QuinnBet to Pay £609,104 Over AML and Safer Gambling Failings

The Gambling Commission found a player who placed 4,800 bets in a day and 7,000 the next without triggering a warning, and another who staked more than £215,000 in a single session and was flagged the following morning. The controls existed. They were manual, and they were too slow.

• QuinnBet (Gibraltar) Limited will pay £609,104 to settle a Gambling Commission compliance review of its remote licence covering March 2023 to August 2025, including £193,118 in disgorgement
• The regulator found insufficient controls to identify and mitigate disproportionate spend, citing a customer who deposited and lost £9,000 in four days on monthly earnings of around £2,000
• Another customer deposited approximately £120,000 and withdrew £111,000 in under three months without source of funds being verified, and the operator was late submitting suspicious activity reports
• A manual deposit-limit process for customers aged 18 to 24 let one player deposit eight times the monthly limit and lose it the same day
• The Commission cited breaches of Licence Condition 12.1.1 and social responsibility code provisions 3.4.3 and 3.4.4

The Findings Describe Alerts That Fired Too Late, Not Controls That Were Missing

QuinnBet (Gibraltar) Limited has agreed a £609,104 regulatory settlement with the Gambling Commission, closing a compliance assessment of its remote gambling licence covering the period from March 2023 to August 2025. The figure includes a disgorgement payment of £193,118 alongside a contribution towards the Commission's investigation costs.

The anti-money laundering findings centre on spend the operator did not treat as disproportionate. The Commission said QuinnBet had insufficient controls to act in a timely manner to identify and mitigate the risk posed by customers displaying disproportionate spend. In one case cited, a customer deposited and lost £9,000 within four days, against payslips indicating monthly earnings of around £2,000. In another, a customer deposited approximately £120,000 and withdrew £111,000 over a period of less than three months, without source of funds being verified.

The regulator also found delays in the submission of suspicious activity reports, and that 194 customers exceeded their deposit limits during a platform migration. Those failings were held to breach Licence Condition 12.1.1.

Two Customers the Systems Should Have Caught Within Hours

The social responsibility findings are the more striking half, because they describe monitoring that worked eventually rather than not at all.

The Commission found an over-reliance on manual interventions, with alerts arriving slowly. One player placed 4,800 bets on one day and 7,000 the next without triggering a warning. Another staked more than £215,000 in a single day following a large win, and was flagged only the next morning.

The age-related finding is likely to attract the most attention. QuinnBet operated a manual process for applying deposit limits to customers aged between 18 and 24, and that process allowed players in that group to exceed the limits set for them. One customer deposited eight times the monthly limit and lost it the same day. The Commission cited breaches of social responsibility code provisions 3.4.3 and 3.4.4.

John Pierce, the Commission's Director of Enforcement, said the regulator expects operators to ensure their safeguards are effective in practice to protect consumers.

It is the second enforcement outcome the Commission has published this week, after Holland Park Leisure was ordered to pay £150,000 over a failure to join the mandatory multi-operator self-exclusion scheme, and both concern protections that were nominally in place.

"Effective in Practice" Is the Standard That Actually Bites

Pierce's phrasing is worth reading as a statement of enforcement policy rather than a platitude. Nothing in these findings suggests QuinnBet lacked policies: it had deposit limits, it had a young-adult regime, it had monitoring that eventually flagged a £215,000 day. What it did not have was a system that acted inside the window in which the harm occurred. That is a meaningfully different test from the documentary compliance many operators still prepare for, and it is much harder to evidence in advance. An operator can show a regulator its thresholds; showing that those thresholds fired before a customer lost £9,000 in four days requires timestamps, and timestamps are what this settlement turns on.

Manual Processes Are Now an Identified Regulatory Risk in Their Own Right

Three of the failings share a root cause: a human step in the loop that was too slow or too easily bypassed. Manual interventions produced late alerts, a manual deposit-limit process for 18 to 24 year olds let customers exceed their own limits, and a platform migration let 194 customers breach limits entirely. For a mid-sized operator, manual review is often the honest answer to a control that cannot yet be automated, and it has historically been treated as acceptable if the policy was sound. This settlement suggests it is no longer a defence in itself. Any operator relying on a person to catch a velocity spike should be asking what happens to that control overnight, at weekends, and during a migration, because the Commission has now priced all three.

The Young-Adult Finding Is the One With Political Weight

Of everything here, the detail most likely to be quoted outside the trade press is that a manual process allowed 18 to 24 year olds to exceed the deposit limits set specifically for them. Enhanced protections for young adults have been among the least contested parts of British gambling reform, precisely because the argument for them is intuitive and the industry has not seriously resisted. A finding that an operator built the safeguard and then let customers around it is the kind of fact that appears in a select committee session rather than a compliance newsletter. Operators with age-banded limits should expect that specific control to be examined next, and should be able to demonstrate it is enforced by the platform rather than by a person.

The Commission did not find an operator without safeguards. It found one whose safeguards ran a few hours behind its customers, and priced the difference at £609,104.