The inspection plan at the Tankwa Gambling and Betting Board, the fictional provincial regulator in this series, used to be a spreadsheet with one row per licensee and one column per month. Every casino received a full compliance inspection each year. Every bookmaker received one every two years. Limited payout machine sites were visited on a rotating schedule. The plan was fair in one sense, because everyone was treated alike. It was also blind, because it did not change when the evidence changed.
In one illustrative year, the board's inspectors spent about the same time at a small retail betting outlet with a clean history as at a large online bookmaker. The online bookmaker had three late returns, a rising number of punter complaints and a new payments provider. The calendar had no way to notice the difference.
This article explains how a regulator can move from calendar-based audits to risk-based supervision without losing fairness, coverage or legal defensibility. Part 2 defined technology-assisted regulation. Risk-based supervision is its most important application. As throughout this series, this is general information, not legal advice.
Why the calendar fails in a digital industry
A calendar-based plan assumes that risk is roughly proportional to licence type and that it changes slowly. Both assumptions were reasonable for a premises-based industry. Neither holds for one where most betting revenue is now online, as Part 1 described.
- Risk is concentrated. A few large online operators handle most of the volume, payment flows and registered accounts. The same licence type can cover very different risk profiles.
- Risk changes quickly. A new payment route, a product launch or a change in ownership can alter a licensee's risk in weeks, not years.
- Inspectors are scarce. Every hour spent confirming that a low-risk outlet is still low-risk is an hour not spent where problems are likely.
The calendar also creates a quieter problem. Because every licensee knows roughly when the next inspection is due, the inspection tests readiness for the inspection rather than day-to-day compliance.
Risk-based supervision is already the standard elsewhere
Risk-based supervision is not a new idea invented for technology projects. The Financial Action Task Force's Guidance on Risk-Based Supervision (March 2021) sets out how anti-money-laundering supervisors should understand the risks in their sectors and allocate supervisory resources according to those risks, and encourages them to move beyond a tick-box approach. The FATF notes on that page that the guidance does not reflect later revisions to its standards, including the 2025 revisions to Recommendation 1, so read it with the current Recommendations.
For a gambling regulator this is directly relevant. Businesses that make gambling activities available are accountable institutions under Schedule 1 of the Financial Intelligence Centre Act. Section 31(1)(e) of the National Gambling Act makes provincial licensing authorities responsible for supervising and enforcing licensees' compliance with their FIC Act obligations. The FIC Act itself requires accountable institutions to develop and implement a risk management and compliance programme. A supervisor that asks licensees to take a risk-based approach is in a stronger position if it takes one itself. The Financial Intelligence Centre has also published a sector risk assessment of the gambling sector, which a provincial regulator can use as one input to its own model.
The shape of a risk model
A supervisory risk model does not have to be complicated to be useful. The Tankwa board's first version has three parts.
Inherent risk describes the licensee's exposure before controls: the gambling mode, the channel (retail, online or both), volumes and turnover, payment methods, customer profile, and whether the licensee is new or under new ownership.
Control effectiveness describes how well the licensee manages that exposure, based on evidence the board already holds: timeliness and quality of returns, findings from previous inspections and how quickly they were closed, complaint patterns, responsible-gambling and self-exclusion control results, and FIC Act compliance findings.
Residual risk combines the two into a supervisory tier, not a precise number. The board uses four tiers, each with a defined supervisory intensity: from desk-based review only, through thematic reviews and scheduled inspections, to close supervision with unannounced visits.
Three design choices keep the model useful.
- Tiers, not decimals. A score of 73.4 implies precision the data cannot support. A tier with a stated reason is easier to explain and harder to argue about.
- Every input has an owner and a source. If an input comes from returns, the returns team owns its quality. If it comes from inspection findings, inspections own it. Data quality and observability are operational disciplines explains why this matters.
- The model is versioned. When weights or inputs change, the version changes, and every allocation records which version produced it.
Keep a floor under the risk model
Pure risk-based allocation has a known weakness. If inspectors visit only high-risk licensees, low-risk licensees are never checked, and the model can never learn that it was wrong about them. Supervision then reinforces its own assumptions.
The board keeps three protections.
- A minimum baseline. Every licensee receives at least a desk-based review each year and an on-site inspection within a maximum interval, whatever its tier.
- A random sample. A small, recorded random sample of lower-tier licensees is inspected each year. This tests the model and reminds every licensee that a low tier is not immunity.
- Triggers that override the cycle. A material incident notification, a credible complaint, an intelligence referral or a change of control moves a licensee into review immediately.
These protections also answer a fairness question. A licensee placed in a higher tier is treated differently from its peers. That is easier to defend when the reasons are rational, recorded and open to challenge. It is hard to defend when the reason is "the system said so".
The supervision cycle
Risk-based supervision is a cycle, not a ranking produced once a year.
The important step is the last one. Inspection findings go back into the model as evidence. If the board finds that licensees in the lowest tier keep producing serious findings, the model is wrong and must be revised, with the revision recorded.
Explainability is a requirement, not a feature
When the Tankwa board decides to place a licensee under close supervision, that decision can affect the licensee's costs, reputation and, eventually, its licence. Whether a tiering decision counts as administrative action under the Promotion of Administrative Justice Act is a question the board would take legal advice on, and this article does not answer it. Whatever the answer, the board should be able to explain it to the licensee, its own audit committee and the National Gambling Board's oversight evaluations under section 34 of the Act.
That rules out some approaches.
- No opaque vendor scores. If the board cannot see how a score was produced, it cannot explain it. Contracts must give the board the model logic, the inputs and the right to change both.
- No unreviewed machine-learning ranking for allocation. A model that learns patterns from past inspections may be useful as one input or for finding anomalies to investigate. The tier decision stays with a named official, based on reasons that can be stated in plain language.
- No secret inputs. The board publishes the categories of factors it considers, without publishing thresholds that would let licensees game the model.
Release readiness scores need an explanation makes the same argument in software delivery. A score without reasons hides judgement rather than replacing it.
Where AI helps, and where it does not
AI is useful at the edges of this process, not at its centre.
| Task | Suitable for AI assistance? | Condition |
|---|---|---|
| Summarising a licensee's history before an inspection | Yes | The summary links to the source records, and the inspector reads the sources for anything material |
| Flagging inconsistent figures across returns and tax declarations | Yes | Rules do the comparison where possible. AI handles free-text explanations |
| Clustering punter complaints by theme | Yes | Sample-checked by an official, and themes are not treated as findings |
| Drafting an inspection plan | Yes, as a draft | The inspector approves and owns the plan |
| Setting a licensee's supervisory tier | No | A named official decides, using the model and stated reasons |
| Concluding that a licensee is non-compliant | No | Findings come from evidence and the inspector's assessment |
Each use needs its own evaluation before it is trusted. The government AI evaluation harness describes how to test AI assistance against cases with known answers.
Calendar versus risk-based, side by side
| Dimension | Calendar-based | Risk-based |
|---|---|---|
| What drives the plan | Licence type and date | Evidence about inherent risk and controls |
| How often it changes | Yearly | Whenever material evidence arrives |
| Coverage of low-risk licensees | Equal to everyone else | Baseline, plus a random sample |
| Response to an incident | Next scheduled visit, unless escalated by hand | Recorded trigger moves the licensee into review |
| How it is explained | "It was their turn" | Tier, reasons, model version and the official who decided |
| How it improves | It does not | Findings feed back into the model |
Key points
- Calendar-based inspection treats licensees alike, but risk in a digital gambling industry is concentrated and changes quickly.
- The FATF expects anti-money-laundering supervisors to supervise on a risk basis, and provincial gambling regulators supervise licensees' FIC Act compliance under section 31(1)(e) of the National Gambling Act.
- A useful model has three parts: inherent risk, control effectiveness and a residual tier with defined supervisory intensity. Use tiers, owned inputs and versioned models.
- Keep a floor: baseline coverage, a random sample and triggers that override the cycle.
- Tier decisions stay with named officials, with reasons that can be explained. AI helps at the edges, not at the centre.
This is part 3 of Regulating a Digital Gambling Economy. Previous: What is technology-assisted regulation? Next: A cloud landing zone for a public regulator.
For the decision-system view, see Test the rule, test the model, test the whole decision in the Machine-Readable Policy series.
Background reading: FATF Guidance on Risk-Based Supervision (2021); FIC sector risk assessment, gambling sector; FIC reference guide for all accountable institutions; National Gambling Act 7 of 2004. Checked on 7 November 2026. This article is general information, not legal advice.
How CloudNala can help
CloudNala helps regulators design a first risk-based supervision model that their officials can explain and defend. We work with your inspectors and compliance analysts to agree the inherent-risk and control factors, map each factor to a data source and owner, define tiers and baseline coverage, and set up the record that shows which model version and which official produced each allocation. We build it to start small, with evidence you already hold, and improve as structured returns come online.
Work with CloudNala
CloudNala helps organisations move from technology ambition to practical execution across cloud, AI, data, platform engineering and digital services.
Whether you are exploring AI, modernising your cloud environment, building a public-sector digital service, or turning an idea into a working MVP, we can help you shape the roadmap and deliver the next step.
Book a Regulatory Technology Review or write to us at consult@cloudnala.co.za