UKGC affiliate compliance: a monitoring SOP you can run

Why this document has to exist

Under LCCP 1.1.2 the licensee is responsible for marketing carried out on its behalf, and the CAP Code applies to affiliate content. "The affiliate published it without our approval" is not a defence, and the ASA has said so directly. In practice a regulator will ask what your monitoring programme is. This is that programme, written down.

1. Scope and ownership

This procedure covers every affiliate, sub-affiliate, influencer and media partner promoting the licensee's Great Britain facing brands, across every channel they use, not only the domains they declared at signup.

• Accountable: the nominated Personal Management Licence holder for marketing.
• Responsible: affiliate manager for remediation, compliance for classification and sign-off.
• Out of scope: the operator's own owned channels, covered by the marketing approval process. In scope the moment an affiliate reproduces that material.

The governing test throughout: monitor what a consumer in Great Britain can actually see, not what the affiliate agreement says they should be publishing.

2. Maintain a live affiliate inventory

Nothing downstream works without this. A monitoring programme that only covers declared URLs will miss the pages a regulator finds first.

Discovery is part of maintenance. Search monthly for brand plus bonus, free spins, no deposit, promo code and review. Any affiliate page that appears and is not on the register is itself a finding, because it means an undeclared partner or an undeclared domain.

3. Scan cadence

4. The check set

Run every check on every scanned page. Record each as Pass, Fail or Unverified. Unverified is a legitimate result where the page could not be fully rendered, and it must never be recorded as a pass.

Two checks cannot be done from HTML alone and must be run as a consumer journey: follow the affiliate link and record the landing page, the offer actually presented, any geo routing, and the terms shown at registration. A discrepancy between the affiliate's advertised offer and the operator's real one is a P1 finding regardless of who introduced it.

5. Severity and response times

Repeat findings escalate one level. A second P2 of the same type from the same partner within 90 days is treated as P1.

6. Evidence pack per finding

Every finding needs a record that would still make sense to a regulator, or to the partner disputing it, six months later. Capture at the point of detection, because the page will change.

• finding_id, and detected_at with timestamp and timezone
• affiliate_id from the register, and the full url including parameters
• channel: web, social, video or email
• market_targeted, with the evidence for GB targeting
• check_failed and the reference clause, plus severity
• evidence_quote, verbatim, never paraphrased
• screenshot, full page, timestamped
• rendered_from, the geography the page was fetched from
• owner, due per SLA, status, and verified_at for the second check confirming the fix

Two fields carry more weight than people expect. Verbatim quote, because a paraphrase is arguable and a quote is not. Rendered from, because affiliate pages routinely serve different content by geography, and a finding is only meaningful if you can say which audience saw it.

7. The remediation workflow

1. Detected. Finding created with the full evidence pack, severity assigned by compliance rather than by the affiliate team.
2. Reviewed. Compliance confirms or dismisses within one working day. Dismissals are logged with a reason, since a pattern of dismissals is itself a signal.
3. Notified. Correction request to the named contact, quoting the URL, the clause and the evidence, with the SLA stated.
4. Corrected. Partner confirms the change.
5. Verified. You re-check independently. A partner's confirmation is not a verification, and this step is the one most often skipped.
6. Escalated. On a missed SLA: pause tracking, withhold commission on affected traffic, then terminate for serious or repeated breaches.

8. Risk tiering

You will not review every partner with equal intensity, and pretending otherwise produces a programme that quietly stops running. Score each partner, review the top tier weekly and the rest monthly.

9. Contractual controls this depends on

None of the enforcement steps above are available unless the affiliate agreement grants them. Confirm all of the following are present, and that they flow down to sub-affiliates.

• Pre-approval of promotional claims and creative for higher-risk partners
• Express prohibition on advertising unauthorised or expired offers
• Compliance with the CAP and BCAP Codes and LCCP as a contractual obligation
• Right to audit affiliate activity, including social and video channels
• Obligation to remove or amend non-compliant material within your stated SLA
• Right to suspend tracking and withhold commission on affected traffic
• Termination for serious or repeated breach
• Mandatory flow-down of all of the above to sub-affiliates
• Requirement to declare every domain and account used to promote the brand

10. The monthly compliance report

One page. The purpose is to show a regulator, and your own board, that the programme runs on a schedule and closes what it opens.

Retain findings, evidence and the monthly reports for the period set by your record-keeping policy. The audit trail is the deliverable when a regulator asks what you were doing about affiliate advertising, and the answer needs to be a dated record rather than an assurance.