A UK-licensed online gambling operator has been handed a fine approaching £500,000 by the Gambling Commission after investigators found the business was conducting source-of-funds and affordability checks selectively, targeting only customers who were in profit rather than applying controls consistently across its player base. The case is a pointed reminder that compliance frameworks built around outcome rather than risk will almost always fail regulatory scrutiny.
What the Regulator Found
The Gambling Commission's investigation revealed that the operator had structured its customer due diligence process around a single variable: whether a player was winning. Customers who were losing, sometimes at significant volumes, passed through the platform without meaningful financial checks. This approach inverted the logic of anti-money laundering regulation, which is designed to detect suspicious activity regardless of whether a customer is profitable to the business.
Regulators identified this as a failure on two distinct fronts. First, it left the operator exposed to the risk that losing customers could be funding play from illegitimate sources without any intervention. Second, it created an inherently inconsistent safer gambling environment, since financial harm can accumulate among losing players far more rapidly than among winners.
Why "Winning Only" Checks Are a Fundamental Flaw
The temptation to focus compliance resource on withdrawing customers is understandable from an operational standpoint. Withdrawal triggers a payment event, which makes documentation feel natural. However, AML obligations under the UK's Proceeds of Crime Act and the Gambling Commission's LCCP do not permit operators to use profitability as a proxy for risk. The regulatory standard requires operators to:
- Assess risk at the point of onboarding, not at the point of cashout.
- Apply ongoing monitoring based on deposit velocity, session patterns and behavioural signals, independent of net outcome.
- Trigger enhanced due diligence when thresholds are crossed, whether or not the customer is ahead or behind.
- Document the rationale for every risk-rating decision in a way that can withstand external audit.
A player losing £2,000 per month with no verified income source presents a materially higher AML and harm risk than a player who wins a single £500 prize. Treating the latter as the compliance priority is not a defensible policy position.
Operational Implications for Operators
This enforcement action has immediate practical consequences for any operator still relying on withdrawal-triggered or winner-only review queues. Compliance teams should audit their current trigger logic and ask a direct question: could a regulator reading our internal procedures conclude that we only scrutinise customers when it suits us commercially?
Beyond the trigger question, operators should review the following areas:
- Risk scoring at registration: Initial risk ratings must be based on declared source of funds, geographic risk and product type, not anticipated win or loss outcomes.
- Time-based review cycles: All active accounts should move through a periodic review schedule regardless of win or loss status.
- Deposit-side monitoring: Velocity rules, unusual top-up patterns and payment method mismatches need to generate alerts on the deposit side, not only when funds leave the platform.
- MLRO oversight: The nominated officer must have visibility of the full monitoring picture, including losing customers who are depositing at pace.
The OnlineShine Perspective
Compliance that is designed around commercial convenience rather than genuine risk assessment is compliance in name only. Regulators are increasingly sophisticated at identifying policies that look plausible on paper but function as gatekeeping tools in practice.
At OnlineShine, our MLRO and compliance managed services are built around consistent, risk-based customer monitoring from the first deposit onwards. We help operators design trigger frameworks, review queues and escalation procedures that satisfy the Gambling Commission's expectations and hold up under inspection, without creating unnecessary friction for the majority of low-risk players. If your current compliance setup relies heavily on withdrawal events to prompt due diligence, that is the conversation we should be having now, before a regulatory review forces it.
