A UK-licensed online casino has agreed to pay £1.2 million to the Gambling Commission after investigators found gaps in the checks it runs on customers.
The regulator published the settlement on Tuesday and closed an eleven-month licence review. The money goes to the National Strategy to Reduce Gambling Harms, which funds treatment, research and prevention work. Customers who lost money on the site receive nothing from that payment, and no rule requires the operator to hand any of it back.
Commission staff pulled 24 customer accounts at random and traced what happened to each one.
The operator's monitoring system raised risk alerts on twelve of those accounts. Three customers deposited more than £10,000 in a single month and heard nothing from the safer gambling team. One account took in £31,000 across five months while the system raised 43 alerts. Staff made one phone call to that customer.
The operator wrote in its policy that staff should interact with a customer after every third alert. The compliance team followed that rule twice in the eleven months under review, and on both occasions the customer had already stopped depositing.
The anti-money laundering failures drew the larger share of the penalty. Nineteen customers moved money before the operator asked where it came from. One joined in March and put £42,000 into the account by July after passing a debit card check at sign-up. The Money Laundering Regulations 2017 require enhanced checks once a customer's activity stops matching the profile the account was opened with.
The operator held incomplete source of funds records, and had not reviewed its business risk assessment since 2021. Two compliance managers covered 40,000 accounts between them, a workload that left little room for case-by-case review.
Commission staff also examined promotions. The operator kept a suppression list of customers who had told it to stop sending marketing. It emailed bonus offers to 61 of them over four months. Fourteen on that list had self-excluded with the operator itself.
Self-exclusion through a single operator works apart from GamStop, the national scheme that blocks you from every UKGC-licensed site. The Commission treats both as binding. An operator that ignores either one risks its licence.
A Commission spokesperson said: "Monitoring software protects nobody on its own. Alerts matter when a person reads them and picks up the phone."
Commission staff open most reviews after a compliance assessment. They visit operators, pull files, and score what they find against the licence conditions. A weak score triggers a formal review.
Operators also report themselves. Licence conditions force a casino to tell the Commission when it finds a breach, and staff give credit for self-reporting when they set a penalty. The operator in this case reported the marketing failure and disclosed the other two during the review.
Customers and whistleblowers add to the pile. The Commission logs complaints about individual operators, and staff move an operator up the assessment queue when complaints cluster around one theme.
Commission guidance tells operators to look at behaviour rather than a fixed deposit figure. A customer who starts depositing at 2am, chases losses, or asks to cancel a withdrawal can trigger a check at £200 a month as easily as a bigger spender can. The operator used one threshold of £5,000 a month and ignored everything below it.
Staff who follow a number instead of a pattern miss the people who need help first. A person on £1,500 a month depositing £600 carries more risk than a wealthy customer losing £5,000, and the operator's own records listed both.
The settlement covers three areas: £600,000 for social responsibility failures, £480,000 for anti-money laundering breaches and £120,000 for the marketing errors. Commission staff set the figures against a framework that weighs the number of customers affected, the length of the failure and the operator's own response.
Licence conditions came with the money. The operator must appoint an independent auditor to review its customer interaction process and send reports to the regulator every quarter for 18 months. It must also re-run checks on the 24 accounts in the sample and contact anyone whose activity should have prompted a conversation earlier.
That template has become familiar. Settlement, licence condition, public statement naming the failures. The Commission publishes each one to show other operators what a penalty looks like, and to give customers a list worth checking.
Your balance stays yours and withdrawals carry on. Expect more friction. The operator will run the affordability checks it skipped, ask for payslips or bank statements, and hold withdrawals while those checks run.
You can refuse. The operator will close the account and return your balance within about a week. Ask for the closure in writing and keep the reply, because a closed account still owes you any funds left on it.
If a bonus offer arrives after your self-exclusion request, you have grounds to complain to the Commission. Keep the email and the date you asked to be excluded.
Start with the licence. The Gambling Commission keeps a public register, and every operator licensed in Britain appears there with its trading names. A site missing from that register runs without a UK licence, and you have no regulator to appeal to if it keeps your money.
Then look at how you pay. Debit cards, PayPal, Apple Pay and Google Pay, open banking transfers through providers such as Trustly, and Paysafecard all work at UK-licensed casinos. Credit cards do not. The Commission banned them for gambling deposits in April 2020, so an operator still offering a credit card option has broken the rules before you place a bet.
Read what other customers say. Trustpilot hosts a review page for each casino's website, and players post withdrawal complaints there months before those complaints reach a licence review. You learn more from a run of gripes about one payment method than from a star rating.
Set your limits at registration, while your head is clear. Deposit limits, loss limits and session reminders take two minutes to configure, and they protect you from the kind of month that turned up in those 24 files.
Complain to the operator first. Its terms must include a complaints process, a deadline for a final response, and details of the ADR service you can use when you disagree with the outcome.
The Commission takes complaints about licensed operators, though it does not settle disputes or return money to individuals. What it does with a pattern of complaints is open a compliance case. Staff triage complaints faster when you include references, dates and screenshots.
Every UKGC-licensed operator must offer deposit limits, loss limits, session reminders and time outs. Set a monthly deposit limit and the operator cannot raise it without your written request and a 24-hour cooling-off period. Lowering a limit takes effect straight away.
GamStop blocks you from every licensed site in Britain for at least six months, and you can extend that period. BeGambleAware and GamCare run free helplines and live chat, and both will talk to you about your gambling whether or not you have decided to stop.
Spend ten minutes on a licence check, one payment method and a review page before your next deposit, and you will spot most of these failures from the outside.