UKGC Deposit and Loss Limits: What the White Paper Reforms Demand From Operators Right Now

The Gambling Act Review White Paper, published in April 2023, committed the UK government to the most significant overhaul of remote gambling regulation in two decades. Three years on, the specific obligations that matter to compliance teams are not the broad policy ambitions but the precise, dated requirements that are already in force, those arriving on 30 September 2026, and those under staged rollout via Financial Risk Assessments. This article maps each obligation to its source, effective date, and operational implication.

The RTS 12 Framework: What Has Always Applied and What Has Now Changed

The baseline obligation for financial limits sits in the Gambling Commission’s Remote Gambling and Software Technical Standards, specifically the RTS 12 series. RTS 12A requires that all remote gambling licensees must offer customers the facility to set a financial limit as part of the registration process or at the point the customer makes the first deposit or payment. The limit must be implemented as soon as practicable after the customer’s request, and the customer must be informed when the limit will come into force.

RTS Implementation Guidance 12A defines three permissible limit types. Deposit limits cap the amount a customer deposits into their account over a particular duration. Spend limits cap the amount a customer spends on gambling or specific products over a defined period, and are appropriate where the customer does not hold a deposit account with the operator. Loss limits cap the amount lost, defined as total stakes minus total winnings returned, for the period applied. The Commission has clarified the loss limit definition to read: “the total value of stakes placed on gambling products minus the total value of any winnings or returns from those stakes is limited for the period or duration of the limit applied.”

Time periods offered must include at least 24 hours, 7 days, and one month. Where a customer sets simultaneous time frames, the lowest limit always governs: a customer setting a daily deposit limit of £10 and a weekly limit of £100 cannot deposit more than £10 per day, leaving a maximum of £70 for the remainder of the week.

RTS 12C and 12D: Accessibility and the Cooling-Off Rule

RTS 12C requires that financial limit facilities be provided via a direct link on the homepage and be clearly visible and accessible. The same accessibility obligation applies on deposit pages and screens. The gambling system must minimise the number of clicks or pages a customer navigates to reach the limit-setting facility. Where communications such as emails or notifications include links to limit-setting tools, those links must go directly to the facility rather than routing through a homepage or intermediate page.

RTS 12D governs the asymmetric treatment of limit changes. Customer-led reductions to limits must be implemented immediately unless systems or technical failures prevent it. Increases, by contrast, may only take effect after a cooling-off period of at least 24 hours has elapsed, and only once the customer has taken positive action at the end of that cooling-off period to confirm the request. The gambling system must also prompt customers to review their limits at a minimum on an annual basis, and to review their transaction history at the point of a limit increase request.

“Customer-led limits must only be increased at the customer’s request, only after a cooling-off period of at least 24 hours has elapsed and only once the customer has taken positive action at the end of the cooling off period to confirm their request.”

What Became Mandatory on 31 October 2025

The first phase of the post-White Paper deposit limit overhaul took effect on 31 October 2025. From that date, all remote gambling licensees must prompt new customers to set deposit limits as part of the account registration process. The prompt must appear before the customer is able to deposit or gamble. Existing customers without limits set must be prompted to review that position at least annually. Licensees must also prompt all customers every six months to review their transaction history and reassess their limits.

The Commission ran a consultation in March 2025 to refine the definition of deposit limits before the second phase. One outcome of that process was definitional clarity: only limits that meet the definition of a gross deposit limit can be referred to as a “deposit limit” in communications to customers. A gross deposit limit caps the total amount a customer deposits into their account over a period, irrespective of withdrawals. The Commission also introduced a new term, “net deposit limit,” covering limits where deposits minus withdrawals determine the period’s cap, and clarified that this type of limit may be offered alongside gross deposit limits as a customer choice, but cannot carry the “deposit limit” label.

The 30 September 2026 Deadline: What Must Change

The second phase of RTS 12B changes was originally scheduled for 30 June 2026. Following stakeholder feedback, the Commission extended the deadline to 30 September 2026, confirmed via a notice published 26 May 2026. From that date, three specific obligations apply to all remote gambling licensees.

Licensees must offer gross deposit limits to customers, and where previous system configurations had removed that option, must re-introduce gross deposit limits to the options presented. Gross deposit limits must be named “deposit limits” exclusively, and no other limit type may carry that label in customer-facing communications. Gross deposit limits must be offered with at least equal prominence as any other type of financial limit presented to the customer.

A further rule applies on timeframes. From 30 September 2026, gross deposit limits may only be offered over fixed time frames. Other limit types, including net deposit limits, spend limits, and loss limits, may be offered over rolling or fixed time frames at the operator’s discretion.

Online Slot Stake Limits: Already in Force

Separate from the deposit limit framework, the Gambling Act 2005 (Operating Licence Conditions)(Amendment) Regulations 2025 introduced maximum stake limits for online slots games by amending the conditions attached to all remote casino operating licences. The £5 maximum stake per game cycle for customers aged 25 and over went live on 9 April 2025. The £2 maximum stake per game cycle for customers aged between 18 and 24 went live on 21 May 2025.

The limits apply to any reel-based game played online where an individual may win a prize based on the resulting arrangement of moving or changing images. A game cycle means the period beginning with the initiation of a game and ending when all staked money has been lost or all winnings have been delivered or made available. Games with multiple game cycles are subject to the limit per cycle, and the minimum 2.5-second interval between game cycles, set out in RTS 14D, continues to apply. The stake limits do not extend to other remote casino games such as roulette, blackjack, or baccarat.

The Commission published market impact data in February 2026 covering operator data through to December 2025, marking three quarters of market data since the stake limit regime commenced. Compliance teams at remote casino licensees should be tracking whether their game libraries have been audited against the statutory definition of “online slots game” as set out in the SI, particularly where game mechanics may sit at the boundary of the reel-based definition.

Financial Vulnerability Checks: The £150 Threshold

The Gambling Act Review White Paper identified two tiers of what have been widely described as affordability checks, though the Commission has consistently preferred the term “financial risk” framework. The lighter tier, Financial Vulnerability Checks, triggers when a customer’s net deposits over a rolling 30-day period exceed £150. The threshold was originally proposed at £500 in the White Paper, the Commission reduced it to £150 following its six-month consultation.

Financial Vulnerability Checks are conducted using publicly available data, principally bankruptcy and insolvency records. The Commission’s design intent is that these checks are frictionless for the customer: no document request, no manual review for the vast majority. The Commission has stated that approximately 3 percent of accounts will be reached by vulnerability checks, though the Betting and Gaming Council has disputed this figure, arguing the affected proportion could be materially higher for active monthly bettors.

These checks sit within the broader customer interaction obligations in the LCCP Social Responsibility Code. Operators must document how vulnerability check outcomes feed into their existing customer monitoring and interaction frameworks under LCCP provision 3.4.3, which introduced structured customer interaction requirements from September 2023.

Financial Risk Assessments: Confirmed, Staged, and Non-Enforcement at Launch

On 7 July 2026, the Gambling Commission confirmed it would proceed with Financial Risk Assessments using a staged approach. FRAs represent the more intensive tier of the financial risk framework: they use credit reference agency data to identify customers experiencing current financial difficulties, rather than assessing what a customer can afford to spend.

Stage one implementation applies to the largest operators and triggers at a high-spend threshold of £5,000 net deposit in a rolling 24-hour period. The Commission describes this as “a very unusually high spend pattern that less than 0.5 percent of customers exceed.” The FRA itself is conducted by Credit Reference Agencies and, for 97 percent of accounts assessed in the pilot, was frictionless and had no impact on the customer’s credit score. For the approximately 1-in-1,000 accounts that cannot receive an automated assessment, licensees are required to verify identity properly and may assess financial risk through open banking or, as a last resort, document requests.

“The vast majority of customers will never require a Financial Risk Assessment, which means people who place an occasional bet, are a recent winning customer or even regularly spend hundreds of pounds would be unlikely to need a check.”

The Commission has explicitly confirmed that during the early stages of implementation, no enforcement action will be taken on a failure to act following a Financial Risk Assessment. This is a significant operational point: licensees are being asked to build and test the process during stage one without the threat of immediate regulatory consequences for FRA-specific failures. The Commission’s intent, as stated in its July 2026 announcement, is that FRAs enable proportionate interventions such as reducing marketing to financially vulnerable customers or supporting customers to set deposit limits, rather than functioning as a binary gatekeeping mechanism.

Identity Verification as a Prerequisite: The August 2026 Reminder

In August 2026, the Commission published a blog post signed by its Director of Major Policy Projects and Evaluation and a Senior Policy Officer, drawing on findings from the FRA pilot and ongoing casework. The blog highlighted that deficiencies in identity verification practices at onboarding had undermined the pilot’s effectiveness and increased consumer friction. The Commission linked these failures to Licence Condition 17, which has been in effect for many years and requires remote licensees to verify a customer’s name, address, and date of birth before permitting gambling.

The Commission’s blog reinforced a specific rule: a request to withdraw funds must not result in a requirement for additional identity information if the licensee could have reasonably requested that information earlier. Compliance teams should treat this as a direct signal that the Commission will scrutinise onboarding-stage identity verification as part of any future FRA enforcement review. Over a quarter of consumer complaints received by the Commission’s Contact Centre relate to identity verification, and it is one of the most common disputes referred to Alternative Dispute Resolution providers.

The Limit Landscape at a Glance

Obligation	Trigger / Threshold	Effective Date	Primary Source
New customer deposit limit prompting	All new accounts at registration	31 October 2025	RTS 12A / 12E (Phase 1)
Bi-annual transaction history prompt	All customers with active accounts	31 October 2025	RTS 12D
Gross deposit limits mandatory, named “deposit limits”	All remote gambling licensees	30 September 2026	RTS 12B (Phase 2)
Online slots stake cap (adults 25+)	£5 per game cycle	9 April 2025	Gambling Act 2005 (OLCA) Regs 2025
Online slots stake cap (adults 18, 24)	£2 per game cycle	21 May 2025	Gambling Act 2005 (OLCA) Regs 2025
Financial Vulnerability Checks	£150 net deposit over rolling 30 days	Phased (pilot completed)	White Paper / LCCP 3.4.3
Financial Risk Assessments (Stage 1)	£5,000 net deposit in rolling 24 hours	Staged from July 2026	UKGC FRA announcement, 7 July 2026

What Operators Should Be Building Now

The 30 September 2026 deadline requires technical changes that cannot be left to September. System configurations that currently present spend limits or net deposit limits under the label “deposit limit” must be reconfigured. Where gross deposit limits were removed from product offerings at any point, they must be restored. The equal-prominence requirement means that user interface hierarchies presenting other limit types above gross deposit limits will need to be redesigned.

For the FRA programme, the Commission’s staged and non-enforcement approach for early failures is a deliberate grace period, not an indefinite deferral. Licensees that have not already onboarded a Credit Reference Agency data feed should begin scoping that integration now. The Commission’s pilot ran from August 2024 at a £500 monthly threshold, dropping to £150 from February 2025, before the staged go-live was confirmed in July 2026 at the £5,000/24-hour Stage 1 level. The Commission has confirmed it will continue working with operators and Credit Reference Agencies to refine assessments and develop guidance, and subsequent stages will bring thresholds down from the current Stage 1 level.

Compliance officers at remote casino licensees should also run a cross-check between their game library and the SI definition of “online slots game” to confirm no reel-based games have been overlooked in the stake limit implementation. The Commission’s market impact data confirmed the stake limits have been live for over a year, any outstanding gaps represent current non-compliance rather than a future deadline.

For broader context on how these player protection obligations sit within the UKGC’s full cost and compliance architecture, the UKGC vs MGA 2026 licence cost comparison models the five-year total cost of ownership for a remote operating licence, including the statutory levy obligations and third-party audit spend that sit alongside the limit requirements addressed here.

Qualified legal counsel should be engaged for any jurisdiction-specific application of the requirements, particularly where an operator serves customers across multiple regulated markets and needs to determine how UKGC obligations interact with requirements in other jurisdictions.

Key Resources

UK Gambling Commission, Remote Gambling and Software Technical Standards (RTS), including RTS 12A, 12B, 12C, 12D, and 12E: gamblingcommission.gov.uk

Implementation Extension for New Deposit Limit Requirements, Gambling Commission, 26 May 2026: gamblingcommission.gov.uk

Commission to Introduce Financial Risk Assessments in Staged Approach, Gambling Commission, 7 July 2026: gamblingcommission.gov.uk

Online Slots Stake Limit Guidance (Gambling Act 2005 (Operating Licence Conditions)(Amendment) Regulations 2025): gamblingcommission.gov.uk

Supplementary Consultation: Definition of Deposit Limits in the Remote Gambling and Software Technical Standards, Gambling Commission, response published 7 October 2025: gamblingcommission.gov.uk