Building Trust in Gambling with Mike De Graaff

Summary

This episode explores the evolving role of compliance in global iGaming, covering best practices, common mistakes, investigations, and the importance of honesty and transparency between firms and regulators.

Listen to Mike De Graaff, Co-Founder and Chief Compliance Officer of BetComply, as he shares his journey into the gambling sector, discusses the realities of regulation, and offers insights from years of experience helping operators, suppliers, and regulators navigate complex challenges, alongside some memorable stories from the industry.

Transcript

Vasco: Hi everyone, and welcome to Bets and Balance Sheets. Today with me I have Mike, co-founder of BetComply. He has years of hands-on experience navigating complex regulatory landscapes and has built a reputation as one of the industry's most trusted compliance experts. He helps operators enter new markets, stay compliant and grow sustainably in a very challenging and always-evolving industry. Thanks for being with us, Mike.

Mike: Thank you for those kind words. I appreciate it. Happy to be here.

Vasco: Cool. To start, we have a little game that we play with our guests, called Splash the Cash. The question is: if you walked out of a casino tomorrow with $10 million, what game were you playing?

Mike: I would play a poker variant. I like to feel that I was the one who decided this was going to be the win. I have the influence, it's not luck. I was the one who made the good decision.

Vasco: Awesome. And what would you spend it on first? What would be your first crazy expense?

Mike: If I won an amount like that, I'd make sure I have no bills left, no debts, no mortgage, that kind of thing. I'm a very boring guy. I'd rather have no bills than a high income.

Vasco: Fair. But is there something fun you'd really like to buy if you had that amount of money?

Mike: A watch, I guess. Something like that. But I'm a father of three, with small kids. All the money I get, I spend on them. So if I got that kind of money, it would probably go to them as well.

Vasco: A lot of toys. I'm sure they'd be very happy.

Mike: Yes.

Vasco: Cool. Okay, let's get on to the serious questions. The first one: if you were to make a carbonara, which ingredients should you use?

Mike: Oh, I have to answer this right. So, you start with the cream and the peas...

A good pasta carbonara, if I still remember it correctly, is the egg yolks. So you need a few egg yolks. Some people add a little egg white, but you need egg yolks. You need the Parmigiano, you need the guanciale, and maybe a little black pepper, but that would be it.

Vasco: I see. Perfect. That sounds like a very good carbonara.

Mike's journey into the gambling industry

Vasco: Okay, some questions about you, to understand how you got here. It's not like you woke up one day and thought, "Oh my god, I'd love to work in gambling, this is my dream." So how did you land in gambling? What was your journey?

Mike: I used to work in healthcare in the Netherlands. I moved to Ibiza for a few months to stay with a friend of mine who was working there. I met my now-wife there, who was a chef. Then the season in Ibiza ended after the summer, and we were wondering whether to go back to the Netherlands or what we were going to do. I started looking online and found a job in Malta. Back then I didn't even know the country existed, but they were looking for Dutch speakers. I looked up on Google how many restaurants there were in Malta, and there were something like 2,000. So I thought, a chef can find a job among 2,000 restaurants, and I can get a job there. Let's go. We took a flight to Malta, having never heard of it and never been there. We landed, and that's how I joined the gaming industry.

Vasco: Malta is somewhere some people love and some people hate. How was your experience landing there, not knowing what to expect?

Mike: Oh, I loved it. We stayed there for a total of seven years. For the first few years it was just me and my girlfriend, working hard, networking, growing, exploring the island and taking trips. We loved it. In this phase of my life, with the kids and everything, I would enjoy it less, because it's not a super family-friendly island. I think it's great when you're young, ambitious and professional, because there's a lot of movement and thriving things there. We absolutely loved it, and I still go there three or four times a year for work, of course.

Vasco: So tell me, why should gaming operators trust you with compliance?

Mike: That's a very direct question, but I'm happy to answer it. We know what we're doing. We've done it, we're doing it, and we've been doing it for a long time. The team we've gathered consists of experts in all fields of compliance: legal, technical, licensing, AML, RG. These people have been on the front lines, have been consulting, have been leading teams. We have never failed an application in any regulated market, ever. We have never failed an audit. Because of that reputation, you can trust us with a project. Internal teams usually struggle with deadlines and wishes from above. Commercial teams and C-levels say, "Oh, we want to go into this market, and that one, and that one," and then all the other teams say, "Oh no, what are we doing? We're already too busy, how do we do this, how do we do that?" We're the kind of party you can trust to actually reach that deadline, by plugging people in or helping you out, and to make sure you don't go crazy internally because of additional roadmaps or wishes. The current operations stay compliant and in your hands, and we take those projects on to make sure the roadmaps are met.

How to adapt to regulatory change in gambling

Vasco: Okay, cool. Gambling is one of the toughest industries when it comes to regulation. It's always changing, with a lot of scrutiny and pressure. How do you help companies adapt to regulatory changes, and most importantly, how do you translate these regulatory frameworks into processes they can implement day to day?

Mike: I think it starts with this: as a compliance officer, consultant or expert, you are the bridge between the regulation and the operation. One reason is that the rest of the operation doesn't know, or doesn't want to know, the ins and outs of the regulation and the law. They don't want to know which article says what. They ask you, "What do I need to do?" or "Do I really need to do it?" That's the translation you make. As a company, that's what you are there to do: make the translation to the operation, and balance the commercial and compliance sides to a level where what you're doing is compliant but still commercially viable. People who want to run a casino want to run a casino. They don't want to run a law firm. Otherwise they would have started a law firm.

They know they need to do what they need to do, because it's a high-risk industry, and they have internal people. But at the same time, they don't want to spend time on compliance that they could otherwise spend on their core business. Does that make sense? You can support them in a way that lifts a lot of the weight off the internal team, so they can focus on what they are great at: building a great casino, a great bookmaker, a good product, whatever the case is. And the stuff in the back is safe, the guardrails are there, and if something goes wrong or becomes a challenge, there's someone you can pick up the phone to, whether that's internally or externally, like us.

Vasco: So it seems more like an ongoing partnership, and that's the way to achieve success with operators. How do they measure the success of these partnerships and their compliance, and how does that affect their brand reputation?

How to measure success in compliance in the gambling industry

Mike: The issue with measuring success in compliance is that it's the lack of things happening. Your success means you're not getting fined, delayed or suspended, or losing your bank account. So it's the lack of things happening that usually measures the success of compliance. That's also why it's sometimes hard to sell. You say, "We're doing great at compliance," and they ask, "Why?" "Because we didn't get a fine." That's like saying, "I'm a great driver because I haven't had an accident." That doesn't really mean the same thing. Other things you can measure are the turnaround of certain processes, such as how fast we are at updating frameworks, or how well we're perceived by the regulators. There are a lot of subjective things, other than the hard threshold of something not happening, like a fine or a warning.

Common errors in gambling compliance

Vasco: Do you see a pattern when it comes to doing compliance wrong?

Mike: Many things go wrong, and it really depends on the size of the company and the jurisdiction. But with smaller companies and startups, they usually underestimate how complex compliance is and how high-risk the industry is. They think, "I make cool games," or "I know how to make a cool casino, so let's go." They underestimate how big it is. Then it's, "Oh, compliance, we need a compliance officer. Let's just appoint Rick." Rick doesn't know what he's doing, but he's appointed, because they think they can just tick a box. In larger companies, with very large compliance teams, you see that one person thinks another person has it covered, and that gives you blind spots. People don't really own the thing they're working on, because they're part of a machine. If you're the machine, as a one-person compliance team for example, you have to own everything. But if you're a gear in a 20-gear machine, you sometimes think, "I don't need to do this task, or look at this, because one of the other gears will have it," and then they don't.

Investigating criminal activity in gambling compliance

Vasco: What's the craziest story you can tell us, something you've seen where you thought, "How is this possible?”

Mike: Oh, jeez. Most of the things I'd like to say I can't, because I'm under NDA. iGaming is interesting for many reasons, and you get some really interesting cases. When I started in iGaming, I started at the bottom, in an entry-level customer service job. I started at the customer service team, led the team, then moved into risk and compliance, and went up from there. In the beginning you see a lot of complaints and refunds. You see money launderers, or people attempting to use the platform for criminal purposes. Then you investigate those players. You see a player profile, you look at the deposits and think, "Oh, more money is moving there," or "This proof of address, I think it's fake." That kind of investigation I think is very cool. In the time I've been investigating and leading teams, we've found some very interesting cases that we reported internationally, really big groups of suspected criminal activity, things that ended up in the newspapers. I like connecting the dots to work out what's going on. Is this someone who is just gambling, or is this a criminal? Or has this person been really lucky, and did they win a million last year, or "why did I not win that million?" All that kind of thing.

Vasco: Did you ever get the chance to speak with people who were trying to get around the rules, or scam one of the casinos? What is their mindset?

Mike: Back in the day, what was very popular was forums. UK punters were especially known for it. If they knew a trick on how to misuse a bonus, or get a refund, or misuse self-exclusion to get a refund, they would share it on those forums: "Oh yeah, if you say this or do this, you can get your money back." Those were very popular, and they still are in some places. You also see people pretending to be others. I've had the weirdest claims when we were investigating players for source of funds because they were spending too much. They said, "No, I can't show you this because I'm part of MI6," and all those kinds of weird claims. And every gambler in the industry has a nephew who is a lawyer and a niece who works for a newspaper. That's always the case. So those are interesting cases. I like to talk about these things in a normal way, because in compliance you also deal with the bad stuff. You deal with gambling addicts, you deal with criminals, the bad stuff that happens. And my philosophy is that in those investigations you need to decide who was wrong. If the casino was wrong, and didn't fulfil its duty of care or its obligations, then you have to fix what you did wrong, pay what you're due, and do that properly. But if you're trying to scam the casino, or you come with some story that you're with MI6 and therefore can't do source of funds, then I'm not going to take that seriously, and I'll make a joke about it.

Compliance best practice for gaming operators

Vasco: You've spoken a lot about the mistakes you generally see from gaming operators. Do you have specific best practices or advice for the operators listening to this podcast, on being compliant, staying compliant, and above all achieving both without adding friction to their everyday operations?

Mike: There's one I want to mention that I haven't mentioned elsewhere before, but I've been thinking about a lot lately. A lot of panellists and speakers talk about trust with the regulators, and about needing to educate the media and get a better picture as an industry, because we also do a lot of things well as a regulated industry. One of the things I think we can really improve as a sector, as operators, is to be more honest towards the regulator about what your position is as a company. Are you aware of the position you have? What do I mean by that? Most operators only own the entity that holds the licence. They don't own the platform, the games, or the [game/fault] reporting, but they hold the licence. The regulator wants to see, in your policy framework, your communication and your handling of situations, that you are aware of your situation. Even if you, as the entity, hold the licence and someone else runs the platform, even if it's the same group, someone else is managing that platform. You should say, "I'm aware of that risk and I know how to manage it." Don't pretend it's your platform if legally it's not the same entity. So communicate and work from your actual position, and don't pretend to have a different one.

The second thing is reporting incidents. That also comes back to pretending everything is great. When you apply for a licence, everything is great on paper, in all your policies. You have the best framework out there. That's why you want the licence, that's why they should give you the licence, and that's your aim. Regulators know that in practice things go wrong. What they don't like is having to find out that something went wrong through a complaint or an audit, and you trying to hide it, scrolling quickly past that player. That's what they dislike, and that's what you get fined and sanctioned for, because at that point you've created friction in the relationship. You tried to hide something. They know things happen. From our experience, if a mistake is made, you need to own it and fix it. If a deposit limit was breached for a player because of a technical issue, that's what happened. Refund the player what they weren't supposed to deposit, and then tell the regulator yourself. In some jurisdictions you have to, but not all operators do it. Do it, and say, "Listen, we had a technical issue and this deposit limit was breached. We noticed it, we fixed it, we refunded the player, and it's not happening again." Done. You might get a reply saying, "Yeah, you really need to investigate that, it can be serious, don't do that." And if you're reporting this 20 times in two months, then yes, you'll still have an issue. But the fact that you're reporting it yourself, saying, "Hey, something happened, but we noticed it and fixed it," means you avoid trouble. I've never seen a fine that says, "Casino X reported that one player breached the deposit limit and now we're fining them 10 million." So that's why I say: be honest about your position, be aware of your position, and be honest when something happens and fix it.

Vasco: I feel like a lot of them, as you said, don't do it out of fear of either losing their licence or getting a fine.

Mike: Getting a fine, and ending up not solving the issues they have at hand, which will cause them much bigger problems later on when they can't hide it any more.

Vasco: Yeah.

Mike: And that's the thing. If you did report it, and said you fixed it, and explained how you did it, then in that scenario, when the player comes to the regulator and reports the incident, the regulator says, "Oh well, the operator already reported it themselves, they fixed it, they owned it, and it's done." Everyone knows things happen, but you need to own the mistake, fix it and report it. Like I said, I've never seen a fine for a self-reported incident like that.

How to compliance varies across jurisdictions

Vasco: Interesting. Do you think that if operators had a set time to solve issues, and were legally obliged to report everything they find but also had a period, say 24 hours from spotting an issue to solving it, that would make it easier for them from a regulator's perspective?

Mike: Not all regulations or jurisdictions have that. Some jurisdictions, like the Netherlands for example, give you an obligation to report within 72 hours of it happening. You don't need to have it fixed by then, you just need to report it. Some jurisdictions don't even define the obligation, but most of the time it's around 72 hours to report, and the report can even be, "We have a signal, we're investigating it, we don't know the answer yet." That can also be the report, but they want the notification within 72 hours, usually.

Vasco: Yeah. We see this with financial services, and it's very common: they have to report a breach, and they have a period in which to solve it, but the report needs to be there first. And it's not because of that that they get a fine or lose their licence. It's just part of the process.

Okay, I have a little game I want to play as well, called Finish the Sentence. Nothing here will be considered professional advice or admissible in a court of law. The first sentence: if you had to win back £1,000 in one night, you would start with...

Mike: Oh, again, I would play a poker variant, thinking that I'm in control. I can do this.

Vasco: Were you ever a professional poker player, or do you just like poker?

Mike: I like to play poker. I go three or four times a year, recreationally, to a casino for poker night. I like it because you are in control, quote unquote, but it's still a game of chance. So I'd think, "Okay, I'll turn this thousand into three thousand by making the best decisions I can."

Vasco: Exactly. Okay, second sentence: the best money lender always...

Mike: Brags about it.

Vasco: Okay, that's good. If you couldn't win anything of value, either money, gold or jewellery, what would be your prize of choice?

Mike: If I couldn't win anything of value, either money, gold or jewellery, I would still take the risk for the heck of it.

Vasco: For the fun. That's good. And in all the years you've been in gambling, was there a moment or something that stood out to you on this journey?

Mike: A few things. One is those crazy player cases, like the MI6 stories. And everyone always remembers the great company parties they have in Malta. The company events are the best, because major achievements that you celebrate are always great. That's something I love in iGaming. And I love the events. I'm a conference guy.

Vasco: I feel like events are where a lot of business gets done, because it's a more personable way to meet people, and a lot of these industries still run on trust and personal connection.

Mike: Yeah. People do business with people. You need to be out there networking with people to be trusted, and look each other in the eyes.

Mike's unconventional take on the gambling industry?

Vasco: That's true. Do you think there's something in this industry that isn't discussed enough?

Mike: This could open a can of worms. The thing I really don't like seeing lately is twofold. One is the waves of redundancies we're seeing across the board. In December we had the usual wave before Christmas, and it's a shame for the people it happens to. The second thing is the overpromising and the lying in B2B. Come on. I know we work in iGaming and casinos and we like flashy images and bonuses, but if we're doing business between each other, let's not use that same approach. I sometimes joke that if you're a turnkey platform provider, I need to be able to turn the key without the car breaking down. So let's do less casino talk with each other when we're doing business, and be more honest and straightforward. That's one. The second thing, which relates to the redundancies, is that a lot of investment has gone in over the last few years into AI projects and new tools. A lot of operators have seen that the investment isn't returning immediately, and some of these companies are, quote unquote, imploding on those investments. That's what we're seeing a little bit. So you have that, and the perfect storm of tax increases and whatnot. That's not a great environment to be in, so let's not make it worse for ourselves with the communication between each other. That's what I want to close off with, I think.

Vasco: Cool. I have one last thing, and I have to ask this because I think this is where the good stuff is. What's the craziest story you've heard from a friend in the industry, something they experienced in gambling, that you can share here?

Mike: One of the craziest stories is from one of the conferences in Malta, I think in 2018. We had some issues on the floor where, let's say, scenes from movies were re-enacted, causing the police to have to intervene a little bit. I think that's the most politically correct description I can give. It caused other events afterwards to be more restrictive, and now it's a bit more behaved, but that was one of the key triggers.

Vasco: Crazy story. We've come a long way. Honestly, I remember my first conference being very different from the last one I went to.

Mike: For sure. Same, same.

Vasco: Cool. Well, Mike, thank you so much for being with us today and sharing your experience, and about BetComply. If you want to know more about BetComply, please make sure you follow them on LinkedIn and also add Mike. I'm sure he'll be able to answer all your questions. So yeah, thank you so much. Speak soon.