Warning over third party responsibilities as FSB receive sanctions
06 May 2020
Gambling businesses are being warned that they will face regulatory action if they do not carefully manage all the third party websites that they are responsible for.
The warning follows regulatory action taken against FSB Technology (UK) who will have to change the way it operates with additional licence conditions and pay £600,000 for advertising, money laundering and social responsibility failings.
FSB’s business model includes contracting provisions of its licensed activities to third parties. This arrangement, often referred to as a ‘white label’, places responsibility on the licensee to ensure that its third-party partners keep gambling fair, safe and crime-free. However, a Gambling Commission investigation discovered FSB did not have sufficient oversight of three third-party websites (1) or effective anti-money money laundering and social responsibility policies and procedures in place between January 2017 and August 2019. For example:
- Ineffective customer interactions with, and source of funds checks on, a customer who displayed indicators of problem gambling and spent £282,000 over an 18-month period
- Sending a marketing email to 2,324 customers who had previously self-excluded
- A VIP team manager acting without adequate oversight and not receiving sufficient AML training
- Placement of an inappropriate banner advertisement containing cartoon nudity on a Great Britain facing website which was providing unauthorised access to copyrighted content.
Richard Watson, Commission Executive Director, said: “All operators should pay close attention to this case as it shows that we hold all licensees fully responsible for third party relationships - and we will act against any of our licensees that do not manage third parties appropriately.
“These were blatant breaches of rules we have put in place to ensure gambling is fair, safe and crime-free."
In addition to paying £600,000 towards delivering the National Strategy to Reduce Gambling Harms, FSB will also have additional conditions on its licence to ensure it conducts risk-based due diligence on new and current third party partners it runs websites on behalf of.
The Commission is still reviewing the actions of personal management licence holders involved in this case.
FSB Technology (UK) Limited public statement
Anti- Money Laundering:
- Licence condition 12.1.1
- Licence condition 12.1.2
- Social Responsibility code provision 3.4.11
- Social Responsibility code provision 3.5.3
Due diligence and control failings related to third-party arrangements which are often referred to as ‘white label’ (where a service provided by one company is rebranded and resold by another).
Operators are expected to consider the issues here and review their own practices to identify and implement improvements in respect of the management of customers.
Licensed gambling operators have a legal duty to ensure that their gambling facilities are being provided in compliance with the Gambling Act 2005 (the Act), the conditions of their licence and in accordance with the licensing objectives, namely to:
- prevent gambling from being a source of crime or disorder, being associated with crime or disorder or being used to support crime
- ensure that gambling is conducted in a fair and open way
- protect children and other vulnerable people from being harmed or exploited by gambling.
1. Executive Summary
This investigation resulted in the commencement of a section 116 regulatory review2 of FSB Technology (UK) Limited, hereafter referred to as FSB, Combined Remote Operating Licence number: 000-022201-R-305119-018.
The regulatory review found failings within FSB’s processes which were aimed at preventing money laundering (ML) and protecting vulnerable people. Anti-money laundering (AML) and social responsibility requirements are expected to be in place to keep crime out of gambling and to protect the vulnerable.
Between January 2017 and August 2019, FSB repeatedly failed to comply with the Licence conditions and codes of practice (LCCP), specifically:
Licence condition 12.1.1 (2) and (3), requiring compliance with the prevention of money laundering and terrorist financing (and the related failure to take into account Ordinary code provision 2.1.1 Anti-money laundering – casino)
Social responsibility code provision 3.4.1, requiring effective policies and procedures for customer interaction; particularly the requirement to make use of all relevant sources of information, to identify at-risk customers who may not be displaying obvious signs, and to interact with customers designated as “VIPs”
As the operator of a casino licence, FSB is subject to the requirement to comply with ‘The Money Laundering Regulations 2007’ (the 2007 Regulations) and is subject to the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017’ (the 2017 Regulations), which superseded the 2007 Regulations.
Our regulatory review identified other areas of failings, namely:
Licence condition 16.1.1 Paragraph 1 (b) - Responsible placement of digital adverts including taking all reasonable steps to ensure that third parties with whom they contract for the provision of any aspect of their business related to the licensed activities do not place digital advertisements on websites providing unauthorised access to copyrighted content; and
Social Responsibility Code Provision 3.5.3 Self-exclusion which requires that remote licensed operators must …..take steps to remove the name and details of a self-excluded individual from any marketing databases used by the company or group (or otherwise flag that person as an individual to whom marketing material must not be sent), within two days of receiving the completed self-exclusion notification’
Senior personal management licence (PML) holders within FSB at the time of the failings failed to provide sufficient and effective oversight of the licensed activities3.
FSB’s business model includes contracting provisions of its licensed activities to third parties. This arrangement, often referred to as ‘white label’ provision, places responsibility on the Licensee to ensure that its third-party partners conduct their business in accordance with the Act and regulatory requirements. Licensee’s must note that the duties and obligations under the licence ultimately rest with them. Licensees who use third-party arrangements are required to comply with Social Responsibility Code Provision 1.1.2 (Responsibility for third parties).
We found that whilst FSB did have contractual arrangements in place with its ‘white label’ partners, it did not take sufficient action to ensure they were following the Licence conditions and codes of practice.
In addition, FSB had not carried out sufficient due diligence prior to entering into and for the duration of these contractual arrangements with third-party partners to ascertain the suitability of them.
In line with our Statement of principles for licensing and regulation, FSB will pay a total of £600,000 in lieu of a financial penalty.
In agreeing to conclude our regulatory reviews by way of regulatory settlement, we considered:
- FSB’s cooperation with our investigation and early acknowledgement of its failings, including its proposal of a regulatory settlement on acceptable terms.
- the improvements FSB made in governance, due diligence, policies, processes and resourcing.
- the financial representations put forward by FSB.
The investigation and our subsequent regulatory review found:
- failings in FSB’s anti-money laundering and social responsibility policies and procedures, and;
- bought into question FSB’s suitability to offer gambling facilities.
Licence condition 12.1.1 (2) and (3)
Licence condition 12.1.1(2) requires that, following completion of and having regard to the risk assessment and any review of the assessment, licensees must ensure they have appropriate policies, procedures and controls to prevent money laundering and terrorist financing.
Licence condition 12.1.1(3) requires that licensees must ensure that such policies, procedures and controls are implemented effectively, kept under review, revised appropriately to ensure that they remain effective, and take into account any applicable learning or guidelines published by the Gambling Commission from time to time.
The Casino licence is subject to ‘The Money Laundering Regulations 2007’ (the 2007 Regulations) and are currently subject to the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017’ (the 2017 Regulations), which superseded the 2007 Regulations.
Ordinary code provision 2.1.1 reinforces the requirement to act in accordance with the Commission’s guidance set out in The Prevention of Money Laundering and Combating the Financing of Terrorism - Guidance for remote and non-remote casinos. This guidance covers requirements in respect of the Regulations referred to above, among other things.
FSB has accepted that, between January 2017 and August 2019, it was in breach of this licence condition4 and that its AML controls did not adequately address the risks presented by higher-risk customers. This included but was not limited to:
- failing to establish and maintain appropriate risk-sensitive policies, procedures and controls relating to the management of its third-party partners and customers (including the monitoring and management of compliance with such policies and procedures)5.
- a lack of adequate documentation and audit trail to demonstrate decision making.
- the compliance team and those responsible for ensuring AML procedures were put into practice not being adequately resourced and trained.
- suitable account reviews not being in place to monitor the re-opening of customer accounts by third-party partners.
As examples of these failings:
Customer A had during an 18-month period gambled and lost circa £282,000 without providing adequate SOF. FSB terminated the relationship with the customer following our initial compliance assessment and its post assessment internal review established Customer A had not provided adequate documentation supporting the level of her spend.
Third party website A was allowed to operate without sufficient oversight of VIP (very important person) arrangements. A VIP team manager located within the third-party website acted without adequate oversight and had not received sufficient AML training.
Licence condition 16.1.1 Paragraph 1 (b) - Responsible placement of digital adverts
Paragraph 1 of licence condition 16.1.1 requires the Licensee’s must
- Ensure that they do not place digital advertisements on websites providing unauthorised access to copyrighted content;
- take all reasonable steps to ensure that third parties with whom they contract for the provision of any aspect of their business related to the licensed activities do not place digital advertisements on websites providing unauthorised access to copyrighted content; and
- ensure that the terms upon which they contract with such third parties enable them, subject to compliance with any dispute resolution provisions, to terminate the third party’s contract promptly if, in the Licensee’s reasonable opinion, the third party has been responsible for placing digital advertisements for the licensed activities on such websites.
We found an inappropriate banner advertisement (the banner ad) containing cartoon nudity was displayed on a GB facing website which seemingly was providing unauthorised access to copyrighted content.
When clicked upon, the banner ad took users to a website FSB operated namely Website B following a third-party business licence arrangement (BLA)6 that it had entered into.
FSB indicated it had become aware of the banner ad but had no knowledge of it and had not authorised its placement. It suspected that it had been marketing carried out by a third-party in breach of the BLA. FSB took immediate steps to remove the banner ad and terminate its BLA.
We found that if FSB had taken reasonable steps in respect of due diligence it would have identified obvious concerns that there was a risk that the third-party could place such advertisements noting its clear association to an unlicensed website with a questionable repute. We therefore consider the FSB was in breach of Paragraph 16.1.1(b).
Social Responsibility code provision (SRCP) 3.4.1(1)
Licensees must put into effect policies and procedures for customer interaction where they have concerns that a customer’s behaviour may indicate problem gambling. The policies must include …
(e) specific provision for making use of all relevant sources of information to ensure effective decision making, and to guide and deliver effective customer interactions, including in particular
(i) provision to identify at risk customers who may not be displaying obvious signs of, or overt behaviour associated with, problem gambling: this should be by reference to indicators such as time or money spent (ii) specific provision in relation to customers designed by the licensee as “high value”, “VIP”, or equivalent
Commission officials found that FSB was not carrying out customer interactions in compliance with this SRCP. FSB owned the process of customer interactions requirements, but the actual interactions were being carried out by staff employed by third-party partners with insufficient oversight and training. As FSB was not ensuring that appropriate and meaningful customer interactions took place, its reporting system meant it was unable to adequately assess such interactions. We found:
- some third-party websites were allowed too much responsibility in respect of managing VIP customers.
- employees of third-party partners had not been sufficiently trained.
- FSB’s policies and procedures in place did not always prompt effective interactions where customers may be displaying signs of problem gambling.
- in some instances, interactions and decisions not to interact, may not have been adequately recorded.
As an example of these failings:
Customer A7 who displayed indicators of problem gambling had been subject to ineffective customer interactions. Customer B had lost £282,000 over an 18-month period yet interactions were restricted to enquiring whether she was ‘comfortable with her level of spend’ and did not explore her circumstances.
Failing to comply with Social Responsibility Code Provision 3.5.3 Self-exclusion
SRCP 3.5.3 requires that:
- ‘Licensees must have and put into effect procedures for self-exclusion and take all reasonable steps to refuse service or to otherwise prevent an individual who has entered a self-exclusion agreement from participating in gambling.
- Licensees must, as soon as practicable, take all reasonable steps to prevent any marketing material being sent to a self-excluded customer.
- Licensees must take steps to remove the name and details of a self-excluded individual from any marketing databases used by the company or group (or otherwise flag that person as an individual to whom marketing material must not be sent), within two days of receiving the completed self-exclusion notification’.
FSB notified the Commission by way of key event8 an error that occurred on a third-party partner’s website resulting in a marketing email being sent to 2,324 customers who had previously self-excluded.
FSB emailed the affected customers with an apology and told the Commission that if the customers had responded to the marketing email, they would not have been able to access gambling products as normal self-exclusion tools remained in place.
FSB indicated it received one customer complaint as a result of this email and indicated it had taken steps to ensure there was no repetition.
In addition, whilst we acknowledge FSB’s motivation in sending the apology to the self-excluded customers, we would not have expected this further contact email to have been sent to self-excluded customers.
FSB’s suitability to offer gambling facilities using third-party arrangements often referred to as ‘white label’ partners
We make it clear that licensees are responsible for the third parties that they contract with. We require licensees to ensure that any contracted third parties conduct themselves in so far as they carry out activities on behalf of the licensee as if they were bound by the same licence conditions and subject to the same codes of practice as the licensee. SRCP 1.1.2 states:
- Licensees are responsible for the actions of third parties with whom they contract for the provision of any aspect of the licensee’s business related to the licensed activities.
- Licensees must ensure that the terms on which they contract with such third parties:
- require the third party to conduct themselves in so far as they carry out activities on behalf of the licensee as if they were bound by the same licence conditions and subject to the same codes of practice as the licensee
- oblige the third party to provide such information to the licensee as they may reasonably require in order to enable the licensee to comply with their information reporting and other obligations to the Commission
- enable the licensee, subject to compliance with any dispute resolution provisions of such contract, to terminate the third party’s contract promptly if, in the licensee’s reasonable opinion, the third party is in breach of contract (including in particular terms included pursuant to this code provision) or has otherwise acted in a manner which is inconsistent with the licensing objectives, including for affiliates where they have breached a relevant advertising code of practice’
As FSB’s business model includes contracting provisions of its licensed activities to third- parties, responsibility for compliance remains with FSB and cannot be transferred to any other party. We found that whilst FSB had contractual arrangements in place it did not provide sufficient oversight to ensure:
- it offered gambling facilities in a way which minimises the risk to the licensing objectives; and
- that our Licence Conditions and Codes of Practice (LCCP) were being complied with.
In addition to its contractual arrangements, we expect Licensee’s obtain the necessary assurance in respect of third-party partners by conducting adequate due diligence on the third-party to ensure (amongst other things) that they are competent and reliable.
In this case we found that FSB had not undertaken sufficient due diligence on its third-party partners for example:
Third-party contractual arrangements Website B
FSB entered into what it referred to as a BLA third-party arrangement with Company B. The BLA required that FSB operated a website offering gambling facilities using an international website brand name associated to Company B.
The brand name was also in use by an international gambling operator not licensed to offer gambling facilities to the British market. FSB agreed the BLA with Company B despite:
- the ultimate ownership of Company B being unclear
- the relationship between Company B and the ownership of the brand name being unclear.
FSB accepts that it that it did not carry out sufficient due diligence which would have identified regulatory concerns in respect of the international operator of the brand name.
The motivation behind the BLA seemed to be to raise the international gambling operator’s footprint worldwide; achieved via marketing of the brand name by advertising associated to the UK Premier League football.
FSB accepted that whilst it did operate the brand name via its UK website its driver was not to operate a conventional gambling website and derive income via customers; but a commercial decision which in the terms of the BLA it received £20,000 a month from Company B.
FSB accepted it had been unable to undertake satisfactory due diligence in relation to Company B and the related brand name. FSB found that the complexities of the international corporate structure between companies and websites made the cost of doing due diligence enquiries financially punitive. It subsequently accepted that this position was a reason not to enter into the relationship at all, not a reason to explore arrangements such as the described BLA. FSB have now terminated the BLA.
Third-party contractual arrangements Website C
FSB had not carried out sufficient due diligence prior to commencing and during the relationship with Company C who associated with branded Website C.
In particular, we noted FSB had not sufficiently assessed the risk in respect of ownership of Company C which had links to an individual regarded as a politically exposed person (PEP). PEP status should have raised concerns and increased monitoring in respect of the level of risk- but in this case it did not. For example, despite knowing the PEP was running for political office they had not established that he had been elected. In addition, FSB failed to discover that Company C had ‘deregistered’ its company status during the business relationship.
FSB has now terminated this business relationship.
3. Actions taken by the Licensee
In addition to accepting the failings, FSB has:
- Put in place an improved system of due diligence and oversight to provide governance of its third-party contractual arrangements.
- Revised its regulatory policies and procedures designed to deliver compliance.
- Recruited new senior staff in various posts within regulatory compliance including a Money Laundering Reporting Officer (MLRO) and a senior compliance manager with a specific responsibility for safer gambling.
- Increased resourcing with responsibilities for compliance within FSB.
- Completed a review of its customer base and where it felt appropriate has suspended the business relationship
4. Regulatory Settlement
This regulatory settlement consists of:
- £600,000 payment in lieu of a financial penalty, which will be directed towards delivering the National Strategy to Reduce Gambling Harms.
- New operating licence conditions stating FSB:
- must, before entering a relationship with a third-party partner, conduct risk-based due diligence with a view to mitigate risk to the Licensing Objectives.
- must manage and evaluate its existing third-party partner relationships.
- must carry out risked-based due diligence on all its third-party partners at least annually to ensure they do not pose a risk to the Licensing Objectives.
- Agreement to the publication of a statement of facts in relation to this case.
- Payment of £34,300 towards the Commission’s costs of investigating the case.
In considering an appropriate resolution to this investigation, the Commission has had regard to the following aggravating and mitigating factors:
- The serious nature of the breaches identified.
- The suitability issues identified in respect of the low level of due diligence conducted by FSB in respect of its third-party partners.
- The need to encourage compliance by other operators with the requirements.
- FSB’s senior management were likely to have been aware of and, if not, should have been aware of, the governance issue that lead to the breaches, given their significance.
- The proposal of a regulatory settlement was made at the first opportunity and at an early stage in the licence review process.
- Openness and cooperation with the Commission throughout the review process.
- Immediate steps were taken to prevent breaches from continuing once identified.
- The financial representation made by FSB.
5. Good practice
Gambling operators should take account of the failings identified in this investigation to ensure industry learning. Operators should consider the following questions:
- Is your governance, due diligence, contractual and audit arrangements effective and are you refreshing existing due diligence at least annually?
- Are your policies and procedures for identifying high risk customers for AML and SR customer accounts effective?
- Have you adequately resourced your AML and SR departments, so your staff are always able to put your policies and processes in place for all customers?
- Have your staff and your third-party partners received sufficient AML and SR training?
- Are you recording all customer interactions, including decisions not to interact with customers, and are these records available for colleagues to refer to when making decisions?
- Are your customers providing documentation to support their level of spend and loss, and not simply giving assurances?
Notes 1 Compliance with an SR code provision is a condition of the licence by virtue of section 82(1) of the Gambling Act 2005 (the Act). 2 The Commission commenced its regulatory review on 16 August 2019. 3 The review of the actions of individual PML holders’ forms part of the investigation. 4 It was also not compliant with Ordinary code provision 2.1.1 5 The Commission noted that the Licensee was in an improving position after taking action following the initial assessment and reached a satisfactory position by August 2019. 6 A BLA is described at section 5 within ‘Third-party contractual arrangements Website B’ 7 Editorial note this is the same customer referred to at finding 1 8 Key event report is an event that is required to be notified to the Commission.
Note to editors
We are not naming the websites for legal reasons
For all media enquiries, please contact the Gambling Commission press office.