Reporting is a control, not an administrative task
In most gambling businesses, regulatory reporting is treated as a deadline. Finance knows the return is due, someone pulls the numbers, someone else presses submit, and the matter is forgotten until next quarter. Key events are handled by whoever happens to notice one.
Regulators see it differently. Every return and every notification is a statement of fact made by the licensee to its regulator, and the regulator uses those statements to decide where to look. A wrong number in a return, or a key event reported weeks late, is not a clerical slip in their eyes. It is evidence about the quality of the licensee's controls, and in Great Britain it can be a criminal matter: the Gambling Commission's guidance on late or inaccurate regulatory returns, updated in September 2026, notes that supplying false or misleading information may be an offence under section 342 of the Gambling Act 2005, and that "correct and full submission of regulatory returns is a condition of holding a gambling licence".
This lesson treats reporting as what it is: a set of controls that can be designed, tested and evidenced like any other.
Three kinds of reporting
Almost every regulator's reporting regime has the same three components, even when they are called different things.
| Type | What triggers it | Typical examples |
|---|---|---|
| Periodic returns | The calendar | Quarterly operational and financial returns, monthly player funds reports, annual audited accounts, tax returns |
| Event notifications | Something happening | Changes of control, key staff departures, security breaches, system faults, investigations elsewhere, suspicious activity reports |
| Information on request | The regulator asking | Compliance assessment document requests, thematic surveys, data requests about specific customers |
A growing fourth type sits alongside these: continuous data feeds, where the regulator receives transaction-level data directly rather than waiting for a summary. That changes what reporting quality means, and it is covered later in this lesson.
Periodic returns
Great Britain. Licence condition 15.3.1 requires every operating licensee to submit regulatory returns. The Commission's general guidance on submitting returns sets the quarters as April to June, July to September, October to December and January to March, and states that "all returns must be submitted within 28 days of the end of the quarterly period", through the eServices portal. A licensee that holds a licence but is not trading still submits a nil return, and there is a separate return for each licence type.
Malta. The Malta Gaming Authority's Gaming Authorisations and Compliance Directive (Directive 3 of 2018, in the version dated October 2021) requires a monthly player funds report "no later than twenty (20) days following the end of the reporting month", management accounts for the first half of the financial year, and audited financial statements within 180 days of the financial year end, alongside separate auditor assurance on gaming tax, licence fees and player funds.
United States. State regimes lean heavily on accounting returns and attestation. Pennsylvania's interactive gaming internal control rules (58 Pa. Code Chapter 811a) require internal controls to be submitted for approval at least 90 days before launch and include required reports and reconciliation, with a chief financial officer's quarterly attestation that player funds have been safeguarded.
The details differ. The design questions do not. For every periodic return, someone needs to own it, the data needs a defined source, the figures need to be reconciled before submission, and a second person needs to review it against something independent.
Event notifications
Periodic returns fail because the numbers are wrong. Event notifications fail because nobody realised an event had happened, or nobody realised it was reportable, or someone realised and assumed someone else would report it.
Great Britain. Licence condition 15.2.1 requires licensees to notify key events "as soon as reasonably practicable and in any event within five working days of the licensee becoming aware of the event's occurrence". The Commission's key events guide, last updated on 28 September 2026 when the shareholding reporting threshold changed from 3% to 5%, defines a key event as "an event that could have a significant impact on the nature or structure of your business" and lists eighteen categories. They range from insolvency events and new shareholders, through changes to banking and payment processors, investigations by other regulators or law enforcement, material litigation and the submission of suspicious activity reports, to security breaches, gaming system faults that cause under or over payments, and starting or stopping trading on a domain.
A separate condition, 15.2.2, covers other reportable events "as soon as reasonably practicable", without a fixed day count, including actual or potential breaches of the money laundering offences and knowledge or reasonable suspicion that a customer has died by suicide. The Commission's information requirements guidance says that a report made after five working days must explain the reason for the delay.
Malta. Directive 3 of 2018 uses two clocks. Some matters, such as changes in qualifying shareholding, material litigation and security breaches affecting player data or locking players out of their accounts for more than twelve hours, must be notified "no later than three (3) working days after". Others, including criminal investigations and changes to key technical set-up, have a thirty-day window.
Ontario. The Alcohol and Gaming Commission of Ontario publishes an internet gaming notification matrix (version 1.5, August 2023) with three defined timeframes: immediate, 24 hours and five business days. Integrity or security problems, and failures of self-exclusion, geolocation or KYC controls, are immediate. A monthly summary of all incidents of non-compliance is also required, along with quarterly internal audit reports and board and committee minutes.
Note the overlap. The same security breach, at a business licensed in all three places, produces a five working day clock in Great Britain, a three working day clock in Malta and an immediate notification in Ontario. A multi-licence business needs a single incident process that works to the shortest clock and records every notification made.
The "becoming aware" problem
Most notification clocks start when the licensee becomes aware of the event. In practice, the licensee is a company, and the people who become aware first are rarely in compliance. Finance learns about a covenant breach. HR learns about a gross misconduct dismissal. IT learns about the outage. The MLRO's team files the suspicious activity report. Legal receives the claim form.
The regulator will usually treat the business as aware when the relevant person in the business was aware, not when the information reached the compliance team. That makes the design of the trigger network the real control.
A working trigger network has four parts:
- A trigger list per function. Each department that might learn of a reportable event receives a short list, in its own language, of what to escalate. IT's list says "any incident where customers cannot log in for more than a few hours" rather than citing condition numbers.
- A single escalation route. One mailbox or form, monitored daily, so nobody has to decide whom to tell.
- A key event log owned by compliance, recording for each event: date it occurred, date the business became aware, who became aware, date compliance was told, the decision on reportability with reasons, date reported, and the portal reference.
- A periodic sweep that checks other sources for events the network missed: board minutes, the litigation register, the SAR log, the IT incident log, the HR disciplinary log, banking correspondence.
The sweep is the part most often missing and the part that finds the failures. If a quarterly comparison of the SAR log against the key event log shows a gap, the trigger network has failed, and it is better to find that yourself.
A case that shows the cost
The Gambling Commission's March 2025 public statement on AG Communications Limited is a useful study. Among other failings, the licensee breached the key event condition between May 2023 and October 2024: it "failed to notify the Commission as soon as reasonably practicable and in any event within five working days" of submitting suspicious activity reports, and instead "submitted key event notices in batches over a period of several months at a time". The total regulatory settlement, which also addressed anti-money laundering and safer gambling failings, was £1,407,834.
Batching is a recognisable organisational habit. Someone decides it is more efficient to report a month's SARs at once, or the person who reports them only does so at month end. Each individual delay looks small. A monitoring test that compared SAR submission dates to key event dates would have found it in an afternoon.
Data quality
The numbers in a return are only as good as the data and logic that produce them, and three sources of error recur.
Definitions. A return asks for a figure defined by the regulator, such as gross gambling yield, active customers or the number of self-exclusions. The business has its own definitions for its own reporting. Where the two differ and nobody has documented the mapping, the return reports the business's number under the regulator's label.
System change. A migration, an upgrade or a new product changes how data flows. The report logic stays the same and silently produces a different answer. New Jersey's Division of Gaming Enforcement provides a clear example. In an August 2024 letter to Borgata, the Division recorded that its audit of internet promotional gaming credit deductions on the BetMGM platform, covering October 2023 to May 2024, found deductions overstated by $4,564,515, producing a gross revenue tax underpayment of $365,161. The cause was "a software upgrade by BetMGM which had the consequence of deducting PGCs in an amount greater than the amount of bonuses awarded". It was the second such finding in under eighteen months, after an earlier overstatement of $9,844,208 found in March 2023 on a different cause, and on the second occasion the Division accepted a $75,000 civil penalty in addition to the tax.
Manual adjustment. Figures pulled into a spreadsheet, adjusted, and pasted into a portal. Each step is a place for an error and none of them leaves an audit trail unless one is designed in.
The controls that address these are familiar from financial reporting: a documented definition mapping for every field, reconciliation of each return to the general ledger or the platform's own totals, a change control rule that any system change affecting a reporting data source triggers a re-test of the return logic, and a review by someone who did not prepare the figures, recorded with the date and what was checked.
When reporting becomes a data feed
Several regulators no longer rely only on returns. In the Netherlands, the Remote Gambling Act requires licensees to record game data in near real time in a separate system called the controledatabank, or CDB, which the Kansspelautoriteit can access. In August 2025 the regulator announced that it had run automated data quality checks across all active licensees and found one or more possible shortcomings at every one of them, stressing that CDB data must be current, complete, reliable and auditable. In Spain, operators maintain an internal control system, the sistema de control interno, that captures gaming operations and transactions in a defined data model the regulator can access, most recently updated by a resolution of June 2024.
A data feed changes the nature of the risk. With a quarterly return, a licensee has four chances a year to get a figure wrong and a review step before each. With a feed, every transaction is a submission, the regulator can run its own analytics on it, and an error in the feed may be visible to the regulator before it is visible to the licensee. The assurance response is to monitor the feed itself: automated completeness checks against platform totals, schema validation, alerting on gaps, and a periodic reconciliation by someone outside the team that runs it.
What late or wrong returns cost
The direct penalties for reporting failures are often modest. The consequences are not.
In April 2025 the Gambling Commission issued an industry warning notice on regulatory returns, stating that since the previous October "more than ten businesses have been fined up to £750 for not correctly completing and submitting regulatory returns within the required timeframe", and warning that "repeated breaches and persistent non-compliance is likely to result in escalating enforcement action". Its guidance on late or inaccurate returns says the Commission will contact the operator, and that if it does not receive an accurate return after contact, "or there are significant concerns around processes and controls", it may refer the matter to enforcement.
That last phrase is the real cost. A late or wrong return invites a question about processes and controls, and once the regulator is looking at processes and controls it rarely stops at the return. Reporting failures also appear as aggravating detail in larger cases, because they show a licensee that does not know what is happening in its own business.
Building the reporting control set
A licensee with a defensible reporting framework can show:
- A reporting calendar covering every periodic obligation in every licence, with owner, preparer, reviewer, data source and deadline.
- A definition map for every field in every return, linking the regulator's definition to the internal data source.
- Reconciliations filed with each return, showing the figures agree to the ledger or platform totals.
- Change control that flags any system change touching a reporting source and requires the return logic to be re-tested.
- A trigger list for each function and a single escalation route.
- A key event log recording awareness dates, decisions and submission references, including decisions not to report and why.
- A quarterly sweep of other registers against the key event log.
- Feed monitoring, where a regulator receives data directly, with completeness and quality checks that run before the regulator's do.
- Monitoring tests in the compliance programme from lesson 2 that re-perform a sample of returns and notifications against source data.
The glossary entries on regulatory returns and key event reporting summarise the terms. The next lesson moves from what the licensee reports about itself to what independent auditors and testing laboratories report about it.