The Grosvenor Casinos settlement: £5 million for source of funds, cash and EDD failures

The Grosvenor Casinos settlement, published on 7 October 2026, requires Rank Group's three casino licensees to pay £5,012,261 after the Gambling Commission found anti-money laundering and safer gambling failures. Crypto checks appeared to require only proof of conversion to fiat, a cash-only customer recycled about £85,000 without a risk upgrade, and enhanced due diligence was skipped where policy required it.

• Grosvenor Casinos Limited will pay £5,012,261 in lieu of a financial penalty, for itself and two sister licensees running 51 casinos across Great Britain.
• The Commission found breaches of licence condition 12.1.1 paragraphs 2 and 3 (AML policies and their effective implementation) and of social responsibility code provision 3.4.1.
• Grosvenor's cryptoasset process appeared to require only proof that the assets had been converted into fiat through a bank account before play.
• A cash-only customer recycled about £85,000 over roughly 11 weeks without a risk upgrade, and enhanced checks were not adequately done until losses reached about £13,000.
• The group must commission a third-party audit within six months of the end of the licence review.

What did the Gambling Commission find at Grosvenor?

The Commission found that Grosvenor's AML policies were out of date, unclear and inconsistently applied in its venues. The case follows a licence review under section 116 of the Gambling Act 2005, opened after information reached the regulator and after key event notices the licensee itself submitted. A targeted compliance assessment of one venue followed on 13 June 2025.

The public statement records breaches of two paragraphs of licence condition 12.1.1. Paragraph 2 requires appropriate policies, procedures and controls once the operator has assessed its risks. Paragraph 3 requires those controls to be "implemented effectively, kept under review, revised appropriately". Grosvenor's policies had not properly absorbed the 2020 changes to the Money Laundering Regulations, which left one customer below the high-risk rating they should have carried.

The Grosvenor Casinos settlement was proposed on behalf of the whole group and accepted because all three companies use the same policies, procedures and controls. Announcing the case, Executive Director of Operations Sue Young said these risks are "equally alive in the land-based sector" and urged every premises-based operator to check its own business against the findings.

Where did the source of funds controls break down?

Source of funds controls broke down at three points: cryptoasset wealth, venue-level discretion and identity records for returning customers. Some failures were in the written rules, breaching licence condition 12.1.1 paragraph 2: they were out of date and unclear. Others were rules staff did not apply, breaching paragraph 3. The crypto case shows both.

On cryptoassets, the statement says Grosvenor's process "appeared to have required only that such assets be verified as having been converted into fiat currency" through a suitable bank account before gambling. A bank receipt proves the money passed through a regulated account. It says nothing about how the coins were acquired, which is the question source of funds verification is meant to answer. Grosvenor's own policy said a customer relying on crypto should not be standard risk and should get enhanced checks as soon as possible. Records showed that did not happen. The same policy applied to a customer identified as a student from China, and that customer's rating was not raised either.

Venue discretion was the second weak point. Grosvenor gives venue management some autonomy, which the Commission said is "not problematic in principle". In practice, source of funds or source of wealth evidence that should have gone to central compliance for scrutiny did not. In one case the venue obtained the evidence but never submitted it, and the customer lost significant funds that "may or may not have been their own".

The third failure was identity. A customer returning after a long break lost around £200,000 in two visits without adequate photographic identification on file or recorded evidence of income. Grosvenor held older identity records only as reference numbers, not documents. The statement adds that later open-source searches suggested the customer may have significant assets, and that a source of funds and wealth review was documented, but no documents were obtained from the customer.

Why did a cash-only customer's risk rating never move?

A customer who played only in cash recycled about £85,000 through a venue over roughly 11 weeks, and Grosvenor never raised their money laundering risk level. Enhanced checks were not adequately carried out until losses reached around £13,000. Eleven weeks of cash recycling is the kind of unusual pattern enhanced monitoring exists to catch, so the rating should have moved before losses reached £13,000.

The statement also found that staff did not request or record enough evidence and rationale for the AML decisions they made, and that customers showing higher-risk characteristics were given risk levels that did not reflect them. The cash case is the statement's example of the second failure.

What were the safer gambling failures?

The Grosvenor Casinos settlement also covers breaches of code provision 3.4.1, the premises-based customer interaction rule, in paragraphs (1)(b), (1)(c) and 2. Staff did not interact appropriately with customers at risk of harm, did not check whether interactions worked, and did not take the Commission's customer interaction guidance into account.

The Commission found staff used perceived wealth or a winning position to justify brief interactions. One long-standing customer won about £260,000 in a short period, then lost about £250,000 in 12 days with no safer gambling interaction recorded. Another lost about £50,000 with none. A customer returning after self-exclusion, playing with verified winnings from another operator, lost about £25,000 before any interaction. Later interactions did not escalate to time or spend limits or reduced debit card access until the customer said the winnings were gone, and a further £11,000 was lost over six weeks before suspension.

Paragraph (1)(c) asks whether interactions worked. In one record, repeated reality checks and loss alerts at the same level failed to change behaviour, and losses passed £73,000. The Commission saw no evidence that such cases were evaluated or fed into policy or retraining.

How does the Grosvenor Casinos settlement compare with recent cases?

At £5,012,261, the Grosvenor Casinos settlement is larger than the other 2026 Gambling Commission AML cases compared here, but half the £10 million Platinum Gaming penalty of October 2025. It also targets a land-based estate. The Commission itself noted that larger enforcement cases are often associated with online gambling.

Evolution turned on an outdated risk assessment. QuinnBet shared Grosvenor's weakness of assuming funds were legitimate without evidence. The common thread is controls that did not work in practice, whether because a risk assessment was out of date (Evolution), rules were unclear (Platinum, Grosvenor) or staff did not apply them (QuinnBet, Grosvenor).

What does this mean for your AML obligations?

For casinos and other relevant persons, the Grosvenor Casinos settlement maps onto four specific duties in the Money Laundering Regulations 2017 and the licence conditions. A supervisor tests each one against customer files, not only the procedure manual.

Regulation 27(5) and (6) requires a casino to apply customer due diligence to stakes, token purchases and collected winnings of £2,000 or more, including linked transactions. A returning customer whose identity exists only as a reference number has not been verified in any way an examiner can check.

Regulation 33(1) requires enhanced due diligence in high-risk cases under paragraph (a), and under paragraph (f) where a transaction is unusually complex or unusually large or there is an unusual pattern of transactions. That cash recycling is an unusual pattern. EDD triggered by losses, not by the pattern, starts at the wrong point.

Regulation 28(11) requires ongoing monitoring, including scrutiny of transactions and, where necessary, source of funds, to confirm they match what you know of the customer. For cryptoassets, that means evidencing how the assets were acquired, not only that they reached a bank.

Regulation 40 requires copies of due diligence documents and enough records to reconstruct a transaction, kept for five years after the relationship ends or, for an occasional transaction, after its completion. A document obtained but not kept fails regulation 40. A missing rationale is a separate failure: the statement found staff did not record sufficient evidence and rationale, and licence condition 12.1.1 paragraph 3 makes effective implementation, not policy text, the measure.

What is still uncertain after the settlement?

Several questions remain open, from which 2020 amendment Grosvenor missed to how the Commission expects crypto wealth to be evidenced. The statement behind the Grosvenor Casinos settlement describes failures by example rather than setting thresholds, so operators must infer the standard.

The statement does not name the 2020 change Grosvenor failed to absorb. Instruments amending the Regulations that year include the Money Laundering and Terrorist Financing (Amendment) Regulations 2019, mostly in force from 10 January 2020, and the EU Exit amendments of 2020. Operators cannot tell which change caught Grosvenor out, so a gap analysis against every post-2017 amendment is the safer reading.

The crypto standard is undefined. The Commission criticised a fiat-conversion-only check but did not say what good evidence of crypto wealth looks like.

Venue autonomy raises a design question. The Commission did not object to local discretion, only to evidence that never reached central compliance, so multi-venue groups need a hard routing rule.

The audit is still to come. The third-party audit must happen within six months of the licence review ending. The statement lists two aggravating factors: prior formal advice to the licensee on similar concerns, and earlier public statements about the same issues at other operators. It also credits Grosvenor for swiftly implementing changes and for full co-operation. A poor audit result after a settlement that already cites earlier warnings would leave the group exposed to tougher action.

Finally, the statement lists no separate disgorgement figure, unlike QuinnBet's settlement, where £193,118 of the £609,104 was disgorgement. Whether any of the £5,012,261 reflects gains from the failings is not stated.

How should compliance teams respond?

Start by testing both your written rules and your customer files, because the Grosvenor Casinos settlement cites both out-of-date rules and rules applied inconsistently. Sample high-loss and high-turnover customers from the last 12 months and check that each risk rating, EDD trigger and decision rationale matches what the policy requires.

The statement ends with good-practice questions for every operator, starting with whether your AML controls "bear objective scrutiny" and are "implemented effectively". Practical steps follow. Add a cash-recycling rule that raises the risk rating on turnover, not losses. Require cryptoasset source of funds evidence that covers acquisition, not only conversion. Make it impossible to close a high-risk review without a recorded rationale and an attached document. Re-verify returning customers whose identity is held only as a reference number. Map your policies against each amendment to the 2017 Regulations since 2019 and record the result. The Commission's 2026 money laundering risk assessment and our guide to KYC for online casinos set out the wider risk picture.

Zyphe helps operators verify identity once with an NFC chip read and two-step liveness, then accept a reusable credential when the customer returns, with an exportable audit trail for every decision. Documents are encrypted into the customer's own vault, so there is no central store of customer PII to maintain. See our AML software or book a demo.

The bottom line

The Grosvenor Casinos settlement is about policies that were out of date and unclear, and that staff then applied inconsistently. Grosvenor had rules that flagged crypto wealth, required enhanced checks and set risk ratings, yet stale wording, a conversion-only crypto check, staff discretion and evidence that never reached central compliance let those rules fail. For any regulated firm, the lesson is the same: a supervisor will judge your controls by the written rules and the customer file, so the file has to show the check, the evidence and the reason.

Cited sources

• Gambling Commission, Grosvenor Casinos Limited public statement, 7 October 2026
• Gambling Commission, Land-based casino operators to pay £5m for regulatory failures, 7 October 2026
• Money Laundering Regulations 2017, regulation 27: customer due diligence
• Money Laundering Regulations 2017, regulation 33: enhanced customer due diligence
• Money Laundering Regulations 2017, regulation 28: ongoing monitoring
• Money Laundering Regulations 2017, regulation 40: record-keeping
• Money Laundering and Terrorist Financing (Amendment) Regulations 2019, commencement
• Money Laundering and Terrorist Financing (Amendment) (EU Exit) Regulations 2020, commencement
• Gambling Commission, £10m fine for online operator Platinum Gaming Limited, 22 October 2025
• Gambling Commission, Evolution Malta Holding Limited to pay £4.75m, 23 July 2026
• Gambling Commission, QuinnBet (Gibraltar) Limited public statement