Frequently asked questions

License holders must maintain compliance with the Regulations, applicable Commission policies and the conditions of their license.

Key obligations include appointing suitable compliance and AML personnel, maintaining required technical controls and certifications, protecting players, safeguarding player funds and providing complaints and dispute resolution procedures.

You must also maintain appropriate records, submit required reports, report material incidents and cooperate with inspections and audits. Certain changes to your business, ownership or operations require prior approval.

A Compliance Officer, a Money Laundering Reporting Officer (MLRO) and a senior manager responsible for the AML/CFT/CPF framework. These, and other Key Persons, must be suitable and competent, and any appointment, resignation, removal or material change must be notified to the Commission promptly.

From the start of operations, someone suitably qualified must be responsible for compliance. For the first 6 months a suitable director may act. After that, a separate Compliance Officer must be appointed, distinct from any director with executive duties.

The MLRO must be appointed from the start of operations, must not be a director, and must have the expertise, authority, resources, independence and direct access to senior management and the board needed to do the job. The MLRO and the Compliance Officer must be different people.

The Commission may require platforms, games, random-number generators, betting systems, wallets, integrations, critical components and material changes to be tested or certified by an Approved Testing Body, and systems must meet any certification requirements it prescribes. Using a system that lacks required certification is treated as serious non-compliance.

Yes, but you need documented change-management controls and the Commission's prior approval for changes it designates as material.

Material security incidents, unauthorised access, material personal-data breaches, loss of critical data and compromise of player funds, without undue delay.

18, or higher where the law sets a higher age.

Identity and age verification, cooling-off and self-exclusion tools, deposit limits (and other limits where appropriate), accessible complaints procedures with access to ADR, clear risk information, responsible-gaming tools and monitoring, and systems to spot potential problem gambling. Detailed requirements are set out in the Responsible Gaming Policy.