Regulatory Fines in iGaming: What Recent Enforcement Actions Reveal

Regulatory fines across iGaming markets rarely turn on novel misconduct. Decisions published between October 2025 and August 2026 in Great Britain, the Netherlands, Sweden, Malta, Spain and Ontario repeat a short list of failures: deposits accepted without any check on their origin, harm indicators recorded but not acted upon, and product features shipped without testing. The recurring grounds matter more than the headline totals, and they align closely with how gambling regulators across major markets set supervisory priorities.

What the 2026 Enforcement Record Shows About Fine Levels

Absolute amounts are the least transferable part of any enforcement decision. A settlement in Great Britain is calculated against the licensee gross gambling yield and the statement of principles the Commission applies to penalties. A Swedish sanktionsavgift is capped at ten per cent of turnover in the licensed activity for the preceding financial year. A Maltese administrative penalty imposed under the Prevention of Money Laundering and Financing of Terrorism Regulations runs on a different scale again. What the figures do reveal is which categories of failure each authority is prepared to price highly.

The decisions and judgments below cover twelve months across six regulated markets.

Authority	Date	Party	Amount	Principal ground
Gambling Commission	22 Oct 2025	Platinum Gaming Limited	£10,000,000	AML and social responsibility
Gambling Commission	23 Jul 2026	Evolution Malta Holding Limited	£4,750,000	Risk assessment and supply to unlicensed sites
Gambling Commission	30 Jun 2026	Petfre (Gibraltar) Limited	£900,000	Customer interaction
Gambling Commission	20 Aug 2026	QuinnBet (Gibraltar) Limited	£609,104	AML and social responsibility
Gambling Commission	25 Jun 2026	Stakelogic BV	£122,835	Game cycle speed below the technical minimum
Kansspelautoriteit	11 Jun 2026	711 B.V.	EUR 886,000	Duty of care
Kansspelautoriteit	24 Jun 2026	LeoVegas	EUR 500,000	Duty of care
FIAU (Malta)	23 Mar 2026	Stanleybet Malta Limited	EUR 225,730 plus EUR 2,000 per day	Customer due diligence and monitoring
Spelinspektionen, upheld on appeal	Decided 28 May 2025, upheld 2 Jul 2026	Spooniker Ltd, Betsson Nordic Ltd, Snabbare Ltd	SEK 22,000,000 combined	Customer due diligence under the money laundering act
AGCO (Ontario)	6 Aug 2026	Betty Gaming Ltd.	CAD 120,000	Age verification and player eligibility
AGCO (Ontario)	20 Aug 2026	Booming Games (Malta) Limited	CAD 70,000	Prohibited auto-play and lifecycle testing
DGOJ (Spain)	First quarter 2026	Perfect Storm B.V. and Rossobash SRL	EUR 5,000,000 each	Supply without a Spanish licence

Two features of the set are worth isolating. Supplier businesses now sit alongside consumer-facing licensees in the same enforcement registers. And the two largest sums both rest at least partly on anti-money laundering findings rather than on player protection alone.

Source of Funds Failures Drive the Largest AML Penalties

The most consistent finding in this category is not an absent policy. It is a policy that stops short of asking for evidence. Source of funds checks in gambling businesses tend to exist on paper, trigger at a threshold, and then accept whatever the customer volunteers.

On 2 July 2026 the Administrative Court in Linköping dismissed appeals brought by Betsson Nordic Ltd, Snabbare Ltd and Spooniker Ltd against sanctions Spelinspektionen decided on 28 May 2025. The supervisory review had examined how each licensee met the Swedish money laundering act during 2023, sampling ten customers drawn from the fifty largest depositors aged between 18 and 29. All three argued that a risk-based method was sufficient, and that deposits recycled from earlier winnings, so-called closed loop funds, needed no further examination. The court rejected that reading and confirmed the penalties in full.

• Spooniker Ltd: SEK 10 million, the largest of the three, imposed after a follow-up review of earlier criticism
• Betsson Nordic Ltd: SEK 6.5 million, case 5093-25
• Snabbare Ltd: SEK 5.5 million, case 5474-25

AML failures at online casino businesses in Great Britain follow the same shape. The public statement behind the QuinnBet (Gibraltar) Limited settlement of 20 August 2026 records a customer who supplied payslips showing monthly earnings of around £2,000 and then deposited and lost £9,000 in four days, alongside customers permitted to deposit significant sums with no evidence establishing where the money came from, and insufficient controls to ensure suspicious activity reports were submitted as soon as practicable once suspicion arose.

The Maltese Financial Intelligence Analysis Unit reached a structural version of the same conclusion. Its measure of 23 March 2026 against Stanleybet Malta Limited found that the operator applied due diligence only where a single deposit reached EUR 2,000, or where staff recognised a repeat customer by sight within one betting shop on the same day. Nothing linked activity across the network or across the 180-day rolling period the law requires, so the company could not produce a complete list of the customers it served. Onboarding forms recorded employment as employed or student and expected funds as savings or wages, which the committee treated as inadequate for building a risk profile. That gap sits directly on the source of funds verification obligations any external auditor will test first.

GICNT-AML requires evidence of origin to be obtained and retained wherever deposit activity diverges from the profile recorded at onboarding, and requires the escalation decision to be documented in a form an annual third-party audit can follow. The Linköping judgments state the same expectation in statutory terms.

How Regulators Judge Customer Interaction and Duty of Care

Customer interaction failures in gambling businesses are almost never described as an absence of monitoring. They are described as monitoring that produced a signal nobody used. The decisions of the past year read as a catalogue of delay measured in hours.

Licensee	Authority and date	Fact recorded as the ground
Platinum Gaming Limited	Gambling Commission, 22 Oct 2025	A loss limit of £2,500 exceeded within 16 minutes of registration without the account being treated as at risk
Petfre (Gibraltar) Limited	Gambling Commission, 30 Jun 2026	A flagged account could not be reviewed again for seven days; one consumer lost £17,900 within 24 hours
QuinnBet (Gibraltar) Limited	Gambling Commission, 20 Aug 2026	Roughly 4,800 bets in one day and 7,000 the next, none of it flagged for manual review
711 B.V.	Kansspelautoriteit, 11 Jun 2026	Ten player files between 28 February 2022 and 26 June 2024 showing shortfalls in analysis, intervention and personal contact
LeoVegas	Kansspelautoriteit, 24 Jun 2026	Duty of care breaches across October 2023 to May 2024, established from requested player files
Hillside (New Media) Malta Plc	Kansspelautoriteit instruction of 13 Nov 2025, published 20 Aug 2026	Signals that players could no longer bear the financial consequences of their play were not answered with adequate intervention

The Platinum Gaming statement is the fullest of these. It records a player who lost £5,000 within a day of registering and more than £16,000 inside three months, another who lost over £31,000 in nine months while hitting a monthly loss limit on six separate occasions, and a 23-day period in which a customer staked £73,000 with no interaction at all. QuinnBet also operated a manual process that let customers aged 18 to 24 spend beyond the deposit limits the operator itself had set for that group. Systems for detecting markers of harm were present in every one of these businesses. What regulators penalised was the interval between detection and action.

GICNT-PP treats that interval as the measurable control. A bi-annual audit examines how quickly a flagged account reaches a human decision and what happened to the account in the meantime, not whether a monitoring tool is licensed.

Game Design Breaches Now Reach Suppliers Directly

Two decisions issued eight weeks apart show enforcement moving up the supply chain into product configuration, where no customer relationship exists at all.

Stakelogic BV agreed to pay £122,835 on 25 June 2026 after reporting to the Gambling Commission that its game Tiger Temple 88 had run with 1.97 seconds between spins, against the minimum of 2.5 seconds set by remote technical standard 14D. Retesting the full Great Britain portfolio revealed a further fifteen titles below the minimum, by margins between 0.001 and 0.675 seconds, with many at 0.042 seconds or less. The affected periods stretched from 31 October 2021 to 30 October 2025. The cause was that compliance with the cycle requirement had been measured with a manual stopwatch.

The Alcohol and Gaming Commission of Ontario ordered CAD 70,000 against Booming Games (Malta) Limited on 20 August 2026 after prohibited auto-play functionality reached Ontario players on several slot games for months. The Registrar cited two provisions rather than one:

• Standard 2.16, requirement 2: the supplier provided slot games containing auto-play features, which Ontario prohibits outright
• Standard 4.09, requirement 3: monitoring and testing were not performed throughout the life of the gaming supplies, so the games could not be shown to operate as approved

The second limb is the one worth reading twice. Approval at launch did not discharge the obligation, and the breach was found through the regulator own proactive testing rather than a complaint. GICNT-FP applies certification at the level of the individual game and requires recertification after any update that touches game logic or timing, which is the control that would have caught both cases. Operators relying on supplier attestations should treat game testing and RNG certification evidence as something to inspect rather than to file.

Advertising and Inducement Cases Follow the Affiliate Chain

Penalties for gambling advertising in the past two years have consistently landed on the licensee rather than on whoever produced the material. Ontario makes the principle explicit. Standard 1.19 of the Registrar Standards for Internet Gaming holds operators responsible for third parties contracted to support the Ontario business, and requires those third parties to behave as though bound by the same rules.

That standard produced the BetMGM Canada Inc. order of monetary penalty of CAD 110,000 on 26 March 2025, after marketing companies engaged by the operator offered cash to members of the public in exchange for opening accounts, including at a national trade conference. Ontario prohibits communicating inducements, bonuses and credits in public advertising under Standard 2.05, permitting them only on the operator own site or through direct marketing to players who have actively consented. In a separate action the Registrar penalised Well Played Media, Unipessoal LDA CAD 54,000 over a Casino Days bonus alleged to breach Standard 2.04(15), which prohibits promotions not reasonably attainable without substantial losses, and Standard 2.06(1), which requires material conditions to be disclosed at first presentation.

Spain approached the same problem from the opposite end. On 30 April 2026 the Dirección General de Ordenación del Juego sanctioned Make Money Now, S.L., operator of the Zona Gemelos streaming platform, for promoting operators without a Spanish licence, a serious infringement under Ley 13/2011. The penalty of EUR 10,000 was reduced to EUR 6,000 after the company withdrew the material, acknowledged responsibility and paid before the resolution issued. The case was classified as affiliate marketing and the audience profile, heavily young, was cited as an aggravating context. Both models converge on the same operational point covered by affiliate compliance obligations: creative control has to be contractual and monitored, because liability does not stop at the contract boundary.

GICNT-AM is reviewed on complaint rather than on a fixed cycle, and the review covers partner-published material as well as owned channels.

Age Verification and Unlicensed Supply Produce Separate Penalty Tracks

Ontario ordered CAD 120,000 against Betty Gaming Ltd. on 6 August 2026 after a flaw in age-restriction and player-eligibility controls let underage individuals register on betty.ca. Nine people under nineteen created accounts, deposited and gambled; another fourteen registered without funding an account. The operator identified the vulnerability itself in November 2025 and notified the regulator, closed the affected accounts and strengthened its controls, and was penalised regardless under section 3.01, requirement 1(a) and section 3.04 of the Registrar Standards for Gaming.

Unlicensed supply is enforced on a different track and at a different scale. The Evolution Malta Holding Limited settlement of £4.75 million on 23 July 2026 concerned games appearing on six unlicensed websites accessible to consumers in Great Britain, with substantial visit volumes between December 2023 and November 2024. The Commission found the money laundering and terrorist financing risk assessment outdated and incapable of flagging that two commercial counterparties were routing its games to the British market without a licence, and stated that the failings were serious enough for licence suspension to have been considered.

Spanish figures for the first quarter of 2026 show how the two tracks separate in practice:

• Nine resolutions became final in the quarter, totalling EUR 10,290,500
• Two very serious infringements accounted for EUR 10,000,000 of that, split equally between Perfect Storm B.V. and Rossobash SRL, both supplying Spain without a licence
• Seven serious infringements against licensed parties accounted for the remaining EUR 290,500

The ratio is instructive. Operating outside the licensing perimeter is priced at roughly thirty-five times the average penalty applied to a licensed party that got something wrong inside it, which is why licence validity verification across every commercial counterparty forms part of GICNT-LS rather than a due diligence nicety.

Repeat Findings Escalate Faster Than First Ones

Enforcement actions taken by the Gambling Commission increasingly reference prior action against the same licensee, and the second decision is rarely proportionate to the first.

Licensee	Earlier action	Later action
Petfre (Gibraltar) Limited	28 September 2022: £2.9 million; 1 October 2025: £240,000	30 June 2026: £900,000 for customer interaction failures
Platinum Gaming Limited	23 March 2023: £2.9 million, part of a combined £7.1 million action with 32Red	22 October 2025: £10 million, plus a warning, a third-party audit and an internal investigation with regular reporting
PointsBet Canada	May 2022 monetary penalty on advertising and inducements; November 2023 penalty on responsible gambling standards	12 February 2026: notice of a proposed five-day suspension of the igaming registration over suspicious betting reporting

The Ontario case is the sharpest illustration, because the proposed sanction was not financial. A suspension removes revenue for the duration and signals to every counterparty that the registration is in question. The Commission language in the Platinum Gaming statement points the same way, requiring senior leaders to own compliance outcomes with board-level oversight and warning that further regulatory activity remained possible. Operators working to the AGCO Registrar Standards should read a first penalty as the calibration point for the next one.

What a Settlement Figure Leaves Out of the Compliance Cost

Compliance settlements agreed by operators are reported as a single number, and that number is usually the smallest part of the consequence. Four elements sit behind it.

• Ongoing financial exposure. The FIAU attached a periodic penalty of EUR 2,000 per day to the Stanleybet measure, running until the unit is satisfied the linking failure has been remediated. The headline figure is a floor, not a total.
• Directed remediation. The same decision carried a follow-up directive requiring an action plan covering cumulative transaction linking, the point at which occasional transactions become a business relationship, and evidence that due diligence, risk assessment and profiling actually run once the threshold is met.
• Mandated external assurance. Platinum Gaming was required to commission an independent follow-up audit and report to the regulator at intervals, which converts a one-off penalty into a supervised programme.
• Publication. Every authority in this survey publishes named decisions, and several publish the detailed reasoning. That record follows the licensee into banking relationships, payment partnerships and future licence applications.

A fifth element is provisionality. The Stanleybet penalty is not final: the company filed an appeal before the Court of Appeal (Inferior Jurisdiction) on 14 April 2026, and the FIAU cannot enforce the amount until the court confirms, varies or rejects the decision. Sums reported in trade coverage as settled are sometimes still contested.

One domain is conspicuously thin in these registers. Data protection and security failures at gambling businesses are handled by data protection authorities rather than gambling regulators, so they rarely appear alongside AML and player protection cases even though the underlying obligations bind the same operator. GICNT-DS sets a single 72-hour breach notification requirement precisely because the sectoral registers give no visibility here, and because the annual security assessment in the certification audit cycles is the only point at which that exposure is examined in the same review as everything else.