Affordability Checks vs Spending Limits: UKGC, Sweden, Denmark, Spain, Ontario

A spending limit caps what a customer can put in, and a financial check asks whether a customer who has put in a lot is showing signs of financial distress. As of October 2026, the UK Gambling Commission (UKGC) runs the second model, with no cap and a risk-triggered check. Sweden, Denmark and Ontario run the first, requiring player-set limits with a duty on the licensee to intervene. Spain is moving from per-operator ceilings to a single cross-operator limit.

This comparison reads the LCCP text, the Swedish Gambling Act and Gambling Ordinance, Spillemyndigheden’s guidance on responsible gambling (version 1.4), the consolidated Spanish royal decrees and the AGCO Registrar’s Standards for Internet Gaming, supplemented by trade press for 2026 developments. Press-sourced figures are attributed in the text.

Affordability check or spending limit: how do the two obligations differ?

A spending limit is a fixed number that stops further deposits or losses once reached. It is mechanical, it is set either by the player or by the regulator, and the licensee has no discretion over whether it applies. An affordability check, which the UKGC now calls a financial vulnerability check or financial risk assessment, is triggered by a spend threshold but produces information rather than a block. The licensee then decides what proportionate action to take.

The UKGC has been explicit that its checks are not caps. In its consultation response, the Commission said it does “not seek to mandate a cap on gambling, or to interrupt the customer journey unnecessarily.”

“The checks we have been piloting will not even attempt to make an assessment of what each customer can afford to gamble.” Tim Miller, UKGC Executive Director, Ethical Gambling Forum.

Industry shorthand still calls the UK checks “affordability checks”, but the Commission’s own materials describe a detection mechanism that feeds licensee decisions. The sources reviewed show no equivalent financial-data check in Sweden, Denmark or Ontario. Their regulators combine a mandatory limit-setting step with an open-ended duty to monitor behaviour.

Regime logic by jurisdiction, as of October 2026

Jurisdiction	Primary mechanism	Who sets the number	Licensee discretion	Recent enforcement signal
UKGC	Risk-triggered financial checks plus customer interaction duty	Commission sets trigger thresholds, no cap	High on action, none on running the check	Petfre (Gibraltar) £900,000, public statement 30 June 2026
Sweden	Mandatory player-set limits plus duty of care	Player	Medium, bounded by guidance	Hillside (bet365) SEK 44 million, upheld on appeal
Denmark	Mandatory player-set deposit limit plus attention duty	Player, no licensee default allowed	Medium	No enforcement case in the sources reviewed, guidance v1.4 sets intervention expectations
Spain	Regulator-set ceilings, moving to joint cross-operator limit	Regulator (Annex II), then DGOJ default	Low	Joint system targeted for 26 March 2027
Ontario	Offered limit tools plus behavioural monitoring	Player	High on monitoring design	theScore C$105,000 for failed high-risk intervention

Which numeric thresholds apply in each jurisdiction?

As of October 2026, the UKGC triggers a financial vulnerability check at £150 net deposits over a rolling 30 days, with Financial Risk Assessments announced at £5,000 in 24 hours for stage one. Sweden, Denmark and Ontario set no figure, because the player chooses the limit. Spain fixes the figure by regulation. The table separates trigger thresholds, which start a check or an obligation to act, from limit values, which stop deposits. Figures for Spain’s joint system and the UKGC’s Financial Risk Assessments come from trade reporting of regulator announcements in 2026, while the other figures come from the regulatory texts cited in each section.

Financial thresholds and timing rules, as of October 2026

Jurisdiction	Threshold or limit	Type	Change or relaxation rule
UKGC, financial vulnerability check	Deposits minus withdrawals above £150 in a rolling 30 days (from 28 February 2025, £500 from 30 August 2024)	Trigger for check	Check not repeated if a check or FRA was done in the prior 12 months
UKGC, FRA stage one (announced 7 July 2026)	£5,000 net deposit in rolling 24 hours, £2,500 for younger and other high-risk customers	Trigger for credit reference agency assessment	Timetable to be finalised after consultation
UKGC, FRA full operation (announced)	25 and over: £1,000 in 24 hours or £3,000 over 90 days. Under 25: £750 or £2,000	Trigger for assessment	Not applicable
Sweden	Player-set limits per day, week and month, SEK 10,000 per month flagged in guidance	Limit	Decrease immediate, increase after at least 72 hours
Denmark	Player sets at least one daily, weekly or monthly deposit limit before play	Limit	Decrease immediate, increase after at least 24 hours
Spain, current	€600 per day, €1,500 per week, €3,000 per month (Annex II ceilings)	Regulator-set cap	Player requests increases individually and expressly
Spain, joint system (target 26 March 2027)	€700 per day, €1,750 per week, €3,300 per four weeks, aggregated across operators	Default cap	Three working days to take effect, increases once every three months
Ontario	Player chooses deposit and/or loss limits, periods include 24 hours, 7 days and one month	Limit	Relaxation only after a cooling-off period of at least 24 hours

UKGC: risk-triggered checks with no spending cap

The UKGC regime has two layers of financial check, both sitting on top of the customer interaction duty in Social Responsibility Code Provision 3.4.3 of the Licence Conditions and Codes of Practice (LCCP). That provision requires remote licensees to implement effective customer interaction systems that embed the three elements of identify, act and evaluate. The requirements in paragraphs 2 and 3 have been in force since 31 October 2023, and the remainder of the provision since 12 September 2022. Licensees must also take problem gambling rates for the relevant activity into account when checking whether their volume of interactions is at least in line with those rates, although the provision states that it does not mandate the outcome of those interactions.

The first layer is the financial vulnerability check, which the LCCP triggers when a customer’s deposits minus withdrawals exceed £150 in a rolling 30-day period from 28 February 2025. Between 30 August 2024 and 27 February 2025 the threshold was £500. The check is light-touch and uses publicly available data such as bankruptcy records. The licensee must record its rationale for the proportionate action it takes. It must also hold policies on whether action is taken manually, in a fully automated way with the customer offered manual review, or through a combination, and on when immediate action is needed to limit harm. A licensee need not repeat the check if it has completed a vulnerability check or financial risk assessment within the previous 12 months.

The second layer, the Financial Risk Assessment, uses credit reference agency data. The LCCP pilot provisions required licensees to request an assessment from a credit reference agency for each relevant customer, within 10 working days in the first two pilot stages and within 24 hours in the third. Customers qualified by exceeding daily or 90-day net deposit thresholds. The Commission announced the permanent rollout on 7 July 2026. According to iGaming Business, net deposits above £5,000 in a rolling 24-hour period will trigger a credit check at stage one, with the Commission saying only 0.5% of UK customers cross that line. Stage one targets the largest operators, and the threshold is £2,500 for younger customers and other high-risk demographics.

The fully operational triggers reported are £1,000 in 24 hours or £3,000 over a rolling 90 days for customers aged 25 and over, and £750 or £2,000 for those under 25. The 2023 White Paper had proposed a £2,000 loss over 90 days. The Commission also said no enforcement action will follow FRA failures during early implementation, and the stage one timetable is subject to industry consultation. The Betting and Gaming Council said on 7 July 2026 that it was considering “all options,” according to SBC News, so the timetable can still move.

The Commission describes the outputs as a way to identify customers, not to stop them. It said the programme is not a binary decision to stop serving customers, and that interventions can include reduced marketing or deposit limits. Enforcement attaches to how the licensee acts on risk indicators. The Commission published its Petfre (Gibraltar) Limited public statement on 30 June 2026, covering the Betfred online business. According to trade press reports of the statement, Petfre agreed to pay £900,000 over failures against SR Code Provision 3.4.3, including insufficient automation in detecting excessive spend and playtime and a procedural flaw that prevented accounts being re-flagged for seven days.

The Commission’s December 2025 action against Done Brothers (Cash Betting) Limited, at £825,000, adds a second data point. The Commission found that the licensee’s source-of-income enquiry thresholds, set at £15,000 losses and £125,000 stakes in 365 days, were not appropriately risk based. Licensees that run affordability triggers and anti-money laundering source-of-funds triggers separately should expect the Commission to test both. For cost and licence-maintenance context across the UK and Malta, see the UKGC and MGA licence cost comparison.

Sweden and Denmark: the player sets the number, the licensee carries the duty

Sweden’s Gambling Act (2018:1138), Chapter 14, Section 1 imposes a duty of care (omsorgsplikt) on every licence holder and includes continuous monitoring of gambling behaviour. Licensees must set out in an action plan how they will meet the duty. Section 7 of the same chapter requires players to be able to set deposit and loss limits. As of October 2026, the Gambling Ordinance (2018:1475), Chapter 11, Section 3 requires the limits to be expressed per day, week and month, a reduction to take effect immediately, and an increase to take effect no earlier than 72 hours later.

The Spelinspektionen guidance on the duty of care adds a financial marker without making it a cap. Raising a deposit limit is treated as an indicator of excessive gambling. Where a licensee allows limits above SEK 10,000 per month, the guidance says those players need particular attention to other indicators, because they are not caught by reaching their limit. A pop-up cannot be the only contact measure when a limit is raised or a limit above SEK 10,000 per month is entered. The guidance refers to email or telephone contact, citing the Administrative Court of Appeal in Jönköping, case 3745-19.

The Hillside case shows how literally Spelinspektionen reads the mandatory-number rule. Between 1 January 2019 and 19 April 2022, bet365’s Swedish entities let customers choose a “no limit” option, backed by a hidden technical ceiling of SEK 500 million. The Swedish Administrative Court of Appeal upheld SEK 40 million against Hillside (Sports) and SEK 4 million against Hillside (Gaming), plus warnings, according to reports in October 2026. The regulator held that a ceiling the customer could not see or set did not satisfy the player-selected limit requirement. It also found that the licensee relied too heavily on automated pop-ups, emails and spend reminders. Trade press reported that the licences survived after corrective action that included manual reviews of high-loss players.

Sweden has also added a payment-source restriction. According to reporting in 2026, from 1 May 2026 licensees must ensure deposits cannot be traced to credit cards, overdrafts, loans or buy-now-pay-later services. This control polices the source of funds rather than the amount or the customer’s finances. The effect of strict limit regimes on the licensed share of the market is covered in Sweden’s channelisation analysis.

Spillemyndigheden’s responsible gambling guidance (version 1.4, 6 December 2022) takes the same mandatory-number approach. Setting a deposit limit must be a compulsory step when an account is created, and existing customers without one must set a limit before continuing to play. The player must set at least one daily, weekly or monthly deposit limit. The licensee may not pre-determine the figure, and the player must make an active choice. An increase can take effect no earlier than 24 hours after the request, while a decrease is immediate. Licensees may offer extra loss or time limits, but not as a replacement for the statutory deposit limit.

Denmark pairs the limit with an attention duty. Section 16(1) of the online betting executive order and Section 22(1) of the online casino executive order require the licensee to become familiar with a player’s gambling patterns and take measures to prevent problematic behaviour. The guidance states that a player’s wish not to be contacted can never remove the licensee’s obligation to prevent problem gambling, and that standard intervention programmes may be adapted where a player responds badly.

Spain: regulator-set ceilings moving to a joint cross-operator limit

Spain is the only jurisdiction of the five where the regulator fixes the number. Article 36 of Royal Decree 1614/2011, as redrafted by Royal Decree 958/2020, requires operators to set economic limits on deposits per day, week or month for each participant, and those limits may not exceed the amounts in Annex II. As of October 2026, the consolidated Annex II sets €600 per day, €1,500 per week and €3,000 per month. Operators must also let participants voluntarily set lower limits, and a participant can expressly request an increase.

The Government approved a new Royal Decree in June 2026 creating a joint limit across all licensed operators, according to trade press reports. The DGOJ roadmap published in October 2026 sets default limits of €700 per day, €1,750 per week and €3,300 over four weeks, aggregated per player across operators, with deposits blocked across all accounts once a threshold is reached. The limits run alongside operator-level controls. Changes to the joint limit take three working days to become effective, and increases are possible once every three months, according to the same reporting. Full implementation is targeted for 26 March 2027 after testing through 2026, and the DGOJ has said technical integration and compliance rest solely with licensees. The DGOJ attributes the reform to the 31% of Spanish online gamblers who use multiple operators.

The reported default figures are higher than the Annex II ceilings in the consolidated text of Royal Decree 1614/2011, so the instrument that finally governs the numbers must be checked against the published decree before system design is finalised. The industry body Jdigital has warned about black-market leakage and the cost of real-time cross-operator tracking, according to trade press in June 2026. The DGOJ is also working on a common algorithm to detect gambling harm and risky behaviour.

Ontario: limit tools are mandatory, intervention is judged on outcomes

As of October 2026, the AGCO Registrar’s Standards for Internet Gaming require operators to give players the option to set loss and deposit limits during registration. Operators must offer deposit limits, loss limits, or both. The periods offered must include 24 hours, 7 days and one month, and where a player sets simultaneous periods the lowest limit applies. Limit functions must be easy to find, reach and change after registration. Standard 2.24 requires a cooling-off period of at least 24 hours before a request to relax or eliminate an existing limit takes effect. Ontario prescribes limit mechanics but not limit values.

The behavioural layer is where Ontario licensees carry discretion and risk. Standard 2.10 covers detecting and addressing situations where players may be experiencing harm, including whether operators intervene appropriately with individual players. According to a mid-year 2025 legal update on Ontario’s gaming sector, the AGCO issued guidance in June 2025 on enforcing Standards 2.10 and 2.11, requiring real-time behavioural monitoring. Repeated deposits in short timeframes, excessive session lengths and apparent loss-chasing must trigger escalated responses, with detailed time-stamped records of interventions. The Standards reviewed contain no financial trigger of the kind the UKGC uses.

The theScore penalty of C$105,000 shows how enforcement works without a threshold. According to reporting on the AGCO decision, a patron wagered C$2.5 million and showed loss-chasing over eight months, while the operator relied on player self-assessments instead of meaningful due diligence. The AGCO found failures in harm-minimisation policy, player monitoring and training. Ontario’s wider enforcement picture is covered in Ontario iGaming at year three.

Decision frame: which regime applies to which licensee

The points below are analysis, and each licensee should confirm application with qualified legal counsel in the relevant jurisdiction.

A licensee holding a UKGC remote licence needs two parallel capabilities, a threshold-based detection engine that fires the financial vulnerability check at £150 net deposits over 30 days, and a behavioural markers system that satisfies SR Code Provision 3.4.3. The FRA integration with credit reference agencies is required for the largest operators first, so mid-size licensees should build to the announced £1,000 and £3,000 triggers and the under-25 variants and then confirm the stage timetable once consulted. A UK licensee does not need to impose any spending cap, and imposing one does not substitute for the check.

A licensee in Sweden or Denmark needs a hard-gated limit-setting step at account creation and for existing customers, with timing rules of 72 hours for increases in Sweden and 24 hours in Denmark. It also needs a documented intervention process that does not rely on automated messages alone. The Hillside decision makes any hidden ceiling or “no limit” option a material risk in Sweden, and the Danish guidance bars licensee-chosen default limits.

A licensee in Spain should build for the Annex II ceilings today and for the DGOJ joint limit from the 26 March 2027 target. The aggregation means each licensee’s own balance and deposit data must connect to a regulator-run service, and the DGOJ places responsibility for integration on the licensee.

A licensee in Ontario needs limit tools with the 24-hour, 7-day and one-month periods, the lowest-limit rule and the 24-hour relaxation delay, then a monitoring engine tuned to the Standards 2.10 and 2.11 behaviours. Because the Standards reviewed set no financial triggers, a licensee should document its own thresholds and the rationale for them, as theScore’s reliance on self-assessment drew a penalty. Review the Ontario iGaming at year three article to understand the enforcement trends shaping expectations across all Ontario operators.

Frequently asked questions

Are UKGC affordability checks the same as spending limits?

No. The UKGC does not set a cap on gambling. As of October 2026, a net deposit of £150 in a rolling 30 days triggers a financial vulnerability check, and the licensee decides on proportionate action. The Commission has said the checks will not assess what a customer can afford to gamble.

What are the UKGC Financial Risk Assessment thresholds?

As announced on 7 July 2026, stage one is £5,000 in net deposits in a rolling 24 hours, or £2,500 for younger and other high-risk customers. Once fully operational, the reported triggers are £1,000 in 24 hours or £3,000 over 90 days for customers aged 25 and over, and £750 or £2,000 for those under 25. The stage one timetable is subject to consultation.

Which jurisdictions require a player to set a deposit limit before playing?

Denmark requires a player to set at least one daily, weekly or monthly deposit limit before play, with no licensee default allowed. Sweden requires players to be able to set limits per day, week and month, and Spelinspektionen treated bet365’s “no limit” option as a breach. Ontario requires operators to offer limit options during registration.

When does Spain’s joint cross-operator deposit limit start?

The DGOJ roadmap targets full implementation on 26 March 2027 after testing through 2026. The reported default is €700 per day, €1,750 per week and €3,300 per four weeks across all licensed operators. Until then, the Annex II ceilings of €600, €1,500 and €3,000 apply per operator.

Key Resources

UKGC, Licence Conditions and Codes of Practice (SR Code Provision 3.4.3 and the financial vulnerability check provision), and the Commission’s customer interaction guidance for remote gambling licensees.

Sweden, Gambling Act (2018:1138), Gambling Ordinance (2018:1475) and Spelinspektionen’s duty of care guidance and Hillside judgment notice.

Spillemyndigheden, guidance on responsible gambling (version 1.4, 6 December 2022). Spain, Royal Decree 1614/2011 (Article 36 and Annex II) as amended by Royal Decree 958/2020, and the DGOJ joint deposit limit roadmap. AGCO, Registrar’s Standards for Internet Gaming.