On 21 October 2026, the UK Gambling Commission announced a £900,000 regulatory settlement with L & L Europe Limited, the operator behind seven online gambling sites, including allbritishcasino.com, casinocasino.com, and hypercasino.com. The Gambling Commission settlement followed a regulatory review that identified failings in the operator’s withdrawal terms and processes, anti-money laundering controls, and social responsibility measures between October 2024 and October 2025.

The £900,000 is a payment in lieu of a financial penalty, directed to the consolidated fund. The Commission also required publication of a statement of facts and payment towards its investigation costs.

At the centre of the case was a familiar compliance failure: controls that relied heavily on financial thresholds and sampling, rather than on meaningful risk factors and individual customer risk profiles. In one example, the operator accepted a customer’s funds as originating from a “gambling account” despite limited evidence of a legitimate source.

What the Commission Found

A regulatory review under section 116 of the Gambling Act 2005 began after a Compliance Assessment of L & L Europe's remote Operating Licence. The review found failings in the operator's AML/CTF and social responsibility controls. The public statement records breaches of the following provisions of the Licence Conditions and Codes of Practice (LCCP).

Withdrawal Terms and Processes

The Commission found that L & L Europe’s terms allowed customers to submit only one withdrawal request at a time. A further request could be made only after the existing withdrawal had been authorised, a restriction the Commission considered unfair under the Consumer Rights Act 2015.

The operator also manually reviewed every fifth or tenth withdrawal for certain customers. As part of that process, some customers were asked to provide additional information before withdrawals were processed, and the operator accepts that this information could, in some cases, have been requested earlier in the customer relationship.

The Commission acknowledged that L & L Europe acted swiftly to address the breach relating to its withdrawal terms. It has also amended its withdrawal process, and withdrawals are now withheld only where a regulatory or legal requirement applies.

"A basic expectation is that when you have winnings you can withdraw those swiftly..."

Sue Young, Executive Director of Operations, Gambling Commission, 21 October 2026

AML Risk Assessment Fell Short

Licence Condition 12.1.1(1) requires operators to assess the risk that their business may be used for money laundering or terrorist financing, and to review that assessment at least annually. The Commission identified several weaknesses in L & L Europe’s assessment.

• The scoring methodology lacked clarity, and the rationale for individual risk scores was unclear.
• The assessment did not clearly follow the Commission’s expected stages of identification, analysis, and evaluation.
• Although it covered activity across multiple jurisdictions, it did not clearly explain which controls applied to British consumers.
• High-spending customers were identified as a risk, but the assessment did not clearly explain how that risk would be mitigated.
• Disproportionate spend was not adequately considered or assessed.

L & L Europe has since produced a standalone risk assessment for Great Britain, taking into account the issues raised in the review.

Controls Relied Too Heavily on Thresholds

Under Licence Condition 12.1.1(2), operators must maintain appropriate policies, procedures, and controls to prevent money laundering and terrorist financing. The Commission found that L & L Europe’s controls were not appropriate because they were largely based on financial thresholds and sampling at set thresholds, rather than on customer-specific risk factors and risk profiles.

The Commission also found that disproportionate spend was not properly considered in the risk assessment and that the operator lacked clear controls to manage that risk.

Customer Due Diligence Was Not Always Followed

Licence Condition 12.1.1(3) requires operators to implement their AML controls effectively. The Commission found that L & L Europe did not always follow its own customer due diligence procedures.

The operator’s due diligence documentation stated that funds should ideally be shown to come from a legitimate source, such as employment or business income. Yet the Commission identified two examples where that standard was not met.

In the first, a customer deposited £4,400 within eight hours of opening an account and then withdrew £50. The operator accepted “gambling account” as the source of funds. It did not consider that the customer’s bank account had been opened only two weeks earlier, or that the funds could not be evidenced as coming from employment, business income, or savings.

In the second, a customer who had registered the previous day contacted the operator about a withheld withdrawal and provided an incorrect address on two occasions. According to the Commission, this did not raise suspicion.

Social Responsibility Failures

The Commission also found breaches of Social Responsibility Code Provision 3.4.3, which concerns customer interaction for remote gambling. The operator’s safer gambling alerts focused predominantly on financial thresholds rather than a broader range of harm indicators.

Alerts relating to time spent gambling, failed deposits, and the number of deposits were active on some websites but not across the operator’s full suite of sites. They also triggered only when two indicators occurred on the same day.

The consequences were significant. In one case, a customer made 84 failed deposits over seven days because of insufficient funds, yet the system did not identify a potential risk of harm.

The operator’s process included only one strong indicator of harm: customer losses within a 24-hour period. One customer met that threshold on the day they registered but did not receive a call until two weeks later. The Commission also identified two customers under 25: a 21-year-old who lost £6,500 within three days of opening an account, and an 18-year-old who lost £4,000 in eight minutes.

The Commission further found that L & L Europe could not demonstrate a process for evaluating whether its overall customer-interaction approach was effective.

Technical Standards

Under Licence Condition 2.3.1, officials observed multiple customers who had spent beyond financial limits set either by the operator or by the customer. In one example, a customer returning from self-exclusion had agreed a £1,000 net monthly deposit limit but deposited £2,898 and withdrew £1,800 over nine days, putting them £98 over the limit. The Commission found that the operator had not effectively implemented facilities allowing customers to set their own financial limits, as Remote Technical Standard 12 requires.

What the Gambling Commission Settlement Includes

The regulatory settlement has three components:

• A £900,000 payment in lieu of a financial penalty, directed to the consolidated fund.
• Agreement to publish a statement of facts.
• Payment towards the Commission’s investigation costs.

In reaching the settlement, the Commission weighed both aggravating and mitigating factors. The failings were serious and potentially affected the licensing objectives, and they occurred in circumstances similar to previous cases that had already produced published lessons for the industry. The mitigating factors were that L & L Europe promptly put in place an action plan and provided updates, cooperated fully and provided information by agreed deadlines, and accepted the failings at an appropriately early stage.

Questions Operators Should Ask

The Commission’s statement closes with practical questions for operators:

Frequently Asked Questions

The Sentinel Perspective

Licence Condition 12.1.1 requires more than policies on paper. Operators must maintain a current risk assessment, implement appropriate controls, and demonstrate that those controls work in practice. The L & L Europe case shows the risk of relying on static thresholds and periodic sampling rather than customer-specific risk profiles and timely monitoring.

Sentinel supports AML/KYC onboarding and customer risk assessment, enhanced due diligence, and continuous customer monitoring. It re-screens existing customers against PEP, sanctions, and adverse media data, generates alerts when relevant information changes, and records decisions in an immutable audit trail.

Truth Technologies provides AML, KYC, OFAC, and sanctions screening compliance solutions through the Sentinel platform. This post is published for informational purposes only and does not constitute legal advice. The findings described are those of the Gambling Commission as set out in its public statement. All facts are sourced exclusively from the Commission's press release and public statement linked above.