Detecting Markers of Harm: Player Interaction Requirements

Markers of harm in gambling are the behavioural, financial and account-level signals that a customer may be losing control. Two supervisors have pushed hardest on what operators must do once those signals appear: the Gambling Commission in Great Britain and the Kansspelautoriteit, the Dutch gambling authority. Both expect detection, proportionate action and a written record, on defined timescales, rather than a policy that describes good intentions.

What Counts as a Marker of Harm in Online Gambling

Regulators have moved away from open-ended wording. Social Responsibility Code Provision 3.4.3 of the Licence Conditions and Codes of Practice sets seven categories of indicator that a British remote licensee must monitor as a minimum, and the Commission is explicit that the list is a floor rather than a complete set. Certification against player protection requirements takes the same position: an operator documents its own library of the indicators of harm that player monitoring must cover, justifies each threshold against its product mix, and shows that the library is reviewed as the portfolio changes.

The mandatory categories, and the kinds of behaviour placed under each of them, break down as follows.

Indicator category	Behaviour placed in scope	Primary data source
Customer spend	Amounts staked and deposited, spend measured against the rest of the customer base, affordability context	Payment and wallet records
Patterns of spend	Binge episodes, clustering around payday, escalating deposit levels	Deposit history
Time spent gambling	Session length, overnight play, rising session frequency	Session logs
Gambling behaviour	Chasing losses, play across multiple products, erratic staking, high in-play volume, heavy staking after a large win	Wagering data
Customer-led contact	Complaints about not winning, expressions of anger, requests for bonuses after losses, disclosure of difficulty	Support tickets and chat transcripts
Use of gambling management tools	Raising limits, previous self-exclusion, repeated time-outs, refusal to set limits, limits set so high they have no effect	Account settings history
Account indicators	Failed deposits, multiple payment methods, pre-paid cards and e-wallets, winnings never withdrawn, evasive replies to information requests	Payments and verification records

Two points inside that list are routinely missed. Time spent gambling became a required category, but the Commission declined to fix a numerical threshold for it, leaving each licensee to set and justify its own against the products it offers. And a strong indicator is not necessarily an accumulation of weak ones: a single behaviour, if pronounced or unusual enough, can carry that weight on its own.

How the Gambling Commission Frames Customer Interaction Under SR Code 3.4.3

The customer interaction requirements that online gambling licensees must meet in Great Britain are built around three linked elements: identify, act and evaluate. Most of provision 3.4.3 took effect on 12 September 2022. Paragraph 10, which bars marketing and new bonus offers once strong indicators of harm are present, followed on 12 February 2023. The duty to take the Commission’s formal guidance into account, along with the vulnerability requirement in paragraph 3, applied from 31 October 2023, which is also the date the current version of that guidance came into force.

Several features of the provision shape system design more than the indicator list does. Monitoring runs from the moment an account is opened, so a licensee cannot wait for a baseline pattern to form before treating behaviour as unusual. Overnight and weekend play must receive the same protection as daytime play, which in practice forces automation. Where a licensee contracts with a third-party supplier for part of the gambling facilities, paragraph 6 leaves responsibility for account-level monitoring with the licensee itself. Paragraph 14 adds a volume backstop: the share of customers receiving an interaction should be at least the published problem gambling rate for the activities offered, weighted by gross gambling yield where more than one product is run. All of it sits underneath the UKGC licensing objectives the rulebook exists to deliver.

Financial Thresholds That Trigger a Check in Great Britain

Money is the one area where Great Britain has fixed numbers. Social Responsibility Code Provision 3.4.4 requires a financial vulnerability check once deposits minus withdrawals pass a set figure in a rolling 30-day window. The threshold was GBP 500 between 30 August 2024 and 27 February 2025, and has been GBP 150 since 28 February 2025. The check itself is narrow: a public-record search for a bankruptcy order, county court judgment, individual voluntary arrangement, high court judgment, administration order or debt relief order, or the local equivalent. It does not need repeating if a check or a financial risk assessment was carried out on that customer within the previous 12 months.

The compliance weight sits in the second half of the provision. The licensee must weigh the result against everything else it knows about the customer, take proportionate action where risk appears, and record the reasoning behind that decision. A clean public-record result is not a finding that the customer is safe, and treating it as one is how files fail review.

Financial risk assessments are the separate, deeper measure that came out of the Gambling Act Review. After a pilot and an analysis phase, the Commission Board decided on 7 July 2026 to proceed with staged implementation, with the start date for the first stage to be confirmed in a formal consultation response. The thresholds at which a safer gambling intervention of this kind becomes mandatory are set out below. Anyone tracking Gambling Act Review implementation should build for the final figures rather than the opening ones, because the gap between them is wide.

Stage	Customers aged 25 and over	Higher-risk groups, including customers under 25
Stage 1	Net deposits above GBP 5,000 in a rolling 24-hour period	Net deposits above GBP 2,500 in a rolling 24-hour period
Interim stages	To be set after engagement with implementation groups	To be set after engagement with implementation groups
Final stage	Above GBP 1,000 in a rolling 24-hour period, or above GBP 3,000 across a rolling 90 days	Above GBP 750 in a rolling 24-hour period, or above GBP 2,000 across a rolling 90 days

The Commission estimates that fewer than 3% of active accounts would trigger an assessment once the measure is fully in place, and has confirmed that no enforcement action will follow a failure to act on an assessment during the early stages of roll-out, provided existing requirements are still met.

Dutch Duty of Care Sets a One-Hour Detection Window

The duty of care Dutch gambling operators owe, the zorgplicht, is drafted more tightly on timing than anything in the British rulebook. Under the Beleidsregel verantwoord spelen 2024, the responsible play policy rule published in the Staatscourant on 3 June 2024, a licensee must detect, analyse and act on a signal or reasonable suspicion of excessive participation within a maximum of one hour. That obligation runs 24 hours a day, seven days a week. Real-time monitoring for gambling harm is therefore not a design preference in the Dutch market; it is the only way to meet the stated window.

The financial articles of the policy rule, together with the verification duty attached to them, were deferred to allow for system changes and took effect on 1 October 2024. They set a net deposit ceiling per calendar month of EUR 700 for players aged 24 and over and EUR 300 for players aged 18 to 23. Above that figure the licensee carries out a draagkrachttoets, an affordability assessment, before further deposits are permitted, and blocks deposits for the remainder of the month where the assessment does not support them. The assessment must rest on verifiable documents such as payslips or tax returns. Income from loans and tax rebates does not count, and a bonus exclusion of at least 30 days follows a breach of the ceiling.

A second instrument runs alongside it. The Regeling speellimieten en bewuster speelgedrag, the regulation on play limits and more conscious play behaviour, also in force from 1 October 2024, requires a contact moment with addiction-prevention trained staff before a player sets a monthly deposit limit above EUR 350, or above EUR 150 for players under 24. It also mandates a neutral limit-setting interface with empty input fields and no promotional content, a session pop-up every 30 minutes, and display of all amounts in euros rather than tokens or chips.

Supervision has not been light. In July 2026 the Ksa updated its published good and bad practices for affordability assessments after sampling 20 licensees, reporting ten improvement discussions, three warnings and one binding instruction arising from that work. Operators weighing the KOA licensing regime should read the evidentiary standard in that document as the working benchmark, not as commentary.

Intervention Triggers Compared Across Four Regulated Markets

No two markets define the trigger the same way, which matters for any operator running one monitoring platform across several licences. Sweden is the instructive outlier: Spelinspektionen licensing and Spelpaus rest on a statutory duty of care with no monetary trigger written into it at all, and that drafting choice has had consequences in court.

Market	Legal basis	Expected detection timing	Financial trigger
Great Britain	SR Code 3.4.3 and 3.4.4 of the LCCP	Monitoring from account opening, automated action on strong indicators	GBP 150 net deposits per rolling 30 days
Netherlands	Zorgplicht under the Koa framework, Beleidsregel verantwoord spelen 2024	Detect, analyse and act within one hour, 24 hours a day	EUR 700 net deposits per calendar month, EUR 300 for players aged 18 to 23
Sweden	Omsorgsplikt, Chapter 14 section 1 of the Spellagen (2018:1138)	Continuous monitoring of play behaviour, described in a filed action plan	None specified in statute
Germany	Glücksspielstaatsvertrag 2021 (GlüStV 2021), early detection under section 6i, Safe Server reporting	Continuous automated detection, short-term account block available	Cross-operator deposit limit of EUR 1,000 per calendar month under section 6c, monitored through the LUGAS limit file

The practical consequence is that a single global threshold set will fail somewhere. A platform tuned to the British 30-day window will miss the Dutch calendar-month calculation, and a Dutch deposit block does not discharge the British obligation to act on time and behaviour indicators that have nothing to do with deposits.

Escalating Action in Proportion to the Indicators Observed

Paragraph 9 of SR Code 3.4.3 requires action to be tailored to the number and level of indicators exhibited, and names five bands of response. Escalation has to work in both directions: gradual where indicators build slowly, and immediate where a serious concern appears at the outset, including straight after registration.

• Early tailored action: prompts to use gambling management tools, feedback on spend and behaviour, backstop limits while checks are under way, enhanced monitoring.
• Medium tailored action: telephone interaction, targeted encouragement to reconsider behaviour, signposting to support, restrictions on direct marketing.
• Medium-strong action: requiring the customer to set a spend limit, reducing the range of products visible to that customer.
• Strong action: blocking direct marketing and new bonus offers, setting spend limits or a time-out on the customer’s behalf.
• Very strong action: refusing service and ending the business relationship.

Two constraints sit on top of the ladder. Paragraph 10 makes the marketing and bonus block mandatory rather than discretionary once strong indicators of harm, as defined in the licensee’s own processes, have been identified, and the restriction should extend across product types and, where relevant, across the group. Paragraph 11 requires automation for that response, with a manual review of how the automated process operated in each individual case and a route for the customer to contest the decision. The responsible gambling tool mandates imposed on the customer-facing side supply most of the raw material these actions draw on.

Documenting Player Interaction So the File Survives an Audit

Player interaction documentation is where compliance cases are usually won or lost. The Commission’s guidance asks licensees to record every action and interaction, including those that were delayed or did not take place, with the reason and the follow-up. Its regulatory returns guidance sets a minimum content standard for the interaction log:

• an identifier for the customer involved
• the behaviour or activity that prompted the interaction
• the action taken, and any advice or support offered
• the outcome of the interaction

Evaluation has to be evidenced separately. Paragraph 12 requires the licensee to understand the effect of each interaction on subsequent behaviour and continued risk. Paragraph 13 requires evaluation of the overall approach, including trialling different methods, measuring impact and demonstrating outcomes to the regulator. The Dutch position is narrower but stricter in one respect: the calculation behind a raised net deposit ceiling must be retained, with supporting documents, until it is replaced by a more recent assessment.

Under GICNT-PP, which carries a bi-annual audit, the interaction file is the primary evidence reviewed. Gaps in it are treated as control failures rather than administrative untidiness, because an undocumented interaction and an interaction that never happened look identical to an assessor. Retention schedules should be aligned to the GICNT audit cycles that apply across an operator’s certified domains.

What Recent Enforcement Reveals About Detection Failures

On 30 June 2026 the Gambling Commission published a regulatory settlement under which Petfre (Gibraltar) Limited, the operator of betfred.com, agreed to pay GBP 900,000 in lieu of a financial penalty, plus the cost of the investigation. The breaches concerned paragraphs 1, 2, 4, 7 and 11 of SR Code 3.4.3 between 31 October 2023 and 24 June 2024. Three findings repay close reading:

• insufficient automated processes to identify indicators of harm including spend, patterns of spend and time spent gambling
• no process to ensure immediate automated action where strong indicators of harm had been identified
• a rule under which an account flagged for a safer gambling review would not be flagged again for a further seven days, during which one customer lost GBP 17,900 inside 24 hours without a further interaction

The Swedish record shows the opposite failure mode. Spelinspektionen issued Svenska Spel Sport & Casino AB with a warning and a sanction fee of SEK 100 million on 25 March 2024 for duty of care shortcomings. The administrative court in Linköping set that decision aside on 2 June 2025, holding that the rules in force during the 2021 review period were too vague to found a sanction of that size, and the regulator appealed to the administrative court of appeal in Jönköping on 18 June 2025. The conclusion for compliance teams is not that duty of care is unenforceable. It is that the enforceable version is the one written down as thresholds, timescales and records, which is exactly the direction British and Dutch drafting has taken. The same pattern is visible across iGaming enforcement actions in the mature markets.