iGaming & Gambling Compliance in the United Kingdom

Great Britain (England, Wales and Scotland) is an open but tightly regulated market for online gambling. Any operator, domestic or offshore, can apply for a remote operating licence. Once licensed, it is bound by the Gambling Commission's Licence Conditions and Codes of Practice (LCCP), which carry more identity and player-protection duties for online operators than for venues. Northern Ireland has a separate, older regime and no licensing route for online gambling.

The principal authorities are the Gambling Commission, which licenses and enforces; the Department for Culture, Media and Sport, which sets policy and makes secondary legislation; and HM Treasury and the National Crime Agency, which handle money laundering rules and suspicious activity reporting.

The biggest obstacle for a new entrant is not the licence application but running its controls in practice. Recent enforcement has focused on operators whose identity, source-of-funds and harm checks existed on paper but did not work at scale.

1. Who regulates this sector

2. Licensing and authorisation

Under section 33 of the Gambling Act 2005 it is an offence to provide facilities for gambling unless an exception applies. The main exception is holding an operating licence that authorises the activity, and carrying on the activity in accordance with that licence's conditions. The Act extends to England, Wales and Scotland.

The online territorial test

Section 36(3), as substituted by the Gambling (Licensing and Advertising) Act 2014, applies the offence to remote gambling in two situations. The first is where at least one piece of remote gambling equipment is situated in Great Britain. The second is where no such equipment is in Great Britain but the facilities are used there. In the second case, the operator commits the offence only if it knows, or should know, that its facilities are being used, or are likely to be used, in Great Britain (section 36(3A)). An offshore operator that accepts British customers therefore needs a remote operating licence, wherever its servers are located.

Remote and non-remote licences

Online and land-based activities are licensed separately. Many LCCP provisions apply only to remote licences, or only to non-remote ones; each provision states the licence types it covers.

Northern Ireland

Northern Ireland regulates gambling under the Betting, Gaming, Lotteries and Amusements (Northern Ireland) Order 1985, as amended in 2022. The courts and district councils license most activity, and the Police Service of Northern Ireland enforces the law. A second phase of reform, intended to regulate online gambling, has not been taken forward since the Assembly dissolved in March 2022. Operators that want to advertise gambling to consumers in Northern Ireland must hold a Gambling Commission licence.

3. AML, KYC and customer due diligence

The UK applies two AML regimes to gambling.

Casinos (remote and non-remote)

Relevant persons under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (the MLRs). They must carry out a business-wide risk assessment, customer due diligence (CDD), enhanced due diligence (EDD), ongoing monitoring and record keeping, and appoint a nominated officer. The Gambling Commission is their AML supervisor.

All other licensees

Betting, bingo, lottery and other operators are outside the MLRs. They are bound by Part 7 of the Proceeds of Crime Act 2002 (POCA) and the Terrorism Act 2000, and by LCCP licence condition 12.1.1. That condition requires a money laundering and terrorist financing risk assessment, and effective policies, procedures and controls that are kept under review.

Casino CDD triggers

A casino must apply CDD when it establishes a business relationship, when it suspects money laundering or terrorist financing, and when it doubts identity information it already holds. It must also apply CDD to any transaction of £2,000 or more, whether made in one operation or in several that appear linked (MLRs, regulation 27(5)). For online casinos, qualifying transactions include depositing funds to take part in remote gambling, and withdrawing those funds or any winnings (regulation 27(6)). Re-staked winnings that were never collected are left out of the calculation (regulation 27(7)). The sterling figure replaced a €2,000 threshold on 30 June 2026.

The Gambling Commission's casino guidance describes a "hybrid approach" in which a remote casino identifies customers and verifies their age at registration, and verifies identity in full once the threshold is triggered. For remote casinos, however, licence condition 17.1.1 already requires identity verification before any gambling (see section 4). The guidance also states that non-face-to-face relationships with no safeguards in place must be treated as high risk and made subject to EDD.

Enhanced due diligence

The Money Laundering and Terrorist Financing (Amendment) Regulations 2026 (SI 2026/621) changed two EDD triggers. EDD is now required only for "unusually complex" transactions, rather than for all complex ones. Mandatory jurisdiction-based EDD is now limited to countries on the Financial Action Task Force (FATF) "Call for Action" list. EDD remains mandatory for politically exposed persons and for other high-risk situations identified in the operator's risk assessment.

Reporting and records

All gambling operators must make a suspicious activity report (SAR) to the UK Financial Intelligence Unit whenever they know or suspect money laundering or terrorist financing. They must also file a key event with the Gambling Commission that gives the SAR's reference number. Casinos must keep CDD documents and transaction records for five years after the business relationship ends (MLRs, regulation 40). After that period, personal data obtained for MLR purposes must be deleted unless another legal basis for keeping it applies.

4. Identity verification and onboarding

For online operators, onboarding is set mainly by two LCCP provisions that apply to all remote licences, with a few named exceptions such as some lottery and business-to-business licences.

• Licence condition 17.1.1 (identity). Operators must obtain and verify information to establish a customer's identity before the customer is permitted to gamble. At minimum this means name, address and date of birth. Before accepting a deposit, operators should tell customers which documents may be requested, when, and how. Operators must take reasonable steps to keep identity information accurate.
• Social responsibility code 3.2.11 (age). Age must be verified before the customer can deposit, play free-to-play versions of gambling games, or gamble with their own money or any free bet or bonus. Customer services staff must be trained in secondary forms of identification for cases where the first verification attempt fails.

Neither provision prescribes a particular verification method, document list or biometric standard. Operators choose methods on a risk basis and must be able to show that they work. The Commission has said that an Application Registration Card, which the Home Office issues to people claiming asylum, is not evidence of identity and must not be accepted. It has also warned operators that false documents, deepfake videos and face swaps generated by artificial intelligence are being used to get through customer checks. Staff must be trained to recognise them.

A verified date of birth also affects product design. Under the Gambling Act 2005 (Operating Licence Conditions) (Amendment) Regulations 2025, the maximum stake per game cycle on online slots is £2 for customers under 25 and £5 for customers aged 25 or over.

5. Digital channels: what's different

Bottom line: In-venue gambling mainly relies on age checks at the door or the counter. Online operators must verify age before any deposit and identity before any gambling, and then run online-only checks for self-exclusion and financial vulnerability.

Verification clock

In venues, the main identity duty is to stop under-18s from gambling. Online, licence condition 17.1.1 and code 3.2.11 bring both age and identity checks forward to before money is deposited or staked. Licence condition 17.1.1(2) also stops operators from delaying verification until a customer asks to withdraw.

Financial checks on online accounts

Social responsibility code 3.4.4 applies only to remote licensees. A financial vulnerability check is required once a customer's deposits minus withdrawals exceed £150 in a rolling 30-day period. It must include a public-record check for bankruptcy, county court judgments, individual voluntary arrangements, debt relief orders and their equivalents. Separately, the Commission decided on 7 July 2026 to introduce financial risk assessments based on credit reference data [Adopted, start date not yet set]. They will apply first at the largest operators, triggered by £5,000 in net deposits in 24 hours (£2,500 for customers under 25). The final thresholds will be £1,000 in 24 hours or £3,000 in 90 days for customers aged 25 or over, and £750 or £2,000 for customers under 25.

Blocking unlicensed sites

The Commission currently disrupts unlicensed sites by issuing cease-and-desist notices that give the operator 48 hours to geo-block British users. Schedule 18 to the Crime and Policing Act 2026 will allow Crown Court judges to order domain names and IP addresses suspended where they are used for serious crime connected with unlicensed gambling [Adopted, commencement not yet set].

6. Data protection and biometrics

Identity capture is governed by the UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025. The Information Commissioner's Office (ICO) treats any biometric recognition system as processing special category biometric data. This applies from the moment the data is collected, and includes one-to-one face matching of a selfie against an identity document photo. Operators need both a lawful basis and an Article 9 condition. The ICO has noted that its biometric guidance is under review following the 2025 Act.

The ICO also stresses that biometric matching produces probability scores, not certainties. Operators should set match thresholds for their use case and provide a fallback route when a genuine customer is rejected. For casinos, regulation 40 of the MLRs requires CDD records to be kept for five years after the relationship ends and personal data to be deleted after that unless another legal basis applies. Operators should set retention for selfies, document images and liveness results to match.

7. Sector-specific obligations

Self-exclusion

Under social responsibility code 3.5.5, remote licensees must participate in the national multi-operator self-exclusion scheme. This applies to all remote licences except named categories, such as some lottery, host and software licences.

Payments

Licensees must not accept payment for gambling by credit card, including credit card payments made through a money service business. The Commission expects pre-paid cards, vouchers and other pre-paid methods to be treated as high risk. Operators must not rely on payment processors to carry out KYC checks or to establish source of funds for them. It also recommends closed-loop payments, in which withdrawals are returned to the method used for the deposit.

Product rules tied to age

The online slot stake limits apply only to reel-based online slot games, not to other casino games. The verified date of birth has to be available to the game platform at the start of every game cycle.

8. Risk indicators and red flags

Online gambling indicators from Gambling Commission publications

• Synthetic onboarding: AI-generated documents, deepfake videos or face swaps used to pass checks.
• Bought identities: consumers paid to hand over documents so third parties can open multiple accounts in their name.
• Mule pattern: a small first deposit followed quickly by larger deposits and withdrawals to a growing number of accounts.
• Card mismatch: card details that do not match the account holder, or several bank accounts or virtual cards funding one account.
• Pre-paid and crypto funding: pre-paid cards or vouchers, or funds said to come from cryptoasset trading.
• Disproportionate spend: losses well above declared income, or large deposits made before source of funds is established.
• Quick cash-out: withdrawals after little play, including on fast products such as crash games.
• Unacceptable documents: an Application Registration Card presented as identity, which may also signal exploitation.

9. Enforcement and penalties

Criminal. Providing gambling facilities without a licence (section 33 of the Gambling Act 2005) is punishable on summary conviction by up to 51 weeks' imprisonment (six months in Scotland), a fine up to level 5 on the standard scale, or both. Failing to report known or suspected money laundering is a separate offence under POCA, carrying up to five years' imprisonment.

Regulatory. The Commission can review a licence (section 116), add or amend conditions, suspend or revoke it (sections 118 and 119), and impose a financial penalty for breach of a licence condition (section 121). In practice, many cases are settled with a payment, a warning and a third-party audit of the operator's AML and safer gambling controls.

• QuinnBet (Gibraltar) Limited, 20 August 2026: £609,104. Failures included letting customers deposit significant sums before source of funds was established, slow suspicious activity reporting, and not carrying out financial vulnerability checks on every customer who met the threshold.
• Platinum Gaming Limited, 22 October 2025: £10 million, its second enforcement action. The operator's risk assessment did not take account of customers whose accounts had been closed over money laundering concerns, which let some of them open new accounts and gamble. Its policy was also unclear on when CDD and EDD applied.

10. Recent changes and what to watch

• 7 July 2026: Financial risk assessments confirmed for staged introduction [Adopted, start date not yet set]. Online operators should plan credit reference agency integration and decision logging. No enforcement action will be taken in the early stages for failing to act on an assessment.
• 30 June 2026: Money Laundering and Terrorist Financing (Amendment) Regulations 2026 [In force]. The casino CDD threshold is now £2,000, and mandatory jurisdiction-based EDD is limited to FATF "Call for Action" countries. Casino AML policies need updating.
• 2026: Crime and Policing Act 2026, Schedule 18 [Adopted, commencement not yet set]. Court orders will be able to suspend domains and IP addresses used for unlicensed gambling.
• 1 April 2026: Remote Gaming Duty rose from 21% to 40% [In force]. A new 25% rate for remote betting follows on 1 April 2027 [Effective 1 Apr 2027]; remote bets on UK horseracing stay at 15%.
• 28 February 2025: The financial vulnerability check threshold fell from £500 to £150 in net deposits over a rolling 30 days [In force].
• 9 April and 21 May 2025: Online slot stake limits of £5 and £2 [In force]. These require the verified age to be available to the game platform.

11. What this means for identity verification

Front-load verification. Age must be confirmed before the first deposit and identity before the first stake. Both should be designed as registration steps, not as checks that run later on.

Method choice is the operator's. No document list, liveness standard or assurance level is prescribed. Operators can combine electronic data checks, document capture and face matching on a risk basis, but must be able to show the Commission that the combination detects forged, AI-generated, stolen and mule identities.

Plan for failed checks. Secondary identification routes and trained staff are required, and withdrawal must not become the point of an avoidable verification request.

Treat biometrics as special category data. Operators need an Article 9 condition and transparent notices. For casinos, retention should follow the five-year MLR period and data should then be deleted.

Re-verify on triggers. Triggers include changes to identity data, the casino £2,000 threshold, net deposits passing £150 in 30 days, and (once phased in) the financial risk assessment thresholds. Repeat-account detection should also cover customers previously closed for money laundering concerns.