1. Governance objective
Entities operating under the NGA framework should maintain governance structures that support responsible decision-making, reduce the risk of misuse, and create visible accountability at ownership, management, and operational levels. Governance is not treated here as a ceremonial board chart. It is treated as the practical structure through which decisions are made, responsibilities are allocated, conflicts are managed, issues are escalated, and records are maintained in a way that can be reviewed later.
2. Fitness & integrity standards
Controllers, beneficial owners, senior managers, and key responsible persons should be capable of demonstrating integrity through conduct, record quality, and disclosure discipline. This is not satisfied by titles, claims, or polished presentations alone. It is usually evidenced through consistency, transparency, disclosure of adverse matters, and the absence of misleading behaviour in operational practice.
- Controllers and key persons should be of sound reputation and capable of explaining their role.
- Conflicts of interest should be identified, recorded, and managed rather than ignored or implied away.
- Material disputes, sanctions, adverse findings, or integrity-related concerns should be documented.
- Internal records should be consistent with public-facing claims and with information supplied to the Authority.
3. Internal accountability
A governance framework should make it clear who is accountable for operations, compliance-facing matters, technology administration, user-facing processes, and integrity-related escalation. It should also be possible to understand how decisions are made and recorded, particularly where changes affect platform rules, service conditions, access rights, user protections, or material operational settings.
- Clear role allocation for operations, compliance-facing responsibilities, technology, and risk.
- Decision logs for material platform, policy, or operational changes.
- Escalation pathways for integrity issues, operational anomalies, or misconduct concerns.
- Defined authority levels for approvals, overrides, and exceptional handling.
4. Operational controls
Internal controls should be proportionate to the entity’s activity, scale, and technical structure. The framework does not assume every entity will operate with identical formality, but it does expect documented policies and practical control measures that reduce ambiguity and create reviewable evidence where material decisions or exceptions occur.
Control design
Policies should cover platform use, customer or player-facing protections, access controls, integrity risks, complaints handling, and exception management where relevant to the activity.
Control operation
Controls should not exist only on paper. Entities should be able to show how they are implemented, reviewed, and updated in practice over time.
- Documented policies covering platform use, player or user protections, and risk limits where relevant.
- Segregation of duties where operational scale permits and where conflict risk would otherwise be elevated.
- Audit trails for rule changes, access rights, administrative changes, and exception handling.
- Periodic review of internal controls and documented follow-up where weaknesses are identified.
5. Governance-ready and review-ready evidence
Governance is easier to claim than to prove. For that reason, entities should maintain documentary evidence that allows governance arrangements and integrity claims to be assessed in a practical way. The stronger the governance language used by an entity, the more important it becomes that the evidence behind that language is real, current, and internally consistent.
- Ownership and control registers showing relevant persons and changes over time.
- Board, committee, or management decision records for material operational matters.
- Conflict-of-interest declarations and logs of how conflicts were handled.
- Policy acknowledgements, review schedules, and evidence of periodic updates.
- Access-control records and administrative-change logs where platform permissions are relevant.
6. What weak governance usually looks like
Weak governance often shows up through inconsistency rather than dramatic failure. Common indicators include unclear responsibility, missing records, changes made without sign-off, public-facing claims that exceed what internal records support, and unresolved conflicts of interest that are never formally documented.
- Key decisions cannot be traced to a named decision-maker or recorded process.
- Ownership, control, or responsibility descriptions differ across internal and public materials.
- Material operational changes occur without logs, review notes, or internal approvals.
- Integrity issues are handled informally with no written escalation or follow-up record.
7. Related materials and verification paths
This page should be read together with the broader NLA framework materials, the applicable licensing pages, and the Public License Register where relevant. Governance and integrity should not be viewed in isolation from authorisation, verification, and recordkeeping.