L & L Europe Limited has agreed to pay £900,000 after the Gambling Commission found that the online gambling operator unnecessarily delayed customer withdrawals while failing to apply adequate anti-money laundering and customer-protection controls. The findings, published on 21 October 2026, expose weaknesses in how the company handled customer funds, with verification procedures delaying some withdrawals even as separate monitoring systems failed to identify significant financial and gambling-related risks.
The settlement follows a regulatory review covering breaches between October 2024 and October 2025. The Commission found that customers were restricted to one outstanding withdrawal request, while manual checks sometimes required additional information that could reasonably have been obtained earlier. At the same time, the operator relied heavily on financial thresholds rather than individual risk assessments, and its safer gambling systems failed to respond adequately to warning signs, including substantial losses among younger customers.
The findings are particularly significant in light of guidance issued by the Gambling Commission in July 2024, before the period covered by the breaches. That guidance warned operators against delaying withdrawals to obtain financial information that should have been requested earlier. The Commission's subsequent findings against L & L Europe therefore concern practices it had already publicly identified as problematic, alongside separate failures to apply effective financial-crime and customer-protection safeguards.
In guidance published on 18 July 2024, Gambling Commission chief executive Andrew Rhodes addressed complaints about delayed withdrawals and the timing of customer verification checks. At the time, the regulator said its contact centre received around 2,000 complaints annually concerning withdrawal delays. It explained that operators should undertake identity verification before customers begin gambling and conduct other financial-risk checks at an appropriate stage of the customer relationship rather than unnecessarily postponing them until customers requested their money.
The guidance distinguished between legitimate checks required to meet anti-money laundering obligations and restrictions that could unfairly prevent customers from accessing funds. Operators were expected to monitor accounts on an ongoing, risk-sensitive basis and obtain source-of-funds or source-of-wealth information when necessary. Where information could reasonably have been obtained earlier, the Commission warned against allowing customers to continue depositing and gambling before using the absence of that information to delay withdrawals.
The October 2026 findings identified two withdrawal-related breaches at L & L Europe. Under Licence Condition 7.1.1, the Commission found that the company's terms permitted only one outstanding withdrawal request at a time, preventing customers from making another request until the previous withdrawal had been authorised. Officials also observed withdrawals being withheld for reasons unrelated to legal or regulatory requirements, contrary to the requirement for fair and transparent terms under the Consumer Rights Act 2015.
A separate breach concerned Licence Condition 17.1.1, which governs the timing of customer identity checks. L & L Europe's fraud and collusion procedures required manual reviews of every fifth or tenth withdrawal for certain customers, sometimes resulting in additional documentation requests before payments were processed. The company accepted that manual reviews delayed the processing of withdrawals and that some information could reasonably have been requested earlier in the customer relationship.
The Commission's rules do not prohibit every request for additional information at withdrawal. Operators may still need to obtain information to meet legal obligations, including anti-money laundering requirements. The distinction in this case was whether the information was genuinely required at that stage or whether the operator could have completed the checks earlier without unnecessarily restricting customers' access to funds.
Following the review, L & L Europe amended its withdrawal procedures so that payments are no longer withheld except where legal or regulatory requirements justify doing so.
While the withdrawal findings concerned checks that delayed payments, the Commission separately identified weaknesses in the operator's anti-money laundering and counter-terrorist financing procedures. Its risk assessment lacked clarity over how different risks were scored, and its controls relied heavily on financial thresholds and sampling rather than sufficiently considering individual customer risk profiles.
The regulator also found that the company's assessment did not adequately explain how spending disproportionate to a customer's financial circumstances would be identified and addressed. Its procedures lacked clarity over the controls applicable specifically to customers in Great Britain, while the operator was not always following its own customer due diligence requirements.
One example involved a customer who deposited £4,400 within eight hours of opening an account and made a withdrawal of £50. L & L Europe accepted that the source of funds was a gambling account without adequately considering the origin of the money or other risk indicators. The customer's bank account had been opened only two weeks before the gambling account was registered, and the money could not be evidenced as originating from employment, business income or savings.
The same customer subsequently contacted the operator about a withheld withdrawal and was asked to provide further documentation. Although the customer supplied an incorrect address twice, this did not raise suspicion within the company's procedures. The Commission identified the case as evidence that the operator was not consistently implementing its own due diligence requirements.
These findings distinguish two different regulatory obligations. Operators must carry out appropriate financial-crime checks based on customer risks, but those obligations do not automatically justify postponing verification until a withdrawal is requested. The Commission's July 2024 guidance had already explained the importance of obtaining information during the customer relationship when the circumstances reasonably require it.
The investigation also identified shortcomings in L & L Europe's safer gambling monitoring systems. Although the operator had alerts covering gambling duration, failed deposits and deposit frequency, they were not active across all its websites. Alerts were also generated only when two indicators occurred on the same day, limiting the system's ability to identify certain patterns of potentially harmful behaviour.
In one case, a customer made 84 unsuccessful deposit attempts over seven days because of insufficient funds without the monitoring system identifying the potential for gambling-related harm. The Commission also found that the company's procedures recognised only one strong indicator of harm, based on customer losses within a 24-hour period, and that its assessment of customer interactions did not adequately establish whether earlier interventions had been effective.
Further failures involved younger customers whose age-related risk indicators were not appropriately considered. A 21-year-old lost £6,500 within three days of registering, while an 18-year-old lost £4,000 in eight minutes. The regulator found that relevant warning signs had not been identified or acted upon adequately, despite requirements to monitor customer behaviour and respond to indicators of potential gambling harm.
The review also found that the operator had not demonstrated an effective process for evaluating its overall approach to customer interactions. The Commission acknowledged examples of individual customers being monitored with positive results, but identified wider shortcomings in how the company assessed whether its policies and safeguards were working across its customer base.
A separate technical standards breach concerned a customer returning from self-exclusion who had agreed to a £1,000 monthly net deposit limit. Over nine days, the customer deposited £2,898 and withdrew £1,800, leaving net deposits of £1,098 and exceeding the agreed limit by £98. The Commission identified this as a failure to implement the required financial-limit safeguards.
The regulatory review was undertaken under section 116 of the Gambling Act 2005 and identified breaches involving fair and transparent terms, customer identity checks, anti-money laundering procedures, social responsibility requirements and technical standards. The £900,000 payment forms part of a regulatory settlement and is classified as a payment in lieu of a financial penalty, rather than compensation awarded to customers. The company also agreed to contribute towards the Commission's investigation costs, while the £900,000 payment will be directed to the Consolidated Fund.
In assessing the case, the regulator described the failures as serious and noted similarities with previous enforcement matters. It also recognised mitigating circumstances, including L & L Europe's cooperation with the investigation, early acceptance of the failings and prompt introduction of an action plan. The operator has since amended its withdrawal procedures and created a standalone money laundering and terrorist financing risk assessment specifically for Great Britain.
