Gambling Commission Warns Poor ID Checks Undermined FRA Pilot

The Gambling Commission has warned that weaknesses in operators’ identity verification processes contributed to customers being excluded from the frictionless element of its financial risk assessment pilot.

In an update published on Wednesday, UKGC Director of Major Policy Projects and Evaluation Helen Rhodes and Senior Policy Officer Sarah Webster said incomplete or inaccurate customer details had prevented successful matches with credit reference agency records.

The regulator found that some customers had been registered using an initial rather than their full name, a nickname instead of their legal forename or a commercial address in place of a residential address.

Some records contained a combination of these problems, despite the affected accounts belonging to some of the highest-spending customers included in the pilot.

The UKGC said the findings indicated that poor identity verification by operators, rather than gaps in credit reference agency data alone, contributed to the small proportion of unmatched accounts.

Poor data reduced frictionless matches

The FRA pilot was designed to test whether operators could identify high-spending customers experiencing financial difficulties without routinely asking them to provide documents.

Customers’ identifying information had to be matched with data held by participating credit reference agencies. Where a match could not be completed, the customer could not receive an assessment through the intended frictionless process.

The Commission previously reported that 97% of customers requiring an assessment could receive one without friction. Fewer than 0.1% of all active accounts would both trigger an FRA and be unable to complete it frictionlessly.

However, its analysis of those unmatched accounts uncovered recurring weaknesses in the information collected and verified by operators during registration.

The regulator said improving these procedures could increase the match rate further while reducing the need for customers to undergo more intrusive checks later.

Wider risks from inaccurate information

Weak identity verification can have consequences extending beyond the FRA system.

The UKGC identified cases in which customers were registered using a middle name in place of their forename. This created discrepancies with records held by GAMSTOP, potentially undermining the effectiveness of the national online self-exclusion scheme.

"Ensuring that robust identity verification checks are carried out at the outset is one of the most effective ways to reduce friction for customers." - UKGC  

Inaccurate information can also weaken controls intended to prevent underage gambling, fraud and money laundering.

Under Licence Condition 17, remote operators must establish that a customer exists and verify that their name, address and date of birth relate to the same person before allowing them to gamble.

The Commission acknowledged that many operators use third-party identity verification providers. However, it raised concerns about varying standards among providers and the use of permissive “fuzzy matching” processes that accept partial or inconclusive information.

It stressed that initials, nicknames and commercial addresses are not sufficient to meet existing identity verification requirements.

Withdrawal checks driving complaints

The regulator also criticised operators that identify potential problems during the customer journey but do not investigate them until a withdrawal is requested.

More than a quarter of complaints received by the UKGC’s Contact Centre concern identity verification. The issue is also among the most common disputes referred to Alternative Dispute Resolution providers.

Operators must not demand information as a condition of withdrawal if it could reasonably have been requested earlier.

The Commission clarified that it does not expect operators to conduct enhanced due diligence on every customer at registration. Nevertheless, they must obtain sufficient information to establish that each account belongs to a unique, correctly identified person.

The warning comes as the UKGC prepares for the staged introduction of FRAs. Initially, the checks will apply through the largest operators when net deposits exceed £5,000 in 24 hours, falling to £2,500 for customers under 25.

The final thresholds are expected to be £1,000 over 24 hours or £3,000 over 90 days for customers aged 25 and over. Lower limits will apply to younger customers.

The Commission will confirm the first implementation date following further engagement with operators, credit reference agencies and other stakeholders. Its full consultation response is expected in September.