The regulator as an auditor with powers
A regulator's compliance assessment looks like an audit. There is a scope, a document request, interviews, sampling and a report with findings. The difference is what happens next. An internal auditor's finding goes on a tracker. A regulator's finding can become a licence review, a financial penalty, a change to licence conditions or, in the worst case, the end of the business.
That changes how a licensee should approach the process, though not in the way many assume. The instinct under scrutiny is to defend: say as little as possible, present the business in the best light, contest every point. Experienced compliance practitioners mostly argue the opposite, and the regulators' own published material explains why. This lesson covers how assessments work, what regulators look for, and the behaviour that helps and hurts.
How often, and why you were chosen
Regulators allocate inspection effort by risk, and most say so. The Gambling Commission's chapter on assessing risk, part of its licensing, compliance and enforcement policy statement, describes impact in terms of customer base, premises, turnover or gaming yield, and likelihood partly in terms of management integrity and competence, governance and compliance history. Its chapter on compliance states that "the frequency and focus of assessments, including visits, is based on the risk assessment of the licensee".
The volume of activity is substantial and has been rising. The Commission's annual report for 2023 to 2024 recorded 122 compliance assessments of online and land-based operators and 182 security audits. Its annual report for 2024 to 2025, published in October 2025, recorded "over 9,700 compliance activities undertaken, compared to over 4,200 in the previous year", a broader measure that includes lighter-touch work. In Malta, the MGA reported in its 2025 annual report announcement that it concluded 15 full-scope compliance audits and 109 thematic reviews in 2025, alongside AML compliance examinations carried out with the Financial Intelligence Analysis Unit.
An assessment can also be triggered by something specific: a complaint, a pattern in returns, a key event, media coverage, intelligence from another regulator, or a thematic review of an issue across the sector. A licensee that understands why it was selected can usually predict what the assessors will focus on.
Forms of assessment
The forms vary by regulator, but most regimes use a combination of the following.
Desk-based review. The regulator requests documents and data and reviews them remotely. Often the first stage of a larger assessment, and sometimes the whole of it.
Remote assessment. The Commission's compliance chapter describes remote assessments that may request "sight of documents and records held by the licensee, including customer records and the audit trail in relation to customer accounts", conducted by video and telephone.
On-site visit. Assessors attend premises, observe operations, interview staff and examine systems. The Commission may give advance notice but states that "assessment visits may be made without prior notice". Land-based operators, with premises that can be walked into, should assume an unannounced visit is always possible.
Thematic review. The regulator examines one issue across many licensees, such as customer interaction, source of funds or affiliate controls. Individual findings may be less severe, but the published summary becomes the benchmark everyone is measured against.
Formal investigation. Where the regulator suspects a breach, the process moves from assessment to investigation, with stronger powers and higher stakes. Malta's Gaming Compliance and Enforcement Regulations distinguish a compliance review from a formal investigation, and make it an offence for the authorised person to fail to provide required information "or to otherwise hinder the Authority's investigation or to neglect to collaborate therewith".
Data analytics. Where the regulator receives transaction-level data, as in the Netherlands and Spain (see lesson 3), much of the assessment may happen before anyone contacts the licensee.
Regulators also gather information from others. The Maltese regulations allow the MGA to request information from third parties that provide services to the licensee "without requiring the consent of the authorised person and with or without informing the authorised person". Payment providers, platform suppliers and affiliates may be telling the regulator things about you that you have not told it yourself.
What the assessors actually do
The method is consistent across regimes and close to the one described for internal monitoring in lesson 2.
They start from obligations. The assessor works from the licence conditions and codes, not from your policies. Your policy is evidence of design. Whether it maps to every obligation is the first question.
They follow customers. Expect requests for complete histories of named customers: registration, verification, deposits, play, interactions, restrictions, source of funds documents, and the reasoning recorded at each decision point. The customers selected are rarely random. They are usually high spenders, rapid losers, customers with complaints, or customers flagged in data the regulator already holds.
They test the gap between policy and practice. If the policy says enhanced due diligence is triggered at a threshold, they find customers who crossed it and check whether it happened, when, and what was concluded. If the policy says a customer interaction follows a defined set of markers of harm, they find customers who showed those markers and check the response.
They interview. Assessors speak to senior management, personal licence holders, the MLRO, the head of compliance and front-line staff. The questions to front-line staff are often the most revealing: what would you do if a customer said this, who would you escalate to, when did you last receive training on it.
They look at governance. Board and committee minutes, management information, the compliance monitoring plan and results, internal audit reports, and the remediation tracker. The question is whether senior people knew about the issues the assessors are finding, and what they did.
The outcome in Great Britain is rated on the scale set out in the compliance chapter: compliant, where the licensee "is unlikely to pose a risk to the licensing objectives"; improvement required, where it "has not met some of the minimum requirements"; and serious failings, involving "substantial risk to the licensing objectives, or significant concerns about the licensee's suitability". In the last case the licensee is placed in special measures and invited to "submit and agree an urgent action plan to rectify the regulatory failings identified".
The results are not a formality. In a November 2024 speech, the Commission's chief executive reported that of assessments in April to June 2024, 42 per cent came back good or satisfactory on consumer protection requirements, leaving nearly 60 per cent with improvement required or significant failings, while July to September 2024 produced 75 per cent good or satisfactory and 25 per cent with significant failings. He attributed part of the volatility to new customer interaction requirements and to targeting of higher-risk operators.
When an assessment becomes enforcement
Several recent enforcement cases in Great Britain began as routine compliance work. The £825,000 penalty against Done Brothers (Cash Betting) Limited, announced in December 2025, followed a 2024 compliance assessment that found, among other things, that the operator's income-inquiry thresholds were not risk-based. The June 2026 public statement on Petfre (Gibraltar) Limited records that a compliance assessment in May and June 2024 led to a licence review and a £900,000 payment in lieu of a financial penalty.
The lesson is not that assessments are traps. It is that an assessment is an evidence-gathering exercise whose output may later be used in enforcement, and the licensee should treat every answer and every document as if it might be read in that context.
A request log in practice
Consider a hypothetical remote operator that receives a desk-based assessment letter on a Monday asking, within ten working days, for its ML/TF risk assessment, its customer interaction policy, the last four quarters of compliance committee minutes, its monitoring results for safer gambling, and complete account histories for fifteen named customers.
A coordinator opens a request log the same day, with one line per item: what was asked, the owner, the internal deadline (two days before the external one, to leave time for review), the source system, and the status. The customer histories are the hard part. Each needs registration and verification records, transaction history, interaction notes, any source of funds documents and the reasoning recorded at each decision. Pulling them reveals that two customers had enhanced due diligence triggered weeks later than the policy requires.
The coordinator does not hide that, and does not quietly add notes to the files. The submission includes the histories exactly as they stood, a short covering note identifying the two delays, the cause found (an alert routed to a queue that was not being worked during a staffing gap), and the action already taken. The assessor will find the delays either way. What the licensee controls is whether the assessor also finds that it knew and said nothing.
Behaviour that helps
The Commission's general principles for licensing and regulation state that it expects licensees to "work with the Commission in an open and co-operative way", and that the Commission will use "the least intrusive regulatory tool to achieve compliance". Co-operation is also an explicit mitigating factor in how penalties are calculated, which lesson 6 covers. Practically, it looks like this:
- One coordinator, a request log, and deadlines met. Every request recorded with date, owner and response date. Late responses are noticed and remembered.
- Complete and accurate answers. If a document does not exist, say so. If an answer is uncertain, say that and follow up. Never guess.
- Raw data where asked. Provide system extracts rather than curated summaries, and explain any limitations in the data.
- Senior people available. Personal licence holders and the board should be accessible and should know the subject. Assessors notice when the most senior person in the room cannot answer questions about controls they are accountable for.
- Known issues disclosed. If your own monitoring has found a problem the assessors have not reached yet, tell them, with the remediation plan. Self-identified problems with credible plans are treated very differently from problems the regulator finds.
- Factual corrections made early. Correct errors of fact during the assessment, with evidence, rather than waiting for the draft report.
Behaviour that hurts
The opposite list is shorter and more damaging.
Manufacturing evidence. Malta's Financial Intelligence Analysis Unit published a notice in July 2026 imposing an administrative penalty of €80,907 on Goldwin Ltd, a remote gaming operator, following a compliance examination in 2022. Among the findings, customer risk assessments made available to the examiners for the sampled player profiles "had been prepared solely for the purposes of the compliance examination". The notice also records that the operator's later policy updates and internal audit exercise did "not negate the material shortcomings" found at the time. Documents created after a request arrives, presented as if they existed before, are usually detectable from metadata, and once detected they transform the regulator's view of everything else.
Coaching that becomes scripting. Preparing staff to explain their role is sensible. Rehearsing answers that do not reflect what they actually do produces interviews that collapse at the first follow-up question.
Delay and drip-feeding. Releasing documents slowly, or answering only the narrowest reading of each request, signals that the licensee is managing the regulator rather than co-operating with it.
Arguing intention. Explaining what the business meant to do, rather than what it did, is as unpersuasive to an assessor as it is to an advertising adjudicator.
Treating the assessment as a negotiation. In its 2019 to 2020 compliance and enforcement report, the Commission's then chief executive criticised settlement proposals approached "as if a licence review is a commercial dispute to be negotiated". The same instinct during an assessment does the same damage.
Preparing without waiting for the letter
The best preparation for a regulatory assessment is the assurance framework from the earlier lessons, operating normally. A licensee with a current obligations register, a working monitoring programme, accurate returns and a remediation tracker has most of what an assessor will ask for already.
A short readiness routine fills the gaps:
- A standing document pack: organisation chart, personal licence holders, policies with version history, risk assessments, the obligations register, the compliance monitoring plan and recent results, internal audit reports, board and committee minutes covering compliance, and the remediation tracker. Kept current, not assembled under pressure.
- A mock customer file review: once a quarter, select five customers the way a regulator would (highest spenders, fastest losers, recent complainants) and assemble their complete history. Time how long it takes and record what is missing.
- Front-line conversations: ask a sample of staff the questions an assessor would ask. Use the answers to fix training, not to write scripts.
- A designated coordinator and deputy, with a request log template and authority to obtain information from any part of the business quickly.
- A rehearsal for senior people: the CEO, chair and other personal licence holders should be able to describe the business's main compliance risks, the controls, recent findings and the remediation status without notes.
After the report
When the report arrives, the response matters as much as the assessment.
Read it for the cause behind each finding, not only the condition. Agree an action plan that addresses causes, with named owners and realistic dates, and submit it on time. Put every action into the same tracker as internal findings and validate closure independently. Report progress as agreed, and if a date will be missed, say so before it passes, with the reason and a new date.
Where you disagree with a finding, say so clearly and with evidence, once. Then fix what you can. A regulator returning a year later will check whether the actions were completed and whether they worked, and a repeated finding is far more serious than an original one. The Law and Compliance course covers the licensing frameworks these assessments sit within, and the regulatory map lists the regulator for each market.