Platform
Player Protection & Responsible Gambling
Two phases: first verify that the protections a licence already requires are genuinely in place, then give a citizen one place to exclude themselves from every licensed operator at once.
Phase A
Automated compliance monitoring
Mandatory player-protection tools are commonly required in licence conditions and rarely verified continuously. Phase A checks that licensed operators actually provide them, on a schedule, with evidence.
Mandatory tools checked
- Age restriction labelling displayed where a player can see it
- A responsible-gambling page that exists and actually works
- Deposit, session and loss limits that a player can set and that hold
- An accessible self-exclusion path, reachable without contacting support
- Helpline contact details, current and correct
- Correct risk warnings on promotional material
Advertising compliance
Promotional material is monitored on the same cycle as the operator's own surfaces, because advertising reaches people who have not yet visited the site. Monitoring flags:
- Creatives that promise guaranteed winnings
- Material that presents gambling as a source of income
- Placement or styling that targets young audiences
Each finding is captured with a dated screenshot and the source placement, so the regulator engages the licensee with the material itself rather than a description of it.
Phase B
A national self-exclusion register
One place where a citizen bars themselves from every licensed operator at once — comparable to GAMSTOP in the United Kingdom, RGIAJ in Spain and Rejestr Wykluczonych in Poland.
Operator-by-operator self-exclusion places the burden on the person least able to carry it. A national register makes one decision effective across the licensed market, and it gives the regulator a way to verify that operators honour it.
Separated perimeter
A physically separate database and network perimeter. The self-exclusion register is not a table inside the enforcement environment; it is a distinct system with its own boundary and its own access control.
Pseudonymised identifiers
Identifiers are held pseudonymised, with keys in a hardware security module. Neither operators nor enforcement staff work with directly identifying values.
Minimal API
The operator-facing interface returns only a yes/no and an expiry date. It answers the single question an operator must ask before accepting a customer, and nothing more.
No reverse flow
There is no reverse flow of citizen data into the enforcement environment. Enforcement analytics never receives self-exclusion identities, and the separation is architectural rather than procedural.
The privacy architecture is what makes the register adoptable. A citizen asked to register a vulnerability with the state must be able to see, in the design, that the record cannot be repurposed.
Request a technical briefing
We brief regulators, ministries and licensing authorities on the architecture, evidentiary model and delivery sequence in detail.