What 'Active Monitoring' Now Means to a Regulator
Regulators expect operators to watch their affiliates, not just contract with them. Here is the bar.
The standard quietly hardened
Across regulated markets, regulators now expect operators to actively monitor their affiliate marketing rather than rely on contractual promises from partners. The language varies by jurisdiction, but the direction is uniform, and it has hardened from a recommendation into an expectation that shows up in enforcement reasoning. An operator that relies on affiliates self-certifying compliance, with no monitoring or approval workflow, is increasingly treated as having failed a basic duty.
For legal and compliance teams, the practical question is no longer whether monitoring is required. It is what counts as enough.
What regulators are actually testing
Strip away the phrasing and 'adequate monitoring' is a test of one thing: did you have a real system that would plausibly have caught the problem, and did you act when it did? That breaks into components a regulator will probe.
- Coverage. Were you watching the content that mattered, or only a convenient sample?
- Frequency. Were you looking often enough to catch problems while they were live?
- Scope. Did you assess visual and video content, or only text?
- Response. When something was flagged, did you act, and can you show it?
Why contracts and sampling no longer clear the bar
Two long-standing postures are losing their protective value. The first is the contract: a strong affiliate agreement is necessary, but it describes intent, it does not detect violations or take down content, and regulators have explicitly moved past accepting it as the control. The second is sampling: checking a representative subset was the pragmatic compromise for years, but it is harder to defend now that regulators themselves are moving to comprehensive, automated scanning. When the regulator can scan your entire footprint, the argument that you could only reasonably check a fraction loses force.
Why this is a visual problem, not a text problem
Active monitoring that only reads text is inadequate by construction, because the violations regulators care about most are visual. A monitoring system that cannot tell you whether imagery appeals to under-18s, whether a claim is baked into a banner, whether bonus terms are visible at the point of offer, or whether a spoken claim in a video breaches the rules is not monitoring the things that get operators fined. Adequacy now implies seeing the page the way a player and a regulator do.
Document the system, not just the findings
Teams building toward adequacy often capture individual detections but forget to document the monitoring system itself. Regulators assessing whether your monitoring was adequate will want to understand what it covers, how often it runs, what it assesses, and how findings are escalated and resolved. That description, kept current, is part of your defense, because it shows the monitoring was a designed control rather than an ad hoc effort. Pair contemporaneous evidence of individual catches with a clear, maintained description of the system that produced them, and you can show both that you had a real control and that it worked.
Where kaspero fits
kaspero produces the posture regulators describe when they say 'active' and 'adequate'. It monitors the full affiliate footprint continuously across websites, social, and video, renders content in-geo and assesses it against the specific regulator's rulebook including visual and audio analysis, and documents every detection and response with timestamped evidence. It converts a vague standard you would otherwise have to argue you met into a system you can simply show, on public data, with nothing to install.
Three audits worth running this week
- Write down your current monitoring system as a regulator would read it: what it covers, how often it runs, what it assesses, how findings are escalated. Note every gap.
- Test your scope. Take one flagged-looking affiliate video and ask whether your current process would have caught a spoken or on-screen claim, or only text.
- Check your response record. Pick a past takedown and confirm you can produce the dated evidence of detection and resolution.
The takeaway
'Active monitoring' is not as undefined as it feels: regulators are testing whether you had a real, comprehensive, visual system that would have caught the problem and whether you acted, and contracts and sampling no longer answer that test.