AI is now on both sides of the gambling identity check
The Gambling Commission's 2026 risk assessment records deepfake and face-swap attempts to bypass identity checks, gives no number, and its enforcement director says the AI operators buy too often is not delivering.
The Gambling Commission's statutory risk assessment, published on 30 July 2026, records attempts to bypass identity checks using deepfake videos and face swaps. Seven weeks earlier, its Director of Enforcement told operators that the AI tools they buy to run those checks too often are not delivering. Read together, the two statements describe one control under pressure from both ends.
The Commission names deepfake videos and face swaps, but describes attempts, not successes
On 30 July 2026 the Gambling Commission published its statutory money laundering and terrorist financing risk assessment for the British gambling industry. It updates the 2023 edition and covers 1 April 2023 to 31 October 2025. In it, the Commission says it "is aware of an increase in the scale and sophistication of attempts to bypass KYC checks using false documentation, deepfake videos and face swaps generated by AI".
Two words in that sentence carry most of the weight, and they deserve separating from how the finding has been reported. The Commission describes attempts, not successes. And it describes an increase in scale and sophistication without putting a number on either.
There is no count in the document, no percentage, no case volume and no baseline for the increase. A regulator recording a trend it has not sized is a normal thing for a risk assessment to do. It is still different from a measured finding, and anyone citing it should quote it as what it is.
The executive summary makes the same point in broader terms: "Technology-driven advancements in particular pose new challenges, such as the rapid development in artificial intelligence capability which tests the effectiveness of customer due diligence controls." The threat section lists "fake identities generated using AI, and altered identification documents" among the vulnerabilities it tracks.
One thing this document is not is an age-checking document. It is published under Regulation 17(1) of the Money Laundering Regulations 2017, and the words age verification, age assurance and underage do not appear in it. Britain handles age assurance through a separate regime. The two should not be read together simply because both involve proving who someone is.
The identity-document risk scores nine out of nine, and only one sector rating moved
The Commission scores each risk as likelihood multiplied by impact, on a scale of 1 for low, 2 for medium and 3 for high. False or stolen identity documentation used to bypass controls, which the 2026 assessment says "includes the use of AI tools to generate documents or videos", is rated likelihood 3 by impact 3, giving 9. That is the top of the scale.
The methodology is unchanged from 2023. What changed is the wording that describes the risks, and that is why the AI language matters: the rating did not move, but what the Commission now says sits behind it did.
Across sectors, only one overall rating changed. Gambling software rose from low to medium. The Commission attributes the rise to business-to-business relationships and the risk of licensed operators supplying software to unlicensed website operators. It is the same supply-chain concern that ran through the Commission's £4.75 million settlement with Evolution Malta in July 2026, where games reached consumers in Great Britain through operators without a licence.
| Sector | 2026 overall rating | Change |
|---|---|---|
| Casino, betting and bingo (remote) | High | unchanged |
| Casino (non-remote) | High | unchanged |
| Betting (non-remote, off-course) | High | unchanged |
| Betting (non-remote, on-course) | Medium | unchanged |
| Bingo (non-remote) | Medium | unchanged |
| Adult Gaming Centres | Medium | unchanged |
| Gambling software | Medium | raised from low |
The assessment is not advisory. It is published under Regulation 17(1) of the Money Laundering Regulations 2017, and operators must take it into account when conducting their own risk assessments under Licence Condition 12 of the Licence Conditions and Codes of Practice (LCCP). That is how a document with no new rules in it still changes what a licensee has to be able to show.
The same regulator says the AI operators buy to run those checks too often is not delivering
Seven weeks before the assessment appeared, on 10 June 2026, John Pierce, Director of Enforcement at the Gambling Commission, told the Gambling Anti-Money Laundering Group annual conference that operators are adopting artificial intelligence for anti-money laundering purposes, and that the evidence the Commission has seen so far is that it too often is not working.
We aren't ideologically against the use of new technology in your processes. But you need to be sure they are doing what is required and the evidence we've seen so far is too often they simply aren't delivering.
John Pierce, Director of Enforcement, Gambling Commission. Gambling Anti-Money Laundering Group annual conference, 10 June 2026
Put the two documents side by side and the same technology appears on both sides of one control. The assessment records AI generating the documents and faces presented at the check. The enforcement director describes AI bought to sit behind the check, and not yet earning its place there.
Neither statement is a verdict on the technology, and this post does not offer one. Together they describe a control squeezed from the same direction at both ends, which is a harder problem than either statement alone.
Pierce made a second point in the same speech that bears directly on how firms should respond: "Using digital identity can support identity verification, but it does not remove wider responsibilities under The Money Laundering Regulations." He also said the Commission "too often" sees "a disconnect between risk assessments and policies and the procedures, and the controls put in place to carry out those policies". The remedy the Commission keeps pointing at is not a better tool. It is evidence that whatever tool is in place does what the operator claims it does.
The underlying duty has not changed. Licence condition 17.1.1 still requires a licensee to obtain and verify a customer's name, address and date of birth before that customer is permitted to gamble, and no new or amended licence condition on identity verification or anti-money laundering was made in 2026. The bar did not move. The Commission's description of what is being thrown at it did.
Where Didit fits: the checks the assessment describes
The three things the Commission names reduce to a document problem and a face problem, and the modules map onto them one by one. Against generated or altered documents, ID Verification at $0.15 per check tests the document itself, and NFC Reading at $0.15 per check reads the chip in a passport or identity card and validates the signature on what it returns. That is a different question from whether an image looks right, which is the point when the image may have been generated. Against the deepfake videos and face swaps, Passive Liveness at $0.10 per check and Active Liveness at $0.15 per check test whether a real person is present, and Face Match (1:1) at $0.05 per check compares that person to the document. The name, address and date of birth that licence condition 17.1.1 requires are what ID Verification and Proof of Address at $0.20 per check collect. Current module prices are on the pricing page.
The limit is best stated in the regulator's own words. Pierce said that "using digital identity can support identity verification, but it does not remove wider responsibilities under The Money Laundering Regulations", and that the Commission's concern with AI in anti-money laundering is operators not being able to show the tools are "doing what is required". Didit does not write the risk assessment Licence Condition 12 requires of you, does not decide your risk ratings, does not conduct your enhanced due diligence, and does not make an operator compliant. On the Commission's own account, buying a tool is not the answer to this document. Being able to evidence that the tool works is.
Frequently asked questions
Is this a new gambling licence condition?
No. It is a risk assessment, not a rule change. No new or amended licence condition on customer identity verification or anti-money laundering was made in 2026. The assessment binds operators through the existing Licence Condition 12 of the Licence Conditions and Codes of Practice, which requires licensees to take the Commission's assessment into account in their own risk assessments.
Does the Gambling Commission's 2026 assessment cover age verification?
No. It is an anti-money laundering and terrorist financing document published under Regulation 17(1) of the Money Laundering Regulations 2017. The words age verification, age assurance and underage do not appear in it. Age assurance in Britain is handled separately under the Online Safety Act 2023 and data protection law.
How many customers are using AI to bypass gambling identity checks?
The Gambling Commission does not say. Its 2026 assessment states that it is aware of an increase in the scale and sophistication of attempts to bypass checks using false documentation, deepfake videos and face swaps generated by AI. It gives no count, no percentage and no baseline, and it describes attempts rather than successes.
What identity information must a British gambling operator collect?
Under licence condition 17.1.1, a licensee must obtain and verify information to establish the customer's identity before that customer is permitted to gamble. The information must include, but is not restricted to, the customer's name, address and date of birth. The condition applies to remote licences with defined exceptions.
Which gambling sector risk rating changed in 2026?
Gambling software was the only sector whose overall rating changed, rising from low to medium. The Commission attributes the rise to business-to-business relationships and the risk of licensed operators supplying software to illegal website operators.
Related reading
- A risk assessment that did not work cost one operator £4.75 million — The same regulator, the same enforcement director, and what happens when a control exists but is not effective.
- FCA financial crime review: private markets — What a supervisor found when it asked 242 firms to describe their own controls.
- Asia is moving the cost of weak identity checks onto banks and platforms — Japan is retiring photo-upload verification entirely, for the reason this post describes.
- The stablecoin identity rule covers issuance and redemption, not what happens next — Another regulator writing name, address and identification number into a new sector.
Sources
- The 2026 money laundering and terrorist financing risks within the British gambling industry — Gambling Commission · published 30 July 2026 · statutory assessment under Regulation 17(1)
- Notice to licensees: money laundering risk assessment 2026 published — Gambling Commission · 30 July 2026
- Gambling Anti-Money Laundering Group annual conference: speech by John Pierce, Director of Enforcement — Gambling Commission · 10 June 2026
- LCCP licence condition 17.1.1: customer identity verification — Gambling Commission · LCCP version in force 29 July 2026
- Previous changes to the LCCP — Gambling Commission · confirms no 2026 change to identity or AML conditions
Who wrote this
Tuan Nguyen — Growth · Didit
Writes about identity verification, fraud and compliance at Didit.
Last reviewed 4 Aug 2026 against the sources above
Related articles
- Europe's deepfake rule is now in force, and it lands on the tool, not the fraud
- The stablecoin identity rule covers issuance and redemption, not what happens next
- Egypt is absorbing the cost of a KYC refresh instead of passing it to the customer
- Unico Partners with Didit to Expand Access to State-of-the-Art Identity Verification for SMEs in Brazil
- Didit vs Onfido: coverage, pricing, automation, and migration
- Identity Verification Software in 2026: A Buyer's Guide