If you lost more than you could afford and no one at the casino stepped in, you are right to ask what checks should have happened. UK-licensed operators have real duties to spot players at risk of harm. This guide sets out what those duties are, what the rules on financial checks actually say, and where they stop.
If gambling is causing you harm right now, free and confidential help is available. You can call the National Gambling Helpline on 0808 8020 133 or chat to GamCare (gamcare.org.uk) at any time.
“Affordability check” is not quite the right name
Most people search for “affordability checks”, and the term is useful shorthand. The Gambling Commission itself calls it an inaccurate description of these measures. The regulator separates two things. One is a financial vulnerability check, which looks at publicly available records. The other is a financial risk assessment, which would draw on credit-reference-style data and is not yet live. The difference matters, because a lot of confident claims online about a fixed spending limit are simply wrong.
The core duty: identify, act, evaluate
Operators licensed in Great Britain must follow the Commission’s Licence Conditions and Codes of Practice (the LCCP). The rule that governs this is Social Responsibility Code Provision 3.4.3, on remote customer interaction. It requires operators to run systems that identify customers at risk of harm, act in a timely and proportionate way, and then evaluate whether their approach is working. The guidance treats this as a continuous loop, not a one-off box-tick: the operator keeps watching, steps in when signals appear, and checks whether its response actually reduced the harm.
Monitoring must begin from the point an account is opened. Under that guidance, an operator should not wait for a clear pattern of harmful behaviour to build up before acting. The duty runs from day one.
Where those signals point to health rather than income, our guide to gambling refunds on mental health grounds explains what the operator’s duties required and what a complaint involves.
The rules ask a casino to watch for harm from the moment you open an account, not to wait until the damage is already done.
Spend is one signal among several
The customer-interaction guidance took effect on 31 October 2023. It tells operators to use a range of indicators of harm relevant to their customers. Spend and patterns of spend are part of that, but they sit alongside other signals: time spent gambling, gambling behaviour, whether someone uses or avoids gambling-management tools, contact the customer has made, and account indicators. Affordability is one input, not a single switch that flips at a set number.
So there is no published universal threshold at which an operator must demand your bank statements or payslips. Anyone telling you a casino “had to” stop you at a precise figure is overstating the rules.
What the £500 and £150 figures really mean
Those numbers exist, but they belong to one specific check. SR Code Provision 3.4.4, the financial vulnerability check, came into force for remote operators on 30 August 2024. It requires a customer-specific check of public-record information for red flags such as county court judgments, bankruptcy orders, individual voluntary arrangements and debt relief orders. The result is considered alongside other information the operator holds, with proportionate action taken.
The trigger was net deposits (deposits minus withdrawals) above £500 in a rolling 30-day period from 30 August 2024, reducing to £150 in a rolling 30-day period from 28 February 2025. This is a public-record check, not a demand for personal financial documents, and it uses only publicly available data. It does not require operators to consider details such as your postcode or job title.
Financial risk assessments: confirmed on 7 July 2026, arriving in stages
On 7 July 2026 the Commission confirmed that financial risk assessments will be introduced, but in a staged approach. These are the deeper checks that draw on credit-reference-style data, and they follow the pilot of “frictionless” assessments that ran from autumn 2024. The pilot found around 97% of accounts above the proposed thresholds could be assessed without the customer providing documents or their credit score being affected, against the roughly 80% estimated in the 2023 White Paper.
Here is what the staged rollout actually means, and what it does not. Stage one applies only to the largest operators, and only at very high spend: net deposits of £5,000 or more in a rolling 24-hour period for customers aged 25 and over, or £2,500 for under-25s. The Commission says fewer than 0.5% of customers spend at this level. No start date has been fixed for stage one; that follows implementation groups over summer 2026 and a formal consultation response. The eventual full thresholds, £1,000 in 24 hours or £3,000 in 90 days for adults over 25, and £750 or £2,000 for under-25s, have no dates at all yet.
Two more points keep expectations honest. The Commission has said no enforcement action will be taken against operators for failing to act on a financial risk assessment during the early stages, though every existing duty, including the £150 vulnerability check and the customer-interaction rules above, remains fully enforceable. And the assessments are aimed at the extreme cases: the Commission has pointed to an operator that enabled a customer to lose £70,000 over 10 hours, a day after opening the account, and another that let a customer spend £245,000 in three months while it knew she was an NHS nurse earning £30,000.
The catch: offshore casinos sit outside all of this
Every duty described above binds operators licensed in Great Britain. Casinos licensed offshore, very often in Curaçao, are not authorised by the Gambling Commission, so these specific protections do not apply to them; what a Curaçao licence requires instead is catalogued in the Curaçao responsible gambling rules. If you gambled with an unlicensed offshore site, it is not accurate to say it “breached the LCCP”, because the LCCP never bound it. That gap is the whole problem. The site owed you none of the checks a UK licence forces, and most players only discover that at the cashout screen. If you are weighing up these sites, our guide to your rights with casinos not on GamStop sets out the practical position.
When checks are missed
Players regularly report on review and complaint forums that they were able to deposit and lose very large sums quickly, with no intervention or affordability question, until they tried to withdraw, at which point checks suddenly appeared. Others describe little or no proactive contact, a safer-gambling message or a limit prompt, despite escalating deposits, chasing losses, or gambling at unusual hours. If you have run into a casino that will not pay out, those withdrawal-stage checks can feel especially unfair.
Where a Great Britain-licensed operator missed its duties and let someone gamble beyond their means, that may support a complaint or a claim. We cover the broader picture in our guide to recovering gambling losses, and the related question of operator duties when protections fail. Outcomes are always case-specific, and nothing here is a promise of recovery.
You can pursue free routes yourself: complain to the operator first, then escalate to alternative dispute resolution (such as IBAS), the Gambling Commission, or the Financial Ombudsman where relevant. You do not need a claims company to do any of this. If you would rather have someone look at your situation first, our free eligibility check is confidential and carries no obligation. Where a case proceeds, our regulated legal partners typically work on a no win, no fee basis, so you pay an agreed percentage only from funds that are actually recovered.
Sources
- Gambling Commission, position on light-touch financial vulnerability checks (SR Code 3.4.4 triggers).
- Gambling Commission, “Commission to introduce financial risk assessments in staged approach”, 7 July 2026.
- Gambling Commission, financial risk assessments update, July 2026 (pilot findings and full-implementation thresholds).
General information, not legal advice. We are not solicitors or a law firm. We connect clients with regulated legal partners.