Written by: Kacper Osiewalski, Lead Backend Engineer, Digital Colliers
Australia's eSafety Commissioner just said Roblox is still failing to stop adults contacting unknown children, more than a year after the platform promised fixes. That's a regulator publicly rejecting a platform's own account of its controls. If you run age gating or player-protection tooling in iGaming, read the ruling as a preview of the questions your regulator is about to ask you, not as someone else's problem.
The pattern is consistent. A platform announces controls. A regulator asks for evidence the controls actually work in production. The platform produces marketing language, screenshots, and a policy PDF. The regulator says that's not evidence. Then the enforcement clock starts. iGaming operators have weeks to make sure their evidence pack survives the same test, not quarters.
Why the Roblox pattern matters for iGaming
Roblox is a games platform, not a gambling one, so it's tempting to file the story under adjacent-industry news. Don't. The regulatory muscle memory being built by eSafety, Ofcom, the ICO and the UK Gambling Commission is the same muscle memory. All of them are moving from policy-based supervision to evidence-based supervision. That means they want to see the logs, the model outputs, the intervention records and the timestamps, not the policy document that says those things exist.
For iGaming specifically, the Remote Customer Interaction guidance from the UK Gambling Commission came into force on 31 August 2022 and was expanded in 2024. That expansion pushed operators from "we have a policy" toward "show us the customer-by-customer evidence you acted on the signals you had." Roughly one in four UK-licensed operators still fails to achieve a satisfactory AML rating on first assessment, which tells you how far the gap between policy and provable practice actually is.
What a regulator-ready evidence pack actually contains
When a regulator asks for your age-verification and player-protection evidence, they're not asking for a slide deck. They're asking for a queryable record of every decision the system made about a given player, in order, with inputs and outputs preserved. Most operators don't have this cleanly. They have fragments across a KYC vendor, an internal risk engine, a CRM, and a data warehouse that only the analytics team knows how to read.
A workable data model looks something like this:
- Player identity events: every KYC attempt, document check, liveness check, and re-verification, with vendor, timestamp, raw response, and decision.
- Signal events: deposit velocity, session length, time-of-day patterns, self-exclusion register hits, and any third-party data feed used.
- Threshold crossings: the exact moment a player crossed £150 net deposits in a rolling 30-day window and triggered UK affordability checks, plus what the system did next.
- Intervention records: the message sent, the channel, the timestamp, whether the player responded, and what changed in their behaviour after.
- Model decisions: for any ML-driven risk score, the model version, the input feature vector, the output score, and the threshold in force that day.
If you can't answer "what did we know about player X on date Y and what did we do about it" with a single query, you're not audit-ready. You're audit-hopeful.
The cost of getting this wrong
UK penalties for the most serious AML breaches reach up to 15% of gross gaming yield. That's not a fine your finance team absorbs quietly. Kindred Group publicly reported £14M in compliance-team cost in 2023, and that's the cost of running the function well, not the cost of failing an assessment. The delta between a well-instrumented evidence pack and a fragmented one is measured in enforcement outcomes, not internal reporting friction.
What to do in the next few weeks
Treat this as a short deadline, because the regulatory tempo is short.
- Run a fire drill. Pick a real player from last quarter who crossed an affordability or age-verification threshold. Ask your team to produce the full evidence pack in 48 hours. Time it.
- Map the gaps. Every place the fire drill required a human to stitch data together is a gap. Log the gap, don't rationalise it.
- Fix the schema before the tooling. A clean event schema across identity, signal, threshold, intervention and model decision is worth more than a dashboard on top of a messy one.
- Version everything. Model versions, rule versions, threshold values. Regulators are increasingly asking "what was in force on the day."
The operators who'll be fine in 2026 are the ones treating the evidence pack as a first-class product this quarter, not the ones treating it as a compliance chore next quarter.