When Good Intentions Aren't Enough: Why the Voluntary Code Is Failing Players Like Lisa

Earlier this year, the BBC spoke to Lisa, a single mother who spent her entire monthly disability benefit — over £1,200 in one week — on instant-win prize draw websites with no spending limits in place. At her lowest point, she was making 90 transactions totalling £400 in a single day, going hungry and using tissues for tampons to save money while chasing losses she couldn't recover.

Lisa's story isn't unique. NHS gambling support services across the UK are reporting a sharp rise in people seeking help for prize draw addiction — people who never thought they'd be "gambling" at all.

The DCMS Voluntary Code, introduced in May 2026, was meant to address exactly this. It set real protections: age verification, a £250 monthly credit card cap per player, bans on credit card payments for instant-win draws, mandatory complaints processes. Good rules, backed by good intentions.

But intention and implementation are worlds apart — and when Dr Matt Gaskell, clinical lead at the NHS Northern Gambling Service, calls prize draws "a grey area being exploited", it's worth asking: are the rules actually working?

The Voluntary Code Has a Voluntary Weakness

The Code sits on one fundamental assumption: that operators will choose to comply because it's right, and that the market will punish those who don't. Sir Iain Duncan Smith, co-chair of the Gambling Reform All-Party Parliamentary Group, welcomed the Code but said it "does not sufficiently address the risks posed by the rapid growth of prize draws and competitions."

What's missing? Real enforcement. Verification. Teeth.

When an operator signs the Code, there's no independent audit confirming they're actually following the £250 cap. No third party is checking whether their "skill" questions are genuinely random or obviously gamed to let players through. No one's verifying that their free entry routes are genuinely free, or just a bait-and-switch to paid entries.

Lisa herself reached out to prize draw firms begging them to block her account — and still couldn't escape the aggressive marketing, the constant emails, the text reminders of how close she was to winning. The safeguards gambling-regulated services offer — payment blocks, advertising opt-outs, mandatory spend limits — were simply unavailable to her because these websites sit outside the Gambling Act.

The Voluntary Code promised to close that gap. But without verification, the promise is toothless.

What Actually Stops Harm? Independent Verification

Dr Emma Ryan, deputy medical director of the Primary Care Gambling Service, put it plainly: "All these products out there, whether they come under the Gambling Act or not, they are all very dangerous. People don't realise what they are getting pulled into because they don't see it as gambling, because it's normalised everywhere."

Normalisation is the killer. Lisa didn't think she was gambling. She thought she was entering a normal competition. But the psychological mechanics — the reward pathway exploitation, the aggressive marketing, the illusion of control through "skill" questions — are identical to gambling.

So what stops harm? Real consequences for violations. Real audits of compliance. Real, verifiable evidence that an operator is genuinely capping spend, genuinely vetting age, genuinely offering a legitimate free route.

That's where third-party certification comes in. When an operator submits to independent audit and compliance checks — when they invite UKCPSA to regularly verify their systems, their spend caps, their complaint handling — they're not just signing a document. They're offering proof.

For players like Lisa, that proof matters. It means someone outside the operator is actually checking whether the £250 cap is enforced in the code, not just promised on paper. It means an independent body is auditing complaint resolution, not relying on operators to police themselves. It means transparency isn't optional — it's verified.

The Market Is Separating — But in the Wrong Direction

Here's what worries experts: as consolidation accelerates in the prize draw sector, bigger, well-capitalised operators are finding it easier to absorb compliance costs. Smaller operators often can't afford even the Voluntary Code infrastructure.

But the real risk is that some operators will treat the Code as a PR tool — sign up, look compliant, and quietly cut corners where they think no one's watching.

Without independent verification, players have no way to know.

UKCPSA Certification offers something the Voluntary Code alone cannot: ongoing, verifiable proof that an operator is genuinely protecting players. Not just on paper. Not just in promises. In audited reality.

For an operator, that certification becomes a real competitive moat in a market increasingly concerned with player safety. For a player like Lisa, it means there's actually someone independent checking whether the house is playing fair.

Ready to stop hoping compliance is real and start verifying it? Learn about UKCPSA Certification and Audit to see how independent verification works — and why it matters far more than a voluntary signature.