August 2022 sees Gambling Commission enforcement actions against four operators

In August 2022, the UK Gambling Commission concluded enforcement action against four operators, including the Commission’s largest regulatory settlement to date.

1. Entain Group

On 17th August 2022, the Commission published statements about regulatory settlements with Entain Group, the terms of which require Entain to pay £17 million for failures in the period December 2019 to October 2020, by its online business LC International Limited (LCI) (£14 million) and by its retail business Ladbrokes Betting & Gaming Limited (Ladbrokes) (£3 million). The Commission’s Chief Executive, Andrew Rhodes issued a stark warning that “we will be monitoring [Entain] very carefully and further serious breaches will make the removal of their li8cence to operate a very real possibility”.

LCI

LCI’s key failures consisted of the following:

• AML: Breach of paragraph 1 of licence condition 12.1.1:
  • Paragraph 1 requires licensees to conduct an assessment of their risks of their business being used for money laundering and terrorist financing. Licensees must ensure that the risk assessment is reviewed in the event of any changes of circumstances (for example, the introduction of new products or technology). LCI accepted that its money launder and terrorist financing risk assessment did not sufficiently reflect the Commission’s expectations or take into account the Commission’s money laundering and terrorist financing risk assessment. LCI’s risk assessment did not refer to terrorist financing or make specific reference to customer nationality or business risks in the geographical risk section.
• AML: Breach of paragraphs 2 and 3 of licence condition 12.1.1:
  • Paragraph 2 states that following the risk assessment, licensees must have appropriate policies, procedures and controls to prevent money laundering and terrorist financing.
  • Paragraph 3 states that licensees must ensure that its policies, procedures and controls are implemented effectively, kept under review and take into account guidelines published by the Commission.
  • The Commission found that certain customers were allowed to deposit large amounts of money without an interaction being triggered, such as a source of funds check. For example, one customer deposited £742,000 during a membership period of 14 months. The customer’s salary was unknown to LCI and no personal financial information was available. The customer had lost £59,000 in the preceding 6 months.
  • The Commission also found that LCI had placed an overreliance on recycled winnings and should have conducted enhanced customer due diligence sooner than it did. For example, one customer deposited over £150,000 in 2 months. LCI requested source of fund evidence, but the customer was allowed to continue gambling for almost a month.
  • Furthermore, the Commission found that LCI placed “excessive reliance” on open-source information. For example, one customer hit an AML trigger by depositing £10,000 in one day, following which LCI conducted a review of the account using open source checks which revealed no adverse information. The customer then continued to play, but hit a further trigger by depositing £60,000 in 7 days, following which LCI conducted a source of funds check.
• AML: Breach of paragraph 1 of licence condition 12.1.2:
  • Licensees are required to comply with Parts 2 and 3 of the Money Laundering Regulations 2007 (UK Statutory Instrument No. 2157 of 2007) as amended by the Money Laundering (Amendment) Regulations 2007 (UK Statutory Instrument No. 3299 of 2007). LCI accepted that it had breached this condition as a result of the AML failings outlined above.
• Customer Interaction: Failure to comply with paragraphs 1 and 2 of Social Responsibility Code Provision (SRCP) 3.4.1:
  • Paragraphs 1 and 2 of SRCP 3.4.1 state that licensees must interact with customers in a way which minimises the risk of customers experiencing harms associated with gambling. This must include: (i) identifying customers who ma be at risk of experiencing such harms, (ii) interacting with such customers, and (iii) understanding the impact of the interaction on such customers and the effectiveness of the Licensee’s actions.
  • LCI accepted that it was slow to interact with, and in some cases did not interact with, customers identified by the Commission in a way which minimised their risk of experiencing harms associated with gambling.
  • LCI also accepted that its policies were not updated soon enough to reflect the October 2019 SRCP 3.4.1.
  • The Commission also found that LCI ought to have considered affordability sooner when interacting with certain customers.
• Customer Interaction: Failure to comply with paragraphs 1 and 2 of SRCP 3.9.1:

• Paragraph 1 of CRCP 3.9.1 states that licensees must have policies and procedures designed to identify separate accounts which are held by the same individual.
• Paragraph 2 states that where customers are allowed to have more than one account, the licensee must have procedures which enable them to relate each the customer’s accounts to the others. Licensees must also ensure that:
  1. if a customer self-excludes they are excluded from all gambling;
  2. all of a customer’s accounts are monitored and decisions that trigger customer interaction are based on the observed behaviour and transactions across all accounts;
  3. where credit is offered or allowed, the maximum credit limit is applied on an aggregate basis across all accounts; and
  4. individual financial limits can be implemented across all of a customer’s accounts.
• LCI accepted that it had breached paragraphs 1 and 2 as customers subject to AML enquiries and restrictions were able to open multiple accounts. For example, one customer had their account blocked by one of LCI’s brands, but was able to open an account with another of LCI’s brands and deposit £30,000 in one day.

The regulatory settlement reached between LCI and the Commission consists of:

• A divestment of over £540,000;
• A payment in lieu of over £13,000,000 in lieu of a financial penalty;
• Agreement to the publication of a statement of facts in relation to the case;
• Addition of licence conditions to:
  • Appoint a Board-level sponsor to assume responsibility for the implementation of the action plan;
  • Undertake an independent audit into the effective implementation of AML and safer gambling policies, procedures and controls and any further recommendations by the audit to be implemented. (This requirement to implement all recommendations goes beyond the standard licence condition to conduct an audit); and
• Payment of the Commission’s costs of conducting the review.

Ladbrokes

Ladbrokes’ key failures consisted of the following:

• AML: Breach of paragraphs 2 and 3 of licence condition 12.1.1:
  • Ladbrokes accepted that there were weaknesses in its maintenance and implementation of its policies and procedures.
  • The Commission found that certain customers were able to deposit large amounts of money without being subjected to monitoring. For example, one customer regularly paid £500 into shop terminals and gambled £168,000 in 8 months, losing £28,000. The customer was not subjected to AML checks as they were not referred for review and did not hit threshold triggers.
  • The Commission also found that Ladbrokes had been over reliant on recycled winnings and that shop staff should have escalated concerns sooner.
• Customer Interaction: Failure to comply with paragraph 1 and 2 of SRCP 3.4.1:
  • The Commission found that Ladbrokes had been too slow, or had failed, to interact with customers in a way which minimised their risk of experiencing harm from gambling. For example, a customer gambled almost £30,000 and lost over £11,000. The customer was not escalated for a safer gambling review.
  • Additionally, the Commission found that the Ladbrokes ought to have considered affordability sooner than it did and that there were instances where interactions were not adapted based on the severity of potential harm to the customer.

The regulatory reached between Ladbrokes and the Commission consists of the same terms as agreed by LCI, save that there was a divestment of over £212,000 and a payment of almost £3 million in lieu of a financial penalty.

2. Smarkets

A licence review of the online gambling operator, Smarkets, revealed a series of anti-money laundering failures (under LCCP 12.1.1 paragraphs 1, 2 and 3 and Ordinary Code Provision 2.1.1) and social responsibility failures (under SRCP 3.4.1 relating to customer interaction) and has resulted in the imposition of sanctions. The period of the failings is not identified in the public statement.

The Commission found that a customer was allowed to deposit £395,000 in a four-month period without source of funds checks being carried out. Furthermore, another customer was able to transfer funds between bank accounts without source of funds checks being carried out.

Smarkets has received a formal warning, is required to pay a financial penalty of £630,000 and is required to conduct a third-party audit into the effective implementations of its relevant policies, procedures and controls. The public statement by the Commission was published on 11 August 2022.

3. Spreadex

The Commission reached a regulatory settlement with Spreadex, with Spreadex to pay £1.36 million in lieu of a financial penalty, plus the Commission’s costs.

The Commission identified anti-money laundering failures (under LCCP 12.1.1 paragraphs 1, 2 and 3 and Ordinary Code Provision 2.1.1) and social responsibility failures (under SRCP 3.4.1 relating to customer interaction) in the period January 2020 to May 2021. The failures included:

• having financial alerts which were ineffective and allowed customers to lose significant amounts over a short period of time
• placing an overreliance on financial alerts to identify customers at potential risk of experiencing harms
• ·not sufficiently recording and evaluating its customer interactions
• a customer was able to continue depositing after providing redacted bank statements in response to a request for evidence of Source of Funds.

In support of the settlement, the Commission noted the swift and robust action taken by Spreadex, including effective action to expand and improve its compliance capacity. The public statement was published on 25 August 2022.

4. LeoVegas

The Commission’s licence review of LeoVegas has resulted in a financial penalty of £1.32 million, a formal warning and a requirement to undergo an audit into the effective implementation of its relevant policies, procedures and controls in accordance with its regulatory requirements. The sanctions related to anti-money laundering failures (under LCCP 12.1.1 paragraphs 1, 2 and 3 and Ordinary Code Provision 2.1.1) and social responsibility failures (under SRCP 3.4.1 relating to customer interaction and SRCP 3.9.1 relating to identification of customers) in the period October 2019 to October 2020.

Social responsibility failures included the following:

• Setting spend triggers for Safer Gambling Team customer review significantly higher than the average customer’s spend;
• Triggering the cool-off period of 45 minutes after 6 hours of play, without an explanation as to why 6 hours was considered appropriate;
• Failing to follow their policy of interacting with customers demonstrating indicators of harm; and
• Not taking into account the Commission’s 2019 guidance on customer interaction.

Anti-money laundering failures included:

• Financial triggers for anti-money laundering review being too high;
• Relying too heavily on threshold triggers and inadequate information on how much a customer should be allowed to spend based on their personal financial information; and
• Inappropriate controls resulting in significant levels of gambling spend to take place within a short space of time, without having the customer’s financial information.

The public statement was published on 3 August 2022.

Comment

The enforcement action taken by the Commission in August demonstrates the Commission’s continued focus on cracking down on operators. It also reinforces the Commission’s desire for operators to learn from other operators’ mistakes, as well as to impose increased penalties on those operators who are the subject of more than one enforcement action.

Operators should review the full detail of the statements to ensure compliance. A few points of particular note from the statements:

1. The Commission has an increasing focus in enforcement action on total deposits (rather than net deposits) and, as a consequence, recycling of winnings.
2. The Commission expects operators to be able to explain why triggers are appropriate (as identified in the LeoVegas case).
3. There continues to be a significant time lapse between the failures identified by the Commission and the conclusion of enforcement action. Entain and LeoVegas’ sanctions related to failings in 2019 and 2020.