GICNT-PP: Player Protection and Responsible Gambling Requirements

Requirements for player protection and responsible gambling now differ so sharply between licensed markets that one operator can run the same platform under several incompatible limit regimes. GICNT-PP sets a single baseline across all of them. The domain covers self-exclusion, financial limits, session controls, harm detection and the placement of support resources, and it is reassessed on a bi-annual cycle rather than the annual review used elsewhere in the framework.

What GICNT-PP Requires of a Certified Operator

GICNT-PP is a mandatory domain and its controls are assessed as a set, not item by item. A deposit limit that resets on a rolling basis is worth little when the reality check timer restarts as soon as the player switches game, and an exclusion that blocks login while leaving the marketing list untouched fails the same test twice. The six compliance domains each carry their own evidence requirements, and this one draws more on live system behaviour than on policy documents.

Certification confers no legal status. It records that an operator’s controls were tested against a written standard on a stated date, which is a narrower claim than holding a licence. GICNT-PP is written to sit above the local statutory minimum wherever the two diverge, so an operator can satisfy its regulator in full and still fall short of the standard.

Connecting to National Self-Exclusion Registers

Where a central register exists, requirements for integration with a self-exclusion register are not met by a nightly file transfer. Each regime names the moments at which the query must run, and those moments are not the same from one market to the next.

Market	Register	Basis	When the operator must query it
Great Britain	GAMSTOP	LCCP licence condition	Mandatory for every remote licensee since 31 March 2020, at account opening and at login. Minimum exclusion 6 months
Netherlands	CRUKS	Wet kansspelen op afstand	Before registration, before login and before play. Minimum exclusion 6 months, defaulting to 2 years where the player sets no term
Sweden	Spelpaus.se	Spellagen (2018:1138)	Before direct marketing, at player registration and at login. From 1 August 2026 each licensee queries through its own Actor ID and API Key under SIFS 2026:3
Germany	OASIS	GlüStV 2021	Before granting access to play, alongside the LUGAS limit and activity files
Australia	BetStop	Interactive Gambling Act 2001	Before opening an account and before providing a service. Existing accounts must be closed. Exclusion runs from 3 months to lifetime
Ontario	BetGuard	Registrar’s Standards 2.14.1	Live since 14 May 2026. Excluded players logged out, new accounts refused, marketing stopped, unused funds returned

Canada has no national register, and the point matters for any certification claim written for a Canadian audience. Ontario’s programme is provincial. Alberta opened its regulated market on 13 July 2026 with a centralised scheme in place from the first day, and every registered operator had to integrate before going live. Elsewhere in the country the arrangements remain operator or lottery-corporation level, so a player excluded in one province is untouched in the next. Mapping that coverage across national self-exclusion registers is the starting point of the GICNT-PP gap assessment for any multi-market licensee.

Where No Central Register Exists the Operator Scheme Carries the Whole Load

Malta runs no national list. Under Directive 2 of 2018, the Player Protection Directive, an MGA licensee operates its own mechanism for definite and indefinite exclusion, and a player seeking revocation must supply a written explanation that the licensee may accept or reject, with the decision given in writing within 7 days. Those MGA licence obligations are the floor. In any market without a register, GICNT-PP adds the following:

• Exclusion applies across every brand on the licence by default, not only the site where the request was made
• Registration attempts using altered details are matched on the underlying identity and logged as attempted circumvention
• Marketing suppression happens at the moment of the account block, not at the next campaign build
• Reactivation after an expired term needs a fresh documented request from the player, never an automatic restore
• Remaining balances are returned without requiring the player to log back in

Deposit Limits Have Moved to the Registration Stage

The rules on deposit limits that online casino operators face have moved from a tool buried in account settings to a prompt the player meets before the first payment clears.

Market	Trigger	What the operator must do
Great Britain	Registration or first deposit	Prompt for a financial limit, present limit setting as the default with an active opt-out, remind at least every 6 months, re-prompt annually where the player declined. From 30 September 2026 only gross limits may be called deposit limits, offered as a minimum, over fixed time frames, with at least equal prominence to other limit types
Netherlands	Net deposits above €300 a month at ages 18 to 23, or €700 from 24	Block further deposits for the rest of the calendar month or complete a means test. Contact thresholds sit lower, at €150 and €350. Updated KSA guidance of July 2026 counts structural income only and excludes liquid assets such as savings
Germany	Any deposit	Enforce the €1,000 monthly ceiling across all licensed operators through the LUGAS limit file, not per brand
Sweden	A monthly limit above SEK 10,000	Contact the player under the duty of care in Chapter 11, Section 5 of the Gambling Ordinance. An increase takes effect no earlier than 72 hours after the request

GICNT-PP requires the gross basis in every market, whatever local wording permits: an amount paid in is an amount paid in, and a withdrawal does not restore headroom. Decreases apply immediately. Increases wait out a cooling-off period, and the interface may not pre-fill a higher figure, rank a larger number first or make declining a limit quicker than setting one. The spread between statutory floors is set out in the comparison of mandated responsible gambling tools.

How Reality Checks and Session Controls Must Behave

Requirements for reality checks in online gambling are specific about behaviour rather than presence. Maltese supervisory work has turned up session alerts missing mandatory content: the alert must interrupt play and display elapsed time, amounts wagered, winnings and losses, the timer must continue across games, and any exclusion of autoplay from the time calculation must be a player choice rather than a silent default. Sweden went further and consulted on replacing its 2018 responsible gambling regulations outright, with autoplay, withdrawals and staff training in scope; responses closed on 10 August 2026. In Great Britain these behaviours live in the Remote Technical Standards, which give operational shape to the UKGC licensing objectives.

The standard fixes five properties that an assessor can test against raw event data:

• The check fires on elapsed session time, not on a count of game rounds
• Figures shown are cumulative for the session and reconcile to the account statement
• Play is suspended until the player acknowledges the alert
• Interval options include a value at or below 60 minutes, and the default is not the longest available
• The timer survives a game switch, a page reload and a move between web and app

Placing Responsible Gambling Resources Where Players Can Reach Them

Placement is testable, which is why GICNT-PP treats it as a control rather than a design preference:

• Responsible gambling information reachable within one click from anywhere on the site, the standard the MGA already applies to its licensees
• A message before the first deposit setting out the available tools and limits
• A working link to at least one help organisation operating in the player’s own market
• A self-exclusion route that needs no contact with support and carries no retention offer in the path
• Register promotion inside operator messaging where the market requires it. ACMA found that PointsBet Australia had left BetStop promotion out of more than 22,000 marketing messages, and on 16 May 2025 the operator paid an AU$500,800 spam penalty and gave court-enforceable undertakings, the regulator noting that a financial penalty was not available to it for the self-exclusion breaches themselves

Placement work fails quietly when it is handled as a static layout task. The standard ties it to behaviour instead: an operator that surfaces support material only in the footer while its own monitoring has already flagged markers of harm on the same account is assessed as non-compliant, even though every link is present and correct.

What the Bi-Annual GICNT-PP Audit Samples

The certification audit for player protection works from records, not screenshots. Six control areas are sampled together so that a failure showing up in one can be traced through the others.

Control	Evidence sampled
Register integration	Query logs at registration, login and marketing dispatch, with timestamps and the response returned
Financial limits	Limit change history for a sampled cohort, showing decreases applied at once and increases held for the cooling-off period
Session controls	Raw event data for alerts fired, acknowledged and dismissed, reconciled against session duration
Player interaction	Case files from trigger to outcome, including any decision not to act and the reason recorded for it
Marketing suppression	Account block and list removal timestamps for the same player, compared
Placement	Rendered evidence from the live estate, including the app builds in production during the review period

Intervals differ across the framework by design, and the reasoning behind each one is set out under GICNT audit cycles.