Once a year, every online casino licensed in Great Britain has to let an outside auditor into its systems.
The auditor must be independent of the company, the audit must follow a set of controls the Gambling Commission has written into its technical standards, and the final report must be kept on file, where the Commission can call for it at seven days’ notice.
That is what “secure” means on a licensed site: somebody outside the company has checked.
That audit is one of several checks done on a player’s behalf by organisations other than the casino, and people who choose a casino carefully are mostly working out which of those organisations stands behind a given site.
The Commission handles the licence and the audit. A test laboratory checks the games. The bank and a national self-exclusion scheme cover some of the rest.
What is left for the customer to do is smaller than the marketing suggests.
The licence is on a public register
The Commission’s licence conditions tell an operator where to put its licence: every screen from which a customer can gamble has to carry a statement that the site is licensed by the Commission, the operator’s account number, and a link to the operator’s own entry in the Commission’s register.
That entry shows whether the licence is active, which activities it covers, which web addresses it applies to, and whether the Commission has taken any regulatory action against the business.
If a site shows a licence number but its own address is not listed in that entry, the licence does not cover it.
What “secure” means, and where your data goes
The Commission’s security requirements are taken from Annex A of the ISO/IEC 27001:2022 standard, and they are what the annual audit is measured against.
They cover things like access rights, logging and staff training as well as encryption. Every secure online casino on the Commission’s register, Betway’s included, passes that audit each year. The customer never sees the result.
The report stays on the operator’s file until the Commission asks for it, so a player is relying on the Commission having looked.
What happens to a customer’s details once they have been handed over is UK GDPR’s business, and the practical version of that law is the privacy notice.
Betway tells customers in its notice that it sends their name, address and birth date to TransUnion, a credit reference agency, when it runs an affordability check, and that a fingerprint or face scan used to unlock its app never reaches the company.
That is the level of detail the law requires, and it is where a player finds out who else will be handling their information.
The same law lets a customer ask any operator what it holds about them and, in some circumstances, have it deleted, and it obliges a business that suffers a breach likely to put people at risk to report it to the Information Commissioner’s Office within 72 hours.
Nobody inspects the login on the customer’s behalf. The Commission does not require two-step verification on a gambling account, and the National Cyber Security Centre calls turning it on one of the most effective ways to protect any online account.
It will not stop every kind of fraud. While extra login checks safeguard accounts from password theft, they cannot shield against scam calls that trick people into granting access directly.
With it switched on, though, a stolen password on its own gets a thief nowhere.
The tools that come with the licence
Deposit limits, reality checks, a time-out option and self-exclusion are licence requirements on every British-licensed site.
Self-exclusion from all of them at once runs through GAMSTOP, which is free, and which online operators have been required to join since March 2020.
It covers the National Lottery’s online instant-win games but not its draw games, and it does not cover betting shops, which use a sister service with its own sign-up.
Complaints also have a fixed route.
The operator has eight weeks to resolve one, after which the dispute goes to an approved alternative dispute resolution body, such as IBAS, and the service has to be free to the customer.
Who checks the games, and who checks the money
The Commission publishes a list of approved test houses, and games of chance have to go through one of them before they can be released to British customers.
eCOGRA, founded in 2003 and based in London, is on that list and tests random number generators and return-to-player figures.
Its separate eGAP seal covers a wider set of standards on player protection and how the operator is run.
The bank does part of the work too. Credit cards have been banned for gambling in Great Britain since 14 April 2020, and the ban extends to e-wallets topped up from a credit card, so a licensed site takes debit cards, e-wallets, or bank transfers.
Most high-street banks now also offer a gambling block on debit cards, with a 48- or 72-hour delay before it can be switched off again. It lives in the banking app, and it works on unlicensed sites as well as licensed ones.
By Angelica Magombedze with support from AI
Advertising feature with Betway
