The UK Gambling Act Review: Implementation Status and Operator Obligations

The review of the UK Gambling Act 2005 has moved out of consultation and into licence conditions. Most measures trailed in the April 2023 white paper now sit in the LCCP, the remote technical standards or secondary legislation, while the outstanding ones carry dates in 2026 and 2027. For compliance teams the baseline keeps shifting: what read as guidance two years ago is enforceable today, and two further deadlines fall before the end of this year.

Where the Gambling Act Review Stands Three Years On

High stakes: gambling reform for the digital age was published on 27 April 2023 and grouped its proposals under six themes, covering online protections, marketing and advertising, the Gambling Commission’s powers and resources, dispute resolution and consumer redress, children and young adults, and land-based gambling. The stated ambition was to deliver most of the package by summer 2024.

Implementation of the gambling white paper slowed after the general election on 4 July 2024, because a large share of it required parliamentary time for secondary legislation. Activity resumed in November 2024, when DCMS published its initial response on the statutory levy and confirmed its approach to slots stake limits. Two statutory instruments were signed on 25 February 2025, and from that point the schedule held.

The regulator now treats delivery as close to complete. Its business plan for 2026 to 2027 describes the programme as approaching the end of its planned implementation, with attention moving to evaluation and to embedding what is already in force. The underlying architecture has not changed: every new provision is drafted to serve one of the three UKGC licensing objectives rather than to sit alongside them, which is why the changes appear as amendments to the LCCP and the technical standards rather than as a new statute.

Which White Paper Measures Already Bind Licensees

The measures below are in force as at August 2026, with the instrument carrying each one.

Measure	Instrument	Effective
Extended personal management licence coverage for CEO, board chair and AML lead	Licence condition 1.2.1	29 November 2024
Security audits aligned to ISO 27001:2022	Remote technical standards	31 October 2024
Light touch financial vulnerability checks at £500 net deposits	SR Code 3.4.4	30 August 2024
Vulnerability check threshold reduced to £150 net deposits	SR Code 3.4.4	28 February 2025
Remote game design changes covering speed, autoplay and display	Remote technical standards	17 January 2025
Removal of the voluntary research, prevention and treatment contribution	SR Code 3.1.1	31 March 2025
Statutory levy on operating licence holders	Gambling Levy Regulations 2025	6 April 2025
Online slots stake cap of £5 per game cycle	Operating Licence Conditions Amendment Regulations 2025	9 April 2025
Lower cap of £2 for customers under 25	Operating Licence Conditions Amendment Regulations 2025	21 May 2025
Direct marketing consent by product and by channel	SR Code 5.1.12	1 May 2025
Revised statement of principles for financial penalties	Commission policy	10 October 2025
Prompt to set a financial limit and customer funds reminders	RTS 12 and licence condition 4.2.1	31 October 2025
Wagering cap of 10 times and ban on mixed product incentives	SR Code 5.1.1	19 January 2026

Two entries carry disproportionate operational weight. The reduction to £150 on 28 February 2025 changed the volume of accounts entering review queues rather than the nature of the check. The changes on 19 January 2026 rewrote how promotional offers may be constructed, which affects product, marketing and legal functions at the same time.

Stake Limits and Game Design Rules for Online Slots

The Gambling Act 2005 (Operating Licence Conditions) (Amendment) Regulations 2025 were made on 25 February 2025 and attach a condition to every remote casino operating licence, including licences issued before the regulation came into force. The maximum stake limit for online slots games is £2 per game cycle where the customer is under 25 and £5 where the customer is 25 or over. Between 9 April 2025 and 21 May 2025 the higher figure applied to all adults, after which the lower tier took effect for the younger cohort.

The condition reaches slots only. Roulette, blackjack and other casino products fall outside it, a scoping point that is regularly misread in internal control documentation. The Commission published guidance on 30 January 2025 and updated it on 16 June 2025, including worked examples of how the limit applies across multi-cycle games.

Separately, the remote technical standards changed on 17 January 2025:

• a minimum of 5 seconds between the start of one game cycle and the start of the next for non-slot casino games
• display of net spend and elapsed time during a session
• removal of autoplay across all online gambling products
• removal of features permitting several games to be played simultaneously
• removal of turbo and quick spin style features that shorten the time to a result
• no celebratory audio or visual effects for returns at or below the amount staked

Each of these alters the certified build rather than the presentation layer alone, so RNG certification obligations attach at game level and re-testing follows any material update. Operators inheriting games from third-party studios carry the same exposure as those building in house, because the licence condition sits with the operator.

How the Statutory Levy Is Calculated and When It Falls Due

The Gambling Levy Regulations 2025 came into force on 6 April 2025 and replaced the voluntary contribution arrangement previously required by the LCCP. The statutory levy payable by gambling operators is charged on the previous financial year’s gross gambling yield as declared in regulatory returns, at a rate that varies by licensed activity.

Rate	Applies to
1.1%	Remote operators and gambling software licences
0.5%	Land-based casinos and land-based betting
0.2%	On-course bookmakers, adult gaming centres and land-based bingo
0.1%	Family entertainment centres, pool betting and machine technical licences
0.1%	Society and local authority lotteries, charged on proceeds retained after prizes and good causes, and external lottery managers on fees less prizes

Invoices are issued on 1 September and payment is due in full before 1 October each year, with no instalments and no payment before the invoice arrives. Nothing is payable where the calculated figure is £10 or less, and the National Lottery is outside the scheme entirely. The first period ran from 1 July 2024 to 31 March 2025 and was multiplied by one and one third to annualise a nine-month window. DCMS has reported that the first year raised just under £120 million.

Distribution is fixed rather than discretionary: 20% to research through UK Research and Innovation, 30% to prevention through the Office for Health Improvement and Disparities and the Scottish and Welsh Governments, and 50% to treatment through NHS England and the devolved administrations. DCMS publishes an annual report on levy finances.

Payment is a licence requirement rather than a commercial arrangement, and non-payment can put the licence itself in question. That is why licence status verification under GICNT-LS is framed as a recurring exercise rather than a single check performed at onboarding.

From Vulnerability Checks to Financial Risk Assessments

Two mechanisms are routinely conflated in industry commentary. Light touch vulnerability checks have applied since 30 August 2024 under SR Code 3.4.4, first at net deposits above £500 in a rolling 30-day period and then at £150 from 28 February 2025. They rely on publicly available data such as county court judgments and bankruptcy records, and the Commission confirmed they do not require operators to weigh personal details such as postcode or job title.

Financial risk assessments are a different instrument and were only settled on 7 July 2026, when the Commission confirmed a staged introduction following a three-stage pilot. Pilot data indicated that fewer than 3% of active accounts would trigger an assessment, that roughly 97% of those could be completed with no customer action, and that fewer than 1 in 1,000 accounts would need an alternative route such as open banking or documents.

Stage	Customers aged 25 and over	Higher risk groups including under 25s
Stage one	Net deposits above £5,000 in a rolling 24 hours	Net deposits above £2,500 in a rolling 24 hours
Interim stages	To be set through implementation groups	To be set through implementation groups
Final stage	Above £1,000 in a rolling 24 hours or £3,000 over a rolling 90 days	Above £750 in a rolling 24 hours or £2,000 over a rolling 90 days

Stage one applies to the largest operators and the commencement date has not been published; the Commission said it would confirm the timetable after working through implementation groups established over the summer. It also confirmed that during the early stages no enforcement action will follow a failure to act on the outcome of an assessment, while every other licence requirement continues to apply in the usual way.

That concession is narrower than it first appears. An assessment that surfaces financial difficulty feeds directly into customer interaction duties, so the documented response to markers of harm remains the live exposure even while the assessment regime is bedding in. Marketing suppression for flagged accounts sits in the same place.

Deposit Limit Rules Change Again on 30 September 2026

The deposit limit requirements for online gambling accounts arrived in two phases. The first took effect on 31 October 2025 and governs the customer journey:

• customers must be prompted to set a financial limit at registration or before the first deposit
• limits must be offered as free text rather than as a menu of preset amounts
• a request to reduce a limit must be actioned as soon as practicable, and the customer told when it takes effect
• customers must be reminded every six months to review their account and transaction information
• operators whose customer funds carry a not protected rating must repeat that warning every six months, with the customer acknowledging it before those funds can be used

The second phase was due on 30 June 2026 and was deferred on 26 May 2026 to 30 September 2026 to give operators further development time. From that date RTS 12B changes what the term itself means:

• only a gross limit, capping total deposits across a set period, may be labelled a deposit limit
• gross deposit limits must be offered as a minimum and given at least equal prominence to stake, loss or net deposit limits
• only gross deposit limits may be offered over fixed time frames, while other limit types may use rolling or fixed periods
• where a customer sets several limits at once, the most restrictive governs
• the system must block further deposits once a limit is reached until the period restarts or the customer raises it, subject to a 24-hour cooling off period
• spend limits are renamed stake limits, loss limits are redefined, and a net deposit limit is added as a permitted type

One housekeeping point matters for anyone building to the specification. The annex published on 7 October 2025 contained errors and was reissued, and any copy saved before 22 May 2026 should be discarded. Set against the wider picture of responsible gambling tool mandates, the British position is now prescriptive about how a limit behaves, not merely about whether one is offered.

Wagering Caps and Mixed Product Promotions Under SR Code 5.1.1

Since 19 January 2026 two prohibitions have sat in SR Code 5.1.1. Wagering requirements applied to bonus funds may not exceed 10 times, and a single incentive may not include more than one type of gambling product drawn from betting, casino, bingo and lottery. The Commission also deleted the earlier provision on benefits tied to a predetermined length or frequency of play, and retained the restriction on altering the value of an incentive where the qualifying spend is reached early.

The mixing ban catches construction rather than wording, and the Commission published worked examples in December 2025:

• a £5 qualifying bet earning a free bet is compliant, because activity and prize sit in the same category
• a £5 qualifying bet earning free spins is not, because the prize crosses into a different product
• a prize combining a free bet with free spins is not, whatever the qualifying activity was
• bonus credit the customer may spend on any licensed product, with no operator restriction on category, is compliant
• a daily reward game offering a mixed pool of prizes is not, even where no stake was required to enter

Terms remain the second exposure. Wagering conditions, game exclusions and expiry have to be clear, fair and accessible before an offer is accepted, which is where bonus terms disclosure under GICNT-FP and the LCCP requirements converge on the same evidence.

Marketing Consent, Sponsorship and What Advertising Teams Must Document

Advertising rules for gambling operators in the UK changed less through statute than through consent mechanics. SR Code 5.1.12 has applied since 1 May 2025 and requires opt-in on a per product and per channel basis, with selection boxes presented unticked. Where an existing customer’s preferences do not match that structure, they must be re-set on first log-in before the customer can gamble again. Soft opt-in is no longer available to remote licensees, which removes cross-selling between verticals as a default marketing route.

Sponsorship moved on a voluntary track. Premier League clubs agreed in April 2023, after consultation with DCMS, to withdraw gambling brands from the front of matchday shirts, and that agreement took effect for the 2026/27 season. Its scope is narrow: sleeves, training kit, pitchside advertising and other club partnerships are untouched, and the English Football League has not adopted the same restriction.

GICNT-AM is reviewed on complaint rather than on a fixed cycle, which places the burden on records: which creative ran, on which channel, against which consent state, and with what responsible gambling messaging attached. Operators running affiliate programmes across several territories should expect the same evidence to be requested wherever gambling advertising codes diverge, since liability for partner output follows the operator.

What Has Not Been Delivered and What Comes Next

Several strands remain open, and three of them are financial rather than behavioural.

• The Gambling Ombudsman, a non-statutory body intended to handle social responsibility complaints, was expected to take cases from summer 2024 and has still not been established, leaving alternative dispute resolution providers and the courts as the available routes.
• DCMS consulted on Commission fees between 27 January 2026 and 30 March 2026, received 47 responses and confirmed on 30 June 2026 a headline 25% increase from 1 October 2026. Society lottery fees are frozen, and fees for general betting (limited) licences move to a basis reflecting gross gambling yield rather than days of operation.
• Remote gaming duty rose from 21% to 40% on 1 April 2026, bingo duty was abolished on the same date, and a 25% remote rate within general betting duty applies from 1 April 2027, with remote bets on UK horseracing remaining at 15%. These provisions sit in the Finance Act 2026 rather than in gambling legislation.
• The response to the January 2025 consultation on gaming machine technical standards is still outstanding, and DCMS consulted separately on category D machines and bingo premises from 15 October 2025.
• DCMS and the Commission commissioned NatCen to evaluate a subset of the reforms; the evaluation plan was published in December 2024 and a further update followed on 17 February 2026.
• The Commission opened a call for industry proposals on reducing regulatory burden on 26 June 2026, closing 25 September 2026. White paper measures are expressly excluded from its scope, so it is not a route to reopen stake limits or incentive rules.

Cumulative cost is the through line. Fee uplift, duty increases and the levy all landed within eighteen months of each other, and their combined effect on operating models is a more plausible driver of structural change over the next two years than any single conduct provision. Reading changes across major markets alongside the British timeline is the practical way to test whether the same sequencing is emerging elsewhere.

Mapping the Reforms to GICNT-PP and GICNT-AM

The framework does not duplicate British law. It sets a floor that travels across jurisdictions, and in several areas that floor is already met by an operator holding a Great Britain licence.

Control area	British requirement	Framework position
Limit setting	Prompt before first deposit since 31 October 2025; gross deposit limits from 30 September 2026	GICNT-PP requires deposit limits and reality checks in every market served, including those with no statutory equivalent
Harm detection	Vulnerability checks at £150 net deposits; financial risk assessments introduced in stages	GICNT-PP requires documented intervention thresholds and an audit trail for each interaction, assessed twice yearly
Incentive design	Wagering capped at 10 times; one product type per incentive	GICNT-FP requires wagering terms to be disclosed before the offer is accepted, in plain language and without qualification elsewhere
Marketing consent	Opt-in by product and by channel under SR Code 5.1.12	GICNT-AM requires responsible gambling messaging in all material and prohibits targeting of minors and vulnerable groups, reviewed on complaint
Self-exclusion	Participation in the national scheme is a licence condition	GICNT-PP requires integration with a national register where one exists and an operator-level scheme where none does

Certification does not replace a licence and no part of the framework displaces the LCCP. Where the two diverge, player protection requirements apply as the higher standard in markets whose local rules stop short of the British position, which is the point of a single internal control set for operators running several licences.