UK Gambling Commission requires AML risk reviews across sector

The Gambling Commission’s 2026 money-laundering risk assessment requires all British gambling licensees to review their money-laundering and terrorist-financing risks.

The risk assessment, published on 30 July, updates the Commission’s 2023 assessment and takes account of the National Risk Assessment published by HM Treasury and the Home Office in 2025. It also fulfils the Commission’s obligation under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 to identify and assess risks in the casino sector.

The scope extends beyond casino operators. Licence Condition 12.1.1 applies to all gambling businesses, requiring licensees to assess the risks that their businesses could be used for money laundering or terrorist financing.

The Commission says operators, gambling software businesses, remote licensees, non-remote licensees and other covered firms must consider the parts of the assessment relevant to their activities. The notice does not set a universal completion date, reporting form or separate notification requirement.

The practical requirement is a documented review of each firm’s own risk assessment against the Commission’s updated analysis. A licensee should record its customer and product risks, governance ownership, revised risk ratings and the controls addressing those risks. Where the review changes the firm’s exposure, its policies, procedures and controls must be updated.

The Commission’s notice says licensees must take account of applicable learning and guidance it publishes from time to time, including this risk assessment. The resulting compliance file should show which sections were considered, why they apply or do not apply, what changed and who approved the control updates.

Casino businesses face an additional requirement. Under the 2017 Regulations, casino licence holders must take the Commission’s assessment into account when carrying out their own risk assessments. The Commission said it has a supervisory duty to review casino risk assessments on a risk-based basis and expects casino operators to update them in a timely manner and demonstrate the steps taken to implement them.

The timing is therefore a matter for each licensee’s governance process, subject to the Commission’s expectation that updates are timely. The source does not quantify the review window, cost or staffing requirement.

For a mid-size operator, the work is likely to involve financial crime, compliance, risk and operational control owners. They will need to map the updated assessment to the existing enterprise risk assessment, test customer-risk assumptions, refresh procedures where ratings change and retain approval evidence.

The supervisory consequence is an evidence trail. Licensees should be prepared to show how their AML risk assessments and controls reflect the Commission’s stated priorities in the next compliance or inspection cycle, while casino operators will need evidence that the updated assessment informed their own risk reviews.

The next step is for each licensee to set its review timetable and document the resulting decisions; the Commission has not published a universal deadline.