Online operator Gamesys fined £6M for AML and social responsibility failures

On 10 January 2024,  the Gambling Commission (the “Commission”) announced that Gamesys Operations Limited (“Gamesys”) had been issued a £6 million fine after a compliance assessment in May 2022 revealed breaches in respect of social responsibility and anti-money laundering (“AML”) obligations under the Licence Conditions and Codes of Practice (“LCCP”). The breaches occurred between November 2021 and July 2022.

BREACHES

Social responsibility

Paragraph 1 of the Social Responsibility Code Provision (“SRCP”) 3.4.1 (applicable at the time) of the LCCP states that operators must interact with customers in a way which minimises the risks of customers experiencing harms associated with gambling. This involves identifying at risk customers, interacting with them and evaluating the effectiveness of such interactions. Paragraph 2 of the SRCP 3.4.1 (applicable at the time) of the LCCP requires that operators take into account the Commission’s guidance on customer interaction.

Gamesys was found by the Commission to have breached paragraphs 1 and 2 of the SRCP 3.4.1 of the LCCP as it had not always detected customers facing or potentially at risk of gambling related harm. In particular, by:

• being overly dependent on checks that show if a customer had a historical individual voluntary arrangement or been bankrupt or insolvent as an indicator of gambling harm; and
• having a system of deposit limits which, for some customers, was too slow to detect harm risks – no risks were detected when one customer deposited £8,255 within three days of creating an account, another lost £5,968 within five weeks of creating an account and another lost £17,482 within 34 days of creating an account.

Gamesys had also not interacted with customers who may be at risk of or experiencing harms associated with gambling by:

• only contacting one customer after they had lost nearly £10,000, and with a ‘responsible gambling interaction’ suggesting new games and offers;
• conducting only one responsible customer interaction with a customer who spent £19,709 over five months; and
• failing to keep records of customer interactions and considerations, and rationale for decisions in sufficient detail, despite this being a requirement of its responsible gambling procedures.

AML

Paragraph 2 of licence condition (“LC”) 12.1.1 of the LCCP provides that following completion and consideration of the risk assessment and its review, operators must make sure they have appropriate policies, procedures and controls to prevent money laundering and terrorist financing.

Paragraph 1 of LC 12.1.2 of the LCCP requires operators to comply with Parts 2 and 3 of the Money Laundering Regulations 2007 (“MLR”) or the equivalent requirements of any UK Statutory Instrument that changes or replaces those regulations as long as they apply to casinos, whether or not MLR applies to their business.

Ordinary Code Provision (“OCP”) 2.1.1 of the LCCP requires that operators should act in accordance with the Commission’s AML guidance for remote and non-remote casinos to help prevent activities related to money laundering and terrorist financing.

Gamesys failed to fully comply with the above AML requirements as:

• some customers were able to avoid AML triggers and spend a substantial amount of money without AML checks being conducted, for example, one customer deposited £14,585 in a 28 week period, another deposited £18,884 in just over six months, and another deposited £34,280 in five and a half months;
• it did not perform adequate customer due diligence and was reliant on information from third parties or customer assurances. For instance, one customer deposited over £25,000 in three months, another deposited over £58,000 in six months, and another deposited over £65,000 in six months; and
• its ‘Reinvestment of winnings policy’ did not adequately mitigate the risk that deposited funds might originate from illegal sources and not just from prior winnings.

OUTCOME

In accordance with the Commission’s ‘Licensing, the compliance and enforcement’ policy statement, the Statement of principles for determining financial penalties and the Indicative sanctions guidance, the Commission’s decision includes:

• a warning under section 117 (a) of the Gambling Act 2005 (the “Act”); 
• a total fine of £6,071,292 (which includes a divestment amount of £165,042); and
• an additional condition on Gamesys’ operating licence under section 117(1)(b) of the Act to conduct a third party audit of its 12 websites, such as ballycasino.co.uk, doublebubblebingo.com and jackpotjoy.com, to verify the effective implementation of AML and safer gambling policies. 

In imposing the sanction, the Commission noted that Gamseys co-operated with it throughout the investigation and had taken corrective steps.  It also noted that it had not found any evidence of criminal monies being deposited by the specific customers reviewed during the compliance assessment.

LESSONS LEARNED

Following the Commission’s decision, operators should bear in mind the following questions:

• Do you keep detailed records of customer interactions and the rationale for decisions?
• Do you have a formal process for analysing whether customer interactions took place, and do you keep detailed records of the types of behaviour which have triggered a customer interaction?
• Do you efficiently record all compliance decisions and can you show the Commission, on request, evidence of ongoing assessment, evaluation and improvement?
• Do you review your AML policies to ensure that they are fit for purpose?
• Have your staff received sufficient AML and social responsibility training?

Co-authored by Xenia Baranova