Tottenham Report: Safer gambling, riskier markets

Wednesday, January 7, 2026 11:00 PM
Photo:  Shutterstock
  • Igaming
  • Sports Betting
  • Andrew Tottenham — Managing Director, Tottenham & Co

Much has been written about the rise of the online gambling “black market”. Industry groups are keen to portray it as large and growing. What strikes me is how little airtime the public health lobby gives it. 

When I say “black market”, I mostly mean operators who are unlicenced in the customer’s jurisdiction, even if they hold some kind of offshore licence. In practice, that universe ranges from grey-ish outfits that try to look legitimate to businesses that are deliberately opaque and hard to hold to account. 

Sizing it is difficult by definition. Researchers use web-traffic estimates, search data, surveys, payment intelligence, and subjective anecdotes. All can be informative; none are definitive. That’s why I’m sceptical of neat numbers delivered with absolute confidence. 

My instinct is that the black market is smaller than some claim. Not because it doesn’t exist, but because some customers still care about basics: being paid, believing games are fair, and having somewhere to complain.  

But even a “smaller-than-claimed” black market can be a major policy problem if it disproportionately attracts the customers regulators most want to protect. 

My simple thesis is this: Any time regulation adds friction, an impediment to play or enjoyment, you increase the probability that some customers will look for a lower-friction alternative. That doesn’t mean most customers will move. It does mean the marginal customer is up for grabs. 

“Friction” also isn’t one thing: 

  • Onboarding friction: KYC, document requests, delays, source-of-funds questions. 
  • Play friction: stake limits, product restrictions, bonus controls, spin speeds, prompts, and time-outs. 
  • Affordability/interaction friction: repeated checks that can feel intrusive. 
  • Circumvention friction: the customer who is blocked in the regulated market (self-excluded, restricted, closed) and seeks a bypass. 

That last group matters greatly. For many people, protections like self-exclusion are necessary. But one cohort, often higher risk, will route around them. For them, the unlicenced market isn’t “more convenient”; it is an escape hatch. Once you accept that, you can see why some unlicenced operators market themselves as “we’ll take you when the licenced market won’t”. 

I’m not arguing that regulation is pointless. I’m arguing that the evidence base for some specific interventions is thinner than the certainty with which they’re sometimes sold. Regulators often measure compliance outputs (checks performed, interactions recorded) rather than harm outcomes in the real world. Meanwhile, the black market is hard to measure, so the debate becomes a stalemate: Industry warns about “leakage”; public health dismisses the estimates as self-serving. 

For me, the practical framing is channelisation. The safest place for most gambling activity is the regulated market, provided the regulated market remains attractive enough that most activity stays there. Lose channelisation and you lose visibility, consumer safeguards, and the ability to intervene. 

In my view, regulators’ tools fall into three buckets: blocking, distribution disruption, and payments disruption. Each has value. None is a one-off fix. 

IP blocking is the obvious approach and is often temporary. Operators can switch IPs, rotate mirror domains, and use redirects. These operators are built for whack-a-mole. 

There are stronger variants — domain actions, DNS measures, hosting disruption — but the dynamic remains: You can raise costs and reduce conversion, but you rarely eliminate demand. Blocking works best as part of a broader programme, not as a headline solution. 

I think the bigger story is acquisition. Unlicenced operators can be very good at finding customers. 

The funnel can run through affiliates and SEO (pseudo-review pages and “top 10” lists), social platforms (short-lived accounts and cloaked links), influencers/streamers (especially around crypto casinos), and app-like wrappers (PWAs and sideloading). 

So when the response is, “We asked Google not to advertise unregulated operators,” I struggle with the operational reality. How are global platforms meant to map legality across hundreds of jurisdictions, especially when marketing is designed to look like content rather than advertising? 

One of the few levers that can bite is the supply chain: the regulated companies providing platforms, games, data, hosting, fraud tools, and so on. If suppliers are compelled to avoid servicing unlicenced operators, you can change the economics. 

But enforcement is often jurisdictionally narrow. Many regulators focus on whether suppliers are supporting unlicenced operators targeting their own market. That is understandable, but it leaves gaps in a global ecosystem. 

Payments is where the debate becomes most concrete. If you can’t pay, you can’t play. The U.S. UIGEA of 2006 tried to disrupt “unlawful internet gambling” by restricting payment acceptance. The logic is simple: choke off the oxygen. 

Transactions carry merchant-category codes; online gambling is 7995. Block the code and you block the transaction, at least in principle. 

In practice, the system relies on accurate coding and honest intermediaries. If a PSP miscoded transactions, pretending a gambling deposit is “flowers” or “online services”, the bank’s controls may never trigger. The result has been the massive growth of a profitable ecosystem of “high-risk” PSPs willing to do the work for a large fee. 

I see this market close up. I’m contacted constantly: payment processing, IBANs, “solutions” for “high-risk merchants”. And the risks are obvious. For the PSP, the card schemes or acquiring banks eventually get wise and cut them off. For the operator, money can disappear, especially where rolling reserves are involved. 

Crypto complicates everything. Yes, the blockchain keeps an indelible record of transactions. But names are linked to wallets only at regulated chokepoints, such as regulated exchanges.  

Regulated exchanges are required to undertake KYC/AML processes to verify identity and assess source of funds. In that respect, once you’re inside the regulated system, crypto can start to look surprisingly similar to banking: identity checks, monitoring, reporting. 

But the enforcement problem is what happens outside those chokepoints: unregulated exchanges, wallet-to-wallet transfers, and structures designed specifically to avoid the points where identity is verified. That’s where the “pseudonymous” nature of crypto begins to matter in practice, because it can be very hard to link activity to a real-world person quickly enough to intervene. 

Crypto casinos are sprouting up all over the place, so much so that I suspect there is more going on than simply “serving the black market”. I can see at least three drivers: 

  1. Speed and global reach: instant deposits, cross-border by default. 
  1. Chargeback resistance: fewer consumer protections, exactly why some operators like it. 
  1. Opacity and commingling: and this is where I start to get uneasy. 

People own cryptocurrencies for two reasons. Some see them as an asset class and own them as an investment. Others use them as a medium of exchange. Of the latter group, some are genuinely wowed by the technology and comfortable using it to transfer value. However, I also think a sizable group use it to skirt currency regulations and launder significant amounts of money. 

Rather than focusing so heavily on whether a casino or bank customer might be laundering money, I think the sharper focus should be on the owners. They are the ones who can mingle legal and illegal funds to make all of them appear legitimate. 

I have a sense, an opinion, based on what I see and how the incentives line up, that many crypto gambling operations function as money-movement machines. They can enable funds from illegal gambling (and other crimes) to be moved around the world, mixed in some cases with real gambling revenues, and made to appear “legitimate” enough to deposit into a bank account at the end of the chain. 

Betting syndicates, unregulated casinos, drugs and arms dealers all need to clean money so that it can enter the real economy. Owning an online gambling operation, especially one that sits outside meaningful supervision, strikes me as an efficient way to do that. 

I’m not accusing any specific operator of anything. I’m saying the structure provides incentives that are very attractive to criminals and regulators should treat it as such. 

Back to my opening question. Why isn’t the public health lobby louder about the unlicenced market? My guess is that there are a few reasons.  

First, sizing claims are hard to verify and often arrive wrapped in industry messaging. It is very difficult for the public-health lobby to “support” the industry. 

Second, public health tends to focus on population-level harm, not channel share, and may treat illegal gambling as an enforcement issue rather than a policy trade-off.  

Third, acknowledging the bypass problem forces an awkward truth: Some of the people who most need protections are precisely the ones most motivated to evade them. Saying that out loud can sound like you’re blaming the harmed or undermining safeguards. But if we ignore it, we pretend policy is costless when it clearly isn’t.  

Finally, the pragmatic reason is that once you accept the unlicenced market as part of the system, you’re admitting that enforcement matters as much as health policy. That means budgets, cross-border cooperation, and messy trade-offs, none of which fit neatly into a campaign slogan. I’m not sure anyone has an easy answer, but pretending the problem doesn’t exist isn’t one either. 

My view is not “regulation bad.” My view is that regulation has trade-offs and one of the biggest is the bypass market you can unintentionally build. 

If you want to reduce harm, you need the regulated market to be supervised and protective and, importantly, attractive enough that most people remain in it. Regulators can block, disrupt distribution, and squeeze payments (probably the strongest lever). But none of these work as one-off gestures. They require persistent enforcement against an ecosystem that is itself persistent. 

If the policy goal is harm reduction, I think we have to keep the paradox front of mind. The safer and tighter you make the regulated market, the more you must consider who you might be pushing into the unregulated one and what is waiting for them when they get there.