Gambling Commission targets software suppliers and operators in latest enforcement round

Introduction

In June and July 2026, the Gambling Commission of Great Britain (the “Commission”) announced regulatory outcomes in relation to four gambling businesses: Spribe OÜ (“Spribe”), Stakelogic BV (“Stakelogic”), Petfre (Gibraltar) Limited (“Petfre”) and Evolution Malta Holding Limited (“Evolution”), arising from unlicensed activity, non-compliance with technical standards, anti-money laundering controls and social responsibility obligations. These latest actions break a quiet period in terms of regulatory outcomes published by the Commission, following the flurry of enforcement activity between May and December 2025, during which the Commission published enforcement outcomes in relation to a total of 13 gambling operators for a range of compliance failings (as we reported in our previous update).

These latest actions reflect the Commission’s increasing focus on B2B suppliers, who face growing scrutiny over how their products are built, hosted, distributed and supplied into the market. For both operators and suppliers, technical and anti-money laundering compliance is no longer a box-ticking exercise, but a core operational requirement that carries severe legal and reputational risk.

1. Spribe – Warning

In October 2025, the Commission suspended Spribe's software operating licence under section 118(2) of the Gambling Act 2005 (the “Act”), whilst a licence review was being conducted. The Commission stated that it had concerns that the company had been hosting games on its own servers rather than passing code to its B2C operator customers, which requires a separate host licence (we covered the suspension in our previous article). The Commission cited suitability concerns due to “serious non-compliance” with the hosting requirements of its licensing framework, and noted that under section 33 of the Act, providing facilities for gambling without an appropriate licence can constitute a criminal offence. Spribe (in public statements) has attributed the licensing gap to an oversight in its 2020 licence application, which it said had not identified that its business model also required a host licence. The suspension was subsequently lifted on 30 March 2026, allowing Spribe to carry out activities covered by its software licence (Spribe’s host licence is still pending).

On 12 June 2026, the Commission announced that, following the conclusion of its licence review, it had issued a warning to Spribe under section 117(1)(a) of the Act, as it had operated without the appropriate licence between 28 May 2021 and 30 October 2025. The Commission determined that this failure undermined the licensing objectives, in particular preventing gambling from being a source of crime or disorder (section 1(a) of the Act), and gave rise to concerns regarding Spribe’s suitability to carry on licensed activities. The Commission reiterated that providing facilities for gambling without an appropriate licence can be considered a criminal offence, and that it takes a robust approach to unlicensed gambling activity.

Notably, no financial penalty was imposed on Spribe. While the Commission did not provide any detail on this in its announcement, it may be because Spribe’s conduct amounted to carrying on an activity that its software licence did not authorise, rather than a breach of a condition of that licence. Under section 121(1) of the Act, a financial penalty is only available where a licence condition has been breached. The Commission could instead have pursued a criminal prosecution under section 33, but chose not to, proceeding by way of suspension and a warning. The Commission’s statement did not set out in detail why it decided to issue a warning, though it did note that Spribe had cooperated throughout and taken corrective steps to address the concerns identified.

The action against Spribe underscores the importance of suppliers carefully considering whether their operations align with their licensing permissions – both at the application stage and on an ongoing basis. 

2. Stakelogic – Regulatory Settlement

On 25 June 2026, the Commission announced that Stakelogic would pay £122,835 as part of a regulatory settlement following an investigation into breaches of responsible product design standards. The investigation was commenced outside of a section 116 licence review, following the submission of a Key Event by Stakelogic. Stakelogic reported to the Commission that one of its online slot games, Tiger Temple 88, had been found to operate with 1.97 seconds between game cycles, breaching the minimum 2.5 second requirement under the Commission’s remote gambling and software technical standards (“RTS”) requirement 14D. Stakelogic had corrected the fault by the time it informed the Commission.

The Commission found that Stakelogic had breached Licence Condition 2.3.1 between 31 October 2021 (the date RTS 14D was introduced) and 30 October 2025 (the date all GB games were disabled). The investigation found that:

• following enquiries made by the Commission, Stakelogic conducted re-testing of its entire portfolio of games offered to the GB market, which identified a further 15 games that were non-compliant with RTS requirement 14D. The non-compliant games had been made available during various periods, with timing shortfalls ranging from 0.001 seconds to 0.675 seconds below the minimum 2.5 seconds, with many operating at 0.042 seconds or below the cycle requirements;
• the errors arose from Stakelogic’s practice of conducting timing checks with a manual stopwatch, a methodology the Commission described as “open to significant inaccuracy”; and
• Stakelogic’s internal processes, procedures and controls fell short of the standards reasonably expected of licensees, particularly relating to quality assurance testing and internal incident management.

In considering the appropriate resolution, the Commission had regard to the following aggravating and mitigating factors:

Aggravating factors:

• Stakelogic’s decision not to immediately suspend the Tiger Temple 88 game upon first discovering it was non-compliant (the issue was discovered on 28 May 2025 but remained live until 30 May 2025);
• Stakelogic did not immediately review its wider product portfolio, with the full scope of the issue only being determined following Commission enquiries.

Mitigating factors:

• Stakelogic disabled all games available to the GB market upon understanding the scope of the issue;
• Stakelogic fully co-operated with the Commission’s investigation and accepted the failings at an appropriately early stage.

The regulatory settlement consisted of a payment of £122,835 in lieu of a financial penalty, together with a payment towards the Commission’s investigative costs. In addition, Stakelogic was required to issue a public statement outlining the facts of the case. 

John Pierce, the Commission’s Director of Enforcement and Intelligence, commented: “With all the technological resources available to an online gambling business, it is unacceptable that Stakelogic were relying on a manual stopwatch to measure the speed of their games.” He added: “We would urge all operators to take careful note of this case and ensure they have effective testing practices in place to ensure they are meeting all the standards we require.”

More broadly, the settlement illustrates the Commission’s continued focus on technical compliance and responsible product design. Software suppliers will be expected to implement robust automated testing and respond swiftly and comprehensively when compliance issues are identified.

3. Petfre – Regulatory Settlement

On 30 June 2026, the Commission announced that Petfre, operator of betfred.com, would pay £900,000 as part of a regulatory settlement following a licence review under section 116 of the Act. The review was commenced following a compliance assessment conducted between May and June 2024, which identified failings in certain aspects of Petfre’s social responsibility controls relating to remote customer interaction.

The Commission acknowledged that, following identification of the issues, Petfre acted swiftly to implement interim mitigating controls to address the Commission’s immediate concerns and subsequently delivered an action plan designed to remedy the failings. The Commission further recognised that Petfre had taken significant steps to provide assurance that its current operating model meets regulatory requirements, and that Petfre had fully co-operated with the investigation throughout. The matter was resolved by way of a regulatory settlement consisting of a payment of £900,000 in lieu of a financial penalty (to be directed to the Consolidated Fund), together with a payment towards the Commission’s investigative costs. Further detail can be found in Petfre’s public statement.

John Pierce, the Commission’s Director of Enforcement, commented: “While the gaps we identified were unacceptable, the licensee acted swiftly to implement interim mitigating controls to address our immediate concerns. They have since delivered an appropriate action plan and taken significant steps to assure the Commission that their current operating model meets our requirements.”

The settlement serves as a reminder of the Commission’s continuing focus on safer gambling controls. The Commission now expects B2C operators to utilise sophisticated, automated, real-time algorithms to identify markers of harm. A framework that relies on delayed manual processing, or locks out recurring risk flags over a set period, will likely be viewed as a systemic failure to protect consumers ‘at pace’.

4. Evolution – Regulatory Settlement

On 23 July 2026, the Commission announced that Evolution, a software and casino game host licence holder, would pay £4.75 million as part of a regulatory settlement following a licence review under section 116 of the Act. The review was commenced after the Commission identified, in August 2024, that five of Evolution’s games were available on six websites operated by two unlicensed operators and had been accessed by UK consumers in large volumes. Following notification by the Commission in December 2024, Evolution confirmed that the games were genuine and immediately and permanently geo-blocked them, together with other websites on which its games were subsequently found.

The Commission found that, between April 2024 and January 2025, Evolution had breached paragraphs 1 to 3 of licence condition 12.1.1, which require licensees to conduct an appropriate risk assessment of money laundering and terrorist financing risks and to implement effective policies, procedures and controls to address those risks, together with licence condition 12.1.2, which requires compliance with the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017. The Commission found that Evolution’s risk assessment did not adequately consider third-party risk, and that its anti-money laundering policies, procedures and controls lacked sufficient detail regarding due diligence and ongoing monitoring of sub-licensees, including enhanced measures for higher-risk relationships. As a result, Evolution’s controls were insufficient to identify that two of its customers were supplying its games to the GB market without holding a Commission licence. Further detail can be found in Evolution’s public statement.

In considering the appropriate resolution, the Commission had regard to the following aggravating and mitigating factors:

Aggravating factors:

• the Commission had previously alerted the industry to its stance on tackling illegal gambling;
• illegal market activity was detected, and the licence breaches gave rise to financial gain for Evolution; and
• the serious nature of the breaches identified, and their potential impact on the licensing objective of protecting vulnerable persons.

Mitigating factors:

• Evolution swiftly put in place an action plan designed to remedy the failings and provided updates; and
• Evolution fully co-operated with the investigation, provided information by agreed deadlines and accepted the failings at an appropriately early stage.

The regulatory settlement consisted of a payment of £4.75 million in lieu of a financial penalty, agreement to vary Evolution’s operating licence to attach an additional condition requiring an independent audit of its relevant policies, procedures and controls within 12 months of the conclusion of the licence review, and a payment towards the Commission’s investigative costs.

John Pierce, the Commission’s Director of Enforcement, commented: “This case exposed serious weaknesses in Evolution’s money laundering risk assessment and its oversight of risks within its supply chain. The company’s money laundering risk assessment was outdated and failed to adequately consider the risk of its games being made available through unlicensed operators. As a result, there was a significant gap between the controls on paper and their effectiveness in practice.” He added that “the Commission’s investigation and testing uncovered failings that were serious enough for us to consider licence suspension”, although Evolution “responded swiftly and comprehensively once these issues were identified, taking immediate action to strengthen its controls and address our concerns”.

The Commission’s scrutiny of B2B suppliers extends beyond hosting and technical standards to anti-money laundering controls over the wider supply chain. The Commission has made it clear that suppliers’ risk assessments must be current, regularly tested and reflective of real-world risks, and that they must understand who they are supplying their games to and how and where those games are being accessed in practice, backed by effective ongoing controls. The Commission will proactively monitor and test the market to identify licensed products being made available through illegal operators targeting GB consumers, and will take action where it finds failings.

Comment

After a break in sanctions and settlements, these four cases demonstrate that enforcement against licensed operators remains a priority for the Commission and that it is at the forefront of a regulatory shift to scrutiny on B2B suppliers. Licensees are required to be proactive, not reactive: businesses should not wait for the regulator to identify failings, but should invest in robust systems, processes and controls that keep pace with the evolving regulatory landscape.