Key Takeaways
- A Gambling Commission settlement published on 21 October 2026 requires L & L Europe Limited, which runs seven casino websites on one remote operating licence, to pay £900,000. Trade coverage led on delayed withdrawals, but the longest set of breaches concerns how the operator’s safer gambling alert rules were built.
- L & L Europe’s alerts only fired when two indicators appeared on the same day, the one strong indicator it had defined was a loss figure measured over 24 hours, and some alerts ran on part of the website estate rather than all of it. A customer aged 18 who lost £4,000 in eight minutes was never identified as at risk.
- Great Britain, the Netherlands, Sweden and New Jersey each fix the moment an operator must intervene differently, and only two of the four hand the operator a number. Where the licensee writes its own definition, as LCCP social responsibility code 3.4.3 allows in Great Britain, that definition becomes the thing enforcement tests. Four questions decide whether safer gambling alert rules would survive a compliance assessment: does one strong indicator fire on its own, does any window run longer than a day, is age an input to the rules, and do the rules cover every brand on the licence.
1. What did the Gambling Commission find at L & L Europe?
The Commission found that L & L Europe Limited could not reliably spot a customer in trouble, and the withdrawal problems that made the headlines were the smaller half of the case. L & L Europe holds remote operating licence 038758-R-319451-015 and runs seven casino websites, among them allbritishcasino.com, casinocasino.com and hypercasino.com. The failings cover October 2024 to October 2025 and came out of a compliance assessment that then became a licence review under section 116 of the Gambling Act 2005. The £900,000 goes to the consolidated fund as a payment in lieu of a financial penalty, with the Commission’s investigation costs on top. (1)
The withdrawal breaches are real enough. Terms allowing a maximum of one withdrawal at any time were unfair under licence condition 7.1.1, and a policy routing every fifth or tenth withdrawal of some customers into manual review breached licence condition 17.1.1, because a withdrawal request must not turn into a demand for more paperwork. (1)(2)
Underneath that sits a longer list under social responsibility code provision 3.4.3, and almost all of it concerns rule design rather than staff missing something. The operator’s safer gambling alerts were predominantly focused on financial thresholds. An alert was only generated when two indicators were present in any one day. The only strong indicator of harm the operator had defined was based on customer losses within 24 hours, and some alerts were live on certain websites rather than across the whole suite, so a customer moving between seven brands on one licence accumulated nothing anywhere. On top of that the operator could not demonstrate it had any process for evaluating how well the overall approach worked, which breaches paragraph 13 on its own terms. (1)(3)
The examples in the statement are the part worth taking into a product meeting. One customer had 84 failed deposits inside seven days for insufficient funds and the system did not identify the potential for gambling-related harm. Another met the operator’s financial threshold within 24 hours of registering and was not called for a fortnight. A 21-year-old lost £6,500 within three days of opening an account and the age indicator was not taken into consideration. An 18-year-old lost £4,000 in eight minutes. Separately, under licence condition 2.3.1, the operator had not built the facilities Remote Technical Standard 12 requires for customers to set their own limits, and a customer who had recently returned from self-exclusion with a £1,000 net monthly deposit limit deposited £2,898 over nine days. (1)
2. How do Great Britain, the Netherlands, Sweden and New Jersey set the trigger?
Four markets answer that question four different ways, and the real split is between regulators who supply the number and regulators who make the operator write it. That is what decides where liability sits when a case like this one comes along. (3)(6)(8)(9)
| Market | What starts the duty | Who sets the number | What the operator must then do |
| Great Britain | A range of indicators under SR code 3.4.3 paragraph 5, which must include customer spend, patterns of spend, time spent gambling, gambling behaviour indicators, customer-led contact, use of gambling management tools and account indicators | The licensee, which defines what counts as a strong indicator of harm for the purposes of paragraphs 10 and 11 | Act in a timely way, run automated action on strong indicators, stop marketing and new bonuses, and evaluate the effectiveness of the whole approach |
| Netherlands | Net deposits in a calendar month above EUR 300 for young adults, described by the Ksa as 18 to 24, or EUR 700 from age 24, plus a duty to detect, analyse and intervene on an indication or reasonable suspicion within at most one hour, 24 hours a day | The regulator, in the Beleidsregel verantwoord spelen of 3 June 2024, with the deposit articles in force from 1 October 2024 | Check whether the player can afford to continue, block further deposits for that calendar month if not, and make personal contact rather than show a pop-up |
| Sweden | The duty of care in chapter 14 section 1 of the Gambling Act 2018:1138, with no monetary intervention threshold at all, except that a player raising a deposit limit above SEK 10,000 a month must be contacted | The licensee, which decides which indicators are relevant and records them in an action plan | Monitor behaviour continuously, assess each player individually, act early rather than after harm, document every measure and follow up on whether it worked |
| New Jersey | Ten mandatory triggers at N.J.A.C. 13:69O-1.2A(d), seven of them behavioural rather than monetary, including three uncompleted visits to the self-exclusion page in 30 days and login time up by half on the prior fortnight | The regulator, as minimum standards, with operators encouraged to add triggers and lower thresholds | Run a due diligence review, then a three-phase intervention ending in live contact, temporary suspension and account closure, with records kept five years |
New Jersey is the useful comparison for anyone who assumes a prescribed list is the softer option. Its triggers reach things no money threshold would catch, such as cancelling withdrawal requests three times in 10 days, ending two sessions in a week with under a dollar left in the account, or three consecutive increases to responsible gaming limits inside seven days with no decrease. The Division of Gaming Enforcement also states that no single trigger is necessarily determinative, which is close to the reverse of requiring two markers before anything is raised: the review starts first and judgement comes after it. (9)
None of this is confined to Great Britain. The Kansspelautoriteit published a EUR 886,000 penalty against 711 B.V. on 11 June 2026 for failing the duty of care in article 4a(1) of the Wet op de kansspelen, having examined ten player files and found breaches in all ten, and its chair Michel Groothuizen said further investigations were producing more duty-of-care fines. (7) The L & L Europe statement makes a similar point in regulatory language, listing as an aggravating factor that the breach was similar to previous cases the Commission had already published lessons from. (1)
3. What does this reveal about operator-defined strong indicators of harm?
It reveals that the discretion social responsibility code provision 3.4.3 grants is the exposure rather than the relief. Paragraphs 10 and 11 require automated action and a marketing stop where strong indicators of harm have been identified, and both qualify that phrase with the words “as defined within the licensee’s processes”. Nothing in the code tells an operator what a strong indicator is. L & L Europe answered the question with a single 24-hour loss figure, and the Commission then held the answer against it. (1)(3)
Paragraph 5 names seven categories of indicator an operator must use, and only three of them concern money or time. The other four are gambling behaviour indicators, customer-led contact, use of gambling management tools and account indicators, and those are exactly the ones the Commission found missing, at sub-paragraphs 5(b), 5(d) and 5(g). Safer gambling alert rules built as a set of deposit and loss tiers do not implement paragraph 5, however low the tiers are set. (3)
A second-order problem arrives in Great Britain within weeks, and it pulls the other way. Financial Risk Assessments are a money threshold by construction. The Commission’s update of 7 July 2026 sets stage one at net deposits above £5,000 in a rolling 24-hour period for most operators and £2,500 for high-risk groups such as consumers under 25, falling at full implementation to £1,000 in 24 hours or £3,000 over 90 days for those aged 25 and over, and £750 or £2,000 for high-risk groups. (4) Sarah Gardner, the Commission’s Acting Chief Executive, told the CEO Briefing on 5 November 2026 that the consultation response is being finalised for publication in the coming weeks. (5)
The same July update says the Commission already requires operators to use a range of indicators to identify harm through the customer interaction requirements, and that assessments provide additional insight in relation to the highest spending customers. It also says no enforcement action will be taken for a failure to act following an assessment during the early stages of roll out, so long as existing requirements are met. That deferral covers the new instrument and nothing else, and fewer than 3 per cent of accounts will ever be assessed. (4) So an operator that spends its 2027 build budget on assessment plumbing and leaves the indicator set alone has moved no risk, and has arguably tilted its detection further towards the financial thresholds the Commission has just penalised.
4. What should operators change in their safer gambling alert rules?
Start with the rule configuration rather than the policy document, because the policy is almost certainly fine and the configuration is where both of these cases were lost. Each of the six checks below maps to a finding in the Commission’s statement, and all of them can be run against a live rules engine in a day by somebody with query access.
- Query whether any single marker raises an alert on its own. If the engine needs two conditions to be true first, that is the L & L Europe finding exactly, and the fix is to promote the strongest markers to single-condition triggers rather than to add more markers.
- List every observation window in the rule set. If nothing runs longer than 24 hours, the build cannot see slow accumulation, which is why Great Britain’s final-stage threshold carries a 90-day leg and New Jersey sets 30-day, 45-day and 90-day triggers alongside its 24-hour ones. (4)(9)
- Write down the operator’s own definition of a strong indicator of harm, with a date and a named owner, then check it against paragraph 5’s seven categories. A definition expressed only in money does not meet paragraph 5, and it is the document a regulator asks for first.
- Check whether age is an input to any rule rather than a field on the account. Both under-25 cases above turned on age being recorded and not used, and the Commission’s own thresholds treat under-25s as a separate group at roughly three-quarters of the adult figure.
- Confirm brand by brand that every rule is live on every website on the licence, taking that from the rules engine rather than the policy, then test it with one account’s activity split across two brands. Whether rules run estate-wide is usually a platform decision made years earlier for reasons unconnected to harm, and it never surfaces in a policy review.
- Produce the evaluation evidence paragraph 13 requires, meaning a record of what was trialled, what was measured and what changed as a result. L & L Europe was in breach because it could not demonstrate a process existed, which is a lower bar than proving one works.
Rebuilding the indicator set is the larger job, and the place to start is a harm indicator library mapped to defined actions and escalation routes rather than a fresh set of thresholds. TGB’s Customer Harm Identification and Interaction Framework covers identification across behavioural, financial and model-generated markers, structured interactions, escalation and the documentation trail, which is the layer that sits above the rule configuration described here.
Boardroom Questions
- What is our written definition of a strong indicator of harm, who signed it off, and when was it last changed?
- How many of our alerts need more than one condition to be true before anything is raised, and who decided that?
- If a customer opened accounts on three of our brands this morning, which of our rules would see all three?
- What evidence could we give a regulator tomorrow that we have evaluated whether our interventions change behaviour?
- Of the money budgeted for player protection in 2027, how much goes to the new assessment regime and how much to the indicator set that is already a licence condition?
Sources
(1) Gambling Commission, L & L Europe Limited public statement, published 21 October 2026. https://www.gamblingcommission.gov.uk/public-register/public-statement/detail/l-and-l-europe-limited-public-statement
(2) Gambling Commission, “L & L Europe pays £900,000 for failures including withdrawal delays”, 21 October 2026. https://www.gamblingcommission.gov.uk/news/article/l-and-l-europe-pays-gbp900-000-for-failures-including-withdrawal-delays
(3) Gambling Commission, Licence Conditions and Codes of Practice, social responsibility code provision 3.4.3, Remote customer interaction, LCCP version effective 29 July 2026. https://www.gamblingcommission.gov.uk/licensees-and-businesses/lccp/condition/3-4-3-remote-customer-interaction
(4) Gambling Commission, Helen Rhodes, “Financial risk assessments update, July 2026”, posted 7 July 2026. https://www.gamblingcommission.gov.uk/blog/post/financial-risk-assessments-update-july-2026
(5) Gambling Commission, “CEO Briefing 2026, Sarah Gardner speech”, delivered 5 November 2026 and published 6 November 2026. https://www.gamblingcommission.gov.uk/news/article/ceo-briefing-2026-sarah-gardner-speech
(6) Kansspelautoriteit, “Kansspelautoriteit publiceert aangepaste Beleidsregel verantwoord spelen”, 3 June 2024, published in the Staatscourant as stcrt-2024-18177. https://kansspelautoriteit.nl/kansspelautoriteit-publiceert-aangepaste-beleidsregel-verantwoord-spelen
(7) Kansspelautoriteit, “711 leeft zorgplicht onvoldoende na en krijgt boete van EUR886.000”, published 11 June 2026, sanction decision of 28 May 2026. https://kansspelautoriteit.nl/711-leeft-zorgplicht-onvoldoende-na-en-krijgt-boete-van-eur886-000
(8) Spelinspektionen, Guidance: Duty of care, on chapter 14 section 1 of the Swedish Gambling Act 2018:1138 and chapter 11 of the Gambling Ordinance. https://www.spelinspektionen.se/globalassets/dokument/engelska/guidance-duty-of-care.pdf
(9) New Jersey Division of Gaming Enforcement, N.J.A.C. 13:69O-1.2A Responsible gaming, adoption text of 19 October 2026, announced 20 October 2026. https://www.nj.gov/oag/ge/docs/ProposedRules/oct2026/OnlineResponsibleGamingAdoption10192026.pdf