Grosvenor Casinos paid £5M after AML lapses let crypto funds slip past checks

A Gambling Commission licence review under Section 116 of the Gambling Act 2005 — prompted by information provided to the Commission and key event notices from Grosvenor itself, then broadened by a targeted compliance assessment of one venue on 13 June 2025 — found the casino operator's anti-money-laundering and social-responsibility controls failing on multiple fronts.

The failures were concrete. Grosvenor's AML policies had not kept up with the 2020 changes to the Money Laundering Regulations, leaving one customer unrated as high risk when that rating was appropriate. Venue-level autonomy produced inconsistent decisions: evidence of source of funds or wealth that should have been scrutinised was not, in one case leaving a customer to lose significant funds that may or may not have been their own. And its cryptocurrency policy required only that assets be verified as converted into fiat via a bank account before being used to gamble.

Implementation was weaker still. Records showed a customer using cryptocurrency as a source of funds, and another identified as a student from China, without either's risk level being raised — despite policies mandating that such individuals never be treated as standard risk and that enhanced due diligence follow as soon as possible. Staff also failed to request or record sufficient evidence and rationale for AML decisions. The regulatory settlement was accepted on behalf of the licensee and the wider group because they share the same policies, procedures and controls.

AML policies had not been updated for the 2020 Money Laundering Regulations, so risk ratings ran on an outdated rulebook.

Venue discretion without recorded evidence let enhanced due diligence checks be skipped or undocumented.

Cryptocurrency was treated as safe once converted to fiat, never assessing the asset's own risk.

Obvious escalation triggers — crypto source of funds, a student from China — failed to raise customer risk levels.

AML controls rot quietly: policies that predate the last rule change, discretion without records, and crypto treated as fine once converted each read as red flags to a regulator.

The Commission published the public statement on 7 October 2026, setting out the £5,012,261 settlement and asking all operators to review their own practices for managing customers' accounts.