Short answer: On 7 October 2026 the UK Gambling Commission published a £5,012,261 settlement with Grosvenor Casinos Limited and two group companies. It found AML policies had not been updated for 2020 regulation changes, source of funds and wealth checks were skipped at venue level, and cryptocurrency was accepted as a source of funds once converted to pounds, without checking where it came from.
Grosvenor is a land-based casino brand owned by Rank Group, but the findings apply directly to online operators, because the same AML rules and the same source of funds expectations apply to remote casinos.
What did the Gambling Commission find?
- Outdated policy. Changes to the Money Laundering Regulations made in 2020 “had not properly been accounted for”, so at least one customer was not rated high risk.
- Inconsistent decisions. Venue managers had enough autonomy that source of funds or wealth evidence was sometimes not submitted for scrutiny.
- Crypto as source of funds. Crypto was accepted once converted to fiat through a bank account. A student with crypto as a declared source of funds was not moved to a higher risk level.
- Weak checks on large losses. A returning customer lost about £200,000 over two visits without current photo ID or recorded income evidence. A cash customer recycled about £85,000 over roughly 11 weeks before checks improved.
- Safer gambling failures. One customer won about £260,000 and lost about £250,000 within 12 days with no recorded safer gambling interaction.
The settlement also requires an external audit within six months. The Commission noted the operator had previously received formal advice on similar concerns, and credited it for swift remediation and full cooperation.
What does this mean for online operators?
The Commission ended its statement with questions for the whole industry, starting with “are your AML controls implemented effectively?”. For online businesses, three points stand out:
- Crypto-derived money needs tracing to its origin. Fiat conversion does not make the source of funds known. See Lora’s crypto payments guide.
- Policies need a change log. Each regulation change should be traced into risk ratings and triggers.
- Discretion must be controlled. Whether it is a venue manager or a VIP account manager, local judgement cannot replace the documented review. Lora’s source of funds guide lists the evidence that holds up.
VIP and account management teams are often where this pressure is highest. igamingsupportai.com discusses VIP support at scale, and Cevro sets out the compliance guardrails it applies to AI conversations in AI player support guardrails for iGaming. igaming.cx covered a separate October 2026 settlement on withdrawal delays at L&L Europe.
What should operators check, by market?
| Market | What operators should check | Rule or source |
|---|---|---|
| Great Britain | Trace crypto-derived funds to their origin; record every regulation change in the risk methodology; centralise source of funds decisions | Grosvenor public statement |
| Ontario | Check EDD triggers create cases with owners and deadlines; occupation and profile risk feed scores | FINTRAC casino guidance |
| Malta | Keep documented customer risk assessments and evidence for crypto exposure | FIAU Implementing Procedures |
| Brazil | Crypto is not a permitted payment method for licensed betting, but crypto gains declared as source of funds still need tracing | Ordinance 615/2024 summary |
Frequently asked questions
How much did Grosvenor pay?
£5,012,261 as a payment in lieu of a financial penalty, plus a contribution to investigation costs and an external audit.
What did the Commission say about crypto?
Grosvenor accepted crypto as a source of funds once converted to fiat through a bank account, without checking the origin of the crypto.
Does this apply to online casinos?
The case concerned land-based venues, but the same AML rules and source of funds expectations apply to remote casino operators.
Why does a land-based case matter online?
The Money Laundering Regulations and the Commission’s source of funds expectations apply to remote casinos in the same way.
Further reading
- Source of funds and source of wealth checks: Lora guide
- AML red flags for operators: Lora guide
- L&L Europe to pay £900,000 over withdrawal delays: igaming.cx
- AML courses for iGaming teams: cevro.academy
Sources
More guides
Source of funds and source of wealth
When SoF and SoW checks are triggered, what evidence counts, and what regulators penalised.
Crypto payments in iGaming
Where crypto is allowed, how it affects source of funds, and the controls an operator needs.
AML red flags for operators
The payment, gameplay and customer warning signs that should trigger review.