L & L Europe Limited Public Statement
Our public statements make reference to breaches of the Licence Conditions and Codes of Practice (LCCP) requirements which were in effect at the time of the breach. In some cases, the requirements have since been updated.
Operators are expected to consider the issues outlined below and review their own practices to identify and implement improvements in respect of the management of customers’ accounts.
Introduction
Licensed gambling operators have a legal duty to ensure their gambling facilities are provided in compliance with the Gambling Act 2005 (opens in new tab)(the Act), the conditions of their licence and in accordance with the licensing objectives, which are to:
- prevent gambling from being a source of crime or disorder, being associated with crime or disorder or being used to support crime
- ensure that gambling is conducted in a fair, safe and open way
- protect children and other vulnerable people from being harmed or exploited by gambling.
Operators are expected to consider the issues outlined below and review their own practices to identify and implement improvements in respect of the management of customers’ accounts.
L & L Europe Limited Executive Summary
A regulatory review under section 116 of the Act was commenced following a Compliance Assessment (the Assessment) of the remote Operating Licence of L& L Europe Limited (the Licensee), licence number 038758 – R – 319451-015.
The review found failings in the Licensee’s Anti-Money Laundering / Counter Terrorist Financing (AML/CTF) and Social Responsibility (SR) controls.
The Licensee failed to comply with the following requirements of the Licence Conditions and Codes of Practice (LCCP) between October 2024 and October 2025:
- breach of Paragraph 1 of Licence Condition 7.1.1 – fair and transparent terms which requires that the terms on which gambling is offered, and any consumer notices relating to gambling activity, are not unfair within the meaning of the Consumer Rights Act 2015 (opens in new tab). Licensees must comply with those terms
- breach of Paragraph 2 of Licence Condition 17.1.1 Customer Identity which requires that, when a request is made by a customer to withdraw funds from their account, it must not result in a requirement for additional information to be supplied as a condition of the withdrawal, if the Licensee could have reasonably requested that information earlier. This requirement does not prevent a licensee from seeking information on the customer which they must obtain at that time due to any other legal requirement
- breach of Paragraphs 1, 2 and 3 of Licence Condition 12.1.1 which requires licensees to conduct an assessment of the risks of their business being used for money laundering and terrorist financing; ensure they have appropriate policies, procedures and controls to prevent money laundering; and ensure that their policies, procedures and controls are implemented effectively, kept under review and revised appropriately to ensure that they remain effective, and must take into account any applicable learning or guidelines published by the Gambling Commission
- failed to comply with paragraphs 5 (b, d & g), 11, 12 and 13 of Social Responsibility Code Provision (SRCP) 3.4.3 which relates to remote customers
- breach of Licence Condition 2.3.1 – Technical standards requires that licensees must comply with the Commission’s technical standards and with the requirements set by the Commission relating to the timing and procedures for testing.
In line with our Statement of Principles for licensing and regulation, the Licensee will make a financial payment in lieu of a financial penalty of £900,000. Details of this are set out under the heading Regulatory Settlement.
L & L Europe Limited Findings
A Commission compliance assessment and subsequent regulatory review found the Licensee had breached the below licence conditions/social responsibility code provisions:
Breach of Paragraph 1 of Licence Condition 7.1.1 - Paragraph 1 - Fair and Transparent Terms and Practices
LCCP 7.1.1 (1) requires:
“Licensees must ensure that the terms on which gambling is offered, and any consumer notices relating to gambling activity, are not unfair within the meaning of the Consumer Rights Act6. Licensees must comply with those terms."
During the Assessment officials identified concerns in respect of the Licensee’s Terms and Conditions policy document relating to customer withdrawals, in that customers were only permitted to request up to a maximum of one withdrawal at any time and could only request a subsequent withdrawal once the current withdrawal had been authorised.
Officials also witnessed customer withdrawal requests being withheld for reasons other than regulatory or legal requirements.
The Commission acknowledges that the Licensee acted swiftly to address this breach.
Breach of Paragraph 2 Licence Condition 17.1.1
LCCP 17.1.1 (2) requires:
“A request by a customer to withdraw funds from their account must not result in a requirement for additional information to be supplied as a condition of withdrawal if the Licensee could have reasonably requested that information earlier. This requirement does not prevent a licensee from seeking information on the customer which they must obtain at that time due to any other legal requirement.”
The Licensee’s ‘Fraud & Collusion policy’ resulted in the Licensee manually reviewing every fifth or tenth withdrawal in relation to some customers. This practice resulted in some customers being required to provide additional information prior to the withdrawals being processed.
The Licensee accepts this process did delay the processing of withdrawals pending a manual review and that the information could in some cases, have been requested at an earlier stage in the customer relationship.
The Licensee has amended its process, and withdrawals are no longer withheld unless it is for a regulatory or legal requirement.
Breach of Licence Condition 12.1.1 (paragraphs 1, 2 and 3 – Anti-money Laundering - prevention of money laundering and terrorist financing
LCCP 12.1.1 (1) requires:
“Licensees must conduct an assessment of the risks of their business being used for money laundering and terrorist financing. Such risk assessment must be appropriate and must be reviewed as necessary in the light of any changes of circumstances, including the introduction of new products or technology, new methods of payment by customers, changes in the customer demographic or any other material changes, and in any event reviewed at least annually.”
A review of the Licensee’s Money Laundering and Terrorist Financing (MLTF) risk assessment identified a number of concerns:
- the risk assessment assigned scores to risk factors and the effectiveness of controls. However, the scoring methodology implemented lacked clarity and the rationale for the scores assigned was unclear
- it did not clearly detail the standard stages of identification, analysis and evaluation as indicated within the Commission’s guidance (the prevention of money laundering and combating the financing of terrorism – guidance for remote and non-remote casinos, Fifth edition April 2025 (opens in new tab))
- the risk assessment covered the activities offered in different jurisdictions but lacked clarity on the controls that were applicable to British consumers
- customers who were high spenders were considered as a risk in the risk assessment but it was unclear how this risk was mitigated
- the risk assessment detailed that casino operators should obtain information about customers’ financial resources to determine whether customers’ spending was proportionate to their wealth or income. However, the risk assessment lacked detail in relation to how disproportionate spend was considered and assessed.
The Licensee has now created a standalone MLTF risk assessment specific to Great Britain, taking into account the issues raised during the review.
LCCP 12.1.1 (2) requires:
“Following completion of and having regard to the risk assessment, and any review of the assessment, licensees must ensure they have appropriate policies, procedures and controls to prevent money laundering and terrorist financing.”
During the review concerns were identified in relation to the Licensee’s AML policies, procedures and controls in place at the time. These included:
- controls in place to identify risks associated with money laundering, terrorist financing and proliferation financing were not appropriate as they were largely based on financial thresholds and sampling at set thresholds, rather than based on risk factors and the customer’s risk profile
- disproportionate spend was not appropriately considered in the MLTF risk assessment and there were no clear controls in place within the policies, procedures and controls to manage and mitigate the risk.
LCCP 12.1.1 (3) requires:
“Licensees must ensure that such policies, procedures and controls are implemented effectively, kept under review, revised appropriately to ensure that they remain effective, and take into account any applicable learning or guidelines published by the Gambling Commission from time to time”.
It was evident during the review that the Licensee was not always following its policies and procedures. The Licensee’s Customer Due Diligence Procedures document detailed:
‘The source of funds provided will most often be a bank account or a payment method that can be related directly to the client but even then, this knowledge may not be sufficient to confirm that the funds are from a legitimate source and therefore appropriate due diligence procedures are applied, based on the customer’s risk profile.’ It further details that ‘ideally funds used on the customer’s account need to be shown to be originating from a legitimate activity such as employment or business income’.
As an example, a customer deposited £4,400 within eight hours of registering an account and made a withdrawal of £50. The Licensee accepted that the Source Of Funds (SOF) was from a ‘gambling account’ and did not consider the risks that the bank account had been opened two weeks prior to the customer registering their gambling account, and that money in the bank account could not be evidenced as coming from their employment, a business income or savings.
In addition, the customer contacted the Licensee to chase a withheld withdrawal and was asked to supply additional documentation. The customer provided an incorrect address on two occasions, and despite this, it did not raise any suspicion from the Licensee. The customer had registered their account the previous day.
Failure to comply with paragraphs 5(b),(d) & (g), 11, 12 and 13 of SRCP 3.4.3
Compliance with a SRCP is a condition of the licence by virtue of section 82(1) of the Act.
SRCP 3.4.3 paragraph 5 requires:
“Licensees must “use a range of indicators relevant to their customer and the nature of the gambling facilities provided in order to identify harm or potential harm associated with gambling. These must include:
- customer spend
- patterns of spend
- time spent gambling
- gambling behaviour indicators
- customer-led contact
- use of gambling management tools
- account indicators”
Safer gambling alerts in place at the time of the assessment predominantly focused on financial thresholds. The Licensee did have alerts relating to time spent gambling, failed deposits and number of deposits, but these were activated in respect of some websites and not across the Licensee’s entire suite of websites. In addition, the alerts were only generated when two indicators were present in any one day.
In one example, a customer had 84 failed deposits within seven days for insufficient funds but the system did not identify the potential for gambling related harm.
SRCP 3.4.3 paragraph 11 requires:
“Licensees must “ensure that strong indicators of harm, as defined within the licensee’s processes, are acted on in a timely manner by implementing automated processes. Where such automated processes are applied, the licensee must manually review their operation in each individual customer’s case, and the licensee must allow the customer the opportunity to contest any automated decision which affects them”.
The Licensee’s process in place at the time of the assessment included only one strong indicator of harm, which was based on customer losses within 24 hours.
SRCP 3.4.3 paragraph 12 requires:
“Licensees must implement processes to understand the impact of individual interactions and actions on a customer’s behaviour, the continued risk of harm and therefore whether and, if so, what further action is needed”.
The Licensee’s Social Responsibility policy did not provide significant detail of a process in place to understand the impact of any action taken on subsequent customer behaviour. It was unclear how the effectiveness of previous interactions was being considered when Safer Gambling (SG) staff were reviewing customer accounts. Manual reviews that did take place often lacked detail and, in many cases, consisted of a sentence or two with no reference to the impact of any previous action or the impact it had on the customer’s behaviour.
SRCP 3.4.3 paragraph 13 requires:
“Licensees must take all reasonable steps to evaluate the effectiveness of their overall approach, for example by trialling and measuring impact, and be able to demonstrate to the Commission the outcomes of their evaluation.”
During the Assessment the Licensee was unable to demonstrate it had a process in place to evaluate the effectiveness of its overall approach to customer interaction. Officials did see some evaluation of individual customers, but the evaluation focused solely on the individual customer and their customer journey. There was no focus on the overall approach or assessment to identify if the policies, procedures and controls in place were effective.
Numerous gaps and concerns were identified in relation to the safer gambling provisions in place. Officials are of the opinion that the Licensee should have identified this prior to the Assessment and ensured that it had an appropriate and effective evaluation process in place. Officials did not see evidence that any trialling or measuring of impact was taking place.
The Licensee failed to have an overall assessment of the effectiveness of the measures it had in place. Customers were not adequately protected where indicators of harm were present, with little or no action taken by the Licensee.
The Social Responsibility policy detailed a list of behavioural indicators that should be considered in relation to gambling related harm or potential harm associated with gambling.
The policy also details that when a strong indicator of harm is triggered a ‘call interaction’ must take place. The Assessment identified failures to follow this policy and instances where calls were not attempted. As an example:
A customer met the financial threshold in 24 hours on the day they registered their account but they did not receive a call until two weeks later, at which point the customer had reached the same threshold numerous times.
There was also evidence of failings relating to two customers under the age of 25.
One of these customers registered an account and lost £6,500 within three days of opening the account. The risk indicator regarding the customer’s age, 21 years old was not taken into consideration. The second customer registered an account and lost £4,000 in eight minutes. This customer was 18 years old and again the indicators of risk were not identified.
The Licensee failed to have an overall assessment of the effectiveness of its social responsibility measures and also failed customers in the examples above where indicators were present and no action was taken. The Licensee did have examples of customers being individually monitored with positive results however, paragraph 13 of SRCP looks at the Licensee’s overall approach.
Breach of Licence Condition 2.3.1 – Technical standards
Licence Condition 2.3.1 Technical Standards states:
"Licensees must comply with the Commission’s technical standards and with the requirements set by the Commission relating to the timing and procedures for testing."
During the review Officials observed that multiple customers had spent beyond financial limits in place either set by the Licensee or by the customer.
In one example, a customer had recently returned from self-exclusion and had set a £1,000 net monthly deposit limit which was agreed as part of their return from self-exclusion. However, over a nine-day period the customer deposited £2,898 and withdrew £1,800, putting them £98 over their set limit.
The Licensee had not effectively implemented facilities in such a way that made it possible for customers to set their own financial limits as required by Remote Technical Standard 12.
L & L Europe Limited Regulatory Settlement
This regulatory settlement consists of:
- a payment of £900,00 in lieu of a financial penalty which will be directed to the consolidated fund
- agreement to the publication of a statement of facts in relation to this case
- payment towards the Commission’s costs of investigating the case.
In considering an appropriate resolution to this investigation, the Commission had regard to the following aggravating and mitigating factors:
Aggravating factors
- the failings were serious and potentially impacted on the licensing objectives
- the breach arose in circumstances that were similar to previous cases the Commission has dealt with which resulted in the publication of lessons learned for the industry.
Mitigating factors
- the Licensee promptly put in place an action plan designed to remedy the failings and provided updates
- fully co-operated with the investigation and provided information by agreed deadlines
- accepted the failings at an appropriately early stage in the investigation.
Good practice
Gambling operators should take account of the failings identified in this investigation to ensure industry learning. Operators should consider the following questions and take remedial action where required:
- are the AML and SR policies, procedures and controls you have in place fit for purpose and compliant with the conditions of its licence and the LCCP?
- are you fully scrutinising all customer information available to you in a timely manner, and properly assessing and taking steps to mitigating potential MLTF and SR risks?
- do you have effective processes in place to test and assess whether your policies, procedures and controls are being effectively applied by staff? Is this recorded and demonstrable?
- have staff received adequate initial and refresher training? Is this recorded and demonstrable?
- do you have an effective method to disseminate feedback, good practice and lessons learned to your staff?
- do you act quickly enough when customers display potential markers of harm? Do your procedures specify appropriate timescales for actions and interactions?