Common F2P programme compliance mistakes UK operators make and how to avoid them

Updated October 2, 2026

TL;DR: Sports betting and casino operators running free-to-play (F2P) programmes in Great Britain repeat the same compliance mistakes. Four carry the clearest code requirements: F2P prize pools that mix betting and casino rewards (banned since 19 January 2026), F2P access before age verification, self-exclusion and harm flags that do not suppress F2P invitations, and affiliates promoting F2P games without age checks. Several of these risks trace back to player data split across systems that sync overnight. A governed data layer, such as the one in Xtremepush's XpertOS, enforces compliance independently of AI decisions. Consolidating onto one platform requires upfront investment, and it only closes the gap if the player account management (PAM) system streams events in real time.

For sportsbook and casino operators, free-to-play (F2P) games can look like a pure marketing channel that sits outside the controls on real-money play. UK Gambling Commission (UKGC) rules say otherwise. F2P games have fallen under UKGC age verification rules since 2019, and prize-based F2P games now sit inside the January 2026 incentive rules.

Many F2P compliance mistakes share one pattern. The F2P game, the customer relationship management (CRM) platform, and the PAM system each hold their own version of the same player. A rule applied in one system then fails to reach the others.

Understanding how UKGC enforcement works

Betting and casino operators often meet UKGC enforcement through a compliance assessment. The assessment reviews anti-money laundering (AML) and safer gambling controls, then samples customer accounts. The Commission can request customer records and the audit trail for those accounts.

Recent cases show where controls break down. William Hill group paid a £19.2 million settlement in 2023 for social responsibility and AML failures. In one case, a new customer spent £23,000 in 20 minutes without any checks. Paddy Power Betfair agreed a £2 million settlement in December 2025 after its systems were not sensitive enough to identify indicators of harm in time.

A high-street bookmaker received an £825,000 fine on 3 December 2025 for social responsibility and AML failures in its betting shops. None of these cases involved F2P. Each turned on failures an F2P programme can repeat: harm indicators flagged too late, and checks or thresholds that did not hold up.

Outcomes are public. The UKGC lists cases on its enforcement news page, and large cases reach national press. Only 43% of respondents to UKGC trust research felt the industry performs well at protecting young and vulnerable groups.

Mixing products in F2P prize pools

Sportsbook and casino operators can no longer mix gambling products in a single incentive. The UKGC's ban on mixed-product promotions took effect on 19 January 2026 under Social Responsibility (SR) Code 5.1.1. It covers four product types: betting, casino, bingo, and lottery.

Prize-based F2P games count as incentives, even though no stake is required. UKGC guidance on free reward games treats a game offering "£1 free bet, 5 free spins, or £10 cash" as non-compliant, because the prize pool mixes products. The same game offering free bets of different values, cash, or non-gambling prizes is compliant.

The test is the prize pool, not the player. A mixed prize pool breaches the ban whoever plays the game.

Bonus prizes from an F2P game also fall under the new wagering cap. A £10 bonus and 10 free spins both count as bonuses, so any wagering requirement attached to either is capped at 10 times. Audit every prize pool against one product category, and review the wagering terms on each bonus prize before the game goes live.

Opening F2P games before age verification

Players must pass age verification before they can open a free-to-play version of a gambling game, with no grace period. The rule sits in SR Code 3.2.11 of the Licence Conditions and Codes of Practice (LCCP). It requires remote operators to verify a customer's age before they can deposit, access free-to-play versions of gambling games, or gamble.

LCCP Condition 17.1.1 separately requires operators to verify identity before a customer gambles. The Commission removed the 72-hour window on 7 May 2019, which had let customers play before checks completed.

The typical gap is an F2P entry point that loads before the age check. A free game opened straight from a push notification or a landing page is a common example. Every route into an F2P game needs the same gate as the deposit page.

Letting self-excluded and at-risk players receive F2P promotions

Self-excluded and at-risk players can keep receiving F2P game invitations when the systems that hold their status sync overnight. The F2P game runs on one system, harm monitoring on another, and the CRM on a third.

Operators must stop marketing to a self-excluded player as soon as practicable. They must also flag or remove that player from every marketing database used by the company or group within two days. The UKGC treats an operator unable to demonstrate those steps as in breach of its code.

Harm indicators carry a tighter expectation. SR Code 3.4.3 requires remote operators to flag indicators of harm in a timely way, and the formal guidance expects real or near-time monitoring. The same provision requires operators to prevent marketing and the take-up of new bonus offers once strong indicators of harm appear. An F2P invitation with bonus prizes is both marketing and a route to a bonus offer.

A two-day database deadline leaves room for an overnight batch. Suppression on strong harm indicators is harder to defend that way, because the indicator appears while the player is still active. That suppression depends on event data reaching the CRM during the session. If the PAM holds events for an overnight export, the CRM's speed makes no difference.

F2P activity belongs in the same harm picture. A sudden rise in F2P session frequency is account activity like any other, so it should reach the same risk model as deposits and bets.

Keeping F2P data outside the player record

Online casinos and sportsbooks that log F2P sessions outside the CRM and PAM cannot produce a complete player history when the UKGC requests one. Incomplete records are a common failure pattern. UKGC casework has found licensees "either not recording, or inadequately recording, their rationale and decision making".

Each F2P session, reward claim, and bonus redemption should carry a timestamp, the game played, the outcome, and the reward claimed. Each harm-related check should record the trigger, the decision, and the rationale. The UKGC expects to see a trail of that kind for its financial vulnerability checks.

Mismatches between systems raise the hardest questions. A player marked "active" in the CRM but "self-excluded" in the PAM is a compliance gap, and a compliance assessment will ask which record is correct. A single customer view (SCV) that every system reads from helps settle that question before it is asked.

For systems that hold customer balances and gambling history, logging is a technical requirement under UKGC security standards based on ISO/IEC 27001:2022. An operator that cannot pull a player's full history quickly will struggle to demonstrate compliance when the UKGC asks.

Using the wrong deposit metric for F2P eligibility

Betting and casino operators that use one deposit metric for two different jobs can send F2P rewards to the wrong players. Affordability checks are a common failure point in enforcement, and the UKGC's own checks run on net deposits.

Financial vulnerability checks start when a customer's deposits minus withdrawals exceed £150 in a rolling 30-day period. The new financial risk assessments also use net deposit thresholds, starting at £5,000 in a rolling 24 hours for the largest operators.

Player-set limits work the other way. From 30 September 2026, operators must offer gross deposit limits with at least equal prominence to any other limit type. A net limit lets players deposit more than their limit once withdrawals are offset, so only a gross limit counts as a deposit limit. Net deposit limits remain available as an extra option.

F2P programmes sit downstream of both. Operators can pause F2P bonus prizes for any player with an open financial vulnerability check, as well as for players showing strong harm indicators. That only works if F2P eligibility reads the same flags as the CRM.

Internal thresholds need a written rationale. The £825,000 fine in 2025 covered source of income thresholds that were not appropriately risk based. Document each threshold, its data source, and its review date.

Presenting F2P prizes and terms unclearly

Players must be able to see the significant conditions of an F2P prize alongside the offer itself. UKGC guidance requires significant conditions on promotions to be provided in a clear, timely, transparent, non-misleading and prominent manner. Gambling advertising rules from the Committee of Advertising Practice (CAP) also cover free-to-play games that offer a prize, so F2P is not exempt.

For an F2P game, that means stating the prizes on offer, any wagering requirement on bonus prizes, and any withdrawal restriction alongside the offer. All other terms should be at most one click away.

Joint work by the UKGC and the Competition and Markets Authority (CMA) on unfair terms raised several concerns, and three are relevant to F2P bonus prizes. These are restrictions on withdrawing deposits and winnings, players being unable to tell bonus and deposit balances apart, and unclear promotional conditions.

Promotional language that misrepresents the odds breaks CAP Code rule 8.20, which bars promoters from exaggerating consumers' chances of winning prizes.

In real-money casino games, the UKGC bans any game that celebrates losses as wins. In practice, the ban covers win-style sounds or visuals for a return that is less than or equal to the stake. The same standard says players who choose to leave a game should not be encouraged to keep playing, for example by being offered a free game. That makes the timing of an F2P invitation a design question as well as a marketing one.

Leaving affiliates and third-party games unchecked

Casino and sportsbook brands answer for F2P games that affiliates promote and third parties supply. The Commission has told operators they are responsible for affiliates offering free-to-play games without age verification. A 2020 survey for age verification provider AgeChecked found that fewer than 10% of affiliates polled had added age checks after the UKGC's free-to-play rule change.

Third-party game suppliers fall under the same principle. LCCP 1.1.2 requires licensees to ensure that contracted third parties act as if bound by the same licence conditions and codes of practice.

Audit each affiliate's F2P age-gating before renewing the relationship. Write the LCCP 1.1.2 obligation into every F2P supplier contract.

Relying on tribal knowledge instead of a documented framework

Betting and casino operators whose compliance process lives in a few people's heads carry that risk into every staff change. The UKGC expects documented training programmes for all relevant staff, delivered at induction and refreshed after that. Training should cover the F2P rules as well as general safer gambling: the mixed-product promotions ban, age verification before F2P access, and self-exclusion suppression.

A written framework should list each compliance process, the data it depends on, the systems involved, and the person who owns it. Review it whenever rules change. The mixed-product promotions ban and the September 2026 deposit limit changes are exactly the kind of shifts that should trigger a review.

Regular internal audits, for example quarterly, help operators meet the UKGC requirement to assess overall effectiveness of customer interaction, which includes spot-checking interaction records. Track each finding to resolution. A logged finding with no fix shows the operator knew about the problem and left it.

Assessing an F2P programme's compliance risk

Sportsbook and casino operators can score an F2P programme against the 18 checkpoints in this checklist. Each "No" marks a gap, and the total shows how urgent the remediation is.

Interpreting your results:

• 15-18 Yes: Your programme shows strong coverage across the key areas. Keep documentation and audits on their current cadence.
• 10-14 Yes: Your programme has notable gaps. Prioritise suppression and records first, since those carry the clearest code requirements.
• Below 10 Yes: Your programme shares several failure patterns with recent enforcement cases and needs remediation without delay.

Building a compliant F2P tech stack

Sportsbook and casino operators that run F2P, CRM, and compliance checks on separate vendors create a sync point at every hand-off. Each sync point is a window where an at-risk player can receive a promotion that should have been suppressed. Running F2P, CRM, and compliance data on one platform closes those windows on the CRM side. The trade-off is real: consolidation concentrates risk in one vendor, and it still depends on the PAM streaming events in real time.

Xtremepush approaches this through XpertOS, its agentic CRM OS. In XpertOS, the governed data layer enforces compliance independently of AI decisions, and the activation layer delivers only what the governed data layer permits. Marketing automation therefore cannot override a player protection rule. Every XpertOS decision is logged and auditable, and human approval gates mean no campaign goes live without sign-off.

XpertOS runs on Xtremepush's existing compliance infrastructure, which includes consent management and responsible gambling scoring. The platform's campaign audit log records the date and time of each campaign change, though it is not enabled by default on every project.

On the F2P side, XP Gamify runs free-to-play games such as spin wheels, scratch cards, and bracket predictors on the same data layer as the CRM.

"Huge portfolio of free to play games." - Bogdan N. on Capterra

Closing F2P compliance gaps

Online casinos and sportsbooks close these F2P compliance gaps by treating F2P as regulated activity rather than a marketing side channel. In practice, that means one product category per prize pool and age verification before every F2P entry point. It also means in-session suppression on strong harm indicators, and F2P data inside the same player record as deposits and bets.

Affiliates and third-party game suppliers need the same checks as the operator's own games. A documented framework, trained staff, and regular audits keep those controls in place when rules or people change.

Want to see how the XpertOS governed data layer applies self-exclusion and responsible gambling rules before a campaign sends? Book a demo to walk through the architecture with our team.

FAQs

What is the mixed-product promotions ban and when did it take effect?

The mixed-product promotions ban took effect on 19 January 2026. It stops UK-licensed operators from including more than one type of gambling product (betting, casino, bingo or lottery) within a single incentive. Both "Bet £5 and get 20 free spins" and a prize pool mixing free bets with free spins are non-compliant.

Is the 72-hour verification grace period still available for F2P games?

No. The 72-hour grace period was removed on 7 May 2019. Under LCCP SR Code 3.2.11, operators must verify a player's age before the player deposits, accesses free-to-play versions of gambling games, or gambles. LCCP Condition 17.1.1 adds identity verification before the player gambles.

What unfair terms concerns did the UKGC and CMA raise?

Their joint work raised concerns about restrictions on withdrawing deposits and winnings, players being unable to tell bonus and deposit balances apart, and significant promotional conditions not shown clearly and prominently.

Does LCCP 1.1.2 make operators responsible for third-party F2P games?

Yes. LCCP 1.1.2 requires licensees to ensure that any contracted third parties conduct themselves as if they were bound by the same licence conditions and codes of practice. An operator that licenses an F2P game from a third-party supplier is responsible for its compliance.

Should operators track gross or net deposits?

Both. From 30 September 2026, player-set deposit limits must be offered on a gross basis. Financial vulnerability checks trigger on net deposits, meaning deposits minus withdrawals, above £150 in a rolling 30-day period.

Key terms glossary

Mixed-product promotions ban: UKGC rule under LCCP SR Code 5.1.1, effective 19 January 2026, that bans including more than one type of gambling product within a single incentive.

Net deposit: The difference between total deposits and total withdrawals over a defined period. The UKGC uses net deposits as the trigger for financial vulnerability checks.

Financial vulnerability check: A UKGC-required check under SR Code 3.4.4, triggered when a customer's net deposits exceed £150 in a rolling 30-day period.

LCCP: Licence Conditions and Codes of Practice. The regulatory framework that all UKGC-licensed operators must follow.

LCCP SR Code 3.2.11: Social responsibility code requiring remote operators to verify a customer's age before the customer deposits, accesses free-to-play versions of gambling games, or gambles.

LCCP 1.1.2: Provision making licensees responsible for third parties they contract with, requiring third parties to act as if bound by the same licence conditions.

LCCP 17.1.1: Licence condition requiring remote operators to verify a customer's identity, including name, address and date of birth, before the customer gambles.

Governed data layer: In Xtremepush's XpertOS, the layer that holds the customer record, consent, policies, and regulatory logic, and enforces compliance independently of AI decisions.

F2P (free-to-play): Games that require no real-money stake. UKGC rules require age verification before players access free-to-play versions of gambling games, and any prizes an F2P game awards count as incentives under LCCP SR Code 5.1.1.

PAM: Player account management system. The backend system that holds player account data, transaction history, and exclusion flags.

Single customer view (SCV): A unified record of all player interactions across systems, serving as the authoritative source for compliance and marketing decisions.