Deposit Limit and Self-Exclusion Breaches as SAR Triggers

A deposit limit override or a self-exclusion breach is not, on its own, a reportable suspicion of money laundering. It becomes one when it sits alongside unexplained funds, linked accounts or low-risk play, and the licensee must then report. As of October 2026, UKGC settlements have combined AML and social responsibility breaches in a single review, so the two data streams are examined together. This explainer applies to MLROs and compliance officers at remote licensees under the UKGC, the Gibraltar Gambling Commissioner and AGLC, and to US and Curaçao licensees with SAR or UTR duties.

When does responsible gambling data become a reportable suspicion?

The reporting duty attaches to knowledge or suspicion, not to the type of data that produced it. No regulator reviewed for this article lists a limit breach or exclusion failure as a standalone SAR trigger. Thresholds differ by regime, as the table shows (as of October 2026).

Gibraltar’s Code applies a civil balance of probabilities test and looks at “any unreasonable delay” and “any unjustified deferral or ignoring of suspicious circumstances by staff or management” (paragraph 4.15).

FINTRAC’s guidance lists “using a higher threshold as your basis for reporting” among common STR deficiencies. Reasonable grounds to suspect is a lower bar than reasonable grounds to believe, so an MLRO cannot wait for proof that the funds are criminal.

Which responsible gambling signals carry AML weight?

FATF’s September 2026 report, Risks of Gaming and Gambling, draws on questionnaire responses from 80 jurisdictions. According to SBC News, its indicators include moving money without actually gambling, smurfing, deposits from multiple third-party accounts, VPN use and automated betting patterns. In practice, repeated deposit limit increase requests, deposits sized just under a limit, and sudden exposure to a higher limit after a platform change fit the structuring pattern, and the limit logs will show them before the transaction monitoring system does.

The UKGC LCCP self-exclusion provisions require the licensee to close the account and return funds held, and state that “it is not sufficient merely to prevent an individual from withdrawing funds from their customer account whilst still accepting wagers from them”. An excluded customer who reappears through a second account, or whose funds are returned to a payment instrument not in their name, raises both an RG breach and a destination-of-funds question for the MLRO.

Gibraltar’s Code (paragraph 6.19) requires licence holders to identify and associate linked accounts, noting that customer due diligence is compromised if a customer can open further accounts undetected.

The AGLC SRIG 2026-03-17 requires registered operators to apply escalating measures to players showing money laundering, terrorist financing or sanction evasion indicators, “including the refusal of transactions or exclusion of the player”. Its Attachment 3.3 separately requires automated and manual monitoring of player behaviour for harm indicators. Operators entering Alberta can find the registration context in the AGLC SRIG framework overview.

What did UKGC enforcement in 2026 find?

The UKGC’s public statement on QuinnBet (Gibraltar) Limited, published on 20 August 2026, records a section 116 review that found breaches of paragraphs 2 and 3 of LC 12.1.1, multiple paragraphs of SRCP 3.4.3 on remote customer interaction, and paragraph 1 of SRCP 3.4.4 on financial vulnerability checks. The licensee made a payment in lieu of a financial penalty of £609,104.

LCCP 12.1.1 requires that, following the risk assessment, “licensees must ensure they have appropriate policies, procedures and controls to prevent money laundering and terrorist financing.”

According to iGamingBusiness on 20 August 2026, the settlement included a disgorgement of £193,118, and the findings covered delayed SARs, weak source-of-funds assessment, and platform migration errors that let nearly 200 customers exceed their deposit limits. UKGC director of enforcement John Pierce said the case showed the consequences of “relying on systems and controls that are unable to identify and respond to indicators of harm and financial crime quickly enough”.

Trade reports of the UKGC’s settlement with Grosvenor Casinos Limited, Grosvenor Casinos (GC) Limited and Gaming Group Limited, dated 7 October 2026, put the total at £5,012,261, following a June 2025 compliance assessment. The reported findings include a customer who won about £260,000 and lost £250,000 of it over 12 days with no safer gambling interaction logged, high-risk customers including crypto users misclassified as standard risk, and self-exclusion breaches. The licensees accepted a third-party audit of AML and social responsibility implementation.

How should licensees run the two workflows together?

The MLRO should receive a defined feed of RG events covering limit increase requests and overrides, excluded-customer match hits, and declined interventions. Gibraltar paragraph 7.2 requires staff to report internally to the MLRO at the earliest opportunity once conduct gives rise to knowledge or suspicion, and an RG analyst who finds an excluded customer’s second account falls within that duty on a plain reading. FINTRAC’s clock runs from completion of the measures that establish reasonable grounds to suspect, and FinCEN’s from initial detection, so queue latency is itself a reporting risk.

Customer-facing RG messaging must not disclose suspicion. FINTRAC prohibits informing a client that an STR has been or will be made where the intent is to prejudice an investigation, and Curaçao’s regime prohibits tipping off outright. Gibraltar paragraph 7.11 states that in live cases the MLRO or a relevant manager should consider whether gambling continues pending advice on a consent SAR, and that the decision should be formally recorded. For UK customers, consent SARs go first to the UKFIU, with implied consent arising if no response is received after seven days.

An AML hold on a withdrawal cannot be framed as an RG measure. The Curaçao Gaming Authority’s Responsible Gaming Policy states that “under no circumstances may an operator use Responsible Gaming measures as a pretext to prevent or delay legitimate player withdrawals”, and requires RG interactions and indicators of concern to be recorded in the player account management system. FINTRAC requires each STR copy to be kept for at least five years, and 31 CFR 1021.320 sets the same period for SARs and supporting documentation. Licensees should take qualified legal advice on how SAR duties, tipping-off offences and withdrawal rules apply in each licensed market.

Key Resources

UK Gambling Commission, QuinnBet (Gibraltar) Limited Public Statement, 20 August 2026, Gibraltar Gambling Commissioner, Code of Practice for the Remote Gambling Industry: AML/CFT/CPF Arrangements, v.1.0.2026.

FATF, Risks of Gaming and Gambling (September 2026); FINTRAC Suspicious Transaction Reporting guidance, AGLC Standards and Requirements for Internet Gaming, 2026-03-17.

Matt Denney

Editorial · gamingcompliance.io

Reads the primary source so you don't have to. Fifteen years inside iGaming compliance: operator, supplier, and crown-corporation lottery.