Compliance
Key-Event Reporting
Definition
A licence condition requiring an operator to notify the regulator, within a set period, of specified significant events: changes in ownership or key personnel, investigations and legal proceedings, breaches of licence conditions, security incidents, insolvency events, sanctions by other regulators and similar. The mechanism by which the regulator learns what it needs to know without waiting for an inspection.
Key takeaways
- Key-event reporting requires operators to notify the regulator of listed significant events within a set period, five working days in Britain.
- The list covers ownership, personnel, investigations, breaches, security incidents, insolvency and third-party failures.
- Materiality judgements sit with the compliance function; under-reporting is itself a breach cited in enforcement.
- The duty passes to affiliates and suppliers by contract, because their failures are the operator’s to report.
Why it matters
A regulator cannot inspect every licensee continuously, so it requires licensees to tell it when something important happens. Britain's licence conditions list the key events an operator must report within five working days, and the list is long: changes of control and of directors or key function holders, the appointment of administrators, investigations by other authorities, court proceedings, regulatory sanctions elsewhere, breaches of the anti-money-laundering rules, significant security breaches, the loss of a key supplier or payment provider, and material failures of the operator's own controls including those of its affiliates. Malta, the American states, Ontario and most European regulators have equivalents, and the lists converge on the same events.
Reporting is a compliance function's routine and a test of its judgement. Some events are obvious (a change of control); some require a decision about materiality (is this security incident significant; does this affiliate's breach reach the threshold); and the wrong call in either direction has consequences, since over-reporting wastes the regulator's attention and under-reporting is itself a breach that enforcement decisions repeatedly cite. Operators keep key-event registers, train staff to escalate candidate events, and route the decision to the compliance officer or MLRO with a record of the reasoning.
The reporting duty also travels down the supply chain by contract. Because an operator must report material failures by its affiliates, suppliers and white-label partners, its agreements require them to tell it about such failures promptly, and the affiliate compliance clauses that regulators expect to see include exactly this obligation.
Frequently asked questions
What counts as a key event?
Whatever the licence conditions list: typically changes of control and key people, insolvency events, investigations and proceedings, regulatory action elsewhere, control failures including anti-money-laundering and safer-gambling breaches, significant security incidents and loss of key suppliers.
How quickly must a key event be reported?
Within the period the licence sets. Britain requires reporting within five working days of the operator becoming aware; other regulators set similar short windows, with immediate notification for some events.
What happens if an operator fails to report a key event?
It is a breach of licence conditions in its own right, and enforcement decisions frequently cite late or missing key-event reports alongside the underlying failure, increasing the penalty.