Case Study Spotlight
Entain’s GBP 615m Turkey Settlement and What It Means for Boards
1. Case Summary
Between 2011 and November 2017, GVC Holdings, the London listed gambling group that renamed itself Entain in December 2020, owned a Turkey facing online betting subsidiary called Headlong Limited, and because gambling is illegal under Turkish domestic law, the business served Turkish customers from outside the country through local third party suppliers and agents. GVC sold Headlong to Ropso Malta Limited in November 2017 for a performance related earn out worth up to €150 million.
Selling the business did not close the file. HM Revenue and Customs, not the Serious Fraud Office, opened an investigation in 2019 into whether GVC had adequate procedures to prevent bribery by people associated with the Turkish business, which is the test set out in section 7 of the Bribery Act 2010, and in December 2023 the High Court approved a deferred prosecution agreement between the Crown Prosecution Service and Entain, the first DPA the CPS has ever secured on its own. The total cost was £615 million: a £585 million principal settlement, a £20 million charitable donation and £10 million in costs, payable over four years, and the second largest DPA in UK corporate history.
A DPA suspends prosecution of the company, not of the individuals who ran it, so the statement of facts was withheld in 2023 specifically to avoid prejudicing proceedings against people, and those proceedings duly followed. In August 2025 the CPS charged 11 individuals, including former chief executive Kenny Alexander, former chairman Lee Feldman, and Richard Cooper, who was chief financial officer until 2016, alongside former group director of trading James Humberstone, with charges spanning conspiracy to defraud, conspiracy to bribe, fraudulent trading, cheating the public revenue and tax evasion. The first hearing was listed for 6 October 2025 at Westminster Magistrates’ Court. Nearly nine years after GVC sold the business, the case is still being written.
2. Global Context
Entain’s settlement sits inside a wider pattern of UK failure to prevent enforcement, and the scale comparison is Rolls Royce, whose 2017 DPA with the Serious Fraud Office, plus parallel settlements with US and Brazilian authorities, totalled around £671 million for bribery involving intermediaries across seven countries over more than a decade. The mechanism mirrors Entain’s, and so does the underlying story, since growth was pursued through third parties in markets the group did not directly control while compliance oversight simply did not keep pace.
A closer to home comparison is the UK Gambling Commission’s £9.4 million fine against 888 UK Limited in March 2022, for anti money laundering and social responsibility failures in its domestic online business. The sum is far smaller and the regulator entirely different, a licensing body rather than a criminal prosecutor, but the failure recurs anyway, as systems that were adequate at one scale of business were never rebuilt as the business grew. Rolls Royce, 888 and Entain span three regulators and three industries, and yet they converge on the same finding, which is that expansion through intermediaries kept outrunning the controls meant to govern it.
3. Analysis
The tension here is timing. Entain’s current board and shareholders paid £615 million in 2023 for conduct that ended in 2017, in a business the group no longer owns, in a country where the underlying activity was not even legal, and most of the people who actually ran that business had already left long before the DPA was approved. Only the 2025 charges reached the individuals rather than the balance sheet, which raises an uncomfortable question for any board that inherits a predecessor’s conduct: who actually pays, and when.
Pull the case apart by dimension and the discomfort only deepens. Strategically, the DPA protected Entain’s ability to hold licences across dozens of jurisdictions, since a conviction would likely have triggered suitability reviews everywhere the group operates, so £615 million bought continuity rather than closure. Ethically, the core fact does not soften with distance, because a London listed operator’s business relied on local suppliers and agents to serve a market where gambling is prohibited by law, and Entain has itself conceded there may have been historical misconduct. Operationally, it was HMRC rather than the SFO that ran the investigation, which shows how layered, offshore subsidiary structures can leave a group unsure which authority even has jurisdiction until it turns up. And on the human side, the 2025 charges mean three of the group’s most senior former leaders now face fraud and bribery charges over decisions taken more than a decade ago, a reminder that a DPA closes one file while quietly opening another for the people who were actually in the room.
What would have happened had ordinary third party due diligence, the kind already applied across the group’s regulated European markets, been applied to the Turkish suppliers with the same rigour is worth sitting with, since it might have surfaced the pattern years earlier. Rolls Royce’s own history suggests the answer isn’t straightforward, as a larger, longer established engineering group with far deeper compliance resources also missed bribery running through intermediaries across seven countries for over a decade. Due diligence reduces this kind of risk, but it does not eliminate it, particularly where local agents have every incentive to conceal what they’re doing from the parent company.
The decision facing Entain’s board now isn’t whether the settlement resolves the matter, because financially it does, but how to manage a criminal process against named former leaders that will generate hearings, and headlines, for years to come. That’s where the real pressure sits, since investor relations teams have to decide whether a resolved corporate settlement and an active individual prosecution read to shareholders as one story or two, and remuneration and succession committees have to price a risk they’ve rarely modelled explicitly before, that a departed chief executive’s conduct a decade ago can produce criminal charges a decade later.
4. Governance Lessons
One, selling a business does not end your exposure to what happened while you owned it. Liability under section 7 of the Bribery Act attaches to the corporate entity, and that obligation does not disappear with a share sale.
Two, failure to prevent bribery carries strict liability in the sense that matters for boards, so prosecutors need not prove intent, only that adequate procedures were absent. That should worry any board that has grown through businesses in markets where it holds no direct regulatory relationship of its own.
Three, the authority that eventually investigates is not always the obvious one, since HMRC, not the Serious Fraud Office, ran this case. Compliance frameworks built around a single expected regulator will miss exactly this kind of exposure.
Four, a DPA resolves corporate liability but not reputational risk if individual prosecutions follow years later. Boards should plan their communications for exactly the sequence Entain has now lived through, rather than assuming the settlement closes the story.
Five, risk concentrates precisely where oversight is thinnest, in third party relationships in markets the group does not directly regulate itself. The furthest edge of a group’s footprint is usually the part compliance sees least of, which is exactly why it needs the most attention, not the least.
5. Boardroom Questions
1. Where, directly or through third parties, do we operate in markets where the underlying activity is not legally permitted, and what evidence shows our anti bribery procedures actually reach those arrangements rather than stopping at our own regulated entities?
2. If a business we sold years ago were later found to have failed on compliance grounds, do we have a governance and communications plan for a criminal process naming individuals no longer employed by us?
3. Do we know, market by market, which body, our sector regulator, a tax authority or a general prosecutor, would have jurisdiction if a compliance failure emerged there, or are we assuming one regulator covers all our exposure?
Sources
1. Herbert Smith Freehills Kramer, ‘CPS Secures its First Deferred Prosecution Agreement’, December 2023, https://www.hsfkramer.com/notes/fsrandcorpcrime/2023-12/cps-secures-its-first-deferred-prosecution-agreement
2. Entain plc, ‘Entain Deferred Prosecution Agreement Approval FAQs’, 5 December 2023, https://www.entaingroup.com/media/4p0ftv4d/entain-approved-dpa-faqs-05122023.pdf
3. Crown Prosecution Service, ‘Crown Prosecution Service charging statement on criminal allegations relating to the provision of gambling services in Turkey’, 28 August 2025, https://www.cps.gov.uk/cps/news/crown-prosecution-service-charging-statement-criminal-allegations-relating-provision
4. SBC News, ‘CPS charges former GVC leaders of Turkish bribes’, 28 August 2025, https://sbcnews.co.uk/featurednews/2025/08/28/cps-charges-gvc-leaders/
5. iGaming Business, ‘Former GVC CEO Kenny Alexander among 11 charged in Turkey bribery case’, 29 August 2025, https://igamingbusiness.com/legal-compliance/legal/kenny-alexander-among-11-charged-turkey-bribery-case/
6. UK Gambling Commission, ‘GBP9.4m fine for online operator 888’, 1 March 2022, https://www.gamblingcommission.gov.uk/news/article/gbp9-4m-fine-for-online-operator-888
7. Judiciary of England and Wales, Serious Fraud Office v Rolls-Royce plc and Rolls-Royce Energy Systems Inc, approved judgment, 17 January 2017, https://www.judiciary.uk/wp-content/uploads/2017/01/sfo-v-rolls-royce.pdf
8. US Department of Justice, ‘Rolls-Royce plc Agrees to Pay $170 Million Criminal Penalty to Resolve Foreign Corrupt Practices Act Case’, 17 January 2017, https://www.justice.gov/archives/opa/pr/rolls-royce-plc-agrees-pay-170-million-criminal-penalty-resolve-foreign-corrupt-practices-act