A risk assessment that did not work cost one operator £4.75 million.

On 23 July 2026 the Gambling Commission announced a £4.75 million settlement with Evolution Malta Holding Limited, and said the failings were serious enough that it considered suspending the licence. Read that notice alongside the 2025 cases and the same shape recurs: a control existed, and it did not work.

The short version

• The settlement. On 23 July 2026 the Gambling Commission announced that Evolution Malta Holding Limited will pay £4.75 million. Its games had appeared on six unlicensed websites reachable from Great Britain.
• The finding. Evolution had a money laundering risk assessment. The Commission found it was not effective enough to flag that two business partners were supplying its games to Great Britain without a licence.
• The warning. John Pierce, the Commission’s Director of Enforcement, said the failings were "serious enough for us to consider licence suspension".
• The pattern. The 2025 cases show the same shape. Videoslots was fined £650,000 in November for, among other things, "an over-reliance on an algorithm … that appeared … to be ineffective".
• The point. Detection is rarely the stated failing. Whether the control worked, and what happened next, usually is.

Evolution had a risk assessment. The Commission found it did not work

On 23 July 2026 the Gambling Commission announced that Evolution Malta Holding Limited will pay £4.75 million after an investigation found its games available on six unlicensed websites reachable from Great Britain. The Commission said Evolution failed to take appropriate steps to identify and assess money laundering and terrorist financing risks.

The detail worth sitting with is not that Evolution lacked a risk assessment. It had one. The Commission found it "was not effective enough to flag that two operators it conducted business with were supplying its games to consumers in Great Britain without holding a Commission licence".

The Commission's own summary lists three breaches. Evolution failed by:

• "not taking appropriate steps to identify and assess the risks of money laundering and terrorist financing"
• "not establishing and maintaining effective policies, procedure and controls needed to ensure that its games were not made available in the GB market by unlicensed operators"
• "not complying with customer due diligence requirements"

John Pierce, the Commission's Director of Enforcement, described the case as exposing "serious weaknesses in Evolution's money laundering risk assessment and its oversight of risks within its supply chain". He also said the investigation "uncovered failings that were serious enough for us to consider licence suspension".

The failings ran from December 2023 to November 2024, a period during which the Commission recorded large volumes of visits from Great Britain to the six sites. No suspension followed; the matter settled.

The earlier cases describe the same gap in different operators

The Evolution settlement of July 2026 follows a run of anti-money laundering penalties the Gambling Commission published during 2025. Videoslots Limited was fined £650,000 in November. Spreadex Limited was reported to have been fined £2,022,000 in May, and Platinum Gaming Limited £10 million in October.

Operator	Reported penalty	What the finding was about
Evolution Malta	£4,750,000 (Jul 2026)	Risk assessment not effective enough to flag two partners serving GB unlicensed; supply chain oversight; customer due diligence
Videoslots	£650,000 (Nov 2025)	Over-reliance on an ineffective algorithm; risk profile not escalated; delayed due diligence on £75,000 of voucher activity
Spreadex	£2,022,000 (May 2025)	Reliance on self-reported finances instead of evidence of source of funds; core risk factors not considered
Platinum Gaming	£10,000,000 (Oct 2025)	Anti-money laundering and social responsibility failings

Evolution and Videoslots detail from the Gambling Commission’s own notices. Spreadex and Platinum Gaming figures as reported; confirm against the Commission’s published notices.

The Spreadex detail

The Spreadex case is worth one more line because of what it says about evidence. The operator was reported to have relied too heavily on customers’ self-reported financial information, rather than requesting evidence of source of funds. Source of funds means proof of where the money being gambled actually came from.

Reporting on the case also describes a customer reaching a daily deposit cap of £3,340 on 12 separate days inside two weeks, with minimal response. No detection system is needed to surface that. The cap itself is the signal, hit twelve times.

Detection is rarely the stated failing

Set the Gambling Commission’s 2025 and 2026 findings side by side and the common element is whether a control worked, not whether one existed. A risk assessment that did not flag unlicensed partners. An algorithm that ran but was ineffective. A risk profile that was not escalated. A deposit cap reached twelve times in a fortnight.

That is an observation across published notices, not a position the Commission has stated. It is worth making because it points at a different remedy from the one usually reached for. If the finding is that an alert was not escalated, more alerts do not address it.

The same shape appears in a different sector under a different supervisor. The Financial Conduct Authority’s July 2026 review of asset management firms found over half of money laundering reporting officers working part-time or sharing the role, and half its sample reporting no investment in anti-money laundering systems in two years. Read together, the two regulators describe adjacent problems: one sector short of systems, another short of the capacity to act on what the systems produced.

There is a design point buried in both the Evolution and Videoslots findings. Establishing that a control works is a separate exercise from having one, and the Commission treated the absence of that assurance as the failing in each case. That is the same logic behind the EU requirement that review frequency depend on a documented risk assessment rather than on a fixed schedule.

It is also why gambling keeps appearing in identity supervision generally, as it did when Spanish and French regulators blocked prediction markets over identity controls. The sector combines fast money movement with customers a firm may never meet.

Key takeaways

• Having a control is not the same as assuring it. Evolution had a money laundering risk assessment. The Commission found it was not effective enough to flag two partners serving Great Britain unlicensed, and said the failings were serious enough to consider licence suspension.
• Escalation is where the cases turn. A risk profile not appropriately escalated, and due diligence delayed on £75,000 of voucher activity, sit in the same notice as the algorithm finding.
• Self-reported finances are not evidence. Spreadex was reported to have accepted customers’ own accounts rather than obtaining evidence of source of funds.
• Some signals need no system at all. A daily deposit cap reached on 12 days in two weeks is generated by the operator’s own control, not by a detection model.

Using Didit for the evidence half of these cases

One of the failings in these notices is a checking problem rather than a judgement problem. Where an operator accepted a customer’s own account of their finances, the gap was documentary evidence. ID Verification and Proof of Address establish who the customer is and where they are, and AML Screening and Ongoing AML Monitoring cover sanctions, politically exposed person and adverse media checks at onboarding and on a repeat basis afterwards.

Published rates are $0.15 per ID Verification check, $0.20 per Proof of Address, $0.20 per AML Screening and $0.07 per user per year for Ongoing AML Monitoring. Current module prices are listed on the pricing page.

The larger half of these cases is not something a vendor supplies. Deciding a risk profile should be escalated, judging when spending stops looking normal, obtaining source of funds evidence from a customer, and satisfying yourself that a monitoring system actually works are all operator responsibilities. The Videoslots finding is a caution against exactly the assumption that buying a system settles the question. It did not there, and it would not here.

Common questions

What did the Gambling Commission find in the Evolution case?

On 23 July 2026 the Gambling Commission announced that Evolution Malta Holding Limited will pay GBP 4.75 million. Its games were available on six unlicensed websites reachable from Great Britain between December 2023 and November 2024. Evolution had a money laundering risk assessment, but the Commission found it was not effective enough to flag that two business partners were supplying its games to Great Britain without a licence.

What did the Gambling Commission fine Videoslots for?

On 20 November 2025 the Gambling Commission fined Videoslots Limited GBP 650,000. The anti-money laundering findings included gaps in policies and procedures and record management omissions. They also cited an over-reliance on an algorithm that appeared to be ineffective, delayed due diligence on GBP 75,000 of digital voucher activity, and a risk profile that was not appropriately escalated.

Can an operator be penalised for relying on an automated system?

The Gambling Commission has named over-reliance on an algorithm as a failing where the algorithm appeared to be ineffective. Automation is not prohibited. The finding concerns depending on a system without establishing that it works and without escalating what it produces.

What is source of funds and why does it appear in these cases?

Source of funds means evidence of where the money a customer is gambling with came from. It appears in Gambling Commission cases because operators are expected to obtain evidence rather than accept a customer’s own account of their finances, particularly once spending patterns suggest higher risk.

Do these cases mean gambling operators need better detection systems?

The published findings mostly concern what happened after a signal existed: escalation, due diligence timing, evidence of source of funds and customer interaction. Detection is rarely the stated failing. That is an observation across notices rather than a position the Commission has stated.

Related reading

• The firms reporting the most risk report the widest control gaps — A different supervisor finding the opposite problem: systems missing rather than unheeded.
• EU law lets five years pass before you recheck who owns a customer — Why review frequency is supposed to follow a documented risk assessment.
• Regulators are asking prediction markets about identity, not trading — Gambling supervisors in Spain and France acting on identity controls.
• The new AUSTRAC SMR form (2026) — What has to be filed once an escalation concludes something is suspicious.

Sources

1. Evolution Malta Holding Limited to pay £4.75m — Gambling Commission · 23 July 2026
2. Evolution Malta Holding Limited: public statement — Gambling Commission · public register
3. £650,000 fine for online operator Videoslots Limited — Gambling Commission · 20 November 2025
4. News, action and statistics — Gambling Commission · index of enforcement notices, for confirming the Spreadex and Platinum Gaming cases

Who wrote this

Tuan Nguyen — Growth · Didit

Writes about identity verification, fraud and compliance at Didit. The Evolution and Videoslots detail comes from the Gambling Commission’s own notices, the first published five days before this piece. The Spreadex and Platinum Gaming figures are marked as reported, because the Commission’s notices for those two were not retrieved directly.

Last reviewed 28 July 2026 against the sources above