Written by: Jakub Pietroszek, Partnership Manager, Digital Colliers
Thirteen operators actioned in eight months isn't a spike. It's a run rate. And if you're licensed in Great Britain, you're on the same queue as everyone else, whether you know it or not.
The useful mental model isn't "will we get audited." It's "when our number comes up, how many days does it take us to answer." That answer is almost entirely a function of your data model.
The queue is real and it's moving
The Commission doesn't audit everyone at once. It works through the licensed population, prompted by complaints, thematic reviews, and its own risk scoring. Roughly one in four UK-licensed operators fails to hit a satisfactory AML rating on first assessment, which tells you the bar is not theoretical and the miss rate is not small.
When your turn arrives, you get a Section 122 notice or an equivalent request. The clock starts. You have weeks, not months, to produce evidence that your Remote Customer Interaction controls did what your policy says they do. RCI guidance came into force 31 August 2022 and was expanded in 2024, so "we're still building it" stopped being a defence a while ago.
The operators who fall out of the queue with a warning and a fix plan look very different from the ones who exit with a public penalty. The gap between those two outcomes is mostly a data problem.
Where your queue position actually gets decided
When the notice lands, the regulator wants specific answers to specific questions. Think about what "produce this" costs you today:
- Every player who crossed £150 net deposits in a rolling 30-day window last quarter, with the affordability check that was triggered and the timestamped outcome.
- Every RCI intervention fired, the signal that caused it, the agent or model that made the call, and what the customer did next.
- Source-of-funds documentation for the top 1% of depositors, linked to the risk score at the moment funds were accepted.
If that's a two-week SQL job with three analysts and a shared spreadsheet, you're deep in the queue. If it's a query that runs in an afternoon because the events, decisions, and evidence are already modelled together, you're near the front.
The operators shipping this well in 2025 tend to treat every regulatory decision as a first-class event: who or what made it, what inputs it saw, what the policy version was at that moment. Not a log line. A record.
The hard deadline nobody's pricing in
Here's the deadline most iGaming compliance teams are still underweighting. EU AI Act Article 50 transparency obligations apply from 2 August 2026. High-risk obligations follow on 2 December 2027. If your affordability scoring, RCI triggering, or AML risk models touch EU customers, and most operators' models do, you're now stacking a second regulator on top of the first.
The fines don't stack politely. GDPR sits at up to €20M or 4% of global turnover. The AI Act adds up to €15M or 3% for high-risk violations. UK penalties for the most serious AML breaches reach up to 15% of gross gaming yield. Any one of those, on its own, dwarfs what most operators spend on their compliance function. Kindred publicly reported a £14M compliance-team cost in 2023, and that's a large operator running it seriously.
The hard deadline effect is this: the data model you need for a clean UKGC response in Q2 2026 is roughly the same one you need for Article 50 in Q3 2026. Build it twice and you'll miss both. Build it once and you're covered.
What first-mover advantage looks like
First-mover in this space isn't a marketing story. It's an operational one. The teams pulling ahead share a few habits.
- They version their policies and models the way engineering versions code. When RCI guidance shifts, they know which decisions were made under which rules.
- They store the inputs to every automated decision, not just the outcome. When a regulator asks why a check didn't fire, "the model said no" isn't an answer. The features are.
- They rehearse the Section 122 response. Once a quarter, someone plays regulator and asks for a real dataset. If it takes more than a few days, that's the finding.
None of this is glamorous work. It's the work that decides whether you're the operator that gets a warning letter or the one on next month's enforcement bulletin. The queue keeps moving either way.