Summer 2023 consultation on proposed changes to Licence Conditions and Codes of Practice (LCCP), Remote Gambling and Software Technical Standards (RTS), and arrangements for Regulatory Panels

In July 2023, we consulted on a number of changes to the Licence Conditions and Codes of Practice (LCCP) requirements placed on gambling businesses.  

We also consulted on changes to the existing Remote Gambling and Software Technical Standards (RTS), including new requirements altogether.  

Additionally, we consulted on changes to the composition and decision-making processes of the Gambling Commission’s (the Commission) Regulatory Panels.  

Four of these topics are connected to the government’s White Paper High stakes: gambling reform for the digital age following its review of the Gambling Act 2005, and our advice to government as part of that Review. The proposals we made in the consultation formed part of our strategic commitment to deliver measures to support improved transparency for consumers, and consumer choice as well as player protections and product safety. 

The detailed proposals were to:  

1. Improve consumer choice on direct marketing: 

Introducing a new LCCP requirement (5.1.12) to provide customers with options to opt-in to the product type they are interested in and the channels through which they wish to receive direct marketing. 

2. Strengthen age verification in premises: 

Removing the current exemption from carrying out age verification test purchasing for smaller licensees and changing the relevant ordinary code (good practice) elements of LCCP to say that licensees should have procedures that require their staff to check the age of any customer who appears to be under 25 years old, rather than under 21 years old. 

We also sought views on how licensees make sure they have effective age verification procedures where their premises may not be directly supervised.  

3. Amend and introduce new requirements on remote game design: 

Extending the controls that already apply to slots to other online products and introducing new RTS requirements to reduce the speed and intensity on online products while making them fairer and increasing consumer understanding about game play.  

We proposed a 5 second minimum game speed which targets the fastest versions of non-slots products (RTS 14G). We also proposed removing features which can speed up play to reduce the harm experienced by consumers who are gambling particularly quickly or intensely or create dissociation from awareness of play (RTS 14E). We specifically consulted on a technical update to RTS security requirements to reflect the 2022 update to ISO 27001. 

4. Remote gambling: financial vulnerability and financial risk: 

Introducing LCCP requirements on operators to conduct checks in a new frictionless manner, to understand if a customer’s gambling is likely to be harmful in the context of their financial circumstances, in the form of financial vulnerability checks and financial risk assessments. 

We proposed that operators should use the information obtained within their overall approach of identifying risk of harm and taking action to prevent gambling harm.  

This topic was also included in a consultation and call for evidence exercise between 2020 and 2021. We published the response to the consultation in 2022 and have now included further information about the responses to the call for evidence. 

5. Extending and clarifying Personal Management Licences requirements: 

Changing licence condition 1.2.1 of the LCCP, which would both clarify and extend the roles captured by the definition. 

6. Changes to Regulatory Panels: 

Changing the composition and decision-making processes of the Commission’s Regulatory Panels. 

The consultation closed on 18 October 2023. 

There were 2,411 respondents who provided 3,113 responses across the Summer 2023 consultation topics, from a wide range of stakeholders, including: 

• 1,881 members of the public 

• 86 persons representing a charity and/or non-profit organisation 

• 69 persons representing a gambling business 

• 17 persons representing a professional body, including academic organisations 

• 12 persons representing a trade association 

• 270 persons, responding in a personal capacity who is or has worked in a gambling business 

• 54 academics responding as individuals 

• 9 representing a licensing authority or other regulator 

• 13 other (not specified). 

Alongside the consultation, there has also been extensive engagement on a number of topics, and we have progressed consumer research in order to more fully understand consumer perspectives. 

We have reviewed the responses to each of the proposals to inform our final position.   

Some of the proposals received general support. There was however a great deal of interest in the topic of financial risk from a range of stakeholders - in the consultation itself and in discussions and engagement with the Commission and with government.  We have carefully considered the consultation responses before arriving at decisions on next steps. 

Following consultation, we have made decisions on next steps, including refining the requirements and associated guidance and further developing our approaches to implementation. The decisions are set out as follows.   

1. Improve consumer choice on direct marketing 

We have decided to proceed with the new LCCP requirement (15.1.12) with some variation to what we consulted upon. Notably, while land-based gambling was included in scope of the original proposal, following consideration, we have not included land-based gambling or the lottery sector in scope of the requirement, at this time.  

Further to this, we have also removed the need to stop marketing to customers that have not set marketing preferences in line with the proposed product options. Instead, customers will be required to update their marketing consent in line with the new requirements before they next gamble. We have also removed the requirement to include post as a form of direct marketing as it would bring only limited benefit for consumers. The new requirement (5.1.12) will come into force on 17 January 2025.  

2. Strengthen age verification in premises 

We have decided to implement the changes to the LCCP covering age verification test purchasing and ‘think 21 to think 25’ exactly as consulted. The updated aspects of the LCCP will come into effect on 30 August 2024.  

Following the request for views in the consultation, we are not considering any measures specific to premises that may not be directly supervised at this time. The requirements in LCCP apply equally wherever premises are located, and licensees should take any measures necessary to comply with them.  

3. Amend and introduce new requirements on remote game design 

There were 7 component proposals put forward under this part of the consultation, 6 for game design and an update to our security audit following an update to the ISO standard. Following due consideration, while we will largely be taking the proposals forward, we have decided to amend certain aspects, as set out as follows. 

We have decided to proceed with the introduction of a 5 second speed for non-slots titles. Therefore, we are introducing new requirement 14G to RTS 14 Responsible product design. 

We have also decided to introduce the requirement to prohibit autoplay for all online gaming products. Implementation guidance has been included in the RTS which makes clear that the auto-posting of blinds in peer-to-peer poker is not caught by this requirement (RTS 8). 

We have decided to prohibit operator-led functionality which enables playing multiple simultaneous games to all casino products, bringing them in line with slots. We removed bingo, virtual betting, and peer-to-peer poker from the scope of this requirement following consultation. The final requirement will prohibit operator-led functionality which facilitates playing multiple simultaneous products, such as 2 games of roulette or 4 blackjack tables) (RTS 14C). 

We have decided to prohibit the celebrations of returns less than or equal to stake (RTS 14F) with a small tweak to the existing implementation guidance within the standards to make it clearer for industry. 

We have also decided to require operators to provide the net spend and net time information that is currently required for slots for casino games (excluding peer-to-peer poker) (RTS 2E and RTS 13C). 

The new game design requirements will come into force on 17 January 2025.  

For the security audit update we will go ahead as consulted on, with one new control (5.23 Information security for use of cloud services) added to the existing set, which has been updated to the 2022 format.  

As an annual requirement, the last date for any licensee to complete a security audit against the 2013 standard will be 31 October 2024. All security audits conducted after 1 November 2024 must be conducted against the controls listed in the updated RTS which aligns with the 2022 standard. This means by 31 October 2025 all relevant licensees will have completed a security audit based on the 2022 standard.  

For clarity, any security audit up to 31 October 2024 can be against either the 2013 or 2022 standard. 

4. Remote gambling: financial vulnerability checks and financial risk assessments 

We are working towards a new, proportionate and frictionless system of checks to make processes smoother and better for customers. We do not seek to mandate a cap on gambling, or to interrupt the customer journey unnecessarily, and the checks would not impact on a customer’s credit score. 

We consulted on 2 types of checks which would work as a package together to identify customers at risk of harm amongst the highest spending customers - the light-touch financial vulnerability check to consider things like bankruptcy and the financial risk assessment to consider credit reference data and identify potential consumer risk.  

We value the consultation responses we have received, and have made some changes to our proposals following consultation. 

Light-touch financial vulnerability checks  

We are introducing a light-touch and frictionless financial vulnerability check to consider publicly available data for things like bankruptcy. We want to prevent some of the cases we have seen such as where customers who were bankrupt did not receive any support.  

Some larger operators already conduct such checks for all customers at registration, and others do so at some point in the customer journey.  

These checks will identify financial vulnerability such as where a customer is subject to bankruptcy orders or has a history of unpaid debts. They will focus solely on publicly available data and, following feedback through the consultation, will not require gambling businesses to consider an individual’s personal details such as postcode or job title. 

Following consultation, we have focused on the monthly threshold rather than also including an annual threshold as a minimum requirement. This is because we consider that the vast majority of those that would trigger an annual threshold would have previously triggered a monthly threshold. We also consider that a customer with a consistent spend profile over the year is less likely to be experiencing financial distress associated with gambling, if there are no other indicators of harm.  Finally, we have made some detailed amendments to the provision relating to definitions and clarifying how the data may be processed, considering practical issues raised by gambling businesses. 

To ease the introduction of these light-touch checks, they will initially come into force at a higher threshold from 30 August 2024, before reducing to a lower threshold on 28 February 2025, to smooth implementation for consumers. We will evaluate the impact of these checks and will continue to keep thresholds and other details under review. 

Frictionless financial risk assessments  

We are also working towards new, proportionate financial risk assessments. We want to prevent some of the serious cases we have seen where customers were able to spend large amounts in short spaces of time without any checks. We think we can improve customer experience with a frictionless system based on data sharing that helps identify risk for the highest spending customers. But we do not intend to roll out the assessments until we are satisfied that the data-sharing can work well. We are therefore going to run a pilot with the largest operators to test the practical issues before a final decision is made on whether and how these assessments take place.  

Consumers will not be affected during a pilot period to make sure that that we can refine the data sharing processes before the assessments would be rolled out in a live environment. The pilot will test out the different forms of data available to consider what is helpful and meaningful in the gambling context. The pilot will assess the type of data that will be used to inform a customer’s risk assessment. For example, credit reference agencies, could share information on any credit arrears a customer has without customers needing to submit documents. Gambling operators will never have access to raw account level data, for example they would not be able to look at customers’ bank accounts. 

If the pilot progresses well, these will be frictionless checks for the vast majority of customers who undergo them, without the customer providing documents. They will apply to only the highest spenders and will not be a cap on gambling and will enable gambling businesses to take into account the whole picture. Once an assessment has been obtained, gambling businesses can consider gambling history such as if the customer is overall winning and consider whether there are other indicators of harm such as whether the customer has been chasing losses. There will be no new requirements on betting at the track, or at the local high street betting shop. 

Following the pilot, we will make fresh decisions on financial risk assessments, and will issue the final response document with all decisions. The final risk assessments are subject to the findings from the pilot and data collection period. 

The pilot will enable us to test the details of data-sharing in practice, working with credit reference agencies and gambling businesses, thinking always about what this means for the consumer.  

For the purposes of the pilot, we consider it reasonable that the largest operators are required to participate. We have therefore decided to require operators in the highest 3 relevant bands of operating licence fee categories, with a significant proportion of market share. We estimate that this group will provide us with sufficient information during the pilot period to inform decision-making whilst also imposing any burden for operators on those with the largest resources and those most likely to be able to participate in a pilot easily and effectively. 

We will additionally seek volunteers from operators outside of these fee bands to participate.  While we think it is important to offer the opportunity for some smaller operators to contribute to the pilot, we did not consider it proportionate to require smaller operators to do so. The pilot will commence at the end of August 2024.  

5. Extending and clarifying Personal Management Licences requirements We have decided to extend the LCCP requirements 1.2.1 as consulted. However, we have provided further clarity in respect of the Chair position. The updated requirement will come into force on 29 November 2024.  

6. Changes to Regulatory Panels 

We have concluded that we will not be implementing the consultation proposals. We remain committed to maintaining robust, cost-effective, and timely regulatory decision-making processes, and we will open further consultation if we have alternative proposals for consultation.   

Implementation timeline 

We have developed a phased implementation approach to these new and amended requirements and codes which has 5 key initial implementation dates: end of August 2024, end of October 2024, end of November 2024, mid-January 2025 and February 2025.  

This phased approach allows the standard 3 month notice period for LCCP changes which may involve some process or technical changes, but which we consider can be delivered within this timeframe, taking into account the consultation responses.  

It also allows a longer period of implementation for those requirements where we consider gambling businesses will need to make more significant technical or process amendments, where there is a link to some external date, or where we want to ensure that operators can make the changes in such a way that supports and enables consumers. We have also taken into account that there are other changes to the regulatory framework, in connection with government’s planned or potential legislative change (for example changes to online slot stake limits). 

The 5 phases of implementation  

The 5 phases of implementation for these Commission-led decisions are: 

At the end of August 2024, 3 requirements will come into force: 

• for land-based operators, the requirement for smaller operators to conduct test purchasing as part of controls to prevent underage gambling, alongside an amended (good practice) code to implement Think 25 approaches to age verification 

• for remote operators, the requirement to conduct light-touch financial vulnerability checks at the higher threshold of £500 per 30-day rolling period. 

• for the largest remote operators, the requirement to participate in a pilot of frictionless financial risk assessments 

On 31 October 2024, one provision will come into effect: 

For remote operators, a technical update to RTS security requirements to reflect the 2022 update to ISO 27001. 

And at the end of November 2024, one further provision will come into force: 

The new and amended requirements for operators to ensure that certain roles within their organisations are held by individuals who hold a Personal Management Licence (PML). 

On 17 January 2025, 2 further requirements will come into effect for remote operators: 

• the requirement to provide customers with options to opt-in to the product type they are interested in and the channels through which they wish to receive direct marketing 

• the set of new or amended remote technical standards relating to remote game design, and associated implementation guidance within the standards will also come into effect. 

On 28 February 2025, one further provision will come into force: 

For remote operators, the requirement to conduct light-touch financial vulnerability checks at the final threshold of £150 net deposits per 30-day rolling period. 

To assist our stakeholders, we will shortly set out a full timeline of Commission changes to the regulatory framework, which covers Commission amendments to LCCP, Remote and Gaming Machine Technical Standards and other key documents. This timeline will be available on our website and cover changes that are connected with Gambling Act Review implementation as well as our important business as usual updates to the regulatory framework.   

The Commission is also in the process of considering consultation responses on other topics. To assist stakeholders, we set out further information about the intended timetable for responses, subject to further analysis of consultation responses. 

On 21 February 2024, we closed the Autumn 2023 consultation. We published the consultation response on the topic of the timing of regulatory returns from gambling businesses on 27 March 2024. We currently intend to publish consultation responses and set out our approach to implementation of any further changes arising in the following areas during quarter 2 of the coming financial year:  

• working to ensure that incentives such as free bets and bonuses are constructed in a socially responsible manner 

• the role of customer-led gambling management tools and tackling artificial barriers to consumer choice 

• removal of the requirement to contribute to Research, Prevention and Treatment from LCCP, in preparation for a statutory levy 

• improved transparency on customer funds in the event of insolvency. 

Finally, we will commence consultations during this financial year in relation to further policy areas, including the topic of Gaming Machine Technical Standards. 

You can read more about the response to this consultation and our next steps on our consultations page.