When it goes wrong
Every assurance framework exists partly for the day it is not enough. A regulator finds a failing the business did not find, or the business finds one it cannot fix quietly. From that point the questions change: what powers does the regulator have, how will it decide what to do, how much does the business's own conduct affect the outcome, and what will be expected of the people in charge.
This lesson covers the enforcement process, with Great Britain as the worked example because its process and outcomes are published in unusual detail, and comparisons with other regimes. It then covers what published enforcement repeatedly finds, how remediation and lookbacks work, and the position of individuals.
The powers, in outline
In Great Britain, the Gambling Act 2005 gives the Gambling Commission a review power and a set of sanctions. Under section 116 the Commission may review a licence if it suspects a breach, suspects the licensee may be unsuitable, or "thinks that a review would be appropriate", and the section makes clear that a reason "need not relate to any suspicion or belief about the licensee's activities". After a review, section 117 allows it to give a warning, attach an additional condition, or remove or amend a condition, and other sections provide for suspension and revocation. Under section 121 it may impose a financial penalty "if the Commission thinks that a condition of the licence has been breached", having regard to the seriousness of the breach, whether the licensee "knew or ought to have known" of it, and the nature of the licensee including its financial resources.
The Commission's guidance on indicative sanctions, last updated in October 2025, sets out the range of outcomes at the end of a review: no further action, advice as to conduct, a warning, additional or amended conditions, a financial penalty, suspension, and revocation.
Other regulators have similar toolkits. Malta's Gaming Compliance and Enforcement Regulations list orders, warnings, amended licence conditions, administrative penalties, referral to the police, and suspension or cancellation. Ontario's AGCO issues monetary penalties against registrants, appealable to the Licence Appeal Tribunal. US state regulators use civil penalties, disgorgement and consent agreements: in August 2026 New Jersey's Division of Gaming Enforcement recorded a civil penalty of $251,250 and disgorgement of $45,465.38 against a sportsbook operator for responsible gaming violations, and in March 2026 the Pennsylvania Gaming Control Board approved a consent agreement fining an online operator $100,000 for insufficient procedures to prevent fraudulent account creation. The Dutch and Spanish regulators impose administrative fines through formal sanction decisions.
Regulatory settlements
Many British enforcement actions end not in an imposed penalty but in a regulatory settlement. The Commission's chapter on regulatory enforcement is careful to say that settlements "are not the same as 'out of court' settlements in the commercial context". Typical terms include an admission of the failings, a public statement, divestment of gross gambling yield or cost savings that accrued from the failings, a payment in lieu of a financial penalty, payment of the Commission's costs, and remedial procedures. The Commission "will not normally accept offers" after the licensee has made representations on its preliminary findings.
That last point shapes strategy. A licensee that wants a settlement needs to recognise the position early and engage on the facts, rather than contest everything and then seek a deal. The glossary entry on regulatory settlements summarises the mechanism.
How the amount is decided
The Commission's statement of principles for determining financial penalties, revised under an approach announced in July 2025 and effective from 10 October 2025, sets out seven steps: disgorgement of any financial benefit; a seriousness level and starting point; aggravating and mitigating factors; deterrence; a discount for early resolution; affordability; and proportionality. The starting point is a percentage of gross gambling yield, ranging from under 1% for the least serious level to between 10% and 15% for the most serious. The early resolution discount ranges from 5% to 30%, assessed case by case.
The aggravating and mitigating factors are where assurance shows up in money. Aggravating factors include repeat breaches, breaches similar to cases the Commission has already published, the involvement of senior management, and concealment. Mitigating factors include early voluntary reporting, quick remediation and co-operation. The seriousness levels themselves refer to management: a lack of oversight or awareness by middle and senior management, and significant failings in governance, are features of the higher levels.
Put together, the statement rewards exactly what this course teaches. A business that found the problem itself through monitoring, reported it promptly, fixed it quickly and can show its senior people were overseeing the area will face a materially smaller outcome than one where the regulator found it, management did not know, and similar failures had already been published.
Malta's guiding principles on enforcement measures (November 2019) follow the same logic, listing among the relevant factors the involvement of key function holders, how promptly the licensee brought the breach to the Authority's attention, remedial action and co-operation. In Spain, a 2025 sanction decision against an operator that let self-excluded players gamble shows the regulator offering two cumulative reductions of 20 per cent each, one for acknowledging responsibility and one for voluntary payment, taking a proposed €12,500 down to €7,500.
What published enforcement keeps finding
Read a run of published cases and the same themes appear, whatever the jurisdiction.
Policies that were not implemented. The Commission's £10 million penalty against Platinum Gaming Limited in October 2025 followed an earlier £2.9 million penalty in 2023, and found among other things that the risk assessment did not account for accounts previously closed over money laundering concerns. Its Director of Enforcement said that "senior leaders must take ownership of compliance outcomes and ensure lessons are embedded across the organisation, supported by structured reporting and board level oversight." In Ontario, the AGCO's $100,000 penalty against NorthStar Gaming in August 2026 concerned a player whose deposits passed the enhanced due diligence threshold in March 2024 without EDD being applied, reaching about $189,395 by June 2025. The Registrar's comment was blunt: "Anti-money laundering controls must be more than policies on paper."
Controls that were never tested. The Commission's 2019 to 2020 compliance and enforcement report listed safer gambling policies that had "never been tested for effectiveness", operators that "do not follow their own policies and procedures", and "a lack of rigorous senior management oversight".
Failures at the boundary of the business. Supply chains and partners appear increasingly. The Commission's £4.75 million settlement with Evolution Malta Holding Limited in July 2026 concerned weaknesses in its money laundering risk assessment and oversight of supply chain risk, after its games appeared on unlicensed websites accessed by consumers in Great Britain.
Duty of care failures detected by data. The Dutch regulator's €886,000 fine on 711 B.V., published in June 2026, related to failures in the duty of care to protect players between February 2022 and June 2024.
Repetition. A striking number of large cases involve a licensee that had been sanctioned before, or that repeated failings described in earlier published cases. Regulators publish cases so that the whole industry learns from them, and they treat a failure to learn as aggravating.
The thread running through all of them is the assurance gap: something the business believed it was doing was not being done, and nobody inside the business found out first.
Remediation plans
Almost every serious outcome comes with remediation requirements, and these are where the business spends most of its money and management time.
The British cases show the pattern. The Commission's £17 million outcome against Entain in August 2022 added licence conditions requiring a board member to oversee an improvement plan and a third-party audit of compliance within twelve months. The Platinum Gaming outcome required a third-party independent audit, an internal investigation with regular updates to the Commission, and board-level oversight. Third-party audits appear in many recent settlements and penalties.
A remediation plan that a regulator will accept has the same features as any good action plan, under more pressure:
- It addresses causes. If the finding was that enhanced due diligence was not applied, the plan must say why: thresholds wrongly set, alerts not generated, alerts generated and not worked, staff not trained, capacity insufficient. Each cause needs its own action.
- It is owned at the top. A named senior individual, often a board member, accountable for delivery.
- It has milestones and evidence. Each action has a date and a defined piece of evidence that shows it is complete.
- It is independently validated. Closure is tested by someone other than the people who did the work, and where a third-party audit is required, the auditor's scope covers whether the remediation worked.
- It reports honestly. Progress updates to the regulator say what is late and why. Discovering at the audit that the plan was not delivered is far worse than reporting the slippage.
Lookbacks
A lookback is a review of the past population affected by a control failure, to find and put right the individual cases the failure caused. If a deposit limit failed for six weeks after a migration, fixing the system stops new harm; the lookback identifies every customer who exceeded a limit in those six weeks and decides what to do for each of them.
Lookbacks are standard in financial services, where the UK Financial Conduct Authority can commission a skilled person review under section 166 of the Financial Services and Markets Act 2000 and require the firm to pay for it. Gambling regulators' published outcomes refer more often to third-party audits than to lookbacks by name, but the logic applies wherever a control has failed for a period. A credible lookback defines the affected population and period precisely, applies the correct control retrospectively to each case, decides on outcomes (customer contact, refunds, account restrictions, suspicious activity reports, key event notifications), documents each decision, and has the method and a sample of decisions checked independently.
The worked example in lesson 2, where a push notification service missed the self-exclusion flag after a release, ended with a lookback for that reason. A fix without a lookback leaves the harm already done unaddressed and unknown.
A self-reported failure, step by step
Consider a hypothetical operator whose own monitoring finds, in March, that for seven weeks after a payments release the deposit limit check did not apply to one payment method. The sequence that best protects the business, and its customers, runs as follows.
- Contain. Fix the check, confirm the fix with a test, and record when the failure started and stopped.
- Assess reportability. Decide, the same week, whether the failure is notifiable under the licence conditions in each market, record the decision and the reasoning, and notify where required within the shortest clock.
- Size the problem. Define the affected population: every customer who deposited above a set limit by that method in the period.
- Look back. Review each affected customer, decide what is owed to them, and act.
- Find the cause. Ask why the release was not tested against the limit control, and change the release process, not only the code.
- Report and validate. Report the failure, the lookback and the root cause fix to the board committee, and have the closure independently tested.
Measured against the penalty framework above, that sequence supplies the mitigating factors: early voluntary reporting, quick remediation and co-operation. The same failure found by a regulator months later, with no lookback and no root cause fix, supplies the aggravating ones.
The individuals
Enforcement against a business increasingly comes with scrutiny of the people who ran it.
In Great Britain, holders of specified management offices need a personal management licence, which under changes effective from 29 November 2024 extended to the chief executive, the board chair and the person responsible for anti-money laundering, except at small-scale operators, alongside heads of finance, compliance, marketing and gambling IT under licence condition 1.2.1. The personal licence conditions require holders to take all reasonable steps to ensure the way they carry out their responsibilities does not place the operator in breach of its licence conditions. The glossary entry on the personal management licence summarises the regime.
Personal licences can be reviewed and sanctioned. The Commission's 2020 to 2021 compliance and enforcement report opened its section on personal licence reviews by observing that businesses do not make decisions, people do, and recorded ten revocations (eight personal functional and two personal management licences), eleven warnings, one warning with conditions, twenty-one advice as to conduct and ten surrenders in that year. The issues identified in that casework read like an assurance checklist: "repeated instances of a lack of adequate documentation and audit trails to demonstrate properly informed decision making", reporting delays or failures to report key events, MLROs "allowing commercial considerations to override AML/CTF obligations", and "insufficient strategic oversight" of the money laundering risk assessment.
Other regimes reach individuals differently. Malta approves key function holders and treats their involvement as a factor in enforcement. In financial services, the FCA's Senior Managers and Certification Regime aims to make individuals "more accountable for their conduct and competence", and gambling regulators' language on senior accountability increasingly echoes it.
The most severe example of governance failure in the sector remains the Victorian Royal Commission into the Casino Operator and Licence, which reported in October 2021 that Crown Melbourne's board "failed to carry out one of its prime responsibilities; namely, to ensure that the organisation satisfied its legal and regulatory obligations", and that either the board was not told what was going on or it "fell asleep at the wheel". Its remedy placed a special manager over the casino's operations for two years.
What an individual needs to be able to show
For a personal licence holder, MLRO or senior manager, the protection is the same evidence the business needs, held personally:
- What you were responsible for, in writing.
- What information you received about it, and when.
- What you asked for when that information was incomplete.
- What you decided, and why, recorded at the time.
- What you escalated, to whom, and what happened.
A senior individual who can show those five things has a defence that rests on facts. One who cannot will find that the absence of records is itself the finding. The final lesson turns to the governance that produces those records as a matter of routine.