This week, the Gambling Commission confirmed that Financial Risk Assessments (FRAs) will be introduced, albeit in staged form. After years of consultation, a delayed Board decision, and a pilot beset by unresolved issues, the Commission has pressed ahead. Operators now face the task of preparing for another new compliance requirement that comes with significant unresolved questions.

This is a moment that demands clear-eyed analysis – not simply of whether FRAs are a good idea, but of what impact they actually have in practice, and whether the Commission's approach is proportionate to the environment in which this scheme now operates.

What are the expectations?

The staged implementation will begin with the largest remote operators, triggering FRAs where customers exceed £5,000 in net deposits over a rolling 24-hour period; for under-25s the trigger is £2,500. Once fully implemented "in due course", those thresholds drop considerably: to £1,000 in net deposits over a 24-hour period (or £3,000 over 90 days) for customers aged 25 and over, and to £750 per 24 hours (or £2,000 over 90 days) for those under 25.

Assessments will be conducted via Credit Reference Agencies (CRAs), and, according to the Commission, will have no impact on the customer's credit score. The Commission has also stated that no enforcement action will be taken against operators who fail to act on an FRA result during the early stages of rollout, though all other existing licence conditions continue to apply.

In terms of what FRAs require in practice, the Commission vaguely states that it will "back operators to take appropriate proportionate action, considering everything they know about the customer" – with options ranging from reducing marketing to supporting customers to set deposit limits or more where needed. Whilst this appears to be a sensible statement of intent, there are still fundamental questions about data reliability, consumer impact, and practical implementation that remain unresolved. The Commission has itself acknowledged that CRA outputs can differ between agencies for the same customer, and operators will receive only an overall assessment accompanied by four data points: defaults, multiple arrears, significant arrears, and the existence of a Debt Management Plan. Operators are therefore expected to make decisions that could materially affect customer relationships on the basis of information they cannot fully interrogate and that the Commission concedes is not entirely consistent.

The Commission's commitment not to take enforcement action for a failure to act following an FRA during the early stages represents a common sense approach. However, operators must still comply with all other existing licence requirements, and the Commission will continue to conduct compliance assessments against those requirements. The Commission has consistently maintained that FRAs are a distinct and more targeted tool, focused solely on identifying customers in financial difficulties rather than assessing what any given customer can or cannot spend. Many operators will find that distinction difficult to maintain in practice, given the Commission's historic track record of applying affordability-related expectations during regulatory enforcement action despite there being no formal regulatory basis to do so. Any sensible operator will be thinking carefully about how the information gathered from an FRA should be taken into account when discharging its other regulatory obligations, principally wider social responsibility requirements and AML obligations (where applicable), as the Commission will undoubtedly expect operators to take such information into account when dealing with a customer.

Frictionless or are document checks necessary?

Speaking at the Ethical Gambling Forum in April, Tim Miller said about FRAs, "… in 2026 it can't be right that this still leads to some operators asking consumers to share bank statements and other financial documentation. Such an approach is outdated, inconsistent and disproportionate." He went on to state that one of the advantages of the FRA framework is that it would allow the Commission to give "clear guidance to operators that they should not require consumers to provide documents to assess financial risk following a financial risk assessment." However, the Commission's FRA blog post on 7 July is explicit that some customers may not be assessable through a frictionless CRA check, and that for these customers this "might mean assessing financial risk through other processes such as open banking or document checks."

These two positions are in direct tension: on one hand, document checks are contemplated as a legitimate fallback for customers who are not assessable through an FRA; on the other, the regulator suggests such checks are disproportionate and that the FRA framework should effectively end the practice. Operators would be well advised to keep track of how many instances of failed FRAs they encounter so that they can help the Commission understand the true scale of this issue. In the meantime, operators will need to resolve this contradiction themselves and take decisions based on all the other information available to them about the customer in question (and of course, record the rationale for those decisions).

Staged implementation plan

While the industry will quite reasonably question the decision to implement at all, especially in the absence of full published findings from the pilot, the staged approach carries several genuine benefits for operators: an initial scope limited to the largest operators and at thresholds higher than those which will eventually apply; time to prepare; and the Commission's commitment that no enforcement action will follow a failure to act on an FRA result during early rollout.

We suggest that operators make use of this time to gather feedback and analyse data on their use of FRAs, including any challenges in implementing them, and what effect the use of FRAs has on their customer base. It will be particularly interesting to know, for example, whether the data shows that FRAs identify (and therefore provide protection to) a raft of customers who would not otherwise have been captured by existing SR and AML requirements (where applicable) and the operator's own compliance framework. This feedback will be crucial if operators are to meaningfully influence the forthcoming guidance on what constitutes proportionate action (whilst leaving scope in any appropriate areas for operator discretion) and how CRA outputs should be interpreted. It will also help the Commission to evaluate the success of FRAs and to determine if they are indeed a proportionate response to the issue they believe to be addressing.

Another burden on an already pressured sector

It is worth pausing for a moment to consider the environment in which this decision lands. As we commented in May, the cumulative compliance and cost burden on licensed operators today is substantially greater than when FRAs were first conceived. Since 2023, the sector has absorbed wave after wave of regulatory reform; Remote Gaming Duty has nearly doubled to 40 per cent; a statutory levy is now in force; and increased licence fees are expected later this year. FRAs arrive not as a standalone measure but as yet another layer on top of a regulatory stack that has fundamentally changed the economics of operating a licensed business in Great Britain.

Against that backdrop, the Commission's decision to press ahead without publishing an updated assessment of the cumulative impact of all these changes – let alone the expected incremental impact of FRAs in the current environment – is a significant omission. The White Paper's estimated Gross Gambling Yield (GGY) reduction of between £380 million and £710 million as a result of 'Financial Risk Checks' was produced in a very different economic setting. The real figure today could be materially higher, with consequences not just for operators but for the broader ecosystem – including the sports and racing industries that depend on the health of the licensed betting sector.

Good regulation demands that the case for any new obligation be assessed against the system as it stands, not as it stood three years ago. That assessment has not been made public, and the Commission's willingness to proceed without it is difficult to reconcile with the principles of proportionate, evidence-based regulation.

What operators should do now

Operators should not wait for formal guidance before progressing their FRA compliance preparation:

First, begin mapping your existing customer interaction framework against the FRA trigger points. The Commission has been clear that FRAs are in addition to, not a replacement for, existing customer interaction obligations. An FRA flag, and the information gathered from it, will need to be considered alongside the information operators already hold about a customer.
Second, document your decision-making. Whatever action you take, or do not take, following an FRA result and the ability to demonstrate that you applied a coherent, evidence-based, and outcomes-focused process will be critical in any future compliance or enforcement context.
Finally, engage with the implementation group process. This is the mechanism through which operators have the best opportunity to shape the guidance that will determine what &q...

Latest from Mishcon de Reya

Message History

Delivery option(s)