Responsible play and limits

1) Purpose and area

Create a system that prevents harm to players and reduces regulatory/reputational risks: transparent limits, timely interventions, correct communication, documentation of decisions and an evidence base of compliance. Coverage: web/mobile product, CRM/marketing, CS, payments/conclusions, game providers, market reporting.

2) RG principles

Prevention is more important than reaction. Early cues and mild interventions before harm occurs.
Player autonomy. The limits are set simply, reversible only in the direction of tightening (cooling).
Transparency. Clear descriptions of rules, time/amount cutoffs, visibility of limit progress.
No pressure. Banning aggressive upsell/reactivations for vulnerable players.
Evidence. All steps are in logs with timestamps and sources.
Privacy. PII minimization, RBAC/DPO storage and access.

3) Roles and RACI

RG Lead (policy owner) - strategy, metrics, UX/copyright approval, escalation. (A)

Risk/AML - harm markers, risk scores, "affordability" checks. (R)

CS/CRM - communications, support of restrictions/self-exclusions. (R)

Payments/Finance - freezing of outputs during RG/AML checks, returns according to policy. (R)

Product/UX/Engineering - limits, mindfulness banners, reality check, counters, registry integrations. (R)

Legal/DPO - compliance with norms/locales, privacy. (C)

Internal Audit - independent audits and follow-up CAPAs. (C)

Exec Sponsor (COO/CEO) - "tone from the top," resources. (I/A)

4) Types of limits and mechanics

4. 1 Financial limits

Deposit/replenishment (day/week/month).
Loss limit - net loss for periods.
wager cap - gross amount.
Win/output limit - optional for behavior curves.

4. 2 Temporary limits

Time per day/week, session length, required breaks.
Reality Check: pop-ups with time/loss and exit button.

4. 3 Self-restraint

Time out (cool-off): 24 h/7/30 days.
Self-exclusion: 6-12 months or indefinitely; cancellation - only through cooling and confirmation.

4. 4 Behavioral "soft" tools

History of spending and net result with a visual diagram.
Budget glider (entering a monthly entertainment budget).
Reminders of the set limit before it is reached (70/90%).
Disable marketing mailings with one click.

Rules: tightening - right away; mitigation - after a cooling period (e.g. 24-168 hours).

5) Markers of Harm and Risk Assessment

Financial: growth in deposits/losses, frequent "near limit" events, cancellation of conclusions, debt/credit methods.
Behavioral: night sessions, increased betting speed, many parallel games, quick return after losses.
Communications: aggression in chat/CS, requests to remove limits, complaints about financial difficulties.
Social: self-positioning as "getting out of debt," mentioning addiction.
Regulatory: incompatibility with self-exclusion registries/age restrictions.

Scoring: rule-base (threshold) + ML signals (training on confirmed cases).
Risk classes: Low/Medium/High → corresponding intervention levels.

6) Interventions and scenarios

Level 0 (educational): banners, reality check, tips "how to set a limit."

Level 1 (soft contact): e-mail/in-app message with a limit/break offer.
Level 2 (CS contact): personalised dialogue, wellbeing check, timeout offer.
Level 3 (restrictions): forced reduction of limits, temporary blocking of marketing/bonuses.
Level 4 (hard measure): self-exclusion/account blocking and notification to the registry if required.

• "We noticed activity indicating risks. Do you want to set a limit or take a break?
• "We will suspend promotional offers to give you time to make an informed decision."
• "According to the rules of responsible play, we will temporarily restrict access. Here's how to request help"

7) UX and copyright

Limits - in one click from the header/profile; visible indicators of progress.
Text without gamification and manipulation; avoid green "nudges" to continue.
"Friction" screens before repeated deposits in a negative trend.
Help page with simple explanations and local support resources.

8) Affordability

Risk triggers → request additional information: source of funds/income (within the framework of the law), validation for large/frequent deposits.
Partial/complete suspension of the game for the duration of the review.
Decisions are documented; no tipping-off about AML suspicions.

9) Integrations and providers

Self-exclusion registers (nat/regional): real-time synchronization or T + 1; block before entry/deposit.
Game providers: API for "freeze," transferring limit/break statuses; single event "session_stop".
Payments/PSP: RG flags in anti-fraud, soft deposit deviations under active restrictions.

10) Data, privacy and retention

Модель данных: `user_id, limit_type, value, period, set_at, effective_at, cooldown_until, changed_by, reason, evidence_id`.
Intervention logs: 'risk _ score _ before/after, channel, script_id, outcome'.
PII minimization: store only what you need; Mask in reports.
Retention: limits/interventions - at least a regulatory period (often 5-7 years); access - RBAC, viewing - only by need-to-know.

11) RG Reporting and Dashboard

• Coverage:% of active players with set limits.
• Time-to-Intervention: median from harm marker to contact.
• Limit Uptake: Conversion from limit offer is → set.
• Recurrence: repeated harm markers at 30/90 days.
• Self-Exclusion Rate and returns after cooling period.
• Marketing Suppression:% vulnerable under suppression-list.
• Complaints/Disputes: percentage of complaints resolved ≤ X days.
• Compliance SLA: synchronization with registries, timely notifications.

12) Regulatory obligations (skeleton)

Self-exclusion/registries: registration/synchronization, timing.
Communications: No aggressive marketing/bonuses for the vulnerable.
Reports: frequency and format (events, limits, SE).
RG incidents: notifications to the regulator on time, artifacts.
Localization: interface language and market help.

13) Checklists

Before starting limits

• UX streams are simplified (≤ 3 clicks).
• Attenuation cooling is configured.
• SE/CR Integration Registry tested (positive/negative cases).
• The time/loss counters are correct in a multi-provider environment.
• CS scripts agreed with Legal/RG Lead.
• Logs/logs are immutable, reports converge with GL/wallet.

Interventions

• There is a scale of triggers and reaction levels.
• Message templates without pressure/manipulation.
• suppression lists are connected to CRM/push/mail.
• Cause and outcome documentation is mandatory.

Reporting and auditing

• The RG dashboard is updated daily.
• Case samples are reviewed quarterly by IA.
• CAPA by Recurrent Finding in Timing (SLA).

14) Frequent mistakes and how to avoid them

It is difficult to find limits. → to put in the header/profile/reality-check.
Mitigation without cooling. → always enforce cool-down.
Marketing to vulnerable. → mandatory suppression flag in campaigns.
There is no evidence base. → structured logs, ID links to artifacts.
Only "paper" measures. → regular A/B proofs to convert limits and reduce harm markers.

15) Templates (quick inserts)

A) Set Limit Banner

B) Message to Player (Level 1)

C) CS response on output delay (without tipping-off)

key> Payment Passes Standard Security Review. We will notify you as soon as it is complete.

D) Self-exclusion letter

16) Technical implementation (skeleton)

Service RG-limits (idempotent API): 'POST/limits', 'GET/limits', 'POST/self-exclusion', 'POST/cooloff'.
Реестр событий: `limit_threshold_reached`, `reality_check`, `rg_intervention`, `marketing_suppressed`.
Policy-engine: trigger rules, cooldown, suppression.
Data-quality: GL reconciliation/wallet vs RG reports, circuit validators.
Privacy-by-design: PII fields separated; all uploads - with masks.

17) Implementation plan (30 days)

Week 1

1. Approve RG policy (limits, cooling, intervention levels).
2. Specify data/event model and RACI.
3. Prepare UX layouts and texts (RU/EN + key locales).

Week 2

4. Implement a service of limits and reality check, integration with providers/PSP.
5. Set up suppression loops in CRM and marketing blocks.
6. Train CS/CRM, release scripts and 1-pages.

Week 3

7. Pilot for 5-10% of traffic: checking logs, cooling, SE.
8. Tabular harm marker tests, manual case validation.
9. Collect feedback, update rules and texts.

Week 4

10. Full release; daily monitoring of KPIs and RG incidents.
11. Report to management; CAPA for deviations.
12. Plan v1. 1: regional integrations, ML signals, additional limits.

• Code of Ethics and Conduct
• AML training and employee training
• Staff compliance awareness
• Incident playbooks and scripts
• Notices of Violations and Reporting Deadlines
• Regulatory reports and data formats
• Internal Audit and External Audit
• Audit checklists and reviews
• License renewals and inspections
• Regulatory changes by region