Gambling Commission settlement: L & L Europe pays £900,000 for late withdrawal checks and threshold-only AML

The L & L Europe Gambling Commission settlement, published on 21 October 2026, requires the operator to pay £900,000 for failures between October 2024 and October 2025. It asked some customers for information at withdrawal that it could have requested earlier, ran AML controls built on financial thresholds rather than customer risk, and accepted weak source of funds evidence.

• L & L Europe Limited, which runs seven websites including allbritishcasino.com, casinocasino.com and hypercasino.com, will pay £900,000 in lieu of a financial penalty.
• The Commission found a breach of licence condition 17.1.1(2): a fraud policy pulled every fifth or tenth withdrawal for some customers into manual review and requests for more information.
• AML controls were "largely based on financial thresholds and sampling at set thresholds", not on customer risk profiles.
• One customer deposited £4,400 within eight hours of registering, and the operator accepted "gambling account" as the source of funds.
• The Commission treated the case as aggravated because it resembled earlier cases on which it had already published lessons for the industry.

What did the Gambling Commission find at L & L Europe?

The Commission found that L & L Europe breached five sets of licence requirements between October 2024 and October 2025, covering fair terms, customer identity, AML, safer gambling and technical standards. The Gambling Commission settlement followed a compliance assessment of the operator's remote licence and a licence review under section 116 of the Gambling Act 2005.

The public statement lists the provisions breached. Licence condition 7.1.1(1) requires terms that are not unfair under the Consumer Rights Act 2015. Licence condition 17.1.1(2) restricts information requests at withdrawal. Licence condition 12.1.1, paragraphs 1 to 3, covers the AML risk assessment and controls. Paragraphs 5(b), (d) and (g), 11, 12 and 13 of social responsibility code provision 3.4.3 cover remote customer interaction. Licence condition 2.3.1 covers technical standards.

Announcing the case, Executive Director of Operations Sue Young said customers should be able to "withdraw those swiftly without hinderance" from unfair terms or checks that came too late. She said operators may sometimes need information at withdrawal to fulfil legal obligations, "but this was not the case here".

How did the withdrawal checks break the identity rule?

L & L Europe broke the identity rule by using withdrawal as the moment to ask for information it could reasonably have collected at registration. Its "Fraud & Collusion policy" sent every fifth or tenth withdrawal for some customers to manual review, and those customers had to supply more information before they were paid.

Licence condition 17.1.1(2) states that a withdrawal request "must not result in a requirement for additional information" as a condition of paying out, if the licensee could reasonably have asked for it earlier. The operator accepted that the reviews delayed payouts and that in some cases the information could have been requested earlier in the customer relationship. The operator has since amended its process so withdrawals are no longer withheld unless a regulatory or legal requirement applies.

A second problem sat in the terms. Customers could have only one withdrawal pending at a time, and officials saw requests held back for reasons other than legal or regulatory requirements. The Commission found the term unfair and acknowledged that the operator fixed it quickly.

The case lands ten weeks after the Commission's own reminder of identity verification requirements for remote operators, published on 12 August 2026. That post said verification must confirm that the customer exists and that name, address and date of birth match the same person before they gamble. It added that over a quarter of complaints reaching the Commission's contact centre concern this area. The breaches predate the reminder, but the Gambling Commission settlement shows how high the issue now sits on the regulator's agenda.

Why were threshold-based AML controls not enough?

Threshold-based AML controls failed because they flagged customers by how much they spent, not by who they were. The Commission found that L & L Europe's money laundering controls were "largely based on financial thresholds and sampling at set thresholds", rather than on risk factors and each customer's risk profile, in breach of licence condition 12.1.1(2).

The weakness started in the risk assessment, whose scoring method and rationale were unclear. It did not set out the identification, analysis and evaluation stages in the Commission's casino AML guidance. It covered several jurisdictions without making clear which controls applied to British customers. It named high spenders as a risk without showing how that risk was mitigated, and gave no clear method for judging whether spending was proportionate to income or wealth.

In practice, a customer deposited £4,400 within eight hours of opening an account and then withdrew £50. The operator accepted that the money came from a "gambling account". It did not weigh that the customer's bank account had been opened two weeks earlier, or that the money could not be shown to come from employment, business income or savings. When the customer chased a withheld withdrawal and was asked for documents, they gave an incorrect address twice, and the operator raised no suspicion.

The operator's own procedure said funds should ideally be shown to be "originating from a legitimate activity such as employment or business income". The breach of paragraph 3 was therefore a failure to follow its own written controls, not the absence of a policy.

The operator has since created a standalone risk assessment for Great Britain. The Commission credited its prompt action plan, full co-operation and early acceptance of the failings.

What else did the Commission find on safer gambling?

The safer gambling findings, under code provision 3.4.3, show the same threshold dependence that weakened the AML controls. Alerts relied mostly on financial thresholds, time and failed-deposit alerts ran on only some of the operator's websites, and an alert fired only when two indicators appeared on the same day.

One customer had 84 failed deposits for insufficient funds in seven days without being identified as at risk. A 21-year-old lost £6,500 within three days of opening an account, and an 18-year-old lost £4,000 in eight minutes, without their age being treated as a risk factor. A customer returning from self-exclusion with an agreed £1,000 monthly net deposit limit went £98 over it in nine days. The Commission treated this as a breach of licence condition 2.3.1 and the remote technical standards on financial limits.

How does this Gambling Commission settlement compare with recent cases?

At £900,000, this Gambling Commission settlement matches the Petfre (Gibraltar) case of June 2026 and sits well below the £5 million Grosvenor and £10 million Platinum Gaming outcomes. What sets it apart is the identity finding. Withdrawal-stage verification is the consumer complaint the Commission singled out in August, and here it carries a named breach.

Sources for the table: Platinum Gaming, Petfre, Evolution, QuinnBet, Grosvenor Casinos and the L & L Europe public statement.

The Grosvenor and QuinnBet cases both turned on funds accepted as legitimate without evidence. This Gambling Commission settlement adds the reverse error: friction applied at the wrong moment, for fraud reasons rather than legal ones.

What does this mean for your AML and identity obligations?

The Gambling Commission settlement changes how operators should evidence when they collect information, not only whether they collect it. Four duties under the licence conditions and the Money Laundering Regulations 2017 are engaged, and each now has a worked example of failure in a published statement.

Identity verification timing. Licence condition 17.1.1, as the Commission's August reminder restates, expects identity to be established before gambling and bars withdrawal-stage requests that could reasonably have come earlier. A sampling rule that pulls every fifth or tenth withdrawal into review is hard to defend unless each request is tied to a legal duty arising at that moment.

Customer due diligence at withdrawal. Regulation 27(5) and (6) of the Money Laundering Regulations 2017 requires a casino to apply customer due diligence to transactions of £2,000 or more, including deposits for remote gambling and withdrawals of funds or winnings. That is the kind of legal requirement licence condition 17.1.1(2) carves out. A withdrawal that triggers this duty can justify a check at that point.

Risk assessment and controls. Regulation 18 requires a firm to assess risk using factors relating to its customers, countries, products, transactions and delivery channels. A control set keyed to spend thresholds alone does not use most of those factors. The written assessment must also explain its scores and say which controls apply to British customers.

Ongoing monitoring and source of funds. Regulation 28(11) requires scrutiny of transactions "including, where necessary, the source of funds". A new bank account, a large first-day deposit and a mismatched address are the risk signals that should move a customer to enhanced due diligence and, where suspicion arises, to a suspicious activity report under Part 7 of the Proceeds of Crime Act 2002.

What is still uncertain after the Gambling Commission settlement?

The main uncertainty is where the line sits between a lawful withdrawal-stage check and a breach of licence condition 17.1.1(2). The statement confirms that legal duties arising at withdrawal are carved out, but it does not say how operators should treat fraud checks that are not legally required, or how much earlier information "could reasonably" have been requested.

The Commission's August reminder narrows that line: "It is not appropriate to wait until a withdrawal request to follow up outstanding queries." That still leaves a real tension. The L & L Europe statement criticises the operator for asking too late and for scrutinising too little. Operators that respond by removing withdrawal checks altogether risk the second failure, while operators that keep broad sampling risk the first. The defensible answer is to front-load verification and source of funds checks to registration and early deposits, which moves friction to sign-up.

Other gaps remain. The statement does not say how many customers faced delayed withdrawals, or how the £900,000 figure was set beyond the aggravating and mitigating factors. It also notes the failings resembled earlier cases with published lessons, and counts that similarity as an aggravating factor.

How should compliance teams respond?

Compliance teams should audit when each piece of customer information is first requested, and remove any withdrawal-stage request that is not tied to a legal duty arising at that moment. Map every withdrawal hold reason to its legal basis, and retire sampling rules that cannot show one, which is the change this Gambling Commission settlement most directly demands.

Next, rebuild the AML risk assessment so each score has a stated rationale, each factor in regulation 18 is covered, and controls for British customers are named. Replace spend-only triggers with combined signals such as account age, deposit velocity, bank account age, address mismatches and customer age. Then test the operator's own source of funds procedure against recent files, since the breach here was failing to follow written rules. Our guide to KYC for online casinos covers the onboarding sequence.

Zyphe's KYC software lets operators verify identity once at registration, with an NFC chip read and liveness check, and reuse that credential when a legal duty arises at withdrawal, instead of collecting documents again. Documents are encrypted into the user's own vault, so there is no central store of customer PII. Operators reviewing withdrawal holds and onboarding checks can book a demo.

The bottom line

This Gambling Commission settlement tests timing as much as substance. L & L Europe asked for information too late and scrutinised risk too little. Move identity and source of funds work to the start of the relationship, tie every withdrawal hold to a legal duty, and build risk controls on who the customer is rather than how much they spend.

Cited sources

• Gambling Commission, L & L Europe Limited public statement, 21 October 2026
• Gambling Commission, L & L Europe pays £900,000 for failures including withdrawal delays, 21 October 2026
• Gambling Commission, Reminder of identity verification requirements for remote operators, 12 August 2026
• Gambling Commission, Petfre (Gibraltar) Limited to pay £900,000 for regulatory failures, 30 June 2026
• Gambling Commission, £10m fine for online operator Platinum Gaming Limited, 22 October 2025
• Gambling Commission, Evolution Malta Holding Limited to pay £4.75m, 23 July 2026
• Gambling Commission, QuinnBet (Gibraltar) Limited to pay £609,104 for regulatory failures, 20 August 2026
• Gambling Commission, Grosvenor Casinos Limited public statement, 7 October 2026
• Money Laundering Regulations 2017, regulation 18, risk assessment
• Money Laundering Regulations 2017, regulation 27, customer due diligence
• Money Laundering Regulations 2017, regulation 28, ongoing monitoring
• Proceeds of Crime Act 2002, Part 7, money laundering