UK: “demonstrable” compliance is the new prize draw test
A voluntary government code aimed at Britain’s online prize draw market is beginning to bite, with operators now being pushed to prove that free-entry routes are real, and consumer safeguards work in practice. Robert Penfold, an internal audit specialist, explained to SiGMA News that those treating the new standards as box-ticking could find themselves on the wrong side of ministers if the sector fails to clean up by 20 May.
Online prize draws have grown from a digital sideshow into a £1.3bn-a-year industry with 7.4 million adult participants, according to research commissioned by the Department for Culture, Media and Sport (DCMS). The same work found the sector sits uncomfortably close to gambling behaviour: 88% of prize draw participants also gambled in commercial products or lotteries over a 12-month period, compared with 60% of adults in the general population.
That closeness is one reason ministers published a Voluntary Code of Good Practice for Prize Draw Operators in November 2025, setting out expectations on age checks, spending controls, complaints handling and clarity about how draws are run. Signatories have six months to fully implement the measures, and no later than 20 May 2026.
While the document repeatedly stresses it does not create new law, it leaves little doubt about the direction of travel. DCMS notes it “reserves the right to amend the Code” and warns it “will consider all available options” if implementation or compliance falls short.
A deadline and a new scrutiny
The prize draw market has attracted attention before. Gambling Commission chief executive Andrew Rhodes told the Betting and Gaming Council’s AGM in February 2025 that the sector’s rise had been striking: “We’ve seen the growth of large-scale prize draws, and that growth has been very significant,” he said. He also warned of the competitive threat to traditional lotteries if younger consumers drift elsewhere: “If products are less attractive to this demographic, there is every reason they might suffer in terms of that share of participation,” he added.
The new DCMS code attempts to address concerns, without pulling prize draws into the full licensing framework of the Gambling Act 2005, largely because the draws offer a free entry route and therefore do not require a licence.
Even so, the Code’s demands are more specific than many operators are used to. Among its measures: draws should be limited to adults, operators should implement “a reasonable age verification process”, and marketing “should not be targeted at anyone below the age of 18”.
It also sets out payment and spending expectations, including a cap on credit card payments: operators “should not accept credit card payments in excess of £250 per month per player” and “should not accept any credit card payments whatsoever for any instant win prize draws.” Alongside that, firms are expected either to set maximum monthly spend limits for all players or to give players the ability to set their own limits, including the ability to set it at £0.
The Code is equally clear about what constitutes a genuine free entry route. DCMS warns that a route that “does not offer a genuine choice to a person as to whether to participate by paying or by sending a communication” may indicate people are, in practice, required to pay.
From policy to proof
For Robert Penfold, head of internal audit at eGaming Integrity, the hardest parts of the Code are not necessarily the headline rules, but the change in mindset behind them. “The most challenging areas tend to be those where operators are being asked to move from informal practice to structured, evidence-based controls,” he shared with SiGMA News.
Age and identity checks, he argued, are emblematic. “Many prize draw operators historically relied on self-certification,” Penfold said. “The Code pushes the sector towards more reliable verification processes.” That can mean rebuilding customer journeys, introducing new technology and training staff, all while keeping conversion rates and customer experience in mind.
He said a similar pressure is building around draw integrity. “Fairness and transparency is another pressure point,” Penfold said. “Being able to demonstrate draw integrity, randomisation, and independent oversight can expose gaps in legacy processes that were never designed with external scrutiny in mind.”
What regulators and politicians want, he suggested, is evidence that controls are real. “Demonstrable compliance means being able to show how something works in practice, not simply saying that it does,” he said. That evidence, in his view, looks like “structured records, and audit trails that reflect daily operations”, with clear logs and traceable decisions when safeguards are triggered.
He pointed to the growing importance of independent assurance. “We also see significant value in third party assurance, such as independent testing of randomisation tools, platform controls, or age assurance systems,” Penfold said. “It provides confidence that controls have been validated in practice.”
In late January 2026, eGaming Integrity announced a new advisory service aimed at operators trying to meet the May deadline. The firm said the Code has shifted expectations away from polished wording and towards day-to-day reality: “Operators now have to show what they actually do, and prove it.”
Voluntary, for now
The question is what happens if the sector does not comply. Penfold believes the Code is a test of whether the industry can regulate itself. “If uptake is strong and standards are applied meaningfully, voluntary compliance can be very effective in addressing government concerns,” he said. But he also offered a blunt warning: “However, if the Code is treated superficially, or only adopted by a minority of operators, the risk is that it is seen as ineffective.”
That matters because ministers have already left the door open to stronger action. In its Code, DCMS says it will periodically review effectiveness and compliance, and it is explicit that a failure to implement may lead it to consider other options.
Penfold was direct about where that road could lead: “The writing is on the wall. This is voluntary for now, but that could change quickly. Operators who build real oversight systems today won’t be scrambling if this becomes statutory tomorrow.”
Rome wasn’t built in a day, but your next deal could be. From 02 to 05 November 2026 the city becomes the heartbeat of global iGaming when SiGMA World opens its gates. With 30,000 delegates, 1,200+ sponsors and exhibitors, and 550+ expert speakers, history is calling at the mother of all conferences.
