Key Points
- More than 25% of all consumer complaints to the Commission’s Contact Centre concern identity verification, making it the single largest category of disputes referred to Alternative Dispute Resolution providers.
- Operators that accepted initials, nicknames, and commercial addresses at registration corrupted credit reference matching during the FRA pilot; those unmatched accounts were disproportionately the highest spenders.
- The Commission’s full pilot data will not be published until September 2026, yet the BGC says the industry cannot meaningfully prepare for a scheme built on evidence it has never been allowed to scrutinise.
The Flaw the FRA Pilot Exposed Was There at Registration
The Gambling Commission’s financial risk assessment pilot was built on one clear assumption: that credit reference agencies could match customer records quickly and cleanly enough to deliver a genuinely frictionless check. What the pilot exposed instead was that failures during customer onboarding, specifically the collection of incomplete or inaccurate personal details, were a primary reason why some customers could not be matched to credit reference agency records at all.
In a blog published on 12 August 2026, Commission Director of Major Policy Projects Helen Rhodes and Senior Policy Officer Sarah Webster set out precisely what went wrong. The customers who fell into the “unmatched” category were not low-value fringe accounts. The Commission confirmed those unmatched accounts were among the highest-spending customers on operator platforms. That is the detail most coverage has overlooked. The FRA was designed specifically to monitor high-spending customers, so a failure concentrated in that group is not a peripheral problem; it is a structural one that affects the scheme’s core purpose.
What Operators Actually Submitted at Registration?
The Commission identified a number of instances where licensees were not obtaining sufficient information from customers at registration to meet the requirements of Licence Condition 17. The errors were consistent and avoidable. Customers had been registered using initials rather than full legal names, nicknames instead of forenames, middle names where first names were required, and commercial addresses where residential addresses were needed. Each discrepancy, however minor in isolation, was sufficient to break a credit reference agency match.
A sharper concern surrounded third-party verification providers. Most operators outsource identity checks, but the Commission said varying levels of data sensitivity across providers had generated widespread use of “fuzzy matching,” a process that accepts approximate or partial details even when they do not fully confirm who the customer is. “This can result in the use of ‘fuzzy matching’, where customers are onboarded on the basis of partial or equivocal verification of their credentials. This introduces risk across multiple regulatory areas, including contributing to unmatched data,” Rhodes and Webster wrote.
The legal context is not ambiguous. Licence Condition 17 has been in place for many years and requires operators to verify that a customer’s name, address, and date of birth all match a single individual before gambling is permitted. The condition also bars operators from requesting additional identity information at withdrawal if that information could reasonably have been collected at registration. This is not a new obligation; operators are already legally required to meet it.
GAMSTOP Is Also Caught in the Middle
A further consequence that was scarcely mentioned in the competing accounts of events was that of GAMSTOP, the self-exclusion register. If someone signs up for the self-exclusion service using a nickname, middle name, or inaccurate address, this discrepancy is not limited to the credit reference file. According to the Commission, the problem had caused issues with the records being kept at other places, which were named as GAMSTOP, and could affect the functionality of the self-exclusion policy. It means that someone who signed up for the self-exclusion service but was registered under a different name or address would continue to gamble without detection.
The Numbers Behind the Complaints
Over a quarter of all contacts to the Commission’s Consumer Contact Centre concern identity verification, making it the single largest category of complaint and one of the most frequent disputes referred to Alternative Dispute Resolution providers.
The Commission’s casework identified a consistent pattern behind those numbers. Operators were observing identity concerns or financial risk signals during the customer journey but deferring any investigation until the customer requested a withdrawal. A player could gamble freely for months, then face sudden document demands the moment they tried to access their funds. The Commission said it still sees cases where risk flags that emerged during the customer journey were only investigated at the point of withdrawal, even where there had been ample opportunity to act earlier. The Commission called this approach reactive and said it directly contravenes licence conditions and anti-money laundering obligations.
What the Pilot Data Actually Showed?
The FRA pilot ran across two stages. Stage One began in August 2024 and covered approximately 530,000 assessments across 300,000 accounts, producing frictionless results in roughly 95% of cases. Just over 4% of Stage One assessments were unmatched, where the credit reference agency could not identify the customer at all. Stage Two, which ran from February 2025 at a lower deposit threshold, improved the frictionless rate to 97% and reduced the unmatched rate to approximately 3%, likely because operators submitted more recent account data. Both stages outperformed the 80% frictionless estimate in the 2023 Government White Paper.
The 0.1% figure, meaning 1 in 1,000 accounts requiring a non-frictionless assessment, is not fixed. The Commission stated explicitly that this number could be reduced further if operators ensured customer details were correct and identity properly verified at the point of onboarding. That is the central point of the August blog: the frictionless rate is a direct function of how accurately operators collected customer data, sometimes years before an FRA was ever contemplated.
Stage One Has No Start Date
On 7 July 2026, the Commission formally confirmed a phased FRA rollout. Stage One targets the largest operators and applies where customers deposit £5,000 net or more within a rolling 24-hour window, a threshold exceeded by fewer than 0.5% of customers. The precise start date remains unconfirmed while implementation groups are established over the summer. The identity verification blog, published six weeks later, was not simply guidance; it was a warning that the FRA’s performance in live conditions depends on operators correcting registration data that has, in some cases, been deficient for years.
Industry Presses for the Full Picture
Tim Miller, the outgoing executive director, confirmed at iGBLive that the Commission’s full pilot data report would not be published until September 2026. The Commission had already announced the FRA rollout in July, so the gap between that announcement and the supporting evidence being made public has drawn direct criticism.
Grainne Hurst, chief executive of the Betting and Gaming Council, said the position was untenable. “The Commission has yet to publish a full evaluation of the pilot, so neither the industry nor the public has seen the evidence needed to justify introducing these checks,” she said. “These checks cannot be described as genuinely frictionless if they produce unreliable outcomes.”
The BGC argued the pilot failed to demonstrate that the data underpinning the checks is accurate, reliable, or consistent enough to support regulatory decisions. “The pilot exposed inconsistencies in the information returned by credit reference agencies, with the same customer potentially receiving different outcomes depending on the provider,” Hurst said. Brant Dunshea, chief executive of the British Horseracing Authority, described the FRA rollout as “self-harm on an immense scale,” warning of financial consequences for racing and the broader UK economy.
What Operators Must Do Before Enforcement Follows?
The Commission refrained from sending out any formal warning notice along with the blog post but the stance was clear. All operators should have all correct information while registering, should have verification measures in place to ensure the uniqueness of the individual being verified, and should have sorted out their identity issues before a request to withdraw has even been made. It also clarified that it was not asking for Enhanced Due Diligence from each new client during onboarding but accepting initials, nicknames, and business address does not satisfy the current Licence Condition 17.
Expert Analysis
The August blog makes plain something the July rollout announcement left unaddressed. The FRA’s frictionless performance is not a fixed technical output; it is a direct function of how accurately operators recorded customer data at registration. A 97% frictionless rate is only meaningful if that 97% was properly verified at signup. Where registration data is inaccurate, the credit reference matching model does not deliver a light-touch check; it produces a manual investigation of a high-spending customer whose identity was never robustly confirmed.
The September data release will test how concentrated the unmatched problem really is among high spenders. If the Commission’s own casework is right about that concentration, the BGC’s complaints about inconsistent outcomes carry more weight than the headline frictionless figure implies. The implementation groups forming over the summer face a harder starting point than they may have anticipated: not simply designing operator responses after an FRA triggers, but auditing whether the registration data already sitting in operator systems is clean enough to run the scheme reliably at all.
Share
5 views
