David Clifton – Licensing expert: Could affordability checks follow age & identity verification changes?

SBC News has already reported on last week’s Gambling Commission “consultation response” confirming the forthcoming LCCP changes on age and identity verification for remote gambling.

In adding my own take on those changes, I also include a comment below on another highly relevant matter flowing from this latest emanation from the UK’s gambling regulator, namely its encouragement to remote gambling operators to collaborate on the issue of customer affordability.

1  Age and identity verification

For good reason, the prime focus within the industry media over the last few days has been on what needs to be done by remote betting and gaming operators licensed by the Gambling Commission to ensure compliance by the time that the new LCCP age and identity verification requirements come into effect on 7 May.

From that date, the existing LCCP provision that remote licence-holders require customers to “affirm they are of legal age” will be removed (although the Commission does say that such a provision can be retained if a licence holder thinks that doing so will supplement its overall approach to preventing underage gambling).

Regardless of whether that provision is retained, all affected remote licence-holders (including lottery operators other than those offering merely subscription or low-frequency lotteries) will be required to verify the age of any customer before the customer can:

• deposit funds into an account,
• access any free-to-play games the licensee may make available, or
• gamble with the licence-holder with either their own money or a free bet or bonus.

A new licence condition will also require all such affected remote licence holders to:

• verify, as a minimum, the name, address and date of birth of a customer before allowing them to gamble,
• ask for any additional verification information promptly,
• inform customers, before they can deposit funds, of the types of identity documents or other information that might be required, the circumstances in which the information might be required, and how it should be supplied to the licensee and
• in what amounts to a requirement to maintain a greater degree of customer monitoring than is required currently, take reasonable steps to ensure that information on their customers’ identities remains accurate.

The Commission has published a summary of the forthcoming key LCCP changes that you will find here.

To ensure compliance by the appointed date, it is important that operators start planning now for implementation of all required technological changes, development of new systems for manually verifying those customers not automatically verified at the first attempt and all associated staff training. In so doing, it will be important to remember that it is verification before deposit or gambling, rather than verification at the point of registration (as some respondents to the consultation mistakenly thought) that will trigger the need to make changes to their existing systems.

Affected operators should bear in mind that the Commission (a) acknowledges that it would be disproportionate to require licence-holders to have verified all their active customers in advance of the changes to LCCP taking effect and (b) is not expecting operators to verify inactive customers who may not conduct any further gambling activity with them. However, with effect from 7 May, where a licence-holder has not yet verified the name, address or date of birth of any existing customer, the Commission will expect it to do so before that customer next gambles with it.

They should also bear in mind that the Commission is not intending to prescribe a uniform methodology for verification, instead focusing on the desired outcome of the verification process, namely that the licence-holder is satisfied that it has, as robustly as possible, established the identity of the customer and that it can demonstrate to the Commission what it has done to satisfy itself as to the verification of that person’s identity.

Even though respondents to the consultation gave time estimates of between three and twelve months to implement the required changes to systems and procedures, the Commission has made it clear that it will have little sympathy for any operator that fails to ensure compliance with the new LCCP requirements by 7 May (i.e. within just three months from the date of the consultation response), saying that, amongst other things, it is “mindful that licensees have been aware of [its] direction of travel on verification since [its] proposals were first outlined in [its] Online Review in March 2018”.

The Commission has decided against proceeding with what had been a proposal to reduce the risk of fraudulent card use by requiring licence-holders to verify that an account holder’s identity matches up with the name linked to the payment method they use (for example, that the name associated with a debit card matches the verified name of the gambling account holder). The reason is that such a proposal is not currently viable because the payer’s name is not verified during the payment authorisation process, with the consequence that no online retailer or merchant can access any verified cardholder name details from a payment transaction.

The Commission accordingly acknowledges that, as matters stand, “remote gambling licensees therefore cannot verify that the payer is the same person as the gambling account holder” but states that licence-holders “should still consider how they can use the information available to them to mitigate risks as part of their fraud prevention processes as online merchants”. It provides the following example: “if a licensee requires its customers to input ‘cardholder name’ details as part of the payment journey then it could conduct basic in-house checks to query any circumstance where the cardholder name keyed in clearly does not match the name of the verified gambling account holder”, adding that “this could help to flag the need for further checks on certain customers when they add additional payment cards”.

2  Free-to-play games

In light of questions posed to me last week, it is worth confirming that the new age verification requirement will apply to free-to-play games on websites of those who hold operating licences granted by the Gambling Commission. It will not apply to non-licence holders over whom the Commission has no regulatory powers, including those who supply solely social games or social casino games.

However, the Commission does sound a note of warning in its consultation response that whether or not it advises the UK Government of the need for additional regulation for the social casino sector will depend on operators within that sector “pursuing a proactive and credible approach to social responsibility and an awareness of potential harm, which must continue to encompass best practice consumer measures”.

You can read more about the Commission’s view on free-to-play games here.

3  Affordability

The Gambling Commission’s consultation response has gone further than merely the issue of age and identity verification. It also contains the Commission’s reaction to the information provided by respondents in relation to its plan, originally identified within its Online Gambling Review, to:

• ensure that operators set limits on consumers’ spending until affordability checks have been conducted and
• consult on requirements for licensees to set limits on customers’ gambling activity that could only be changed once the licensee had further verified information about the customer.

In the above respects, in last September’s consultation on age and identity verification, the Commission requested information or evidence of good practice (both in terms of existing practice and what is possible) that helps licence-holders and customers to ensure that gambling remains fair and safe.

In what will come as a welcome relief to many operators, the Commission has confirmed in its consultation response that it is “not proposing at this stage to introduce a specific licence condition or code to require mandatory account limits”, but it is nevertheless encouraging remote gambling operators “to collaborate in developing approaches to assess the levels of gambling that a customer might be able to afford”.

Some of the questions it posed in last September’s consultation were expressly directed at the issue of affordability. In an indication of what might yet be coming, the Commission asked:

• What types of information are you able to access that could help inform you as to how much a new customer might be able to afford to gamble?
• Do you consider socio-demographic or economic data, that is not specific to the customer’s identity, but which could help to inform an assessment of what they might be able to afford to gamble (e.g. postcode deprivation indices) and could these be used to inform limit setting?
• What information have you already acquired from the application of any limits on your customers’ accounts?
• What information have you gathered from your enforcement of these limits as part of your customer interaction processes?
• Do you verify any economic information specific to the customer (e.g. credit scoring data, employment history or indicators of income and expenditure) as part of your risk’s assessment?
• What do you think of the idea of gambling businesses setting limits on a customer’s gambling until they know more about them?
• What information should a gambling business use to decide whether to change or remove a limit?

In its consultation response, having considered (and commented on) the answers received to the each of the above (and other) questions, the Commission has summarised its current position as follows:

• “We welcome the responses to these questions from licensees, consumers and third parties, and we will use the feedback to continue to develop our work in this area.
  
  We will continue to engage with remote gambling licensees and encourage them to collaborate in developing approaches to assess the levels of gambling that a customer might be able to afford. This will form part of our broader work with licensees and financial institutions to better understand the range of accessible data and how it could inform mandatory limit setting, before we consider consulting on options at a later date”.
• “We note the concerns raised by consumers regarding the purpose of any such checks, and the related issues of data security and privacy. In progressing our work in this area, we will consider the balance that may be needed between allaying these concerns and the opportunities for stronger consumer protections that could be delivered”.
  
• “We will consider the responses submitted as part of this call for information when reviewing and updating our customer interaction guidance, and we will publish a consultation on the customer interaction elements of LCCP in February. Licensees should take account of the details submitted as part of this call for information, as outlined in this section, when reviewing their own approaches to harm prevention”.

It seems we can expect to learn more about this ‘affordability’ issue once the Commission’s consultation on the customer interaction elements of the LCCP has been published later this month.

_____________________

Article by David Clifton – Director of Clifton Davies Consultancy