# Responsible Gambling in CRM: Who to Exclude, and When Responsible gambling in iGaming CRM: whom to exclude from outreach, how self-exclusion registers work and how to re-check consent and harm markers at send time. Responsible gambling in CRM means that no campaign reaches a player who has excluded themselves, withheld consent or shown strong indicators of harm. Build it as one suppression list that every campaign reads, and check that list again at the moment a message is sent. A check at audience build is not enough, because a player can register an exclusion minutes later. The rules differ by country. This guide covers Great Britain, Sweden, Brazil and Spain, using regulator and official texts, then sets out the build in six steps. Name the jurisdiction in every rule you write down, and ask your compliance team to confirm the rule for each licence you hold. Reactivation, win-back and VIP campaigns carry the highest risk, because they target players who have stopped. Self-excluded and vulnerable players must never be contacted, however strong the commercial case looks. ## Whom to exclude, by jurisdiction Every register below is a source for your suppression list. Treat a hit as a hard stop for all marketing. | Jurisdiction | Register or rule | What it says | What CRM does | |---|---|---|---| | Great Britain | GAMSTOP | One request blocks access to sites and apps run by Great Britain licensed businesses, for a period the player chooses | Suppress from all marketing, remove or flag within two days of the exclusion notice | | Sweden | Spelpaus | From 1 August 2026 a check is required before direct marketing, through a dedicated marketing API | Run the marketing check before each direct send | | Brazil | Centralised self-exclusion, SIGAP list of excluded persons | Checks at account opening, at the first login of each day and at least every 15 days for all users | Block, notify and close as the instruction says | | Spain | RGIAJ | The national prohibition is indefinite | Suppress from all marketing | ### Great Britain The Gambling Commission's code, SR code 3.5.3, requires licensees to take all reasonable steps, as soon as practicable, to prevent marketing material reaching a self-excluded customer. It requires the person's details to be removed from marketing databases, or flagged so that they receive no marketing, within two days of receiving the completed self-exclusion notification. The requirement covers any gambling marketing. GAMSTOP is the national scheme. The Commission describes it as blocking a player from gambling websites and apps run by businesses licensed in Great Britain, for a period the player chooses. A player may also be self-excluded directly with your brand, and that status feeds the same suppression list. ### Sweden Spelinspektionen decided new rules on 23 April 2026 and published them on 29 April 2026. They take effect on 1 August 2026. Each licence holder receives its own Actor ID and API key. Operators must verify a player's status at registration and at login, and must run a self-exclusion check before sending direct marketing. Marketing checks go through a dedicated marketing API, and registration and login checks use a separate login API. Responsibility stays with the licence holder even when a third-party provider runs the technical checks. ### Brazil Brazil runs a centralised self-exclusion system through the Secretaria de Prêmios e Apostas. The gov.br page for the platform says a request takes up to 72 hours to take effect and that the user acknowledges they will not receive targeted advertising during the exclusion. The Normative Instruction SPA/MF 31/2025 sets the operator checks. Operators query the SIGAP list of excluded persons by CPF when an account opens and at the first login of each day. They must also check all registered users at least every 15 days. On a blocked result at login, the operator stops new bets immediately, notifies the user within one day, and closes the account within three days of the query. The notice must say the user can withdraw funds within two days. Operators log every communication with date, time, channel and content, and keep the log for at least five years. Article 12 of the instruction bars operators from active communications, targeted advertising or direct notifications telling a user removed from the list that they may rejoin. This matters for reactivation. A player who leaves the list is not an audience. ### Spain The DGOJ's document on the registers states that at national level the RGIAJ prohibition is indefinite, while some regional registers differ. A suppression list for Spain should therefore hold RGIAJ entries until the register removes them, and should follow the regional registers that apply. ## What else limits outreach A register covers only players who asked to be excluded. Other limits come from consent, from the player's behaviour and from the rules of the offer. In Spain, Royal Decree 958/2020 requires prior consent for commercial communications by email or equivalent means, according to Cuatrecasas and Osborne Clarke. Osborne Clarke adds that commercial communications may go only to registered customers whose account has been open for at least 30 days and who are documentarily verified. Cuatrecasas reports the same 30-day and verification condition for promotions. In Great Britain, the Commission's customer interaction guidance stops direct and targeted marketing and new bonus take-up for customers with strong indicators of harm. From 19 January 2026 the Commission also caps wagering requirements on promotional offers at 10 times and bans mixing product types in one incentive. ## 1. Build one suppression list Create a single table that every campaign tool reads before it builds an audience. A list that lives inside one journey tool leaves the others open. - One row per player ID, with a reason code, a source and a timestamp. - Reasons include: national or regional register hit, self-exclusion with your brand, time-out or cooling-off, complaint, strong indicators of harm, no consent. - The list covers every channel and every product: email, SMS, push, voice, messengers, in-account messages and VIP host calls. - Registers update on their own schedule. Pull each one at the frequency its rule requires. - Third parties that send for you, such as affiliates and agencies, read the same list or receive a fresh extract every day. Write the same duty into every contract with an affiliate or agency that sends on your behalf. ## 2. Record consent per channel Consent for email is not consent for SMS or push. Store one consent record per player, per channel, per purpose. Each record holds the date, the wording shown, the source and the withdrawal date if any. In Spain, consent applies to email and equivalent channels under Article 24 of the decree. Apply the same discipline to every channel in every market. If the record is missing, treat the player as not consented. Honour a withdrawal in the same system and on the same day. A withdrawn consent is a suppression reason, so write it to the suppression list at once. Service messages, such as a verification code or a withdrawal receipt, are not marketing. Keep them out of campaign tools and out of the frequency cap. ## 3. Add markers of harm A register shows what the player has asked for. Markers show what the player's behaviour suggests. The Commission's guidance treats strong indicators of harm as a stop for direct and targeted marketing and for new bonus take-up, and says this should happen as soon as practicable. It notes that automation may help with timeliness. Examples from the Commission's customer interaction guidance on vulnerability include a customer who makes a disproportionate effort to earn a bonus offer, a new customer who chooses high-risk or complex products in a non-standard pattern, and a customer who says they are struggling with their gambling. The guidance asks licensees to review the account for other indicators of harm and to keep monitoring. Build markers in two layers. The examples below are starting points for your safer gambling team to confirm. They are not a regulator's list. - Hard markers stop all outreach at once: a statement from the player about harm, a complaint about gambling losses, a customer service flag, repeated use of safer gambling tools such as deposit limit changes in the same direction as loss chasing. - Soft markers route the player to a human review before any further outreach: sharp rises in deposit frequency, long night sessions, repeated failed withdrawals reversed, deposits straight after losses. Agree the list of markers with your safer gambling team, not with the retention team. CRM consumes the output and does not own the definition. Do not use churn models to override a marker. The [player churn](/blog/player-churn-igaming/) guide treats churn risk as a commercial signal, and the marker rules apply first. ## 4. Re-check at send time Run the suppression check twice: when the audience is built, and again for each message at the moment of sending. The second check catches anyone who registered, withdrew consent or tripped a marker in between. **Checks before each send** - Build: Audience built. Segment query runs against the suppression list. - Queue: Register check. Self-exclusion registers checked for the exact list of recipients. - Send: Consent and markers. Channel consent and harm markers read from the live tables. - Stop: Any hit. Message removed. Reason logged. No retry. Sweden's rule fits this pattern. The marketing check must run before direct marketing, through the marketing API. Brazil's rules fit it too: a daily check at first login and a full-base check every 15 days. **Example.** A campaign targets 50,000 players. At the send-time check 9,300 have no consent for the channel, 1,200 are on a self-exclusion list and 800 carry a harm marker. The campaign sends to 38,700 players. The report records the three reasons so the team can see which source removes the most players. **Send-time check on a 50,000 player campaign** - Planned audience: 50,000 players - Removed, no consent: 9,300 players - Removed, self-excluded: 1,200 players - Removed, harm marker: 800 players - Sent: 38,700 players Log every removal with its reason. A regulator or an audit may ask you to show what you did and when. ## 5. Cap frequency None of the regulator texts used in this guide sets a limit on how often you may message a consented player. The cap is therefore an operator rule, and it should be written down. A workable cap has four parts: - A limit per player per day and per week across all channels, not per journey. - A cooling period after a player ignores a set number of messages in a row. - A lower cap for players with soft markers, or no outreach at all. - A hard stop on a complaint, a withdrawal of consent or a register hit. Apply the cap in one place, the same place as the suppression list. If each journey carries its own cap, a player can receive five "capped" messages from five journeys on the same day. ## 6. Set VIP and incentive rules VIP players spend more, so their accounts need the closest attention. The Gambling Commission announced a £170,000 fine on Taichi Tech Ltd on 3 July 2025. The findings included high-velocity spending with limited know-your-customer checks and inadequate follow-up when signs of harm persisted. Write VIP rules that put safer gambling ahead of retention: - A VIP host calls only players who are not on the suppression list and who have consent for calls. - A host checks the account for markers before every outreach and records the result. - A host never offers a bonus to a player with strong indicators of harm. The Commission's guidance requires new bonus take-up to stop. - Incentives and gifts follow the same markers and caps as email campaigns. - Source-of-funds and affordability checks come before upgrades in VIP tier. For partly completed bonuses, the Commission says licensees should consider whether to stop a customer completing the bonus and whether to pay a proportion. It states that commercial considerations should play no part in withdrawing a partly completed bonus. Reflect this in your terms. The [casino VIP programme](/blog/casino-vip-program/) guide covers tiers and host work, and the [bonus abuse prevention](/blog/bonus-abuse-prevention/) guide shows how to separate abuse reviews from safer gambling cases. ## Check your set-up A [Lifecycle Assessment](/lifecycle-assessment.html) reviews CRM, bonuses, loyalty, journeys and channels, and ends with a prioritised improvement plan. Ask for the suppression list, consent records and send-time checks to be part of the review. For email-specific rules, read the guide to [casino email marketing](/blog/casino-email-marketing/). ## FAQ ### Which players must be excluded from CRM outreach? At minimum, every player who is self-excluded in a register that applies to your licence, every player without consent for the channel, and every player with strong indicators of harm. Local rules add more. In Great Britain the Gambling Commission requires licensees to stop marketing to self-excluded customers as soon as practicable. ### How quickly must a self-exclusion reach the marketing database in Great Britain? The Gambling Commission's code requires the customer's details to be removed or flagged in marketing databases within two days of receiving the completed self-exclusion notification. Licensees must also take all reasonable steps to prevent marketing reaching a self-excluded customer as soon as practicable. ### Does a register check at sign-up cover later campaigns? No. Players register after sign-up, so the status can change at any time. Check again at send time. Sweden requires a Spelpaus check before direct marketing from 1 August 2026, and Brazil requires checks at account opening, at the first login of each day and across all users at least every 15 days. ### Can we message a player who has left a self-exclusion register to invite them back? In Brazil, no. The instruction on centralised self-exclusion bars operators from active communications, targeted advertising or direct notifications telling a user removed from the list that they may rejoin. Treat that as the safe rule elsewhere too, and use only neutral service messages. ### Do markers of harm override a high churn score? Yes. Churn risk is a commercial signal. Strong indicators of harm stop direct marketing and new bonus take-up under the Gambling Commission's customer interaction guidance, whatever the model predicts.