The question behind the argument
Behavioural data tells you a customer's play has changed. It does not tell you whether they can afford it. Two customers depositing the same amount each month can be in entirely different positions, and nothing in the gambling data distinguishes them.
Financial risk assessment is the attempt to close that gap. It is the most contested area in responsible gambling, it has produced more industry opposition than any other measure, and the argument is frequently conducted with both sides talking past each other. You need to be able to state it properly.
The principle attracts broad agreement: an operator should not knowingly take money from someone who cannot afford to lose it. The implementation is where the disagreement lives, and it is a real disagreement rather than a manufactured one.
Why gambling is unusual here
Other consumer credit and financial services sectors assess affordability as a matter of routine, and the gambling sector's discomfort with it is partly a legacy of having been treated as ordinary retail.
Three features make gambling different in ways that cut against the sector's position.
Losses are structurally certain over time. A customer who plays indefinitely will lose in expectation. This is not a risk that may materialise; it is the product's design. Selling a product with a certain expected loss to someone who cannot bear it is a different proposition from selling them a television.
Revenue concentration is extreme. In most online operators, a very small share of customers generates a very large share of revenue. Whatever the causes, that concentration means the commercial interest sits squarely on high-spending accounts, and a subset of those accounts belongs to people spending more than they can bear.
The customer's own judgement is compromised by the thing being assessed. Self-reported affordability from a person experiencing harm is unreliable in a specific, documented way, which is precisely why the previous lesson ended where it did.
Against those, one feature cuts the other way, and it is legitimate. Gambling is discretionary entertainment, and a person of ordinary means is entitled to spend their own money on it without being required to justify themselves. Any framework has to accommodate that without becoming a means test on leisure.
The evidence available
Operators have several sources, each with real limits.
Declared income. Cheap, instant, unverified. Useful as a first filter and worthless as a basis for a serious decision, because the customer with the strongest reason to overstate is the customer the check exists for.
Open banking. With the customer's consent, a direct view of transactions: income, outgoings, existing credit, and gambling spend with other operators. This is by far the richest source and the only one that closes the cross-operator blind spot. Its limitation is consent, which introduces selection: customers who decline are not a random sample.
Credit reference data. Bureau checks can indicate insolvency, county court judgments, defaults and, at more detailed levels, credit utilisation. Available without ongoing consent in some jurisdictions through soft searches. It describes credit behaviour, which correlates with financial difficulty but is not a measure of disposable income, and it is backward-looking.
Documentary evidence. Payslips, bank statements, tax returns, evidence of asset sales or inheritance. The most robust and the most intrusive, and the source most likely to end the customer relationship at the point of request.
Publicly available and inferred indicators. Postcode-level affluence data, occupation, age. Weak individually and prone to producing decisions that are indefensible when explained to the individual concerned, because the individual is not the average of their postcode.
The operator's own data. Declined deposits, multiple payment instruments added in succession, deposits from credit-adjacent sources, and cancelled withdrawals. These are behavioural markers that carry genuine financial information, they are free, and they are the most underused source in the list.
Proportionality: the framework that actually works
The workable design is a tiered one, in which the intrusiveness of the check scales with the level of spend and the strength of the risk signal. Every jurisdiction that has implemented something in this area has converged on a version of this shape.
Tier one: no check. Ordinary spend levels, no adverse behavioural markers. The overwhelming majority of customers sit here and should experience nothing. A framework that puts friction in front of a customer spending a small amount each month has failed on its own terms and has also spent political capital it will need later.
Tier two: frictionless background checks. At moderate spend, or on a behavioural trigger, run checks that require nothing from the customer: bureau indicators of insolvency or default, internal markers, and any data already held. The customer is unaware unless something is found. This tier does most of the useful work and is where the sector's investment has concentrated, for good reason.
Tier three: customer-facing assessment. At higher spend, or where a background check has surfaced something, ask the customer. Open banking consent, declared income with some corroboration, or a documented conversation. Friction is real here and it should be reserved for cases that justify it.
Tier four: evidence required before continuing. At very high spend, or where earlier tiers indicated financial difficulty, require documented evidence. Play is restricted until it is provided.
Two design points make or break the framework. Thresholds must be set against something defensible, not chosen for their revenue consequences, and the reasoning must be written down before the numbers are picked. And the check must be capable of producing a "no" that is acted on; a process where every customer eventually passes is a process that exists to be shown to a regulator rather than to protect anyone.
Where it overlaps with source of funds, and where it does not
These two are routinely confused, including by people who run both.
Source of funds is an anti-money-laundering control. It asks where the money came from, and its purpose is to establish that the funds are not the proceeds of crime. The concern is the money's origin. The obligation arises from financial crime regulation, and the remedy for an unsatisfactory answer includes a suspicious activity report and, in some cases, an obligation not to tip off the customer.
Affordability, or financial risk assessment, is a consumer protection control. It asks whether the customer can bear the loss, and its purpose is to prevent harm. The concern is the money's sufficiency. The obligation arises from responsible gambling regulation, and the remedy is restriction or refusal.
The evidence overlaps substantially, which is why the confusion persists. A bank statement serves both. A conversation about income serves both. But the questions differ, the legal bases differ, the thresholds differ, and the consequences of a failure differ. An operator running one process and labelling it both will satisfy neither regulator properly, and it will make errors in the direction of whichever discipline owns the team.
The specific trap: a customer who can clearly afford their play and whose funds are of unexplained origin is an AML matter, not a responsible gambling one. A customer whose funds are plainly legitimate salary and who is spending more than that salary is a responsible gambling matter, not an AML one. Both processes must be able to reach those conclusions independently.
The objections, taken seriously
The industry's arguments against intrusive checks are not all self-serving, and dismissing them wholesale is both unfair and tactically weak.
Displacement. A customer refused or frustrated by a licensed operator may move to an unlicensed one with no controls, no limits and no self-exclusion. This is real, it has been observed, and its size is genuinely disputed. The honest response is that it is a reason to design checks that are proportionate and frictionless where possible, not a reason to have none. An operator invoking displacement should be able to describe what it does to make its own experience the better option.
Privacy and dignity. Being asked to produce payslips to place a bet is intrusive in a way that has no parallel in other leisure spending. This objection has real force and it is the reason tiering exists.
Inconsistency across operators. Where each operator sets its own thresholds, a customer refused by one proceeds to another, and the market-wide effect is much smaller than the per-operator effort suggests. This is a genuine argument for a consistent standard rather than for no standard, and it is one of the stronger cases for central data sharing.
Error costs. A customer wrongly assessed as unable to afford their play experiences a real harm of a different kind, and the data sources available produce errors at meaningful rates.
The blunt-threshold problem. Any fixed monetary threshold treats a low earner and a high earner identically at the same number, which makes it simultaneously too strict for one and too lenient for the other.
What the objections do not support is inaction. They support better design, proportionality, consistency and evidence, and an operator making them while doing nothing is making them in bad faith.
What good looks like
Several things distinguish a credible financial risk framework from a performative one.
The thresholds are written down with reasoning, and the reasoning is not commercial. Somebody outside the revenue line signed them off.
The checks produce refusals. There is a measurable number of customers restricted or refused as a result, and it is not zero.
The customer's own account is weighed, not deferred to. A customer who says they can afford it and whose evidence says otherwise is resolved on evidence.
Checks repeat. A customer verified once at a given level is reassessed when their spend or behaviour changes, because circumstances change and the original assessment expires.
Refusal is handled properly. A customer told they cannot continue is told why, given support information, and not passed to a retention campaign. The most damaging pattern available is a customer restricted for affordability and then re-engaged by a marketing system that never heard about it.
The friction is measured. The operator knows how many customers abandoned at each tier, and treats that as a design input rather than an argument against checking.
The direction of travel
Wherever a mature regulator has looked at this, the movement has been the same: from no check, to a check at very high spend only, to frictionless background checks at moderate spend with customer-facing assessment reserved for the tail. Implementation details, thresholds and data sources vary considerably between jurisdictions and change over time, so the operative requirement is always the current rules of the market you are in rather than any general description.
What is stable is the underlying expectation. An operator that took a very large amount of money from a customer without ever forming a view on whether they could afford it has no answer when asked why not, and "the customer told us it was fine" is not an answer. That expectation is now sufficiently settled that designing around it, rather than against it, is the only durable position.