Governing an affiliate programme: contracts to offboarding

Governing an affiliate programme means being able to show, at any point, that you knew what your affiliates were publishing, that you told them the rules, and that you acted when something was wrong. Regulators write the duty into licence conditions; governance is how you meet it. Four things carry most of the weight: a contract that makes the rules enforceable, monitoring that finds problems, a takedown and offboarding route that works quickly, and records that prove all three.

This guide covers each one. It uses only rules we read on regulators' own pages in October 2026, and it marks clearly where something is our suggestion rather than a rule.

Why governance, not just vetting

Vetting checks a partner once. The rules expect more. In Great Britain, the Gambling Commission's page on third parties says licensees must carry out due diligence and keep oversight, and that failure "can result in regulatory action including suspension or the loss of the operating licence". Malta's regulation 33 of S.L. 583.09 holds the operator responsible for an affiliate's breach, and lets the MGA decline to sanction only where the operator took sufficient precautions and acted at once to put it right. Spain's RD 958/2020 article 37(2) requires operators to take the measures needed to make sure affiliates acting for them comply.

All three describe an ongoing process. A one-off approval does not meet any of them.

Contract clauses that make compliance enforceable

A clause is only useful if you can point to it when you act. These come straight from the rules.

Required in Great Britain

SR code 1.1.2 says your contracts with third parties must:

• Bind the affiliate to act as if it were subject to the same licence conditions and codes of practice as you.
• Oblige it to supply information you need for your reporting to the Commission.
• Let you terminate promptly if it breaches the contract or acts inconsistently with the licensing objectives, "including for affiliates where they have breached a relevant advertising code of practice".

Condition 16.1.1 adds one more: contract terms allowing prompt termination of a third party that places ads for your licensed activities on websites giving unauthorised access to copyrighted content.

Required elsewhere

• Ontario: Standard 1.19 requires third parties to act as if bound by the same laws, regulations and standards. Standard 1.21 requires you to ensure no affiliate you pay also promotes sites accepting Ontario players without AGCO registration. That needs an express clause and a way to check it.
• Malta, Spain and the US states we checked put responsibility on the operator. The provisions we read don't prescribe contract wording, so a clause binding the affiliate to the local rules is the obvious way to show you took precautions.

Clauses we suggest

These are not required wording. They make the required clauses work in practice:

• A list of the codes the affiliate must follow, by name: CAP section 16 and rule 2.1 for UK audiences, plus the market rules for each geo they promote
• Use of current offers only, with significant terms shown as SR code 5.1.9 requires
• Upfront ad labelling ("#ad" or "Ad", per ASA advice)
• Audience age data supplied on request, for each channel used
• No creative featuring anyone who is or seems to be under 25 (CAP 16.3.14)
• A fix-or-remove deadline after notice, and what happens if it's missed
• Which breaches allow immediate termination, and which get notice first
• What happens to commission on traffic from content that breached the rules
• Record-keeping and access, so you can show your monitoring

Monitoring: what to watch

No GB rule we read sets a monitoring frequency. What the rules and guidance do set is what you should be able to show.

Evidence that counts

Be careful what you rely on. In its White Hat Gaming ruling of 16 September 2026, the ASA rejected referral data as evidence of a website's audience, because successful referrals are all adults, and found that social media audience data did not establish the audience of a separate website. CAP guidance also warns that registered ages understate under-18 followers. Ask for audience data for the channel actually carrying the ad.

How often: our suggestion

For example, a programme might review new affiliates' content before their first payment, review the highest-traffic GB pages each month, and run a full sweep whenever a rule changes, as it did on 19 January 2026. Set your own cadence by risk, write it down, and keep to it. A written cadence you follow is worth more than an ambitious one you don't.

Affiliate view

Monitoring works best when it's predictable. Tell us what you check, how often, and how you'll contact us. A named affiliate manager with a fix-by date gets a faster response than an automated termination notice.

Content review before and after publication

Most programmes can't pre-approve every page, and none of the rules we read says you must. The Midnite ruling of 16 September 2026 shows why it still matters: an affiliate made a paid TikTok ad with an AI-generated character who appeared under 25, Midnite said it had not sanctioned it, and the ruling was made against both Midnite and the affiliate. Not approving something is not a defence.

A workable split:

• Pre-approve paid social and video creative, anything featuring a person, and anything using a new offer.
• Spot-check after publication for evergreen pages, comparison tables and reviews.
• Re-review on change: when an offer ends, when a rule changes, or when a complaint arrives.

Give affiliates a current offer sheet with significant terms they can copy. Most offer errors come from old copy, not bad faith.

Takedown and offboarding

Takedown

When content breaches a rule, speed is what the rules reward. Malta's regulation 33 looks at whether you acted at once. SR code 1.1.2 requires that you be able to terminate promptly. In practice:

1. Notify the affiliate with the URL, the rule and what needs to change.
2. Set a deadline. Short for a live breach, longer for a wording fix.
3. Check that the change is made, and record it.
4. Escalate to suspension or termination if it isn't.

Offboarding

When a partnership ends, for compliance reasons or otherwise:

• Ask the affiliate to remove your brand, offers and links, and set a date.
• Deactivate tracking links and promo codes so old content stops converting.
• Settle commission according to the contract, and record what was held and why.
• Re-check a sample of their pages after the removal date.

Operator view

Terminating is the easy part. The content stays up long after the contract ends, still carrying our name and an offer we no longer run. Offboarding isn't finished until the pages are gone or corrected.

Records and audit trail

SR code 1.1.2 requires affiliates to supply information for your reporting, which assumes you keep it. The KSA expects Dutch licensees to show reach reports on request. Keep, for each affiliate:

• The signed contract and version of your terms
• Vetting records, including KYB checks
• Audience age data received, with dates
• Each review: what was checked, when, by whom, and the outcome
• Each notice sent, the deadline and the response
• Offer sheets sent, with dates, so you can show what the affiliate was told
• Terminations and offboarding checks

Where to read the rules yourself

This guide is not legal advice. Read the Gambling Commission's page on licensees' responsibilities for third parties, CAP's age-restricted ads online guidance, and the regulator's own guidance for each market in affiliate marketing rules by market.

Checklist

• Contract meets SR code 1.1.2 and condition 16.1.1, plus each market's rules
• Monitoring list and cadence written down
• Audience data requested for the channel carrying the ad
• Pre-approval for paid social, video and anything featuring a person
• A notify, deadline, check, escalate takedown route
• Offboarding includes link deactivation and a removal check
• Records kept for every review, notice and termination