Evolution Malta’s £4.75m settlement with the UK Gambling Commission represents a watershed moment for online casino supplier accountability. The penalty follows a comprehensive licence review revealing that Evolution’s live dealer games reached UK players through six unlicensed websites, facilitated by two intermediary operators.
The investigation uncovered multiple compliance failures, including outdated money laundering risk assessments and inadequate monitoring of game distribution channels. This case establishes critical precedents for gaming software suppliers, particularly regarding their responsibilities in preventing unauthorized access to their products and maintaining robust third-party risk controls.
Evolution Malta Settles for £4.75m with UK Gambling Commission
The UK Gambling Commission announced the £4.75 million settlement with Evolution Malta Holding Limited following a comprehensive investigation that exposed serious control failures. The regulatory action concluded after the Commission discovered Evolution’s live dealer games appeared on six unlicensed websites accessible to players in Great Britain, with large volumes of visits recorded during the investigation period.
John Pierce, Commission Director of Enforcement, stated the investigation uncovered failings serious enough to warrant consideration of licence suspension. “This case exposed serious weaknesses in Evolution’s money laundering risk assessment and its oversight of risks within its supply chain,” Pierce said. The settlement amount reflects the severity of breaches identified across multiple regulatory requirements, including failures to identify and assess money laundering risks, establish effective control policies, and comply with customer due diligence requirements.
Timeline of the Investigation
The Commission initiated the review under Section 116 of the Gambling Act 2005 in December 2023 after identifying Evolution games being accessible from the UK through operators not holding a Commission licence. Evolution CEO Martin Carlesund acknowledged the review, stating the company embraced the Commission’s objectives and committed to supporting the licensed UK market while preventing unlicensed traffic.
The investigation period extended from December 2023 through November 2024, during which regulators conducted extensive monitoring and testing of Evolution’s supply chain practices. Evolution’s stock price fell 12.13 per cent to SEK804.20 per share in Stockholm following the announcement, despite the UK market representing approximately 3 per cent of the company’s total revenue.
Prior to the settlement, the Section 116 review carried a range of potential outcomes. These included no action being required, conditions imposed on the licence, financial sanctions, suspension, or complete revocation of the licence to operate. The Commission confirmed the review remained ongoing throughout 2024, with no specific completion date documented in internal records.
The Six Unlicensed Websites Involved
Between December 2023 and November 2024, six unlicensed websites facilitated large volumes of visits from UK players accessing Evolution’s games. The Commission’s investigation revealed these websites operated without valid GB licences, yet successfully distributed Evolution’s live dealer products to British players through intermediary operators.
Evolution responded by taking immediate action once the Commission identified the unlicensed websites. The company withdrew its games from the identified platforms, making them unavailable to UK players. Carlesund emphasized Evolution was taking forceful action using all technical tools available to ensure games only reached UK players through Commission-licensed operators.
According to Pierce, Evolution responded swiftly and comprehensively once the issues were identified, taking immediate action to strengthen controls and address the Commission’s concerns. Subsequent testing conducted by regulators did not identify any further instances of concern following Evolution’s remedial actions. The investigation revealed that Evolution’s money laundering and terrorist financing risk assessment failed to identify that the two operators it supplied were offering games to GB players without valid Commission licences.
The case provides an important lesson for the industry, according to Pierce. “Operators must ensure their risk assessments are current, regularly tested and reflective of real-world risks,” he stated. The Commission emphasized its commitment to continue proactively monitoring and testing the market to identify licensed products being made available through illegal operators targeting players in Great Britain.
How Did Evolution’s Games Reach Unlicensed UK Operators?
Two intermediary operators served as the conduit through which Evolution’s live dealer games reached British players via unlicensed channels. The settlement primarily relates to the finding that Evolution game content was available via these two operators on six websites that, in breach of Evolution’s terms of supply, offered content to British players without a UK licence. The operators actively evaded restrictions in place at the time, creating a deliberate circumvention of Evolution’s control mechanisms.
The Two Intermediary Operators
Evolution’s risk assessment of whether their business could be used for money laundering and terrorist financing was not effective enough to flag that the two operators it conducted business with were supplying games to players in Great Britain without holding a Commission licence. The commercial relationships with the two operators whose websites offered Evolution content that may have been accessed by British players were terminated immediately upon discovery. Specifically, the investigation revealed that Evolution’s money laundering and terrorist financing risk assessment failed to identify that the two operators it supplied were offering games to GB players without valid Commission licences.
During the 18-month review, no broader pattern of unlicensed access to Evolution content in the UK was identified. This finding suggests the distribution breach remained isolated to these two specific business relationships rather than indicating systemic failures across Evolution’s entire partner network. The company’s AML risk assessment was outdated and failed to adequately consider the risk of games being made available through unlicensed operators.
Large Volumes of UK Consumer Visits
Between December 2023 and November 2024, large volumes of visits to the six websites occurred from UK players. The Commission first noticed Evolution games operating without proper authorization in August 2024, yet formally informed the company in December 2024. This timeline indicates significant online casino traffic reached the unlicensed platforms over an extended period before regulatory intervention occurred. The investigation period revealed sustained access patterns rather than isolated incidents.
Evolution’s Initial Response
Evolution cooperated fully with the Commission and terminated commercial relationships with the two operators immediately after discovering the issue. The company took immediate action to strengthen controls once the Commission identified the unlicensed websites, making games unavailable to UK players. CEO Martin Carlesund stated Evolution was taking forceful action using all technical tools available to ensure games only reached UK players through Commission-licensed operators.
Meanwhile, Evolution initiated a ring-fencing exercise after the Commission’s review launched. The supplier commenced this project to ensure it met compliance requirements across Europe and was not contributing to the growing black market. According to sources, the supplier withdrew products from unregulated offerings in Sweden and Romania as part of broader compliance measures. Evolution continuously strengthens technical measures and refines procedures, with the introduction of enhanced ring-fencing measures among the latest developments.
What Compliance Failures Did the UKGC Uncover?
Regulators identified multiple systemic control failures during their comprehensive review of Evolution’s compliance framework. The investigation revealed breaches spanning from April 2024 to January 2025, affecting core anti-money laundering obligations and customer due diligence requirements.
Outdated Money Laundering Risk Assessment
Evolution’s 2024 risk assessment did not meet the Commission’s minimum requirements, particularly with regard to assessing third-party risk. Between April 2024 and January 2025, the risk assessment was deemed inappropriate for the company’s operational context. Pierce emphasized that the company’s money laundering risk assessment was outdated and failed to adequately consider the risk of games being made available through unlicensed operators. This created a significant gap between the controls on paper and their effectiveness in practice.
The assessment failed to identify and assess risks of money laundering and terrorist financing resulting from games being made available in the GB market by unlicensed operators. As a result, Evolution breached Licence Condition 12.1.1 paragraph 2, which requires licensees to ensure appropriate policies, procedures and controls to prevent money laundering and terrorist financing following completion of the risk assessment.
Inadequate Sub-Licensee Due Diligence
The Commission found Evolution’s anti-money laundering policies, procedures and controls were lacking in detail in relation to due diligence measures and ongoing monitoring for sub-licensees, including enhanced measures for high-risk entities. This deficiency contributed to the failure to have adequate policies, procedures and controls in place to monitor and identify supply to unlicensed websites accessible by GB players. In particular, the documentation failed to clarify what risk-based checks were conducted on business partners.
Evolution failed to adequately implement measures described in the Money Laundering Regulations 2017, including not establishing and maintaining effective policies, procedures and controls needed to ensure games were not made available in the GB market by unlicensed operators.
Failure to Monitor Game Distribution
Between April 2024 and January 2025, Evolution’s policies, procedures and controls to prevent money laundering and terrorist financing were not effective in ensuring games were only available in the GB market via Commission-licensed operators. The company lacked adequate ongoing monitoring mechanisms to detect unauthorized distribution of its online casino products. Detection should have been Evolution’s responsibility, not the regulator’s, according to compliance experts reviewing the case.
Breach of Customer Due Diligence Requirements
Evolution’s policies and processes were not fully compliant with customer due diligence regulations, resulting in a breach of licence condition 12.1.2 between April 2024 and January 2025. The company failed to sufficiently comply with regulation 28(1) covering customer due diligence requirements. In addition, Evolution did not adequately comply with regulation 18 regarding risk assessment by relevant persons and regulation 19(1)(a) concerning policies, procedures and controls.
What Must Evolution Do Beyond the Financial Settlement?
The regulatory settlement extends beyond the financial payment to include several mandatory compliance measures. In addition to the £4.75 million payment, Evolution agreed to vary its operating licence to attach an additional licence condition, publish a statement of facts in relation to the case, and contribute towards the Commission’s investigation costs.
Independent Audit Requirement
Evolution must complete an independent audit of its relevant policies, procedures and controls within 12 months of the licence review’s conclusion. The audit will specifically assess compliance against security requirements and anti-money laundering frameworks. This requirement follows the Commission’s finding that Evolution’s 2024 risk assessment did not meet minimum requirements, particularly with regard to assessing third-party risk.
The independent auditor must hold specific qualifications, including ISO 27001 Lead Auditor certification, Certified Information Systems Auditor (CISA), Certified Information Security Manager (CISM), or Certified Information Systems Security Professional (CISSP) credentials. The audit scope must cover electronic systems that record, store, process, share, transmit or retrieve sensitive customer information, as well as systems that generate random numbers used to determine online casino game outcomes.
Enhanced Third-Party Risk Controls
Evolution’s anti-money laundering policies, procedures and controls were found lacking in detail in relation to due diligence measures and ongoing monitoring for sub-licensees, including enhanced measures for high-risk entities. The Commission emphasized that operators must now answer three critical questions and take remedial action where required:
- Have you sufficiently identified the third-party risks to your business and put in place policies and procedures, particularly in relation to anti-money laundering, to mitigate the risks?
- What proactive measures are you undertaking to minimize the risk of your games appearing on the illegal market?
- Are you aware of all the sites your games are appearing on? Do you have sufficient procedures in place to periodically monitor this?
Ongoing Monitoring Obligations
Correspondingly, the Money Laundering Regulations require ongoing monitoring of business relationships, including scrutiny of transactions throughout the relationship to ensure consistency with the customer’s business and risk profile. Operators must undertake reviews of existing records and keep documents obtained for customer due diligence purposes up-to-date. The Commission expects this requirement to be approached on a risk-sensitive basis, with regular players subject to closer scrutiny and assessment of their play levels.
Why This Case Matters for Gaming Software Suppliers
The regulatory action against Evolution signals a fundamental shift in how gambling authorities approach market integrity. Andrew Rhodes, Chief Executive of the Commission, confirmed the strategy focuses on causing upstream disruption by targeting ISPs, payment providers, search engines, and software suppliers. This approach moves enforcement upstream in the supply chain rather than exclusively pursuing unlicensed operators.
UKGC’s Upstream Disruption Strategy
Since the start of FY24/25, the Commission issued over 770 cease and desist and disruption notices, referred 102,000 URLs to Google with 64,000 subsequently removed, and took down 264 websites. The regulator invested in specialist software to support website reviews and test purchasing activity, allowing secure access to illegal sites while masking IP addresses. This enables verification of jurisdictional targeting and evidence gathering to support enforcement decisions.
In November 2024, Rhodes stated the Commission would pursue considerable enforcement activity against licensed B2B software developers over the following 12 months. Richard Williams, a lawyer at Keystone Law, noted the CEO indicated there will be substantially more to come in relation to games suppliers providing products to black market operators serving the UK. In truth, the Evolution case is not isolated but represents the beginning of sustained regulatory scrutiny across the B2B sector.
Supplier Accountability in the Supply Chain
On 20 January 2025, the Commission issued an Industry Warning Notice highlighting the appearance of licensed games on illegal sites. Licensed B2B and B2C suppliers must take proactive steps to prevent their products from being supplied to unlicensed websites targeting players in Great Britain. Where games are found supplied to illegal operators, the Commission will act with direct regulatory impact.
Regulators increasingly treat serious security failures as questions of licence suitability rather than merely IT hygiene concerns. Correspondingly, supplier compliance plays a role in how operators manage third-party risk and meet their own licensing obligations.
Three Critical Questions Every Operator Must Answer
The Commission established a practical framework requiring suppliers to address specific compliance areas. Operators must answer three critical questions and take remedial action where required:
- Have you sufficiently identified the third-party risks to your business and put in place policies and procedures, particularly in relation to anti-money laundering, to mitigate the risks?
- What proactive measures are you undertaking to minimize the risk of your games appearing on the illegal market?
- Are you aware of all the sites your games are appearing on? Do you have sufficient procedures in place to periodically monitor this?
Conclusion
Evolution Malta’s £4.75 million settlement marks a pivotal shift in regulatory enforcement within the gaming industry. The case exposes critical vulnerabilities in supplier oversight, from outdated risk assessments to inadequate monitoring of game distribution channels. Given that the UKGC has signaled sustained scrutiny of B2B suppliers, this action represents far more than an isolated incident. Software providers must now recognize their accountability extends beyond contractual obligations to encompass proactive market monitoring and robust third-party controls. The three critical questions established by regulators provide a clear compliance roadmap. Operators failing to implement effective safeguards risk substantial financial penalties and potential license suspension.