Meet Andrew Murray,
our auditor.

Andrew joined SlotsGamblers as a founding specialist in September 2025, brought in by David alongside Claire Wilson to build the desk's responsible-gambling and compliance checks from day one, when the site was still just David working alone off a Reddit thread. His background is in compliance and responsible-gambling process — the kind of work where you read licence conditions line by line and learn to notice when a self-exclusion process looks good on paper but doesn't actually hold up when you test it. He's not on the site to make an operator sound safer than it is; he's there to say plainly when it isn't, and that distinction is the reason David wanted a dedicated RG desk rather than folding compliance into the general review process.

He owns the responsible-gambling section of every operator profile on the site — deposit limits, reality checks, cooling-off periods, and whether the self-exclusion process an operator advertises actually works when someone uses it. That ownership isn't a checkbox he fills once and forgets: operators change their RG tooling without announcing it, sometimes as a side effect of a platform migration rather than a deliberate decision, so every profile gets re-checked on a rolling basis rather than left to age on the strength of its original audit. He also holds the second sign-off on every review alongside David: neither of them will publish a review the other hasn't approved, and Andrew is the one who can veto a listing purely on RG grounds even if every other desk has cleared it — the games can be excellent, the payouts fast and the bonus terms fair, and the review still doesn't go out if the RG side doesn't clear.

Based in Edinburgh, he covers RG requirements across GB, CA and US markets and keeps the site's internal blocklist — any operator we've caught refusing a genuine self-exclusion request in the last 24 months stays off the index, no matter how strong the rest of the review is. Working three markets at once means holding three separate sets of RG expectations in his head at the same time: what GamStop requires in GB is not what a provincial self-exclusion scheme requires in CA, and neither maps cleanly onto the patchwork of state-level US requirements, so a lot of his day-to-day work is translation as much as it is auditing — making sure a claim that's technically true in one market doesn't get presented as if it applies everywhere. Susan Taylor pings him the moment a regulatory change lands in any of the three markets, and Nathalie's scoring model treats an RG flag from Andrew as a hard input, not a soft signal, which means a single confirmed RG failure can move an operator's composite score more than a run of good payout times can rebuild it. You can reach him directly at [email protected].

The three-market split also shapes how he reads an operator's marketing copy. A responsible-gambling page written for a GB audience will often lean on GamStop by name because that's what a GB regulator expects to see referenced; the same operator's US-facing page might mention a helpline only in small print at the footer, because US disclosure norms are looser and the operator knows it. Andrew reads those differences as a signal in themselves — an operator that treats RG disclosure as a minimum-compliance exercise in one market and a genuine feature in another usually treats the underlying tooling the same way, and that's often what the live test then confirms.

The blocklist itself is the part of the job Andrew talks about least publicly and thinks about most. It isn't a list he built once at launch and now just maintains — it grows and occasionally shrinks as operators either get caught failing a live test or, less often, prove over a full rolling window that a previous failure has actually been fixed rather than patched over for the review cycle. He treats a reinstatement as a heavier decision than a first-time addition, because removing an operator is a one-line note in a review and readers rarely see the reasoning behind it, while putting one back on the index after a documented failure means he's staking the desk's credibility on the fix holding under future testing, not just the one he ran.

Day to day, a lot of what lands on Andrew's desk doesn't start as an RG question at all. Kevin will flag a bonus term that reads as if it's designed to make a deposit limit look higher than it functionally is; Marc will notice a withdrawal delay that lines up suspiciously with when a player tried to self-exclude rather than with normal processing time; Susan will forward a licence-change notice that quietly drops a jurisdiction's RG requirement out of an operator's terms. None of those arrive labelled as compliance work, but Andrew is usually the one who ends up tracing whether the pattern is a coincidence or something worth a live test. That cross-desk noticing is, in practice, as much of his job as running the self-exclusion checks themselves — the tests only happen on operators someone had a reason to be suspicious of, and most of those reasons come from somewhere else on the team first.

He keeps his own notes separate from the published review copy — dated screenshots, support-ticket references, timestamps on when a deposit-limit change actually took effect versus when the operator said it would. None of that raw material goes on the page itself; what readers see is the conclusion, not the log. But the log is what lets him reopen a case eighteen months later and tell, from his own record rather than memory, whether an operator's RG tooling has genuinely improved or just changed its wording.

"Self-exclusion" is a single word on most operators' responsible-gambling pages, and it covers a lot of ground that never gets tested. Andrew's position is that the claim is only worth what it does when a real account tries to use it — not what the terms page says it does. That's the difference between a tool that exists and a tool that works, and it's a distinction most reviewers never get to because it means opening a real account, going through onboarding, and then deliberately breaking the thing they're testing rather than just reading about it. It also means accepting that a test can come back negative — most operators do honour it, and Andrew's notes make a point of saying so plainly rather than treating a clean result as less noteworthy than a failure.

The 24-month rolling blocklist is the sharpest version of this rule: if an operator has refused, delayed or quietly failed to honour a genuine self-exclusion request inside the last two years, it does not appear on the SlotsGamblers index — full stop, regardless of licensing, bonus quality or how every other desk scored it. The window is rolling, not a permanent ban, because Andrew re-checks lapsed entries rather than leaving a stale flag in place indefinitely once an operator has demonstrably fixed the process. That re-check is deliberately harder to pass than the original test: a single clean run inside the window isn't enough on its own, because a fix that was only made to satisfy one audit tends to quietly regress once the pressure is off, so Andrew looks for the fix showing up consistently across more than one pass before he'll consider lifting a flag.

Most self-exclusion failures Andrew has actually caught aren't outright refusals — operators rarely say no outright. They're partial: the deposit button gets disabled but marketing emails keep arriving, or account access is blocked on desktop but the mobile app still lets a session through, or the exclusion applies to the operator's main brand but not to a skin running on the same platform under a different name. A tool that's 80% honoured isn't honoured, so the test has to cover every surface an operator controls, not just the one the terms page mentions — email, SMS, desktop, mobile app and, where it exists, any sister brand sharing the same backend.

The other failure mode he watches for is friction on the way in rather than the way out — a self-exclusion flow buried three menus deep, or a support team that redirects a request to "just lower your deposit limit instead" rather than processing what was actually asked for. Neither of those shows up in a terms-and-conditions read-through, and neither would count as an outright refusal if you only checked whether the option technically existed somewhere on the site. Andrew treats a self-exclusion request that a support agent tries to talk a player out of as functionally the same failure as one the system silently ignores, because the outcome for the player is the same either way.

There's also a category of near-miss that doesn't earn an operator a blocklist entry but does get written up in the review: the tool works, but only if the player already knows exactly what to ask for. An operator whose self-exclusion option is real but is filed under a support-article title that doesn't use the word "exclude" anywhere in it is technically compliant and practically useless to someone searching for it under pressure. Andrew's notes distinguish between "fails when tested" and "passes but shouldn't have to be searched for," because the second category is a design problem the operator can usually fix in a week, while the first is the one that puts them on the blocklist for two years.

Reversal is the last thing he checks, and it's easy to miss because it sits after the part most reviewers stop testing at. Some operators will process the initial self-exclusion request cleanly and then make undoing it almost as easy as a login — a same-day "cool-off" link buried in an account-recovery email, with no waiting period and no second confirmation. A tool that a player can accidentally cancel in a moment of impulse is arguably worse than one that never worked at all, because it gives the appearance of protection without the substance of it, so Andrew's test doesn't end at confirming the exclusion applied — it ends at confirming how hard it is to undo.