The Problem
Most boards want a clean answer to a messy question, which is whether the business is actually keeping its customers safe, and the affordability or financial risk check has become the closest thing gambling regulation anywhere offers to a clean answer, because it produces a pass or a fail that can be logged, audited and shown to a regulator on request. That is why it sits at the centre of responsible gambling programmes across every mature market, whether the threshold is set by a UK regulator working from net deposit data or a US state commission enforcing a limit the customer chose. The trouble is a check can be built entirely to a regulator’s specification, run without a single complaint, and still tell a board almost nothing about whether the person on the other end of it is safe, because it answers one question, whether a customer can afford what they are staking or has stayed inside a limit, and that sits alongside everything else gambling harm depends on, like a person’s relationships, sleep, work and state of mind. Boards tend to treat ‘passed the check’ and ‘not experiencing harm’ as close enough to report together, and that is where the exposure sits, because the two things are not the same claim.
How It Actually Works
The UK’s financial risk framework, introduced through the Gambling Commission’s work on the 2023 money laundering and terrorist financing risks review, works on net deposit thresholds rather than total spend, so it is triggered by how much money a customer has put in, minus withdrawals, over a set window. The first stage, aimed at the largest operators, set that threshold at £5,000 within a rolling 24 hours for customers 25 and over, and £2,500 for those under 25, and the Commission has since set lower thresholds for full implementation, down to £1,000 for customers 25 and over and £750 for those under 25. Once a customer crosses that line, the check is designed to be frictionless wherever possible, running through credit reference agencies against data the customer never submits, and the Commission’s own pilot data put the frictionless rate at 97% across roughly 1.7 million assessments, well ahead of the 80% predicted, with only around 0.3% moved on to identity verification or, rarer still, open banking or document requests, and even then operators work from a risk flag, indicators like recent defaults or active debt plans, rather than a customer’s actual bank statements.
What that design tells you matters, because the check is built, tested and tuned to catch one specific failure mode, a customer spending more than their financial position can sustain, and it is genuinely good at that job within its own terms. But the academic taxonomy of gambling harm that underpins most of the public health literature on this question, set out by Langham and colleagues and used in GambleAware’s own review of harm frameworks, identifies seven separate domains harm shows up in, financial, relationship, psychological and emotional, physical health, work and study, cultural, and criminal justice involvement, and a person can be doing badly in several of those while sitting comfortably inside every deposit threshold a check will ever apply to them. The clearest evidence of the gap comes from the prevention paradox research published by Browne and Rockloff, of Central Queensland University, in the Journal of Behavioral Addictions, which found that around 90% of the financial harm recorded across a population comes from gamblers not classified as problem gamblers at all, simply because there are far more of them than there are severe cases, so a threshold calibrated to catch the heaviest spenders is structurally unlikely to catch the much larger group experiencing real harm that never trips an alarm. A customer can be gambling every evening instead of seeing their children, losing sleep and missing shifts at work, and still clear every financial threshold a licensed operator runs, because none of that shows up in a credit file, in the UK or anywhere else.
The same structural gap turns up under a different label once you cross the Atlantic, and the mechanism a US state uses looks nothing like the UK’s automatic, regulator-triggered assessment, which is itself instructive. Massachusetts, one of the more prescriptive US sports wagering regulators, requires operators under 205 CMR 255 to build a play management system that lets a customer set their own wager, deposit and spend limits, and once set, the operator must reject or void anything that would breach it, a real, auditable rule, and an operator that never processes a wager past a customer’s stated limit is fully compliant with it. But the limit only exists because the customer chose to set one, and the American Gaming Association’s national Responsible Gaming Code of Conduct, which shapes practice across most licensed US states, is built the same way, around making information and self-exclusion available to whoever asks for it rather than assessing anyone’s financial position the way the UK check does. So a US operator can run a fully compliant programme and never have looked at one customer’s actual capacity to afford what they are staking, because the model assumes the customer will flag their own risk, and most never set a limit, so are never checked at all, the same gap as the UK’s, just earlier and for a different reason.
A Practical Way In
This is not a finished framework, but it is a useful starting set of questions to put to whoever owns the responsible gambling function, wherever in the world that function sits.
– What does our check actually look at, and can we say in one sentence what it is structurally unable to see?
– Where do our thresholds sit against the relevant benchmark in each market we hold a licence in, and what does a customer just under that line look like?
– When a customer passes the check, does that close the file, or does it feed into a wider view drawing on time spent, session patterns, self-exclusion history and support contact, with someone owning the harms that sit outside financial capacity?
– If a regulator or a journalist asked us to show the difference between our compliance rate and our harm rate, could we produce two numbers, or only one?
Where This Goes Deeper
Building a check that satisfies a regulator, whether that is the Gambling Commission’s net deposit threshold or a state commission’s limit enforcement rule, is a defined, achievable piece of work, and most operators of any size have done it competently in every market where they hold a licence. Building a picture of a customer that goes beyond financial capacity, pulling in behavioural markers, contact history and the kind of detail a support team picks up in a phone call, is a much harder design problem, and it is the one that determines whether a board can say its customers are safe rather than simply compliant. That is the layer the full Tools and Expert Sessions are built to help with, and it is worth seeing if it fits what your board is missing.
Sources
1. Gambling Commission, ‘Commission to introduce Financial Risk Assessments in staged approach’, 7 July 2026, https://www.gamblingcommission.gov.uk/news/article/commission-to-introduce-financial-risk-assessments-in-staged-approach
2. Gambling Commission, ‘Regulatory decisions: Procedures and guidance for regulatory hearings, summary of financial vulnerability and financial risk checks’, undated guidance page, https://www.gamblingcommission.gov.uk/guidance/regulatory-decisions-procedures-and-guidance-for-regulatory-hearings/summary-financial-vulnerability-and-financial-risk
3. iGaming Business, ‘Gambling Commission reports improved 97% rate of frictionless financial risk checks’, 21 May 2025, https://igamingbusiness.com/legal-compliance/regulation/gambling-commission-financial-risk-checks/
4. Close, J., Martin, I., White, G., Lau, R. and May, J. (National Centre for Social Research and University of Plymouth, for GambleAware), ‘Frameworks and Measurement of Gambling Related Harm’, July 2023, https://www.gambleaware.org/media/jh2lol4f/frameworks-and-measurement-of-grh_final_for-publication.pdf
5. Browne, M. and Rockloff, M.J., ‘Prevalence of gambling-related harm provides evidence for the prevention paradox’, Journal of Behavioral Addictions, 2018, https://pmc.ncbi.nlm.nih.gov/articles/PMC6174604/
6. Massachusetts Gaming Commission, ‘205 CMR 255.00: Play Management’, https://www.mass.gov/doc/205-cmr-255-play-management/download
7. American Gaming Association, ‘Responsible Gaming Code of Conduct’, updated September 2025, https://www.americangaming.org/wp-content/uploads/2025/12/Responsible-Gaming-Code-of-Conduct-2026.pdf