UK Financial Risk Assessments 2026: Stage 1 at £5,000, Final Triggers at £1,000 and £3,000

The short answer

On 7 July 2026 the Gambling Commission announced that its Board had decided to introduce financial risk assessments (FRAs) in stages. An FRA is a check the operator requests from a credit reference agency once a customer’s net deposits cross a threshold. The agency returns an overall risk result. The operator decides what support, if any, the customer needs.

Three things are settled and one is not:

• Stage 1: the largest operators, customers whose net deposits exceed £5,000 in a rolling 24 hours (aged 25 and over) or £2,500 (under 25 and other high-risk groups).
• Final stage: net deposits over £1,000 in 24 hours or £3,000 in 90 days for customers 25 and over; £750 or £2,000 for under-25s.
• Enforcement: during the early stages the Commission will take no action against an operator for failing to act after an FRA. Every other licence requirement stays enforceable.
• Not settled: the start date. The Commission’s July blog says the stage 1 date “will be confirmed in the formal consultation response document”. On 16 October 2026, 101 days after the decision, that document had not appeared on the Commission’s news or blog pages.

FRAs are not the check UK operators already run. The financial vulnerability check, required since 30 August 2024, uses public records and triggers at £150 of net deposits a month. The two are compared below.

How the thresholds moved, 2023 to 2026

The trigger figures changed three times. Each step comes from a different Commission document, and the measure being counted changed along the way.

Version	Measure	25 and over	Under 25	Who it applies to	Source
White Paper proposal, April 2023	Net loss	£1,000 in a day or £2,000 in 90 days	Not given in the figures quoted	All remote operators (proposed)	Consultation response, background page
Pilot, 30 Aug 2024 to 31 Mar 2025	Net deposits (deposits minus withdrawals)	Set per pilot stage, not published as rules	Set per pilot stage	Remote bingo, casino and betting licences in fee categories J1, K1, L1	LCCP 3.4.6; consultation response, pilot page
Final stage, decided July 2026	Net deposits	Over £1,000 in 24 hours or over £3,000 in 90 days	Over £750 in 24 hours or over £2,000 in 90 days	Not yet specified by operator size	News release and blog, 7 July 2026
Stage 1, decided July 2026	Net deposits	Over £5,000 in 24 hours	Over £2,500 in 24 hours	Largest operators	News release and blog, 7 July 2026

What the comparison shows, computed from those figures:

• The final 90-day trigger for customers 25 and over is 50% higher than the White Paper’s £2,000. The under-25 figure kept the old £2,000.
• Stage 1 is five times the final 24-hour trigger for customers 25 and over, and 3.33 times for under-25s.
• The pilot counted net deposits, not losses, “mirroring for now the final financial vulnerability check definition”. The final thresholds kept that choice. A customer who deposits £1,200, wins and withdraws £1,200 the same day has zero net deposits for the day, however much they staked.

The Commission said in its pilot position that pilot thresholds were “not indicative of where thresholds would be set following the pilot”. Interim stages between stage 1 and the final stage are still “to be set following further engagement with implementation groups and stakeholders”.

The check already in force: financial vulnerability checks

Most of the confusion in coverage of “affordability checks” comes from mixing two controls. Both come out of the same 2023 consultation.

	Financial vulnerability check (FVC)	Financial risk assessment (FRA)
Status	Licence condition, SR code 3.4.4, since 30 August 2024	Decided 7 July 2026, not live; pilot condition 3.4.6 ended 31 March 2025
Trigger	Net deposits over £150 in a rolling 30 days since 28 February 2025 (£500 from 30 August 2024 to 27 February 2025)	Staged, see above
Data	Public records only: bankruptcy order, County Court Judgment, Individual Voluntary Arrangement, High Court Judgment, Administrative Order or decree, Debt Relief Order	Credit reference agency data: an overall result plus defaults, multiple arrears, significant arrears and whether there is a debt management plan
What it can see	Insolvency-type events	Current financial difficulty, including arrears and defaults
Reach	7% of active accounts checked in the first three months at £500 (Commission data request)	Fewer than 3% of accounts when fully implemented; stage 1 trigger exceeded by fewer than 0.5% of customers
Validity	A check lasts six months, even if the customer crosses the threshold again	Validity period was a pilot question; no published answer yet

Two findings from the Commission’s May 2026 review of FVCs matter for anyone building the FRA flow:

• Some operators reported that they were receiving credit reference data through their FVC. The Commission says that sharing is not permitted and treated the answers as a misunderstanding by whoever filled in the return.
• Automated account stops on a single CCJ create friction the rules do not require. The Commission suggests deposit limits or a manual review instead.

The 2023 White Paper had proposed light-touch checks at £125 of net loss a month or £500 a year. Those figures never became the rule: the operative test is £150 of net deposits in 30 days. A headline circulating in July 2026 described the new FRA as a “£125 trigger”. It is the old light-touch proposal, not the FRA threshold.

What stage 1 does not catch

Stage 1 has a 24-hour trigger and nothing else. The 90-day trigger arrives only at the final stage.

Read literally, a customer aged 25 or over whose net deposits stay under £5,000 in every rolling 24-hour window can put in up to £450,000 net over 90 days without an FRA being required at stage 1. That is 150 times the final 90-day trigger. For under-25s the same arithmetic gives £225,000, 112.5 times the final £2,000.

This is a limit of the FRA trigger, not a gap in the licence. SR code 3.4.3 already requires operators to use a range of indicators of harm, including patterns of spend, time spent gambling and changing payment methods. The Commission’s July blog points to that code when asked about factors beyond spend. A customer depositing £4,900 a day for weeks is a customer-interaction case under existing rules, with or without an FRA.

The same reading applies to the operator side. “Largest operators” is not defined in the July news release or blog. The pilot used fee categories J1, K1 and L1. Whether stage 1 uses the same cut is one of the points the consultation response should settle.

What an FRA returns and what the operator must do with it

The operator receives an overall financial risk assessment and four data points: defaults, multiple arrears, significant arrears and whether the customer has a debt management plan. During the pilot, credit reference agencies could also use current account turnover data inside their models, but no turnover data and no derived income figure reached the gambling business.

The Commission has said what it expects after a flag:

• Consider everything known about the customer, including what lowers risk, and act in proportion.
• Options include reducing marketing, helping the customer set deposit limits, “or more where needed”.
• Do not request documents routinely after an assessment. The July blog says that “would serve no regulatory purpose”.
• Use the data only for regulatory purposes, never commercially. The Commission describes this as part of the proposed licence condition.

For the roughly 1 in 1,000 accounts that need an assessment but cannot get one frictionlessly, the operator must verify identity properly and may assess risk another way, through open banking or documents. The pilot found that some of these customers had never had their identity verified properly: registrations with an initial instead of a full name, or a commercial address. The Commission’s April 2026 blog calls that a possible breach of existing age and identity rules.

The pilot numbers the Commission relies on: 97% of assessments frictionless, against 80% estimated in the 2023 White Paper; 0.1% of accounts needing an assessment and unable to get one frictionlessly, against 0.6% estimated.

Who this applies to

The Commission describes FRAs as a way of identifying high-spending remote gambling customers, and the pilot condition covered only remote bingo, casino and betting licences. An operator licensed elsewhere, in Malta or Gibraltar for instance, that takes British customers needs a Commission licence and falls under the same rules. See the UK jurisdiction profile for the licence itself and the UK licence fees from 1 October 2026 for the fee bands.

The British model is a trigger, not a cap. The Commission says in its April 2026 blog that there are no plans to introduce spending limits. The Netherlands takes the other route: a net deposit limit of €300 a month for players under 24 and €700 for older players unless affordability is shown, covered in our Netherlands licence page.

What to do before the start date

1. Keep the FVC and the FRA separate in systems and in records. They use different data, triggers and legal bases. Map each to its own SR code.
2. Fix identity data now. Full names and residential addresses decide whether an FRA can be frictionless. This is already a licence requirement.
3. Compute net deposits over rolling 24-hour and 90-day windows. Stage 1 needs only the first; the final stage needs both, with separate values for under-25s.
4. Write the post-flag playbook before the data arrives. It should start from marketing reduction and deposit limits, not from document requests or account closure.
5. Keep FRA results out of commercial systems. CRM, VIP and bonus engines should not be able to read them.
6. Watch for the consultation response. It is the document that sets the stage 1 date, and possibly which operators “largest” means.

For the wider White Paper package (stake limits, the statutory levy, bonus rules), see the UK White Paper status page.

What is still open

• The stage 1 start date and the formal consultation response.
• The definition of “largest operators” for stage 1.
• The interim thresholds and the dates for later stages.
• The validity period of an FRA when a customer crosses a threshold again.
• Guidance on proportionate action, which the Commission says it will develop with implementation groups.

The Commission said in April 2026 that NatCen’s evaluation reports on the pilot would be published alongside its decisions. We did not find them on the Commission’s news or blog pages on 16 October 2026.