What the duty actually is
A protection duty is usually written as three obligations rather than one: to monitor play against defined signals, to act on what the monitoring finds, and to record the decision and its basis. The three are separate on purpose. An operator that watches and never acts has failed the second; one that acts and keeps no record has failed the third, and cannot later show that the first was done at all.
- obligations
- 3
- signal families
- 5
- review window
- 14 days
- accounts reviewed
- 4,000
- accounts with no action taken
- 1,600
- records kept
- 4,000 of 4,000
Read the signals
Five comparisons the account already supports, run continuously rather than after a complaint. 6,000 flags in the sample, 96.0% of them relative to the account own history.
Choose a response
Nothing, a message, a limit or a break, or a restriction - one of four, graded by how much it takes from the player. 960 of 4,000 reviews in the sample changed access.
Write it down
Signals, crossing dates, rule version, path, response and outcome - one record per review, including the 1,600 that ended with nothing done.
Take the appeal
A route outside the desk that decided. 480 appeals in the sample, 176 of them upheld, which is 36.7% - high enough that the route does real work.
A protection duty is normally three obligations, not one. The first is monitoring: reading play against defined signals rather than waiting for a complaint. The second is acting: doing something proportionate with what was found. The third is recording: keeping the decision, the signals behind it and the outcome in a form that can be inspected later. Monitoring without acting, or acting without a record, fails the duty.
Three obligations, and why they are not one
The reason to separate them is that each can fail privately. An operator that monitors diligently and never acts looks, from the outside, exactly like one that never monitored at all - until an audit reads the flag log and finds thousands of crossings with no decision attached. Equally, an operator that imposes limits generously but records nothing cannot show that the limits were proportionate to anything, and a regulator will treat an unexplained limit as a poorly evidenced one.
So the duty is written so that each link in the chain can be tested on its own: what was watched, what was done, and what is on the record. The figures on this page come from sample J, a quarter at one desk: 4,000 reviews opened, 2,400 contacts made, 640 limits or breaks imposed, 320 accounts restricted or closed, and 4,000 records kept - one for every review, including the 1,600 that ended with no action at all.
Obligation one: monitor
Monitoring is a rule set, and a rule set is a list of things that can be counted. Sample B is the list this desk uses: five families of signal, 6,000 flags raised across 40,000 accounts. The important word is defined - the operator is not asked to notice that something feels wrong, it is asked to run comparisons the account already supports.
- Count the session length, and compare it with the account own history rather than with a fixed number.
- Count a single session spend, and compare it with the account own 90-day mean.
- Read the interval between a loss and the next deposit, and flag the short ones.
- Watch the requests that raise a limit, and note how soon after a loss they arrive.
- Treat a self-reported problem flag as its own severity class, whatever else the account shows.
Four of those five are relative to the account. Only the fifth is absolute, and it is the only one that arrives as an explicit statement from the player rather than as an inference from behaviour. That asymmetry matters when the rules are tuned: relative signals produce most of the flags and, as sample G shows, most of the mistakes.
Obligation two: act
Acting is where the policy has to choose a proportionality ladder, because the range of possible responses is wide and the cheapest ones are not the safest. Sample D is one desk's ladder across 4,000 reviews: no action 1,600, a message only 1,440, a limit or a break 640, and a restriction or closure 320. More than half of all reviews end with the account untouched - and that is a feature, not a failure, as long as the record says so.
| Response | What changes | Reversible | Reviews |
|---|---|---|---|
| No action | nothing; the review closes with a note | n/a | 1,600 |
| A safer-play message | nothing automatic; the player is told what was seen | n/a | 1,440 |
| A limit or a break | a ceiling on play, or a period with no access | yes, on review | 640 |
| Restriction or closure | access suspended pending checks, or the account ended | partly | 320 |
The ladder is ordered by how much it takes from the player, which is also the order of how much the operator must be able to justify. The 320 cases in the bottom row are the ones where a record stops being administration and starts being evidence.
Obligation three: record
A protection record is not a log entry that says a limit was applied. It carries the signal or signals that opened the review, the version of the rule that was applied, whether a person or an automatic decision resolved it, the response chosen, the dates, and what happened after the player responded. In the sampled desk that record exists for all 4,000 reviews, and it exists in the same form for the 1,600 that ended with no action - which is the case that is most often missing in practice, and the one that proves the monitoring happened.
- 2,800 reviews came from the two-flags-in-14-days rule, so the record has to name both flags and both dates.
- 720 came from a single high-severity flag, so the record names one signal and its severity class.
- 480 came from a spending ratio against a declared band, so the record names the band, the spend and the ratio.
- 3,200 of the 4,000 were resolved automatically against the policy and 800 were referred to a person; the record says which, because the appeal route is not the same for the two.