UK Gambling Commission reminds operators of ID check duties
Table of contents
- Gambling Commission has reminded UK remote operators to meet identity verification duties under Licence Condition 17.1.1.
- More than a quarter of complaints to the regulator’s Contact Centre relate to identity verification problems.
- A financial risk assessment pilot found incomplete onboarding data, such as initials, nicknames or commercial addresses, is undermining identity matching.
The Gambling Commission has reminded remote gambling operators to meet identity verification duties under Licence Condition 17.1.1.
Director of Major Policy Projects and Evaluation Helen Rhodes and Senior Policy Officer Sarah Webster issued the warning in a blog published last week on 12 August 2026. The pair cited findings from the Commission’s financial risk assessment pilot and wider casework showing gaps in registration checks.
Existing requirements
Licence Condition 17.1.1 has applied to remote operators for several years. Licensees must obtain and verify a customer’s name, address and date of birth before that customer is permitted to gamble.
A withdrawal request must not result in a requirement for additional information if the operator could reasonably have requested it earlier. The Gambling Commission said breaches of this principle remain a persistent source of consumer frustration.
Effective checks support multiple regulatory goals: preventing underage gambling, identifying self-excluded customers, and strengthening anti-money laundering controls. Rhodes and Webster said over a quarter of complaints handled by the Contact Centre concern identity verification, and disputes in this area remain among the most common referred to Alternative Dispute Resolution providers.
Pilot findings
The blog draws heavily on the Commission’s staged financial risk assessments, which tested frictionless assessments for high-spending customers against credit reference agency data. The Commission found that only a small percentage of customer accounts in the pilot could not be matched by the credit reference agencies used, but wanted to understand why those cases occurred.
The regulator’s own review found that some of the pilot’s highest-spending customers had been identified using incomplete details: an initial rather than a full name, a nickname instead of a legal name, a commercial address in place of a residential one, or a combination of these issues.
Separate casework identified customers registered under a middle name rather than their forename, creating mismatches with records held by third parties, including GAMSTOP, and undermining the effectiveness of self-exclusion. The Commission also flagged “fuzzy matching,” where third-party verification providers accept partial or equivocal credentials, as a contributing risk.
Operator obligations
The Commission does not expect the equivalent of Enhanced Due Diligence at onboarding for every new customer. It was clear, however, that onboarding customers based on incomplete or inaccurate information is not sufficient to meet existing identity verification requirements.
The findings sit alongside a busier year of scrutiny on consumer friction. The regulator recently invited proposals to cut red tape around compliance, even as bettors showed resistance to affordability checks requiring bank statements or payslips. It has also been sharpening its wider stance on financial crime, having recently flagged rising laundering risk in the gambling software sector.
Operators that rely on third-party verification providers were told to weigh up the differing standards of data sensitivity and tolerance those partners apply. The Commission said it will continue to review operator progress and consider whether further clarification or action is needed.
Read the full blog post from the Gambling Commission, and the LCCP 17.1.1 condition text in full.
Do you have a story worth sharing?
Send it over to our editors!
