Written by: Karol Sobieraj, Founder & CEO, Digital Colliers
Thirteen operators were actioned by the UK Gambling Commission in the first eight months of 2025. That's not a rounding error, it's a pattern. And the pattern I keep seeing is that the operators who clear these reviews quickly don't do it because their compliance team is bigger or smarter. They do it because they already have the answer sitting in a query that runs in under an hour.
Everyone else is running a data project.
Two operators, same letter, different week
Picture two operators who get the same request from the Commission on a Monday morning. Show us, for this cohort of customers over this window, what interactions you had, what markers of harm you saw, what actions you took, and when.
Operator A runs a query. It joins customer, product, transaction, and interaction data. By Tuesday afternoon they've sent a PDF with the numbers, the SQL, and the timestamps. Their compliance lead sleeps fine on Wednesday.
Operator B kicks off a project. Someone has to pull deposit data from the payments warehouse. Someone else has to pull RG interactions from the CRM. A third person has to reconcile customer IDs across three systems because marketing renamed a column in 2023. Two months later they hand over something that mostly answers the question, with caveats. The Commission asks a follow-up. They start again.
Same regulator. Same question. Two very different cost curves.
What the evidence pack actually is
Call it a compliance data model or call it an evidence pack, the shape is the same. It's a joined, versioned view of the four things a UK regulator will ever ask you about:
- Customer: who they are, KYC state, self-declared affordability, vulnerability flags, and the timestamps on every change to those fields.
- Product: what they played, what stakes, what velocity, what session length.
- Transaction: deposits, withdrawals, reversals, and the running net-deposit total on any rolling 30-day window. The £150 affordability trigger only works if this number is queryable, not calculated after the fact.
- Interaction: every RG touchpoint, every message sent, every popup shown, every action taken, and what the customer did in the next 24 hours.
The part that separates a real evidence pack from a warehouse dump is point-in-time integrity. When the Commission asks what you knew on 14 March, you need to answer with what you actually knew on 14 March, not what the record looks like today after six updates. Slowly changing dimensions, event sourcing, immutable interaction logs. Boring words, but this is where reviews are won and lost.
RCI guidance came into force in August 2022 and expanded in 2024. The expectations are not going backwards. Roughly one in four UK-licensed operators still fails to achieve a satisfactory AML rating on first assessment, which tells you how many teams are still assembling the evidence after the request lands.
The compounding cost of running it ad hoc
Here's the part that gets underweighted. The cost isn't the one review. It's every review, forever, plus every internal question that touches the same data.
Kindred publicly reported a £14M compliance team cost in 2023. A meaningful chunk of any number that size is people doing joins by hand. Every ad hoc pull is a re-derivation of the same underlying model, done by a different analyst, with slightly different assumptions, defended in a slightly different way. The numbers drift. The confidence drops. And when the penalty ceiling for the worst AML breaches is up to 15% of gross gaming yield, drift is not a survivable position.
Run the same query ad hoc a hundred times and you've paid for the model ten times over, and you still don't have the model.
Who gets left behind
In 2026 the operators who treat the evidence pack as a live product will spend less time on reviews, not more. They'll answer new questions in hours. Their compliance headcount will shift from assembly to judgement.
The operators who keep running it ad hoc will fund the same joins twice a quarter, forever, and their next Commission letter will still take two months to answer. Given that roughly 95% of enterprise AI projects never reach production, the winning move is unglamorous. Build the boring joined model first. Everything else, including anything AI-shaped you want to do on top, needs that foundation to stand on.