All British Casino operator L&L Europe pays £900,000 over withdrawal delays and anti-money laundering failings

Withdrawals at the centre of the case

The case began with a compliance assessment of the company's remote operating licence and moved to a formal licence review under section 116 of the Gambling Act 2005. The breaches covered the period from October 2024 to October 2025.

The first problem was a rule in the operator's terms and conditions. Customers could request at most one withdrawal at any time and could only request another once the first had been authorised. The Commission said this term was unfair within the meaning of the Consumer Rights Act 2015, and its officials also saw withdrawal requests being withheld for reasons other than regulatory or legal requirements. The regulator acknowledged that the company acted quickly to fix this breach.

The second problem came from the operator's fraud and collusion policy, under which some customers had every fifth or tenth withdrawal reviewed by hand. Those customers were asked for additional information before their money was released. Under the Commission's licence conditions, a withdrawal request must not trigger a demand for information that the operator could reasonably have asked for earlier, unless another law requires it at that point. The company accepted that the reviews delayed withdrawals and has since changed its process.

"A basic expectation is that when you have winnings you can withdraw those swiftly without hinderance from unfair terms and conditions or the operator failing to carry out checks at an earlier stage," said Sue Young, the Commission's Executive Director of Operations. "There may be occasions where a gambling business can ask consumers for information at withdrawal to fulfil legal obligations, but this was not the case here."

Anti-money laundering gaps

The Commission found that the operator's money laundering and terrorist financing risk assessment used a scoring method whose rationale was unclear. It covered several jurisdictions without making clear which controls applied to British customers, and it did not say how high spending or spending out of line with a customer's wealth was assessed. The company has since written a separate risk assessment for Great Britain.

The published findings include one customer who deposited £4,400 within eight hours of opening an account. The operator accepted the source of funds as "a gambling account" without weighing the fact that the customer's bank account had been opened two weeks earlier and that the money could not be shown to come from employment, business income or savings. The same customer gave an incorrect address twice when asked for documents, which did not raise suspicion.

Safer gambling failings

Alerts for time spent gambling, failed deposits and the number of deposits were switched on for some of the company's websites but not across its whole portfolio, and they fired only when two indicators appeared on the same day. In one case, a customer had 84 failed deposits for insufficient funds within seven days without the system flagging possible harm. The operator's process contained only one strong indicator of harm, based on losses within 24 hours.

Other examples in the statement:

• A customer hit the operator's 24-hour spending threshold on the day they registered but was not called until two weeks later, by which point they had reached the same threshold several times.
• A 21-year-old lost £6,500 within three days of opening an account, and an 18-year-old lost £4,000 in eight minutes, without their age being treated as a risk factor.
• A customer returning from self-exclusion set a £1,000 net monthly deposit limit, then deposited £2,898 and withdrew £1,800 over nine days, ending £98 over the limit. The Commission said the operator had not implemented customer-set limits as its remote technical standards require.

How the settlement was set

The Commission counted as aggravating factors that the failings were serious and resembled earlier cases for which it had already published lessons for the industry. It credited the company for putting an action plan in place promptly, cooperating with the investigation and accepting the failings early. The £900,000 payment goes to the UK government's Consolidated Fund.

The company holds remote casino and remote general betting licences from the Commission and lists its head office in Mosta, Malta. The Commission did not name the four other websites it operates.

Young said the regulator wanted the case to remind the industry that "although much of our enforcement action frequently relates to anti-money laundering and social responsibility failings, we will not hesitate to act when we see incidents of gambling not being fair and open."

The settlement came two days before the Commission announced sentences in the 2024 general election betting case. Its acting chief executive recently outlined the regulator's work against illegal gambling websites.