What Gibraltar's Gambling Act 2025 means for your staff training obligations

The Gibraltar Gambling Act 2025 came into force on 1 October 2025, replacing the Gambling Act 2005 as the primary legislative framework for remote gambling operators licensed in Gibraltar. While much of the regulatory commentary has focused on licensing changes and new product restrictions, the training obligations embedded in the Act deserve equal attention.

What the Act requires

Section 42 of the Gambling Act 2025 introduces a statutory duty for licensed operators to ensure that all staff who interact with customers, handle complaints, or have access to player account data are trained to a defined competence standard. This is no longer a matter of good practice. It is a condition of licence.

The Gibraltar Gambling Commissioner's updated Social Responsibility Codes of Practice, published alongside the Act, specify that training must cover:

• Responsible gambling obligations, including identification of at-risk behaviour
• Self-exclusion procedures and the operator's obligations under the National Self-Exclusion Register
• Affordability checks and source of funds verification at enhanced thresholds
• Advertising restrictions and the prohibition on targeting vulnerable individuals
• Complaint handling standards under the Consumer Protection (Gambling) Regulations 2024

Who it applies to

The training obligation applies broadly. Customer support staff, payments teams, marketing personnel, and compliance officers all fall within scope. Directors and senior managers with gambling-specific responsibilities are held to a higher standard. They are expected to demonstrate working knowledge of the full regulatory framework, not just the customer-facing obligations.

The Act introduces explicit accountability at board level. A designated director must sign off the firm's annual training plan and attest to its adequacy in the annual compliance return to the Commissioner.

Frequency and record-keeping

Training must be completed on appointment and refreshed at intervals of no more than 12 months. The Commissioner has signalled that it will treat firms without documented training records as non-compliant during supervisory visits, regardless of whether actual training took place.

Records must show the date of training, the topics covered, the format, and a means of verifying that the individual understood the content, not simply that they sat through it. AI-generated scenario-based training, where answers are scored and recorded, satisfies this requirement more robustly than slide decks or video modules.

What this means in practice

Firms operating under the 2005 Act framework will need to audit their existing training arrangements against the new requirements before the Commissioner's first supervisory round in Q2 2026. The key gaps we see repeatedly:

1. Training that covers generic responsible gambling principles rather than Gibraltar-specific obligations
2. No role-differentiation: customer support and directors receiving the same content
3. Annual completion records that log attendance but not comprehension
4. No process for training newly onboarded staff before they go live with customers

The Gambling Act 2025 is an opportunity to formalise what good firms were already doing informally. The firms that will face difficulty are those that have relied on generic e-learning platforms built for UK or Malta regulation, which do not map to the Gibraltar statutory framework.

Gibraltar-regulated operators should review their training programmes now, before the Commissioner begins its 2026 supervisory cycle.