Casino operator Grosvenor Casinos Limited will pay £5,012,261 under a regulatory settlement with the Gambling Commission over anti-money laundering (AML) and player protection failings. The commission announced the case on Oct. 7.
The payment was extended to the wider group — Grosvenor Casinos (GC) Limited and Gaming Group Limited — because all three companies operate under the same internal policies. The group is owned by Rank Group PLC and runs 51 casinos across Great Britain.
One detail matters: this is not a fine. According to the commission's public statement, the operator itself proposed the terms of the settlement and the commission accepted them. Formally it is a payment in lieu of a financial penalty. All £5 million will go to the UK government's Consolidated Fund. The operator will also pay toward the commission's costs of investigating the case, on top of that sum.
The operator has further committed to an external third-party audit of its business, to be carried out within six months of the commission concluding its licence review.
How the review began
The commission opened a licence review under Section 116 of the Gambling Act 2005 after receiving information and key event notices submitted by the operator itself. While the review was under way, further intelligence led to a targeted compliance assessment of one of the company's venues, carried out on June 13, 2025.
The review found breaches of licence conditions LC 12.1.1 (paragraphs 2 and 3) and of social responsibility code provision SRCP 3.4.1.
The AML findings
The operator's internal policies were not updated to account for the 2020 changes to the Money Laundering Regulations. As a result, one customer was not rated as high risk even though it would have been appropriate to do so.
Decisions on customers with elevated money laundering risk were applied inconsistently. Venue management was allowed a degree of autonomy — not a problem in principle — but in practice evidence of source of funds and source of wealth that should have been obtained and submitted for close scrutiny was not. In one case this left a customer losing significant sums whose origin was never established.
Cryptocurrency was a separate concern. The operator's processes appeared to require only that crypto assets be verified as having been converted into ordinary currency through an appropriate bank account. After that, the customer could gamble with those funds without further questions.
Enhanced customer due diligence was not carried out even where the company's own policies required it. Examples include a customer using crypto assets as their source of funds and a customer identified as a student from China: neither had their risk level raised, although the operator's policies state that such individuals must not be treated as standard risk.
Two further cases from the public statement:
- A customer gambled exclusively in cash, recycling around £85,000 through the venue over roughly 11 weeks. Their risk level was not raised and enhanced due diligence was not properly conducted until losses reached about £13,000.
- A customer returning to the operator's venues after a long break lost around £200,000 across two visits, with no adequate photographic identification or evidence of income on file.
The player protection findings
The commission concluded that staff used a customer's perceived wealth or winning position as the rationale for perfunctory safer gambling interactions.
- A well-known, long-standing customer won around £260,000 in a short period and then lost around £250,000 in 12 days. No safer gambling interactions were recorded.
- Another long-standing and wealthy customer lost around £50,000 with no interactions taking place at all.
- A third customer, gambling with verified winnings from another operator, was allowed to lose approximately £25,000 before anyone spoke to them. Interactions did follow, prompted by the frequency and length of their visits, but the operator never escalated: no limits on time or spend, no restriction on debit card access. That continued until the customer admitted their winnings were exhausted. After that admission they were allowed to lose a further £11,000 or so over six weeks before play was suspended. The same customer appears in records of individuals returning from self-exclusion who were permitted to play with significant funds.
A separate failing was that the operator did not assess whether its own measures worked. Customer records show repeated interactions at the same level — reality checks, loss and play frequency alerts — that did not change behaviour; in one case losses exceeded £73,000. The company did not evaluate the effectiveness of its approach or use it to revise policies or retrain staff.
Aggravating and mitigating factors
The commission took into account that it had previously issued the operator with formal advice on similar areas of concern, and that it had published public statements about the same issues at other operators — meaning the industry had been put on notice.
Counting in the operator's favour: it swiftly implemented changes designed to remedy the failings and fully cooperated with the investigation.
Sue Young, executive director of operations, said larger enforcement cases are more often associated with online gambling, but this case shows the risks of AML and social responsibility failings are just as real for operators running venues. She advised all premises-based operators to look carefully at the case and make sure their own businesses are not repeating the same mistakes, and so do not face costly and inevitable commission action.
Earlier, on Sept. 30, the commission announced that from June 30, 2027, new Category B gaming machines must give players improved access to tools for managing their gambling and to session information. Session information will be available to licensees in all sectors so they can meet regulatory obligations, including reaching out in good time to players showing signs of gambling-related harm.
