Online gambling self-exclusion: implementation checklist

Which systems need the exclusion state?

The UKGC requires operators to have their own arrangements and describes multi-operator schemes. The relevant scope and implementation details must come from the current rules for the particular business.

Map where the customer exists: account platform, customer support, marketing, affiliate processes and any other relevant system. Identify the authoritative record and how updates reach each dependent system. An exclusion recorded only in a support ticket can leave active access elsewhere.

What should be tested at the time of exclusion?

Test both the normal request and failure cases. The following is an implementation checklist rather than a replacement for jurisdiction-specific requirements.

• The customer can find and use the request process.
• The correct restriction reaches the gambling platform.
• Relevant scheduled marketing is suppressed.
• Support sees the correct status and escalation instructions.
• Attempts to create another account are assessed through appropriate controls.
• Failures in an integration create an alert and a defined response.

How should duplicate accounts and identity changes be handled?

Use appropriate identity matching and manual review where needed. A customer may use a different email address or have inconsistent records. The process should resolve relevant matches without assuming every similar name is the same person.

Document the data used, the decision and the action taken. Keep the process proportionate and privacy-conscious. It is possible to fail both ways: missing a relevant match or incorrectly restricting another individual.

What happens when an exclusion period ends?

Do not assume that expiry means immediate automatic reactivation and renewed marketing. Check the applicable return process, cooling-off requirements and any required positive action by the customer.

Separate the account-access decision from marketing eligibility. Test that a system date change does not silently switch every permission back on. Support staff should have instructions that match the actual legal and technical process.

How should an operator measure effectiveness?

Track failures to apply restrictions, inappropriate marketing, unresolved identity matches and integration delays. Investigate root causes instead of treating each incident as an isolated support issue.

Use controlled test accounts and documented case reviews. Where a supplier operates part of the process, obtain evidence of the relevant controls and agree incident responsibilities. A vendor contract stating that self-exclusion is supported does not establish that the operator’s deployed configuration works.