UKGC Stages Financial Risk Checks

Key Takeaways:

UKGC introduces Financial Risk Assessments (FRAs) in stages.
Stage one targets largest operators with high net deposits.
FRAs are data-based, replacing unpopular document checks.
No enforcement for FRA failures during early implementation.
Pilot found 97% of checks were frictionless for customers.
FRAs are distinct from affordability checks and do not cap spend.
Operators must align compliance infrastructure from day one.

The UK Gambling Commission (UKGC) confirmed on July 7, 2026, the introduction of Financial Risk Assessments (FRAs) for UK operators. These data-based checks will replace document checks, which the UKGC noted are unpopular with many consumers, to identify financially vulnerable gamblers. The implementation will occur in stages, starting with the largest operators.

Phased Rollout and Thresholds

Following consultation, stakeholder engagement, and piloting, the Commission opted for a staged approach rather than a single implementation date. Stage one applies only to the largest licensed gambling operators, covering customers with net deposits of £5,000 or more in a rolling 24-hour period for those aged 25 and over. For high-risk groups, including consumers under 25, stage one applies to net deposits exceeding £2,500 in a rolling 24-hour period. This initial threshold affects fewer than 0.5% of customers.

Interim stages will have thresholds set following further engagement with implementation groups and stakeholders. The final stage will see thresholds of £1,000 net deposit in a rolling 24-hour period or £3,000 over a rolling 90-day period for consumers aged 25 and over. For high-risk groups, final stage thresholds will be £750 net deposit in a rolling 24-hour period or £2,000 over a rolling 90-day period. The regulator states these checks are needed because some high-spending customers in financial difficulty are currently going unidentified, a trend seen across regulated online casino markets.

Industry Impact and Compliance Considerations

The Commission confirmed that no enforcement action will be taken for a failure to act following an FRA during the early stages of implementation. However, operators remain subject to all other existing licence requirements, and action may still follow breaches of those. Roman Baranovskyi, head of iGaming and investment legal practice at SBSB FinTech Lawyers, noted that the grace period is narrower than the headline suggests. He stated: “Operators who treat this as a blanket pause risk building FRA processes last, when the surrounding compliance infrastructure, such as existing customer interaction and social responsibility codes, needs to be aligned from day one, affecting how online casino payment methods are processed.”

Michael Clohisy, sports attorney and adviser at Quintel Intelligence, also described the UKGC’s grace period as “fairly narrow and highly conditional.” Clohisy added: “Existing licensing conditions must still be met, operators cannot treat the grace period as a pause on affordability and social responsibility metrics. The grace period exists to allow technical integration between operators, CRAs, and the UKGC.” He emphasized that “In the interim, behavioral red-flag spending markers must remain active. Otherwise, a high-spending customer who suffers foreseeable gambling harms under old trigger markers may invite scrutiny for the operators, including heavy penalties from the UKGC.” The Commission has stressed that FRAs are not affordability checks; they do not assess what a customer can afford or cap spend. Assessments will be frictionless and document-free, conducted by credit reference agencies without impacting a customer’s credit score.

Operational Challenges and Regulator Confidence

A pilot found that 97% of customers spending above the relevant thresholds could be assessed frictionlessly, exceeding the 80% estimated in the 2023 White Paper. Fewer than 3% of accounts would trigger an assessment, and fewer than 1 in 1,000 accounts would be unable to complete one frictionlessly. These customers would require proper identity verification and potentially other checks like open banking or document requests. Baranovskyi cautioned that this is “exactly where the burden concentrates,” as proper identity verification and alternative evidence are labor-intensive processes. He also highlighted consistency across credit reference agencies as a “real hurdle,” noting that industry critics suggest the pilot was less frictionless in practice than the 97% figure implies due to varying results from different CRAs.

Clohisy addressed a common misconception regarding consent, clarifying that operators do not need explicit consumer consent for frictionless checks. He explained that the lawful bases under GDPR Article 6 are Legal Obligation Article 6(1)(C) and Legitimate Interests under Article 6(1)(F). Strict purpose limitation protocols must be met, ensuring inbound financial data is not repurposed for commercial gain, and privacy notices must be updated. Sarah Gardner, acting chief executive of the Gambling Commission, expressed confidence in the approach. Gardner stated: “We are confident that our approach, using high-quality data, will enable support for high-spending customers in financial difficulties, while reducing friction for customers who are not in financial difficulties by removing the need for unnecessary and unpopular document checks to understand financial risk.” Baroness Twycross, gambling minister, added: “The right balance must be struck so that assessments protect those in financial difficulties from the risk of gambling-related harm but do not create unnecessary burdens for the industry or consumers.” Implementation groups involving industry and other stakeholders will convene over the summer to confirm a timetable for stage one.