From a duty to a model
Regulators have expected operators to identify and protect customers at risk of harm for two decades (Britain's Gambling Act 2005 made protecting children and other vulnerable persons from being harmed or exploited by gambling a licensing objective), but until the 2020s the requirement was largely met with rules and human judgement: a deposit above a threshold, a support agent noticing distress. Britain's Commission has since observed that many operators used deposit or loss thresholds as a main or sole prompt for an interaction, often set at inappropriately high levels. That has changed. Britain's customer-interaction rules, the Dutch duty of care, Ontario's standards and New Jersey's data-driven responsible gaming initiative, launched in January 2023, now expect operators to monitor behaviour continuously across a defined set of indicators, to act in proportion to the risk, and to evaluate whether the action worked, at a volume no team can handle by hand. The answer is a model: a system that scores each account for markers of harm and prioritises the interactions. This lesson covers what such a model does, how it is built, what regulators expect of it, and where the hard questions are.
What the model predicts
The target is contested and matters. Three definitions are in use. Behavioural harm markers: the indicators regulators list (in Britain seven required categories: spend, patterns of spend, time spent gambling, gambling behaviour such as chasing losses, customer-led contact, use of gambling management tools, and account indicators such as failed deposits or failing to withdraw winnings), combined into a score. Future events that proxy harm: self-exclusion, a complaint of harm, a request for help, a chargeback citing gambling, account closure with a harm reason. Validated screens: scores on instruments such as the Problem Gambling Severity Index, a nine-item screen developed for general-population surveys, obtained from a sample of customers who complete a survey and used to label the behaviour of everyone else. The first is transparent and directly maps to the rules; the second gives a model something concrete to predict but is rare and late; the third is the closest to a direct measure of problem gambling, though the PGSI is a survey instrument rather than a clinical diagnosis, and it depends on a sample that may not represent the base. Operators use combinations, and the choice of target is the first thing a regulator or auditor will ask about.
Features and architecture
The features are the account's behaviour over time: deposits and their trend, withdrawals and cancellations, stakes and their escalation, session timing and duration, product mix and moves to higher-volatility products, limit changes, promotional response, payment declines, support contacts and their content, and, where the operator has it, affordability information. Real-time features (this session's stakes against the customer's norm) matter as much as historical ones, because the interaction that regulators expect is one that happens during the session in which harm is showing. Britain's guidance calls for real or near time monitoring to identify harmful behaviour as it occurs, and since 2024 the Dutch regulator has required operators to detect, analyse and act on a signal of excessive play within one hour, around the clock. A 2026 British settlement shows the cost of batch processing: one operator did not identify a customer who staked over £215,000 in a day until a report was produced the following day. The architecture is therefore a streaming one: events scored as they arrive, a risk score maintained per account, thresholds and rules that trigger interactions, and a record of every score, trigger, action and outcome for the audit trail.
Interactions and evaluation
A score is only useful if something happens. The interaction ladder runs from automated messages (a safer-gambling prompt, a reality check, a suggested limit) through personal contact (a call or email from a trained team), to imposed measures (a limit, a cooling-off, a suspension) and, where the market requires it, an affordability or source-of-funds check. The model prioritises which accounts get which rung, and the rules set the floor: certain markers must trigger certain actions regardless of the score, and certain customers warrant earlier action: Britain's Commission treats young adults aged 18 to 24 as more vulnerable to gambling harm, and the Dutch affordability check applies from €300 a month for them, against €700 for older players.
Evaluation is the hard part and the part regulators now examine. Did the interaction reduce the behaviour? Operators measure the change in deposits, session length and markers after an interaction, ideally against a comparison group. In Britain they must be able to demonstrate the outcomes of their evaluation to the Commission, keep the interaction log defined for their regulatory returns, and, as good practice, follow up a sample of customers with problem gambling screens. The ethical constraint on evaluation is that randomised holdouts of at-risk customers, the cleanest method, mean deliberately not interacting with some people showing harm; the alternative the British guidance points to is trialling different approaches to interaction and comparing them, which in practice means varying the form and timing of an interaction rather than whether it happens.
What regulators expect
The expectations have converged across markets and are specific enough to audit against.
Coverage. All customers, all products, all channels, in real time or near it, with the regulator's listed indicators as a minimum. Britain requires monitoring from the point an account is opened and adds a backstop: interactions with at least as large a share of customers as the problem gambling rate for the products offered.
Proportionality. Action scaled to risk, with escalation for repeat or severe markers, and documented thresholds.
Evidence. A record of scores, triggers, actions and outcomes per customer that the regulator can inspect, and aggregate reporting in returns.
Evaluation. Measurement of whether interactions work, with adjustments where they do not.
Explainability. The ability to say why a customer was flagged, to the customer where appropriate and to the regulator always; opaque models are a compliance risk in themselves. Britain requires automated action on strong indicators of harm to be manually reviewed case by case, and the customer to be able to contest any automated decision that affects them.
Primacy. Protection scores applied before commercial ones: no promotion, no reactivation, no VIP treatment for a customer the harm model has flagged, with the suppression audited. Britain prohibits marketing and new bonus offers where strong indicators of harm have been identified, and Ontario bars marketing that is knowingly communicated or sent to high-risk players.
Governance. A named owner, documented methodology, validation, monitoring for drift and bias, and board-level reporting. Drift and bias monitoring come from general model-risk practice rather than gambling rules, but Ontario requires responsible gambling policies to be reviewed and evaluated regularly for effectiveness. Britain's Commission, the Dutch authority and Ontario's regulator have each published guidance or standards covering most of these expectations, and enforcement cases have turned on their absence: the 2026 British settlement cited above, £609,104, listed controls that failed to capture and flag high deposits, high-velocity sessions and escalating stakes.
The single customer view
A customer at risk may hold accounts with several operators, and no single operator sees the whole picture. Britain's answer to the Commission's 2020 single customer view challenge is GamProtect, an industry scheme launched to the wider industry in September 2024, by which point it was already live with the four largest operator groups after a pilot: when an operator closes an account because the customer has self-declared a very serious marker of harm, it shares a flag, without further detail, that other participating operators can match against their own customers. Participation is voluntary, although the Commission has said a mandated solution could be considered if take-up does not grow. Germany's LUGAS limit file enforces a cross-operator monthly deposit limit centrally under section 6c of the 2021 State Treaty, normally no higher than €1,000; and in the Netherlands deposit limits and the regulator's affordability thresholds are applied by each operator to its own accounts. The single customer view is the logical end-point of harm modelling, and it raises data-protection questions, which in Britain were worked through in an Information Commissioner's Office regulatory sandbox, and competition questions; lesson six covers both.
Hard questions
Several problems remain open and an honest course says so. False positives impose friction on customers who are not at risk, and friction can push some customers towards unlicensed sites; the trade-off is set by the regulator's tolerance and the operator's, and neither has a settled number. Bias: models trained on operator data reflect which customers were flagged before, and may under-detect harm in groups whose behaviour differs from the historical flagged population. Gaming: customers learn what triggers checks and adapt. Commercial conflict: the operator building the harm model also profits from the customers it flags, and the model's thresholds are set by that operator; independent validation and regulator inspection are the answer offered, and the debate about whether that is enough continues. And the most fundamental: behavioural markers are proxies for harm, not measurements of it, and a model that optimises the proxies may or may not reduce the harm.
What to take from this lesson
Player-protection models score accounts for markers of harm in real time and prioritise interactions, replacing threshold rules and manual judgement at volumes regulators now require. The prediction target (behavioural markers, proxy events or validated screens) is contested and matters. The architecture is streaming, the interactions run on a ladder from prompts to imposed measures, and evaluation measures behaviour change after interaction. Regulators expect coverage, proportionality, evidence, evaluation, explainability, primacy over commercial models and governance. Cross-operator systems (Britain's single customer view, Germany's LUGAS) are the end-point. False positives, bias, gaming, commercial conflict and the gap between proxies and harm remain open.