Written by: Jakub Pietroszek, Partnership Manager, Digital Colliers
The UK Gambling Commission actioned 13 operators in the first eight months of 2025. Some paid settlements, some lost their licence, some got public warnings that will follow their brand for years. The ones who came through cleanly weren't the ones with the thickest policy binders. They were the ones who could produce evidence on demand.
That distinction matters more every quarter. Roughly one in four UK-licensed operators fails to achieve a satisfactory AML rating on first assessment. The reason is almost never the absence of a policy. It's the inability to prove the policy actually ran on the actual customer, at the actual moment, with the actual data.
What the regulator actually asks for
When the Commission opens a review, they don't ask for your policy PDF. They ask for artefacts. Concrete ones, tied to specific customers, on specific dates.
A rough shape of what gets requested:
- Every customer who crossed the £150 net deposit threshold in a rolling 30-day window, and what affordability signal fired for each.
- The full interaction log for those customers, including any RCI-triggered contact and its outcome.
- Source-of-funds evidence collected, when it was collected, and who reviewed it.
- The decision tree that flagged (or didn't flag) each account, with timestamps.
- Every marketing message sent to any customer showing markers of harm, and the suppression logic that should have caught it.
If your team has to write ad-hoc SQL against three different systems to produce that pack, you're already in trouble. Not because the answer will be wrong, but because the audit will take weeks and the regulator will notice how hard it was to assemble.
Audit readiness is a data model, not a policy
This is the part most compliance functions get backwards. A policy tells you what should happen. A data model determines whether you can prove it happened.
The operators who ride through reviews cleanly tend to have a few things in common at the data layer:
- Customer events are stored as an immutable log, not overwritten. When a customer's affordability status changes, the previous state is preserved with a timestamp and the trigger that caused the change.
- Every automated decision has a stored reason. Not just "flagged" but which rule fired, on which inputs, at which version.
- Communications are joined to customer state at send time. You can answer "what did we know about this customer when we sent them that reactivation email" in one query, not five.
- The affordability, AML, and RCI signals live in one canonical place, not scattered across the CRM, the risk engine, and a spreadsheet the MLRO maintains.
RCI guidance came into force on 31 August 2022 and expanded again in 2024. Each expansion adds new interaction triggers that need to be logged, joined, and retrievable. If your data model can't absorb those changes without a six-month project, every future guidance update becomes a compliance risk on top of an engineering risk.
The cost of getting this wrong
UK penalties for the most serious AML breaches reach up to 15% of gross gaming yield. For a mid-sized operator that's the difference between a going concern and a fire sale. And that's just the direct penalty. The reputational tail, the banking relationships that get harder, the payment providers who quietly raise their rates, all of that compounds.
On the other side, compliance done well is not cheap either. Kindred Group publicly reported £14M in compliance-team cost in 2023. The point isn't that compliance should be smaller. The point is that spend produces evidence only if the underlying data model lets it. A large team running manual reconciliations against a broken schema produces stress, not audit packs.
The left-behind operators
Here's the pattern worth watching. The gap between operators with a real data spine and operators without one is widening every quarter. Each new piece of guidance, each new affordability threshold, each new marketing restriction, is trivial to absorb if your customer state is one clean log. It's a fresh crisis if it isn't.
Operators shipping in 2026 tend to have already made the investment. They rebuilt the event log, they consolidated the risk signals, they made every automated decision explainable by design. The operators who haven't done that work are betting they won't be in the next batch of 13. Some of them will be right. Most of them won't.