Our audit assigns every operator a score out of 200 points, split across five weighted pillars: licensing and financial integrity, game fairness, player protection, payment and withdrawal conduct, and marketing compliance. No single “great bonus” or slick homepage can offset a weak score in any pillar, because each is scraped and re-verified on a recurring cycle rather than accepted on trust. This article breaks down exactly what the algorithm checks, why each category is weighted as it is, and where the underlying regulatory data comes from.
Key takeaways
- The 200-point rubric is split into five pillars: licensing/financial integrity, game fairness, player protection, payment conduct, and marketing compliance.
- Regulators such as the UK Gambling Commission and Malta Gaming Authority publish the enforcement, complaints and fund-segregation data our algorithm ingests directly.
- Independent test labs (GLI, eCOGRA, iTech Labs) certify RNG and RTP claims, but a certificate only confirms fairness at the point of testing, not continuously.
- Complaint-resolution data from ADR bodies like IBAS and eCOGRA feeds directly into an operator’s player-protection score.
- Points are deducted, not just awarded, when public enforcement records show AML, social responsibility, or advertising breaches.
Table of contents
Why 200 points, and why not a single “star rating”
A single aggregate star rating hides more than it reveals: an operator can post a 4.5-star average while quietly failing on withdrawal speed or complaint resolution. We built a 200-point structure instead, because it lets every pillar be inspected, re-weighted, and audited independently. This approach follows directly from the design decisions we set out in our algorithm’s founding methodology, and it responds to the structural conflict of interest we documented in our analysis of affiliate-funded human reviews: a reviewer paid per signed-up depositor has no incentive to weight withdrawal friction or AML enforcement heavily, so we removed that discretion entirely and replaced it with fixed point allocations tied to verifiable public records.
The five pillars below are weighted according to the severity of consumer harm each category can cause, not according to how much any operator would prefer it to be weighted. Licensing and financial integrity carries the largest allocation because it is the precondition for every other protection: a licence can be suspended or revoked, and when it is, every other point on the scorecard becomes irrelevant.
Pillar 1: licensing and financial integrity (50 points)
This pillar checks three things: which regulator issued the licence, whether that regulator’s own enforcement record shows unresolved breaches, and whether player funds are demonstrably segregated from operating capital.
Segregation is not a marketing claim we take at face value. Under Malta Gaming Authority rules, for instance,
player funds must be kept segregated and remain separately identifiable at all times, with the Authority able to exercise viewing rights over the common account
. The UK’s framework is built around the Licence Conditions and Codes of Practice, which
covers customer-funds protection, AML, responsible gambling, customer interaction, marketing, complaints, KYC, and key-event reporting
. Our scraper checks for public confirmation that an operator’s declared licence category matches the fund-protection tier disclosed in its terms, and flags any mismatch for manual audit.
Enforcement history is scored on a rolling basis. Between May and December 2025 alone,
the Gambling Commission of Great Britain took regulatory action against a total of 13 gambling operators for a range of compliance failings in respect of AML, CTF, social responsibility, technical, and hosting obligations
. Recent cases illustrate the range of severity the algorithm has to weigh: Spreadex was fined
£2.02 million ($2.6 million) for breaches in anti-money laundering (AML) and social responsibility rules, marking the second enforcement action against the firm since 2022
, while Videoslots received a fine after an investigation found
AML/Countering Terrorist Financing (CTF) failures included gaps in associated policies and procedures, record management omissions and an over-reliance on an algorithm to identify and monitor customer behaviours that appeared in some instances to be ineffective
. Each confirmed enforcement action within the trailing 36 months triggers a fixed point deduction scaled to the fine amount and the number of repeat findings against the same licensee.
Pillar 2: game fairness and RNG verification (40 points)
RTP and RNG claims are only meaningful if an accredited third party has verified them. Independent labs such as GLI, eCOGRA and iTech Labs
carry out routine audits of online casinos to verify that their RNGs operate exactly as they should
, and their process
confirms that results are truly random and consistent with the game’s published return-to-player percentages
. Our algorithm checks for a live, clickable certification link in the operator’s footer rather than a static badge image, because a certificate confirms fairness only for the tested software version —
that certification is valid for the version of the software that was tested
, and
if the developer releases an update the updated version should be retested, though in practice minor updates may not always go through a full retest cycle
. Points are awarded for verifiable, dated certificates and withheld for badges that do not resolve to an actual lab report.
This pillar overlaps with our Security, Fraud Detection & Fair Play hub, where we track certification lapses and re-certification cadence across the wider market.
Pillar 3: player protection and dispute history (40 points)
Every UK-licensed operator must offer access to an Alternative Dispute Resolution (ADR) body once its own 8-week internal process is exhausted;
consumers who have a complaint must contact the operator first, the operator then has 8 weeks to resolve the issue, after which it can be raised with an ADR body, currently IBAS and eCOGRA handle the majority of disputes
. Historically,
IBAS dealt with 93.6% of all disputes in the British gambling sector, while eCOGRA dealt with the second-largest share at 5.2% of the total
, giving our algorithm two dominant, trackable data sources rather than dozens of fragmented ones.
We weight two figures from this dataset: complaint volume normalized against an operator’s estimated player base, and complaint type. Regulatory data shows the leading dispute categories are settlement disagreements and payment issues —
the most common dispute type received by IBAS was Disputed Settlement Criteria/Bet Instructions, while the most common dispute type received by eCOGRA was Deposits and Withdrawals
. An operator whose public dispute record skews heavily toward withdrawal-related complaints loses points here even if its overall complaint volume looks modest, because that category correlates most directly with the payment-conduct failures we track in Pillar 4.
Pillar 4: payment and withdrawal conduct (35 points)
This pillar is scored from three signals: published maximum withdrawal timeframes, the proportion of an operator’s ADR disputes classified as deposit/withdrawal issues, and any regulator finding that ties specifically to payment handling. The Videoslots enforcement action is instructive here: the regulator found
the operator’s monthly deposit limits were found to be ineffective when tested in practice and AML controls were not applied to the standards expected
, and separately identified
a serious example where pre-paid digital vouchers had been used for gambling without effective oversight and early intervention
. Findings of this kind are cross-referenced against our payment-method dataset, described in more depth on our Technology, Payments & Crypto Gambling hub, because payment-method risk and withdrawal friction are structurally linked: operators relying on manual review of unusual deposit methods tend to also show slower manual withdrawal approval.
| Pillar | Max points | Primary data source | Example disqualifying signal |
|---|---|---|---|
| Licensing & financial integrity | 50 | Regulator public registers & enforcement notices | Confirmed AML/CTF fine within 36 months |
| Game fairness & RNG | 40 | GLI / eCOGRA / iTech Labs certificate pages | Non-clickable or expired RNG certificate |
| Player protection & disputes | 40 | IBAS / eCOGRA ADR reporting | Above-median share of upheld complaints |
| Payment & withdrawal conduct | 35 | ADR dispute-type breakdown, operator T&Cs | Deposit/withdrawal disputes disproportionate to volume |
| Marketing compliance | 35 | ASA / CAP Code rulings | Upheld ruling for irresponsible or under-18-targeted ads |
Pillar 5: marketing and advertising compliance (35 points)
Marketing is scored against a public ruling record, not against tone or subjective “good taste.” The UK’s Advertising Standards Authority actively investigates gambling promotions, and recent rulings show the range of breaches that trigger deductions: an operator’s Instagram promotion was found to have
portrayed, condoned and encouraged socially irresponsible gambling behaviour and could lead to harm, breaching rules 16.1, 16.3 and 16.3.1 of the CAP Code
, while a separate campaign was found to have
not been appropriately targeted, exposing users with a date of birth signifying they were under-18 to the ad
. Affiliate-published content is not exempt from this scrutiny:
operators have been held responsible for affiliate-created promotions that failed to meet these standards
, which means our algorithm treats an operator’s affiliate network as an extension of its own advertising surface rather than a separate, unaccountable channel.
It’s worth noting the regulator’s own broader read on the market is not uniformly negative —
repeated proactive monitoring sweeps across media have shown that the overwhelming majority of gambling ads are sticking to the rules
— so this pillar rewards a clean record rather than penalizing the entire sector by default. For background on how we mine this kind of public complaint and sentiment data at scale, see our Natural Language Processing & Sentiment Analysis hub.
How deductions and re-scoring work
Points are additive up to the pillar maximum but deductions are applied on top, meaning a score can move within a single re-scrape cycle if a new enforcement notice, ADR statistic release, or ASA ruling becomes public. A licence suspension or a confirmed AML fine within the trailing three years produces the largest single deduction because it directly reflects a regulator’s own risk assessment of the operator — we do not attempt to second-guess a determination like the one that found
Spreadex’s policies, procedures and controls were not appropriate to prevent money laundering or terrorist financing, and that Spreadex was overly reliant on customers’ self-reported financial position
. Our full weighting logic, including how pillar totals convert into the published operator score, is detailed on the Scoring System & Algorithmic Weights hub.
What the rubric cannot see
The 200-point audit is a public-record and disclosed-data system: it cannot detect an unreported dispute, an unfined breach, or harm that never reaches an ADR body or regulator. Survey data on the UK market suggests a meaningful reporting gap exists —
8% of gamblers reported making a complaint, whilst a further 4% of gamblers wanted to make a complaint but didn’t
. That gap means our player-protection score should be read as a floor on documented risk, not a ceiling on total risk. We treat any jurisdiction with thin public reporting — a topic we cover in Regional Deep Dives & The Global Split and Licensing & Jurisdictions — as inherently lower-confidence, and we disclose that confidence level alongside the score rather than hiding it.
Frequently asked questions
How often is a score recalculated?
Licensing and enforcement data is re-checked on a rolling basis as regulators publish new notices; ADR and complaint statistics update on the reporting cycles those bodies use, which are typically annual or semi-annual. A score shown on the site reflects the most recent successful scrape, with a visible last-updated marker.
Does an RNG certificate guarantee an operator is fair going forward?
No. A certificate confirms the tested software version behaved as declared at the time of testing; it does not monitor live sessions. Our algorithm checks certificate freshness and link validity rather than treating the presence of a badge alone as proof of ongoing fairness.
Why does affiliate marketing count against the operator, not just the affiliate?
Regulators have held operators responsible for non-compliant content published by their affiliates, so we score the operator’s total marketing footprint, including third-party promotional content it authorizes or pays for.
Can the point weightings change over time?
Yes. Weightings are reviewed when the underlying regulatory framework changes materially, for example when a jurisdiction updates its codes of practice. Any weighting change is logged and dated on the Scoring System & Algorithmic Weights hub.
Methodology note
This rubric is built from structured public data: regulator licence registers and enforcement notices, ADR/complaint statistics from bodies such as IBAS and eCOGRA, independent RNG/RTP certification pages, and ASA/CAP Code rulings. Our scraping engine, described on the Data Scraping & The Technical Engine hub, pulls each source on a fixed schedule and flags discrepancies between an operator’s own disclosures and the regulator’s public record for human audit before any score is published.
Gambling involves risk. Only play with money you can afford to lose and use the deposit limits and self-exclusion tools available in your jurisdiction.
