Why connecting the dots is 2026’s biggest player protection priority

The biggest risk to player protection in 2025 was not a lack of data, but the fragmentation of that data across disconnected RG, fraud, AML, and marketing systems. Xpoint CEO Manu Gambhir outlines the steps that need to be taken to build safe-by-design journeys centred around a unified, real-time view of the player, making integrated data a core compliance expectation for the year ahead.

Looking back on 2025, what issue do you think was central to impacting player protection?

The core issue was fragmentation. Most operators still make player-protection decisions on top of disconnected systems: RG, fraud, AML, geolocation, payments, and marketing all looking at slightly different versions of the same customer. As a result, we often fail to use all the information we already have.

When we don’t join these dots, two things happen: Genuine risk is missed because no one sees the full picture; and low-risk players are over-flagged because we only see one noisy signal at a time.

Technologies like AI and blockchain can help here. AI can synthesise all known signals in real time (behaviour, device, location, payments, history) and surface clear, explainable risk scores instead of long rule lists. Blockchain and similar distributed-ledger approaches can provide tamper-evident audit trails and shared registers (for example, self-exclusion, source-of-funds evidence, or device reputation) so we know where data came from and when it was changed.

In short, 2025 showed that the biggest player-protection risk is not lack of data, but the lack of a trusted, unified view of that data.

What steps can the industry take to truly put a safe experience at the heart of a session?

To put safety at the heart of a session, we need to build around a complete, live view of the player rather than isolated checkpoints.

Three practical steps should be taken:

1. Use all known information in real time

This means combining behaviour, spend patterns, device, precise location, payment data, and historical markers into a single risk profile that updates during the session. AI models can be used to turn that profile into simple, explainable signals that product, operations, and compliance can all act on.

2. Embed “safe by design” journeys

Default settings should favour safety: sensible limits, easy breaks, and clear session summaries. Interventions should be progressive: gentle nudges first, then increasing friction, and only finally hard blocks for high-risk cases. The safest option should always be the fastest and easiest for the player.

3. Strengthen trust in the underlying signals

It’s vital to treat location and device integrity as core player-protection controls, not just licensing requirements. It’s also important to explore blockchain or similar technologies where shared, verifiable records make sense – for example, cross-operator self-exclusion registers or proof that a device or account has a particular risk history. If we do this well, a “safe session” becomes the default experience: smooth for the vast majority of players, but with the ability to intervene quickly and fairly when risk appears.

What would you like to see strengthened from a compliance point of view heading into 2026?

I would highlight four priorities for 2026: integrated data, clear expectations, responsible technology, and structured collaboration.

1. Integrated data as a compliance expectation

Regulators should increasingly expect operators to demonstrate that they are using all relevant information they already hold, not working in silos. That means showing how RG, AML, fraud, geolocation, payments, and marketing data are connected, and how insights from one area actually change decisions in another.

2. Outcome-based, comparable metrics

Rather than only more prescriptive rules, I’d like to see a small set of common, outcome-focused player-protection metrics that can be benchmarked across operators and markets. Boards should see these metrics alongside financial KPIs, and executive incentives should be tied to both.

3. Responsible AI and shared, trusted records

As AI becomes central to risk detection and customer interaction, we need clearer expectations on model governance: testing for bias, explainability, and ongoing monitoring. Where it’s appropriate, regulators and industry could explore blockchain or similar technologies to hold shared, verifiable records (for example, self-exclusion, key risk events, or integrity data), with strong privacy safeguards.

4. Collaboration and data sharing between technology providers

Today, each vendor often sees only a slice of the picture. I’d like to see stronger expectations around interoperability: open standards, well-governed APIs, and privacy-preserving data sharing between core providers (identity, geolocation, payments, RG tools, and platforms). When vendors can securely exchange relevant signals under clear rules, operators get a more complete view of risk, regulators get better transparency, and players benefit from earlier, more accurate interventions.

If 2025 was about adding more rules, 2026 should be about making sure that operators and their technology partners use all the information they already have, in a connected and explainable way, to deliver genuinely safer play.