The Five-Minute Audit: What iGaming's Newest Rules Have in Common

Between October 26 and October 30, 2026, a Spanish decree took effect, the UK Chancellor delivered a Budget, the Dutch regulator published its annual market figures, and the deadline for a US state inquiry into AI promotions moved a week closer. None of these is the kind of headline that tells a retention team to rebuild anything. Together they ask for the same thing.

Each one wants an operator to prove something about a specific player at a specific moment: that a payment card belongs to them, that a bonus stayed inside its limits, that an offer was sent for a defensible reason, that a protection tool did its job. The rules differ by country. The shape of the question stays the same.

This piece walks through the five developments, shows where the question comes from in each, and then turns it into something you can try on your own stack in five minutes.

Spain: a verified account is no longer enough

Spain's Royal Decree 813/2026, published on October 8, took effect on Wednesday, October 28. Under its anti-money-laundering rules, a licensed operator now has to verify that the holder of the gaming account is the same person as the holder of every payment method used to deposit and withdraw. A card, a bank account or a payment gateway that cannot be shown to belong to the player does not pass.

The check applies to new accounts immediately. Existing customers have until April 28, 2027. During the transition they can keep depositing and playing, but they cannot withdraw winnings until their payment methods are verified. If no match is confirmed by the deadline, according to iGB's report, the operator has to close the account, notify the DGOJ and return the full balance, including any withheld winnings. EFE, cited in the same report, says the measure targets identity impersonation, with complaints up 12% in 2025 to 8,675.

The operational burden is clear: systems that can confirm the name behind every card and e-wallet, and a clean-up of an existing player base before April. The retention angle is easier to miss. A player who cannot withdraw until they switch payment method is a player who is about to contact support, or leave. The message that explains what to do, when and why is a retention message, and the operator needs to know who has completed the step and who has not. Spain's industry association Jdigital has asked the authorities for an interpretive guide, because operators are working without detailed guidance for now.

A second Spanish date follows closely. National deposit limits that cap spending across all operators at €700 a day are expected to launch in March 2027, per the same report.

A practical first step is to split the player base into three groups: verified, unverified with a deposit history, and unverified and inactive. The first group needs nothing. The second needs a message and a clear path to add or switch a payment method. The third may not be worth the cost of reaching. How many players sit in each group is a number you want well before April.

The UK: the budget, the duty and the 10x cap

On October 28, Chancellor John Healey raised Machine Games Duty from 20% to 25% from April 1, 2027, as gambling.com reported. Online operators were not directly affected by that change. Their own increases are already in the calendar: Remote Gaming Duty rose from 21% to 40% in April 2026, and the rate on remote betting rises to 25% in April 2027.

Alongside the tax, the promotion rules are tighter. Since January 19, 2026, the Gambling Commission has capped wagering requirements on bonus funds in promotional offers at 10 times and banned promotions that require play across more than one product type. The Commission's consultation response points to Social Responsibility Code 5.1.1 (rewards and bonuses) as the framework.

Our reading, which is interpretation rather than data: when the duty on gaming profit is 40% and the wagering cap is 10x, a bonus has less room to hide. Every unit of bonus cost comes out of a thinner margin, and every offer has to fit inside terms that are narrower than they were a year ago. That favors operators who can say, player by player, what a reward cost and what it returned. It does not favor a blanket offer sent to everyone on the assumption that a few will respond.

A practical first step is a list of every active offer with its wagering requirement, its product scope and its cost per redeeming player. For UK-licensed brands, any offer with a mixed-product condition or wagering above 10x on bonus funds is the first to review. The rest of the list shows where the budget is going.

Massachusetts: the question is "why did this player get this offer?"

The US item is the one most directly about retention technology. In September, reporting by the New York Times and ProPublica alleged that DraftKings used AI and machine learning to target bettors it considered likely to lose with promotions that encouraged more betting. DraftKings denies targeting customers based on losses or signs of problem gambling.

The Massachusetts Gaming Commission announced a review on September 24. In October it sent the state's seven licensed mobile sportsbooks a written questionnaire with responses due on November 3. CasinoBeats' coverage says it asks whether operators use AI, machine learning, algorithms or automated decision-making for marketing, promotions or customer engagement. Per other coverage of the questionnaire, it also asks whether the operator can identify why a specific customer received a particular offer on a particular date, whether people can review or override automated decisions, and whether potentially harmful behavior triggers more promotions instead of protective interventions.

Massachusetts already prohibits using customer data to provide promotions through automated systems, including AI, that are "known or reasonably expected" to make a gambling platform more addictive. The Michigan Gaming Control Board has confirmed it is reviewing issues raised in the same reports, and New York has proposed restrictions on AI-personalized promotions. No new restrictions have been announced yet.

These are US sportsbook rules and inquiries, and this article does not claim they apply to a casino operator in Europe. The question inside them travels well, though: could you reconstruct why one player received one offer on one day?

A practical first step is to write down, in plain language, how an offer gets chosen for a player: which inputs, which model or rule, and who can override it. The exercise is useful even if no inquiry ever reaches you, because the answer is the first thing a compliance officer or a new colleague will ask for. If the answer is "the model decides," the human-review theme in the questionnaire is where the gap sits.

The Netherlands: protection rules meet the legal market's limits

On October 29, the Dutch regulator, the Kansspelautoriteit, published its annual market scan and its half-yearly monitoring report. According to CasinoBeats' summary, the licensed market's gross gaming result fell to €4.1bn in 2025 from €4.5bn the year before, with online casino down 18.2% to €947m and online sports betting down 30.2% to €254m. Around 94% of people who gamble do so with licensed providers, yet the licensed market captures about 59% of revenue, up from 54%. Sources differ on whether the 59% refers to 2025 or the first half of 2026.

Two details matter for retention. The regulator says people who gamble illegally lose considerably more, on average, than people who use licensed operators, which suggests the higher-spending players are the ones most likely to be elsewhere. And the number of online accounts rose in the first half of 2026 without a matching rise in the number of players, which the regulator links to possible deposit-limit dodging. The regulator also recently fined EOD Code a record €37m over twelve illegal casinos, and the Dutch government has reportedly proposed a near-total ban on online gambling advertising.

A practical first step is to look at how many accounts you see per player in the segments you treat as high value, and whether the same people sit in a deposit-limit journey and a deposit-driven promotion at the same time. A player on a tight limit who keeps receiving offers that ask for a deposit is a conflict worth catching in your own data before a regulator does.

The message for a retention team is that protection rules and player value pull against each other, and the operators who keep both are the ones who can show how protection tools and promotions interact for each player.

Prediction markets: a competitor under different rules

A fifth development sits outside the licensed-operator world, and it is competing for the same wallet. On October 26, the NBA named Kalshi and Polymarket its preferred prediction market exchanges and signed an information-sharing agreement with the CFTC, joining MLB and the NHL in commercial deals with the platforms. Kalshi was reported at a $40bn valuation on October 29. iGB's weekly roundup notes that Kalshi faces litigation from more than a dozen states, that federal circuit courts are split on whether sports event contracts qualify as swaps, and that a complaint filed by Utah's attorney general on October 29 names two Kalshi executives as defendants.

For a sportsbook or casino operator, the competitive point is that these platforms play by a different rulebook, in some states while the courts decide which one applies. The operator's advantage is the relationship with the player, and that relationship is only worth as much as the operator's ability to run it responsibly.

The common thread

Lay the five side by side and the pattern is visible:

• Spain asks whether you can prove who is behind every payment method.
• The UK asks whether the bonus stayed inside its limits and whether it earned its cost.
• Massachusetts asks why this player received this offer, and whether a person could have stopped it.
• The Netherlands asks whether protection tools and promotions work together for each player.
• Prediction markets ask whether your relationship with the player is strong enough to survive a rulebook you do not control.

The common ask is traceability: a record, at the level of one player, that shows what happened and why. The teams that handle the next rule change calmly will be the ones for whom that record already exists in one place.

The calendar adds urgency. The expected Spanish deposit limit, the UK duty increases and Spain's verification deadline for existing accounts all land between March and April 2027, within about two months of each other. A team that runs the audit in November has the winter to fix what it finds. A team that starts in March does not.

Run the five-minute audit

Here is a test you can run on your own stack today. It is our framing, not a regulatory test, and it takes five minutes if your setup is in good shape.

Pick one real player (from a test environment, or anonymized), one offer they received, and the date. Then answer five questions without leaving one system:

1. Where did they come from? Which segment or rule placed this player in the journey, and who set it up?
2. Why this offer? What data led to this reward instead of a different one, or none?
3. What did it cost, and under whose rules? Which market's bonus limits applied, and did the terms stay inside them?
4. Could a person have stopped it? Was there a review or override step, and did the player carry any protection flags that day?
5. What changes if the rule moves tomorrow? What would you edit, and in how many places?

A good result is five answers from one place, with reasons attached. A weak result looks familiar: a spreadsheet, a message to the person who built the journey, a screenshot from last quarter. The fifth question is usually the hardest, because rules move per market, and a change for one country should not require touching the others.

Each development in this article maps to one of the questions. Spain is question 1 and 3 for payments, the UK is question 3, Massachusetts is questions 2 and 4, the Netherlands is question 4, and the prediction markets raise question 5.

What the audit looks like on one player (an invented example)

Take a fictional player, call him Player 4417, registered with a Spanish license. On a Friday, after two weeks of inactivity, he received a free-spins offer.

Question 1: he sat in a "lapsed 14 days" segment that the retention lead built in March.

Question 2: the journey picks the offer with the best redemption record for that segment, and the model that flagged him as likely to return rated the bonus worth granting, because earlier offers had lifted his real-money play.

Question 3: the spins carried the wagering terms set for the Spanish market, inside the limits.

Question 4: he had no deposit-limit change in the previous 30 days, and the journey sends rewards above a set value to a human reviewer, but this one fell below the threshold.

Question 5: if Spain changed the cap on bonus value, the edit would sit in one market-level setting plus the two journeys that reference the offer.

That is five answers in five minutes from one place. Now picture the same player on a stack where question 2 lives in a spreadsheet and question 5 means opening fourteen journeys one by one. The player is the same and the audit fails.

Three ways the audit usually fails

These are patterns we see across retention setups, not statistics.

The reason is a label. A segment called "Q3 reactivation" explains who was in a group. It says nothing about why this offer was chosen over another. A reason has to be stored next to the decision, in words someone outside the team can read.

The rule lives in a person. The logic works, and the only way to explain it is to ask the colleague who built it. That is fine until the colleague is on leave, or a regulator asks on a Tuesday.

One rule, many copies. The same limit is hard-coded into twenty journeys, one per channel or campaign. A change in one market then needs twenty edits, and the one that gets missed becomes the finding.

Six questions for any retention vendor, including us

The audit tests your own setup. The same logic works when you evaluate tools, and these six questions are worth asking in any demo:

• Can you read, in plain words, why a specific player received a specific offer?
• Is there a change log that shows who edited a journey or a rule, and when?
• Can bonus limits be set once per market and inherited by every journey?
• Can you edit or pause a rule for one market without touching the others?
• Can a person review or override an automated reward above a value you choose?
• Can all of this be exported for an auditor?

A "yes, with a custom report" is a partial yes. Ask how long that report takes to produce, and who has to build it.

Bring a scenario, and we will start the clock

This is the exercise we would like to run with you. At SiGMA World in Rome (November 2 to 5, stand H4-4036), or in any Smartico demo, bring one scenario from your own operation and we will walk it through live: the segment, the journey, the reward and the reasons behind it.

A few things you will see along the way. Smartico's AI models, such as Bonus Eligibility, score every active player each day and recommend whether the next bonus is worth granting, based on four signals from that player's history, including whether past bonuses moved their real-money play. Each recommendation comes with the reasons attached, and the models feed directly into segments and journeys. The same platform is configured market by market, so a change for one country can happen without touching the rest. Behind it is CRM automation and gamification in one place, built on iGaming player behavior Smartico has processed in real time since 2019.

If you cannot be in Rome, send us the scenario ahead of the demo and we will build the walkthrough around it.

Did you find this article helpful? If so, consider sharing it with other industry professionals such as yourself.