SoF) for the licensee's business and concerns with "inadequate identity" for key persons or shareholders within applications.

Of further note is the fact that HM Treasury considers there to have been an "increase in vulnerabilities" within the sector – for both casino and non-casino gambling – including certain risks which were not referred to in the 2017 assessment, such as:

• the increasing use of third party providers, and the increasing scope of the services being outsourced to such providers – e.g. SoF and source of wealth (SoW) checks;
• the growing range of payment methods now available to customers, some of which can increase the ability to mask SoF (an example given is pre-paid card transactions);
• the growing complexity of products and payment methods, including cryptoasset conversion to fiat currency via third party providers.  Interestingly, while cryptoassets had in 2017 been given a 'low' risk score, the risk score for both money laundering and terrorist financing is now deemed to be 'medium', with the NRA stating that they 'remain a key tool in cybercrime', and citing 'uneven regulatory requirements' and their pseudo-anonymous nature as key vulnerabilities; and
• the fact that many operators operate in multiple jurisdictions, not least because the regulatory frameworks for AML in other jurisdictions tend not to be as robust as in the UK.

In discussing supervision and enforcement by the Commission, the NRA notes that while the sector continues to improve, there are certain flaws in its approach to AML obligations. For example, while efforts are increasing to train staff, there is a lack of training specific to the sector. Additionally, there remains a tension between regulatory requirements and commercial drive, with some licensees looking "to minimise compliance costs and time", thereby increasing the risk of non-compliance with the MLRs and failure to identify money laundering activity.

Interestingly, there has been an uptick in reporting SARs by both casino and non-casino operators. Non-casino operators submitted 5,743 SARs in 2019 compared with 1,848 in 2017, while the number of SARs submitted by casino operators jumped by 24%. This is viewed as a positive improvement for the sector, and the NRA makes clear that the Commission continues to emphasise the importance of proactive reporting.

Operators should review the NRA and make any necessary updates to their own Business Risk Assessment and associated policies and procedures to take account of the new risks outlined in the NRA. The trigger for this review of the Business Risk Assessment and associated policies (i.e. these policies have been reviewed in light of the publication of the NRA) should be noted in the version control of the relevant documents.

The Commission published its annual money laundering and terrorist financing risk assessment in December 2020 (the Assessment). While the overall risk rating given by the NRA 2020 (see above) for the gambling sector is 'low', remote casino and betting, and off-course non-remote betting, are still considered high risk by the Commission.

In its Assessment, the Commission has increased the risk rating attributable to certain risks associated with remote casino, remote betting and non-remote betting and has identified new inherent and emerging risks that were not flagged in its 2019 assessment. In summary:

Remote casino:

Echoing the NRA 2020, the Commission's assessment is that the risks associated with pre-paid cards and cryptoasset transactions have increased. The risk of false or stolen identification documents being used to bypass AML controls has also increased to 'high'.

New inherent risks (all of which are perceived as high risk):

• peer to peer betting, and the potential for betting sites to be used by criminals to facilitate match fixing. The Commission notes that the risk of this has increased in recent years with the introduction of P2P betting apps (medium risk); and;
• the use of third parties or agents to obscure source of funds and identity (high risk).

New emerging risks:

• unregulated betting events (i.e. matches outside the jurisdiction of a sports governing body) (high risk);
• due diligence being carried out only when a withdrawal request is made by a customer (high risk);
• smurfing (multiple small transactions being made to avoid meeting financial thresholds and CDD requirements) (medium risk);
• mule accounts (high risk); and
• insufficient controls in place to identify PEPs (medium risk).

Non-remote betting:

The Commission has increased the risk score attributable to operators obtaining inadequate KYC in the non-remote betting industry – this is now 'high' for both on and off-course betting.  While the only new 'inherent' risk noted is that of dyed bank notes being found in gaming machines, the assessment notes the following new and existing emerging risks:

• the lack of closed loop systems – particularly in light of the increase in cashless payments as a result of the Covid 19 pandemic (high risk);
• the risk of organised crime gangs using betting premises to place bets derived from proceeds of crime (medium risk);
• the risk of on-course bookkeepers providing gambling facilities for which they do not have the appropriate licence (low risk);
• the use of Scottish bank notes (medium risk); and
• "bring your own device" – this describes facilities that enable customers to place bets through non account-based play using their own device (an existing risk highlighted in the Commission's 2019 assessment). The Commission's concern is that such facilities may result in operators failing to undertake KYC or to monitor such transactions in real time. However, the Commission understands that licensed betting operators are not currently providing this facility.

Operators must review and consider the Assessment in full and update their own Business Risk Assessments to reflect the increased risk scoring attributed to existing risks by the Commission and to take account of the new existing and emerging risks identified in the Assessment (by assigning risk scoring and outlining any relevant mitigants). The trigger for this review of the Business Risk Assessment (i.e. publication of the Assessment by the Commission) should be noted in the version control of the Business Risk Assessment.

Once the Business Risk Assessment is updated, any necessary updates/changes must be made to the associated policies and training modules.

A common theme is the Commission's concern that monetary thresholds for CDD (including EDD) checks are not being set at appropriate levels.

We have recently seen evidence of the Commission suggesting that the use of appropriate triggers and thresholds must also be supplemented by operators imposing account limits to prevent customers from spending large amounts before appropriate CDD and EDD (including affordability checks) is undertaken.

The European Gaming and Betting Association (EGBA) has confirmed its intention to release a new pan-European code on anti-money laundering for the gambling sector during 2021.

The EGBA has already published gambling-specific codes of conduct for GDPR and Responsible Advertising in pursuit of its goal to create “a safe and reliable European digital environment for online gambling players”.

The EGBA's codes tend to indicate the "direction of travel" for the sector, and gambling operators would be well advised to monitor developments in this area. The EGBA's pan-European code on AML is currently in draft form. We expect the draft will be published in Q2 or Q3 2021.

In November 2020, the Commission published a consultation and call for evidence on remote customer interaction which proposes far-reaching additional measures to further mitigate the risks of consumers experiencing harms associated with gambling. The consultation closed on 9 February 2021, after having been extended by 4 weeks.

In our November article, we discuss the Commission's proposals to introduce additional specific measures on top of the existing requirements of SR Code 3.4.1 (Customer Interaction), as well as the introduction of a customer interaction "manual" to replace the current customer interaction guidance. Our article also discusses the potential unintended consequences of the proposals, both those acknowledged by the Commission itself and others not contemplated by the consultation document.

The Gambling Commission, on 2 February 2021, announced a package of strict measures in relation to online games design and reverse withdrawals.

As we discussed in our October article, BGC's Game Design Code of Conduct: a positive step for responsible game design, the Commission consulted during the summer on proposed changes to the design of online slots, with a view to making them safer for consumers, and proposed restrictions on reverse withdrawals.

The Commission's response to the consultation has now been published and confirms the Commission's intention to proceed with most of the proposed changes set out in the consultation document. See our website briefing for more details: Gambling Commission announces strict new measures for online games.

The measures will need to be fully implemented by operators by 31 October 2021. In the meantime, the Commission has already updated its Remote gambling and software technical standards (February 2021) to reflect the measures.

On 8 December 2020, DCMS published terms of reference and a call for evidence in connection with the review of the Gambling Act 2005. The scope of the review focuses on six key areas namely: online protections (players and products); advertising, sponsorship and branding; the Gambling Commission's powers and resources; consumer redress; age limits and verification; and land based gambling.

The BGC's campaign in response to the call for evidence has centred around the dangers associated with disproportionate regulation and/or regulation that is not based on evidence including driving consumers to unlicensed operators (an argument that has already been met with some scepticism) and the potential negative impact on the economy through the loss of taxes and jobs provided by the industry.

For answers to some of the procedural questions you may have if you are considering responding to the call for evidence, please see our December Accumulator blog post.

The call for evidence closes on 31 March 2021 but we expect the associated debates and formulation of any resulting changes to the law and regulation will continue into Q3 2021 and beyond.

On 21 January 2021, the ICO announced that it had granted the Gambling Commission access to the ICO Sandbox to develop a Single Customer View project which "will allow data which already exists around player behaviours to be aggregated in a safe, controlled manner to drive better decision making, actions and evaluation around player protection across all online gambling providers."

The exact scope of the Commission's proposed project is unclear, but it raises a number of fundamental questions from a data protection perspective; what will be the lawful basis for the sharing of data; will consumers be required to opt-in to having their data shared; how will the project comply with the principle of data minimisation? It is also unclear whether, from an administrative law perspective, the Commission is the appropriate body to consider the range of issues which are raised by a data sharing project of this nature. We have recently seen criticism in the press of some of the Commission's recent proposals, and the public is increasingly aware of the privacy implications of new data sharing schemes of this kind.