Compliance
Key-Event Reporting
Last reviewed 24 September 2026
What is Key-Event Reporting?
A licence condition requiring an operator to notify its regulator within a set period of specified significant events, such as changes in ownership or key personnel, insolvency, investigations, material litigation and security breaches.
Key takeaways
- Key-event reporting requires operators to notify the regulator of listed significant events within a set period, five working days in Britain.
- The list covers ownership, key personnel, insolvency, investigations, litigation, suspicious activity reports, security breaches and gaming system faults.
- Materiality judgements sit with the compliance function; under-reporting is itself a breach cited in enforcement.
- Operators pass the duty down by contract, because some key events, such as a processor ending its service or a supplier's game fault, originate with third parties.
Why it matters
A regulator cannot inspect every licensee continuously, so it requires licensees to tell it when something important happens. Britain's licence conditions list the key events an operator must report within five working days, and the list is long: insolvency events such as administration or a winding-up petition, new shareholders of 5% or more, appointments to and departures from key positions, material changes to banking arrangements and payment processors, the grant, refusal or withdrawal of licences by other regulators, investigations by other authorities, material litigation, suspicious activity reports, security breaches that affect customer data or account access, gaming system faults that cause incorrect payouts, and the opening or closing of gambling domains, including white-label ones. A separate condition requires actual or potential breaches of the anti-money-laundering rules to be reported as soon as reasonably practicable. Malta, the American states, Ontario and most European regulators have equivalents, and the lists converge on the same events.
Reporting is a compliance function's routine and a test of its judgement. Some events are obvious (a change of control); some require a decision about materiality (is this security incident significant; is this litigation material); and the wrong call in either direction has consequences, since over-reporting wastes the regulator's attention and under-reporting is itself a breach that enforcement decisions repeatedly cite. Operators keep key-event registers, train staff to escalate candidate events, and route the decision to the compliance officer or MLRO with a record of the reasoning.
The reporting duty also travels down the supply chain by contract. Several key events can originate with third parties, such as a payment processor ending its service, a supplier's game fault that causes incorrect payouts, or a white-label partner opening or closing a domain, so operators' agreements require suppliers and partners to tell them about such events promptly.
Sources
- LCCP Condition 15.2.1: Reporting key events - Gambling Commission
- LCCP Condition 15.2.2: Other reportable events - Gambling Commission
Frequently asked questions
What counts as a key event?
Whatever the licence conditions list. In Britain that includes insolvency events, new shareholders of 5% or more, changes in key positions, material changes to banking or payment processors, action by other regulators, investigations by other authorities, material litigation, suspicious activity reports, security breaches affecting customer data or account access, gaming system faults causing incorrect payouts and the opening or closing of gambling domains. Actual or potential anti-money-laundering breaches are reported separately, as soon as reasonably practicable.
How quickly must a key event be reported?
Within the period the licence sets. Britain requires reporting within five working days of the operator becoming aware; other regulators set similar short windows, with immediate notification for some events.
What happens if an operator fails to report a key event?
It is a breach of licence conditions in its own right, and enforcement decisions frequently cite late or missing key-event reports alongside the underlying failure, increasing the penalty.