What Gibraltar Gambling Commissioner enforcement actions tell us about staff training

The Gibraltar Gambling Commissioner publishes enforcement decisions and regulatory outcomes as part of its supervisory transparency commitment. Reading these decisions carefully, not just the headlines, reveals a consistent pattern in how inadequate staff training contributes to regulatory failures, and what standard the Commissioner expects operators to meet.

The pattern in enforcement decisions

Across enforcement decisions published since 2023, training failures appear in two main forms. The first is direct: the Commissioner identifies a failure to train staff as a breach in its own right. The second is indirect: inadequate training is cited as an aggravating factor when assessing the severity of an underlying compliance failure.

The indirect cases are instructive. When an operator fails to identify a customer's problem gambling behaviour, or mishandles a self-exclusion request, or fails to apply enhanced due diligence to a high-risk account, the Commissioner's assessment of why frequently refers to inadequate training. The finding is not that the operator deliberately breached its obligations. It is that staff did not know what the obligations were.

This matters for how operators should think about training. It is not only a compliance obligation in itself. It is also a defence. A firm that can demonstrate comprehensive, documented, role-specific training is in a fundamentally different position during an enforcement investigation than one that cannot.

What the Commissioner looks for

Based on published decisions and supervisory guidance, the Commissioner applies an implicit standard against which training programmes are assessed:

Currency. Training must reflect the current regulatory framework, including recent amendments. Operators still using training materials that pre-date the Gambling Act 2025 are at risk of being found to have an inadequate programme, regardless of how recently the training was completed.

Role specificity. Enforcement decisions repeatedly distinguish between what senior managers are expected to know versus front-line staff. A director who cannot articulate the firm's obligations under the Social Responsibility Codes of Practice is viewed as a governance failure, not simply a training gap.

Comprehension, not completion. The Commissioner has stated explicitly in published guidance that it will not accept completion records as evidence of adequate training where there is no mechanism for verifying that staff understood the content.

Timeliness of onboarding. Several enforcement decisions have identified cases where new staff were placed in customer-facing roles before completing required training. The Commissioner's expectation is that training is a prerequisite for customer contact, not a task to be completed within the first few weeks.

The lesson for operators

The enforcement decisions are not primarily about fines, though these are significant, running into six figures in the most serious cases. They are about the regulatory relationship. An operator found to have systematic training failures will face increased supervisory intensity: more frequent visits, tighter reporting requirements, and heightened scrutiny of subsequent applications for licence variations.

Rebuilding that relationship takes time. Preventing the failure in the first place takes a credible, documented, Gibraltar-specific training programme.

Practical implications

Operators should approach their training programme as if the Commissioner were reviewing it today. The questions to ask:

• Does our training content specifically reference Gibraltar law: POCA 2015, the Gambling Act 2025, the Commissioner's Social Responsibility Codes?
• Is there a different programme for front-line staff, senior managers, and the MLRO?
• Can we produce completion and comprehension records for every current employee, and for leavers over the past three years?
• Have we updated our materials since the Gambling Act 2025 came into force in October 2025?
• Do new starters complete training before they interact with customers?

A yes to all five is the standard the Commissioner expects. It is also, increasingly, the standard that professional indemnity insurers and counterparties are beginning to ask about.

The enforcement record is clear: training failures are not treated as minor administrative lapses. They are treated as evidence of a firm that does not take its regulatory obligations seriously. The reputational and commercial cost of that finding far exceeds the cost of getting the training right.