Why one-size-fits-all compliance falls short

Regulatory frameworks are diverging across markets, and expectations for player protection continue to rise. For suppliers operating in multiple jurisdictions, this raises the challenge of building products that are commercially competitive and engaging while meeting standards that vary by market and keep changing. Greentube’s Director of Group Compliance, Roxanne Scicluna, explains how compliance can shape product decisions from the start, why designing for the strictest jurisdiction often causes more problems than it solves, how compliance underpins trust with operators and players, and where product and compliance teams still disagree.

Where does compliance shape product decisions early on; where is it still applied after the fact, and what does it take to close that gap?

The more useful distinction here isn’t really early versus late; it’s whether compliance is embedded or reactive. For licensing and market-entry decisions, for instance, compliance tends to be embedded into the lifecycle almost by nature, shaping the product before it even exists. Compliance more often finds itself catching up after the fact elsewhere, such as in affiliate relationships or fast-moving feature rollouts.

That split is rarely a clean line running through an entire organisation, though. The same company can have compliance embedded in one instance and reactive in another. A campaign in a jurisdiction with clear, well-understood marketing rules might need little more than sound judgement, while the same campaign in a market with more ambiguous or fast-changing requirements could call for a formal pre-launch check. What determines which side of the line you land on has less to do with the activity itself and more to do with the organisation’s actual risk exposure in that context.

How to close that gap, and whether it even needs closing, depends on why it exists in the first place. If it stems from a lack of awareness or some lingering resistance to compliance requirements, the fix is cultural. If it’s a lack of resourcing to act on what’s already known, start by getting leadership to understand what’s at stake. Treating every gap the same way, regardless of its root cause, tends to produce either overkill or under-protection.

Ultimately, this comes down to risk management: understand where your exposure genuinely sits, define your risk appetite accordingly, and let your compliance framework follow from that, rather than applying a uniform standard everywhere by default.

What trade-offs come with designing for the strictest jurisdiction versus adapting market by market?

Regulatory frameworks across jurisdictions tend to converge on the same handful of objectives: player protection, preventing financial crime, and system integrity, even as the requirements used to achieve them vary widely from one market to the next.

Adapting a market-by-market approach comes with a fairly obvious cost. It’s resource-intensive to run in parallel, harder to keep consistent across a group, and much of the work simply isn’t recyclable from one jurisdiction to another. Gaps or inconsistencies between markets can also slip through more easily than one might expect.

Consequently, designing for the strictest jurisdiction may seem more efficient, but it rarely works out that way in practice. It can hurt commercially, since an offering that visibly “overcomplies” tends to stand out against competitors and becomes less attractive to players. It can also work against compliance itself: a stricter threshold doesn’t automatically mean safer or more compliant. Take safer gambling, for example: banning a player on low criteria or thresholds borrowed from another jurisdiction can look like discrimination and restrict access to a service the player is legally entitled to under the rules that actually apply to them.

It doesn’t even save the effort one might hope for, either. No single jurisdiction is the strictest on every requirement, so “the strictest rule” becomes a moving target, harder to pin down as more markets are added. Even where a genuinely stricter standard can be identified, deviating from what’s locally mandated still needs explaining to regulators, auditors, B2B partners, and players alike. Some requirements, such as real-time vault reporting or national self-exclusion registers, are jurisdiction-specific by design, so no shortcut exists.

In today’s regulated environment, a market-by-market approach should remain the default, with compliance functions resourced to match. Local ownership, through dedicated country expertise, tends to achieve what a centralised, one-size-fits-all approach structurally cannot.

Trust is vital in any market with operators and players. What role does compliance play in achieving these goals?

What really separates the regulated industry from the black market is the choice to pursue profit responsibly, within a framework of obligations the unregulated space simply doesn’t carry.

It’s easy to assume enforcement drives that choice, but the black market remains a lucrative, persistent alternative in several jurisdictions. Choosing the regulated route despite that says something: organisations aren’t just avoiding penalties; they’re choosing to do things properly.

Compliance is what gives that choice real substance in practice. It’s the function that keeps the industry’s real problem areas, gambling harm chief among them, properly addressed, in an industry that doesn’t always start with public goodwill.

For operators, trust also earns its keep commercially. Players who trust that RTP, payout timelines, and other promises will be honoured keep coming back; reliability builds the kind of relationship a quick, untrustworthy win never will.

That said, trust isn’t built by the sheer volume of restrictions, but by getting them right. Overly strict or impractical requirements can backfire, pushing players toward the black market rather than away from it. Additionally, because many players can’t easily tell a regulated operator from an unregulated one, a bad experience with the latter can erode trust in the industry as a whole, including regulated operators.

What separates organisations that anticipate regulatory shifts and leverage compliance insights from those that scramble to react?

Change is very much the only constant in this industry. For an organisation operating across more than a handful of jurisdictions, there’s rarely a moment when at least one regulatory shift isn’t being discussed or rolled out somewhere.

Anticipating those shifts comes from active horizon-scanning, rather than instinct: engaging with regulators and trade associations, tracking consultations early, and treating that intelligence as a genuine input into planning. It also comes from learning loops, reviewing how past changes were handled, what worked and what didn’t, and feeding that back into how the next one is approached.

Having sufficient lead time changes the quality of the response considerably. It allows for a genuinely better solution rather than just an acceptable one, less disruption for the player, and fewer missed details along the way. But lead time alone isn’t enough; it only pays off if compliance, product, and tech are sufficiently aligned internally to act on it. Knowing early and still scrambling to coordinate is its own kind of failure.

Even so, anticipation only takes an organisation so far. Legislators or regulators often underestimate the practical and technical workload of implementing changes, leaving even the best-prepared teams with little runway to deliver. Anticipating shifts reduces how often an organisation is caught off guard, but it doesn’t eliminate the pressure of tight deadlines. What determines whether a team holds up under that pressure, repeatedly, is whether it has deliberately built adaptability and resilience to change, rather than leaving it to individual effort each time. Those who engage early and constructively also tend to build better standing with regulators over time, a dividend that compounds well beyond any single change.

Ultimately, this industry doesn’t forgive organisations that stay permanently in reactive mode. Long-term stability comes from building the muscle to anticipate, and the resilience to weather what can’t be anticipated, rather than simply surviving each shift as it comes.

Player engagement and safer gambling are often framed as being in tension. Where do product and compliance teams actually disagree, and how do those challenges get resolved?

The narrative of compliance and commercial teams being permanently at odds has faded considerably over the years. Choosing to operate in a regulated industry is, in a sense, already a statement of intent, and that tone from the top tends to cascade down through an organisation.

Commercial teams today are considerably more compliance-literate than they once were. What used to be outright pushback against safer gambling requirements has largely shifted to conversations about fine-tuning implementation, partly because in markets with real enforcement appetite, the more aggressive approach simply isn’t tenable anymore. Compliance teams have moved too, recognising that rigidity for its own sake doesn’t serve a business that’s meant to be commercially sustainable, not just risk-averse.

On established, well-understood requirements, there’s genuinely less disagreement than there used to be; those are largely arguments of the past. Real friction still shows up on newer, less settled ground, and AI is a good example. It’s reshaping what’s possible in player engagement, enabling predictive, highly personalised experiences that simply weren’t achievable before. But it also raises questions the industry hasn’t fully worked through yet: the same predictive power that personalises engagement could just as easily reinforce compulsive patterns if left unchecked, on top of data protection and AI-specific regulatory questions.

The industry simply doesn’t yet have the maturity it built over years with traditional player protection, so while I expect a period of genuine back-and-forth, this too will eventually settle into a more harmonious balance.