UK - UKGC: Requirements and Reporting

1) UKGC base frame

The UK Gambling Commission (UKGC) sets the rules through two key documents: LCCP (License Conditions and Codes of Practice) and RTS (Remote Technical Standards). LCCP defines license terms/codes for all licensees; RTS - technical standards for remote gambling and safety requirements (ISMS/ISO 27001-subset).

2) Licenses and personal roles

Operating licenses are issued to provide online products in the UK; personal licenses - for key managers (PML) and functional employees (PFL, where applicable). From November 29, 2024, PML coverage has been expanded to a number of management offices (including AML/CTF), with the exception of small operators.
PML is indefinite, but requires an update every 5 years through the UKGC (eServices) service.

3) Responsible play and customer checks (high-level)

Financial vulnerability/risk checks: UKGC launched a pilot of "friction" financial checks (without using credit bureaus on a permanent basis), based on responses from the 2023 summer consultation; threshold implementation sequence: £500/month c 30. 08. 2024 → £150/month from 28. 02. 2025 (focus on public data). Financial risk-assessments are in the pilot and do not work as a permanent "hard" duty until the final decision.
New deposit limit rules: from 31. 10. 2025 operators must proactively offer to set a financial limit before the first deposit and then - reminders/simple limit changes (interface details and periodic notifications).
Expected LCCP updates on bonuses/incentives: transparency of funds in bankruptcy (31. 10. 2025) and SR Code 5 changes. 1. 1 (with 19. 01. 2026): restriction of vagers, prohibition of mixing products in incents, etc.

4) AML/CTF and risk assessment

AML/TF risk assessment is mandatory, taking into account the industry risk profile of UKGC; LCCP 12 is in effect. 1. 1. UKGC regularly publishes summaries of new ML/TF risks (e.g. April 2025 update).
For online casinos, the updated edition of the AML guide (5th ed. with adjustments) plus a common set of responsibilities (KYC, SoF/SoW if necessary, EDD, SAR triggers in NCA, etc.).

5) Technical standards and tests (RTS/Testing)

RTS requires: honesty of RNG/games, transparent account functionality, player information; safety - as a subset of ISO 27001.
Testing Strategy: procedures for initial/annual tests of games, as well as an annual security audit with a third-party auditor (for the corresponding types of licenses).
Test reporting: Operators are required to provide game test reports, annual games testing audit and security audit reports according to their license cart.

6) Reporting: Regulatory Returns (quarter) and Key Events

From July 1, 2024, UKGC transferred all licensees to quarterly Regulatory Returns (instead of annual). Deadlines: quarter - 28 days after the period, annual - 42 days (for periods before the transition - shortening to 30. 06. 2024, examples - in the UKGC guide).
UKGC emphasizes meeting deadlines; in the spring of 2025, the regulator separately warned of penalties for delay. Submission - via eServices.
Key Events (LC 15. 2. 1) - significant events that must be notified to UKGC within 5 working days (restructuring/bankruptcy, changes in beneficiaries/key persons, marketing incidents for self-excluded, etc.). Submission via Key Events section in eServices.

7) Personal licenses (PML/PFL): responsibility and practice

PML holders are personally responsible for compliance and can be subject to regulator measures in case of violations (fines/sanctions up to PML suspension). Submission/update - via UKGC digital services.

8) Upcoming and related regulatory changes (sample)

Statutory "gambling levy": the first settlement period for most operators is from July 2024 to March 2025 (year by a factor of 1. 3333); the first UKGC invoices were expected in the fall of 2025 - check notifications/invoices in your personal account and DCMS/UKGC instructions.

9) Compliance checklist for online operator (B2C)

Legal/Management Roles

Mapping of "management offices" for PML (incl. AML/CTF functions), up-to-date job descriptions, training and PML event log.

RG/Client Checks

Setting up financial checks by consultation thresholds (pilot/phasing), logging Customer Interaction, transparent deposit limits (new requirement from 31. 10. 2025).

AML/CTF

Updated ML/TF Risk Assessment, KYC/EDD/SoF policies, monitoring triggers, SAR procedures, training, UKGC April risk-update review.

Engineering/Safety

RTS compliance; Annual Testing Strategy game audits/security audits ISMS (ISO 27001-subset), logs and alarms.

Reporting

Regulatory Returns (quarter, dates 28/42 days), Key Events (5 working days), storage of evidence of submission.

10) Checklist for B2B supplier (Remote gambling software)

Availability of RTS/security compliance in terms of supplied software; annual security audits (where required) and games testing annual audit for games/engines.
Contractual KPI/SLA, Incident Management, Change Control, Version Log, Export Diaries for Operator and UKGC on request.

11) Practical timing and typical risks

Shift to quarterly reporting increases the burden on financial and BI teams - pre-allocate resources for data on GGY/no-spend/interventions.
Strengthen requirements for PML coverage and customer financial checks - check roles/processes and UX (limits/threshold scenarios).

12) Mini-FAQ

How to quickly report an important event?
Within 5 business days via Key Events in eServices. Categories - see LC 15. 2. 1 and the UKGC guide.

How often is Regulatory Returns now?
Quarterly for all licensees (plus rules for a shortened period of 30. 06. 2024 and deadlines 28/42 days).

Does everyone need to extend PML?
Yes, from 29. 11. 2024 expanded the list of "specified management offices" (except small-scale), check coverage.

13) Short total

UKGC mode is strict LCCP discipline + RTS/security + hard reporting. For 2024-2026, the key highlights are quarterly returns, operational Key Events, expanded PML coverage, the evolution of customer financial audits, plus updates on bonuses/incentives and limit interfaces. Build this into processes (data, UX, roles, audits) - and keep the compliance evidence base at the level of UKGC expectations.