L & L Europe pays £900,000 after withdrawal delays and missed harm checks

L & L Europe Limited, which runs seven online casino websites including allbritishcasino.com, casinocasino.com and hypercasino.com, will pay £900,000 under a regulatory settlement with the Gambling Commission, announced on 21 October 2026. Its terms let customers hold only one withdrawal request at a time, and some were asked for more information when they tried to cash out. The Commission also found anti-money laundering and safer gambling failures between October 2024 and October 2025. The operator accepted the failings early and has changed its withdrawal process.

What the Commission found

The case began with a compliance assessment and became a regulatory review of L & L Europe's remote operating licence under section 116 of the Gambling Act 2005. It ended in a settlement rather than a formal penalty: a payment in lieu of a financial penalty of £900,000, a contribution to the Commission's investigation costs and the publication of a statement of facts. The statement covers October 2024 to October 2025 and lists five breaches of licence conditions, from the fairness of the operator's terms to the way it set deposit limits.

The Commission's news release names three of the seven websites. The public statement itself names none, and does not break the £900,000 down or give the amount of the costs payment. "As a regulator we expect consumers to be treated fairly," said Sue Young, the Commission's Executive Director of Operations.

One withdrawal at a time, and documents at cash-out

The withdrawal findings come under two licence conditions. Under the rule on fair and transparent terms, the Commission objected to terms that allowed a customer only one withdrawal request at a time: a second request could not be made until the first had been authorised. Its officials also saw requests held back for reasons that had nothing to do with regulatory or legal requirements. The Commission considers terms like that unfair under the Consumer Rights Act 2015, and acknowledged that the operator acted swiftly once it was raised.

The second finding concerns identity checks. Under what it called its Fraud & Collusion policy, the operator manually reviewed every fifth or tenth withdrawal for some customers and asked them for more information before paying out. The Commission's requirements say that information should not be demanded at the point of withdrawal if it could reasonably have been requested earlier, and the operator accepted that it could have been in some cases and that the reviews delayed payments. It has since changed the process, and withdrawals are no longer held back unless regulatory or legal reasons require it. Our article on instant payouts explains why operator checks, not payment rails, usually set the speed of a withdrawal.

Money laundering checks built on thresholds

The anti-money laundering findings are about method. The Commission found that the operator's controls relied mainly on financial thresholds and on sampling at set points, rather than on risk factors and each customer's risk profile, and that its own procedures were not always followed. Its main example is a customer who deposited £4,400 within eight hours of registering and withdrew £50. The source of funds was accepted as a "gambling account", although the customer's bank account had been opened two weeks earlier and the money could not be shown to come from employment, business income or savings. The same customer gave an incorrect address twice when asked for documents, which raised no concern. The operator has since written a separate money laundering risk assessment for Great Britain. Our earlier piece on identity and source of funds checks covers how these rules are meant to work.

Harm signs the alerts did not catch

The safer gambling findings rest on the operator's alerts. They were built mainly around money; alerts for time spent, failed deposits and the number of deposits were not switched on across all seven websites, and an alert fired only when two indicators appeared on the same day. The statement gives a customer with 84 failed deposits in seven days, for insufficient funds, where no harm was identified. Losses within 24 hours were the only strong indicator of harm, and reviews were often one or two sentences long.

The age cases are the starkest. A 21-year-old lost £6,500 within three days of opening an account without the age-related risk being considered, and an 18-year-old lost £4,000 in eight minutes without any risk indicator being identified. Another customer met the operator's 24-hour financial threshold on the day they registered but was not called for two weeks, by which time the threshold had been met many more times. The operator also could not show any overall evaluation of whether its customer interaction worked.

The fifth breach concerns deposit limits. A customer returning from self-exclusion had a net deposit limit of £1,000 a month, then deposited £2,898 and withdrew £1,800 over nine days, finishing £98 over the limit. The Commission found that the operator had not effectively put in place the tools that let customers set and keep their own limits.

The Commission's recent actions

The settlement is the second published in October. The Commission's own news list for the autumn reads:

In weighing the case the Commission counted against the operator that the failings were serious and resembled earlier cases that had already produced published lessons for the industry, and in its favour that it moved quickly with an action plan, cooperated fully and accepted the failings early. The statement ends, as these statements usually do, with questions the Commission wants every operator to ask itself: whether its anti-money laundering and safer gambling policies are tested and actually followed, whether staff look closely at the information customers give them, whether training is good enough, whether lessons are fed back, and whether markers of harm are acted on in time.

What is confirmed and what is not yet known

• Confirmed: a £900,000 payment in lieu of a financial penalty, a costs payment and a published statement; five licence breaches between October 2024 and October 2025; the one-at-a-time withdrawal term and the withdrawal reviews have been changed.
• Confirmed: the operator runs seven websites; the Commission names allbritishcasino.com, casinocasino.com and hypercasino.com.
• Not known: the other four websites, how many customers were affected, how long withdrawals were delayed, and the size of the costs payment. The statement gives none of them.

What it means for players

For anyone playing on a site licensed in Britain, the case is a useful summary of what the Commission expects at the cashier. You should be able to make more than one withdrawal request without waiting for the first to clear, and the checks an operator needs should come early rather than when you ask for your money; since 2021 the operator also cannot offer to reverse a withdrawal once you have requested it, under its technical standard RTS 14B. If you are asked for documents at withdrawal that you think should have been requested at sign-up, the operator's complaints process is the place to say so. And the age and harm examples are a reminder that alerts can miss things: if your own play is moving faster than you meant it to, the National Gambling Helpline is free on 0808 8020 133, 24 hours a day.

Frequently asked questions

Sources

1. Gambling Commission - L & L Europe pays £900,000 for failures including withdrawal delays (21 October 2026)
2. Gambling Commission - L & L Europe Limited public statement (21 October 2026)
3. Gambling Commission - news list (read 22 October 2026)
4. Gambling Commission - Land-based casino operators to pay £5m for regulatory failures (7 October 2026)
5. Gambling Commission - Suspension of licence, Targetlocal Ltd (21 September 2026)
6. Gambling Commission - RTS 14, responsible product design (updated 12 January 2026)
7. GamCare - National Gambling Helpline