Due to a long spate of enforcement actions in the first half of the year, the UK Gambling Commission (UKGC) will undergo changes to the way it determines financial penalties.

The regulator stated today (10 July) that it wants to make the process more transparent, particularly around the steps taken to determine the seriousness of a regulatory offence, a matter highlighted to the Commission in previous industry consultations.

Fines, financial penalties and other enforcement actions are now going to be subject to a seven step process, with regulatory breaches ranked along five levels of seriousness.

The extent of a financial penalty will be determined by the gravity of the breach, based on the five levels, and the percentage of an operator’s yearly gross gambling yield or other income at the time the breach occurred.

John Pierce, UKGC Director of Enforcement and Intelligence, said: “We are making changes to strengthen the transparency and consistency of how we impose financial penalties.

“These proposals were subject to extensive consultation, and the views shared by all our stakeholders have been taken into account.

“The resulting changes will strengthen our decision-making and streamline the calculation of penalties – helping to improve the efficiency and effectiveness of our enforcement work.”

Commission clears up communication on enforcement
The UKGC is one of the most active regulators in Europe when it comes to enforcing standards across its industry. Given the vast scale of the British gaming industry, the often strict monitoring it engages in is necessary.

Headlines have often been generated as a result of the hefty penalties imposed by the regulator. Most notably, records were broken in 2022 and 2023 when huge penalties of £17m and £19m were issued to Entain and William Hill respectively for anti-money laundering and social responsibility shortcomings.

At the time, both gambling Plcs responded that the record penalties had been imposed on their business for the period of 2019-to-2020, prior to undertaking mandatory compliance changes on AML, customer care and responsible gambling.

This year has been no different. The past six months alone have seen the regulator take aim at Merkur Slots, the Football Pools, Corbett Bookmakers, SpreadEx and most recently Fafabet, issuing penalties of varying size.

With a focus on transparency, the UKGC is hoping to reduce the number of enforcement actions though, according to Pierce. The regulator hopes that the new process will encourage greater compliance with UK regulations, and catch out acts of non-compliance before things have to escalate to penalties or fines.

Additionally, the Commission has also clarified that penalties against society lotteries will not be determined by GGY or income. This comes amid a wider review of society lottery regulations, with the government evaluating whether to raise the limit on how many ticket sales these lotteries can make each year.

“Crucially, the new approach also encourages compliance at the earliest opportunity, supporting the protection of consumers alongside fair and proportionate outcomes for operators,” Pierce concluded.

“Where fines are imposed on society lotteries, registered charities or personal licence holders these will not be based upon a percentage of the GGY accrued during the breach period, rather an appropriate alternative will be used.”

The UK Statistics Authority has warned the Department for Health and Social Care and the Office for Health Improvement and Disparities (OHID) about the misuse of suicide statistics. Disparities at the Office for Disparities: The statistics regulator also noted problems with the OHID report, which assumes:  Lies, damned lies etc: The issue of the misuse…

Flutter Entertainment confirmed yesterday (8 July) that its Paddy Power and Betfair UK brands had been subject to a heavy cyber attack.

The respective sportsbook and betting exchange brands were targeted by cyber criminals who were able to access information like emails and account names.

It is understood that a significant number of customer accounts were targeted. However, Flutter stated that serious information like passwords, ID documents and payment details, were not accessed by the cyber attackers.

“We can confirm that our Paddy Power and Betfair businesses have suffered a data incident involving personal information for some of our customers,” a Flutter statement provided to SBC News read.

“Immediately upon becoming aware of this incident, we informed relevant regulators and authorities and initiated a full investigation, supported by external IT security experts, to understand what happened and how we can better protect our networks and customers.

“The unauthorised access has been removed and the incident contained. Our investigation concluded that the affected information was isolated to limited betting account information. No passwords, ID documents or usable card or payment details were impacted. We are informing all affected customers.

“Safeguarding and securing our customers’ information is of the utmost importance to us.”

The incident highlights the extent of cybercrime threats to online-focused businesses, with a huge range of companies subject to attacks over the past year, not just those in the gambling sector.

The British government’s Cyber Security Breaches Survey for 2025, for example, found that 43% of UK businesses reported a cyber security breach or attack in the past year – showing that Paddy Power and Betfair’s recent issue is hardly uncommon.

For companies like Flutter, which has access to one of the best tech stacks the industry has to offer as well as other important aspects like legal counsel, overcoming cyber security issues is a challenge – but not an enormous one.

For the many SMEs which make up both the B2C and B2B pillars of the betting industry, cyber issues may present more of a challenge.

According to a study conducted by Umazi, a digital ID platform, which was released the same day as the attack on Flutter, SMEs are the biggest victims of cyber criminality. The firm’s study found that 70% of SMEs are worried that business identity information and other data could be stolen.

“This isn’t a digital economy, it’s a digital illusion,” said Cindy van Niekerk, CEO and Founder of Umazi. “While regulators and corporates applaud innovation, SMEs are being left behind with legacy processes that actively undermine cybersecurity and economic growth.”

The British government, which is acutely aware of how big a contribution financial services make to its economy, has attempted to clamp down on cyber crime through legislation, such as the Product Security and Telecommunications Infrastructure Act.

These measures will provide some support to betting and gaming firms as much as any other digital business. However, the attacks against Flutter, one of the biggest betting firms in the world, showcases the boldness of cyber criminals and the extent of the threat faced by businesses large and small.