Money lending prevention measures. In the UK, licensed casinos take appropriate measures to prevent organized money lending between customers on their premises. Similarly, if money lending appears to be commercial and/or connected to ML activity, online casinos must be prepared to report such cases to the Gambling Commission.
11 X BetThe UK Gambling Commission has recently made onboarding and verification of clients even stricter. Without successful verification, casinos can neither allow users to deposit money, nor grant them access to free-to-play games, free bets, or bonuses.
5. Fundamental gambling/casino KYC requirements
In most jurisdictions online casinos are obliged to conduct a Know Your Customer (KYC) procedure as part of the local AML regulations. KYC requirements for casinos differ from one jurisdiction to another, but usually they include the following:
6. Responsible gambling guidelines—from underage gambling to marketing ethics
Gambling is only fun when done sensibly; otherwise, it becomes dangerous. To make sure gamblers and gamers are not at risk, regulators demand that online casinos and betting shops keep up with responsible gambling requirements.
This also concerns video games. In 2019 video game firms faced the risk of prosecution in the UK over gambling by children, with such products as skins and loot boxes in Counter-Strike and Call of Duty. Skins are in-game items that can be won in the game, while loot boxes invite players to pay a certain amount for a mystery reward. Such items aren’t defined as gambling under English law, due to the fact that the in-game items cannot be exchanged for cash within the game. However, they can still be bought and traded with real money on other sites, and acquiring them may involve an element of chance, similar to placing a bet. The UK’s Gambling Commission said it is prepared to regulate this when the proper legislation is introduced.
According to the UK’s Gambling Act 2005, it is illegal to permit any person under the age of 18 to enter a licensed gambling premises. Yet, a 2019 study conducted by GambleAware and the University of Bristol shows that 50% of 17-year-olds living in the UK are gambling on a regular basis. To protect themselves from underage gamblers and related regulatory fines, online casinos must ensure that new players submit their official IDs for verification to comply with casino KYC requirements.
The legal age for gambling varies across countries; most set it at 18, while in Greece and in most US states it’s 21. In Malta, the age is much higher, at 25 for locals. While Portugal has complicated laws, with different age requirements depending on the institution.
Controls for detecting problematic gambling behavior
An important aspect of responsible gambling is being able to stop damaging behavior before it seriously affects a player. Therefore, online casinos have to be on the lookout for warning signs. This means implementing three specific measures for detecting gambling addiction.
When onboarding players, online casinos must check if their names appear on self-excluded lists. If so, the casino must bar them from entry. Self-excluded lists may belong to a specific casino or be part of broader, national self-restriction schemes, such as GAMSTOP in the UK.
Ongoing monitoring and addictive gambling triggers
Detecting the signs of gambling addiction is an ongoing process, lasting throughout the customer lifecycle. Addictive behavior can manifest itself on multiple occasions, such as when players chase losses, play high stakes, or show erratic gambling patterns. Once problematic behavior is detected, online casinos must restrict the affected player from their service and, ideally, direct them towards help.
When checking sources of funds/wealth for casino AML compliance, casinos must analyze whether a player displays behavioral patterns associated with problem gambling. For example, a warning sign could be when a person spends €3k ($3.1k) every month, while earning only €2k ($2.1k).
Casinos should have special programs to enable players to protect themselves
Access limiting. Users can restrict their gambling activity to the amount of hours they consider appropriate.
Activity alerts. Notify users if they have been playing for too long. What’s considered ‘too long’ is also determined by the player. Some countries, like Sweden, make these alerts mandatory for all players.
Deposit limits. Players put a certain limit on their deposit amounts in order to stick to their budgets and avoid overspending.
11 X BetTime-outs. Users have the option to put their accounts on temporary hiatus for an amount of time that works best for them.
Nationwide self-exclusion. Users enter their name onto a national self-exclusion list to block themselves from accessing any gambling website in their country.In the UK, for instance, all online casinos are required to have GAMSTOP membership.
Permanent self-exclusion. Players can block themselves from an online casino forever and irreversibly, requesting to cease any contact and no longer receive marketing promotions.
There are many more initiatives that countries can take to protect their nationals. Denmark, for example, requires all online gamblers to pass an online test revealing if they are addicted to gambling.
During the COVID-19 pandemic, regulatory measures have toughened worldwide in a bid to further protect problem gamblers. For instance, Sweden imposed a weekly deposit limit of 5k SEK ($493) and the UK issued strengthened its guidance in response to data showing that players are spending more of their time and money on gambling.
Online casinos must avoid targeting vulnerable groups, such as children, teenagers, or self-excluded players. Similarly, gambling can’t be normalized through sponsorship of sports or any other medium that could be associated with youth culture.
These marketing restrictions can also affect the timing of casino advertisements. For example, new rules for online gambling platforms in Germany forbid ads between 6 am and 9 pm. The UK is also ready to introduce curbs on advertising, given findings that 96% of 11-24 year olds in the UK had been exposed to gambling ads in February 2020, leading them to place bets soon after.
These marketing restrictions can also affect the timing of casino advertisements. For example, new rules for online gambling platforms in Germany forbid ads between 6 am and 9 pm. The UK is also ready to introduce curbs on advertising, given findings that 96% of 11-24 year olds in the UK had been exposed to gambling ads in February 2020, leading them to place bets soon after.
In September 2020, the UK made it mandatory to teach students about online gambling risks at school. The same is expected of online casinos, who must educate users on the dangers of gambling through videos, blog posts, webinars, and other initiatives aimed at raising gambling addiction awareness.
7. Key security standards and practices
Fraud has become a real menace for the gambling industry, with schemes like bonus hunting, multi-accounting, account takeovers and illicit chargebacks on the rise.
enforce age verification requirements without slowing down the onboarding process.
Online casinos already have to deal with criminals attempting to steal unprotected data. Worse yet, data can be leaked due to poor management and frequent turnover of staff. That’s why online casinos must implement appropriate controls aimed at protecting players from unnecessary risk.
1) Information Security Management System (ISMS)
An Information Security Management System (ISMS) is a set of procedures to systematically manage a company’s sensitive data. The goal of an ISMS is to reduce risk and ensure business continuity by preemptively limiting the impact of a security breach.
In most online gaming jurisdictions, information security requirements are based on the ISO/IEC 27001:2013 standard, which specifies the requirements for establishing, implementing, and improving an ISMS within the entity.
ISO/IEC 27001:2013 lies at the heart of an Information Security Management System, since its main focus lies on the integrity, availability and confidentiality of sensitive company information. At the same time it covers information backup, along with access control, disaster recovery, incident management procedures, the security of the software cycle and network security controls, and security in supplier relationships. ISMS helps gambling and betting operators minimize security breaches and cyber attacks while reducing the costs associated with keeping information safe. If online casinos are ISO/IEC 27001 certified, jurisdictions such as Colombia, Denmark, Great Britain, the Czech Republic, Greece, Portugal, Romania, Spain, Sweden and Switzerland waive certain security auditing requirements if the company decides to operate abroad.