Games supplier settles with Gambling Commission over third party risk blind spot

What happened

The Gambling Commission published a public statement on 23 July 2026 concerning Evolution Malta Holding Limited. It followed a licence review under section 116 of the Act, opened after five of Evolution’s genuine games were found on six websites run by two operators who held no Commission licence, yet were accessible at scale to consumers in Great Britain.

The Commission says it has information suggesting that between December 2023 and November 2024 there were “large volumes of visits to the Websites by UK consumers”. It identified what appeared to be Evolution games on those sites in August 2024. It notified Evolution in December 2024. Evolution confirmed the games were genuine and immediately and permanently geo-blocked them to GB consumers on the unlicensed sites and on other sites where its games were found.

The review found breaches of paragraphs 1, 2 and 3 of licence condition 12.1.1, covering the prevention of money laundering (ML) and terrorist financing (TF), and of licence condition 12.1.2, between April 2024 and January 2025. The Commission found Evolution’s 2024 risk assessment “did not meet the Commission’s minimum requirements particularly with regard to assessing third party risk”, and that its anti-money laundering (AML) policies, procedures and controls were “lacking in detail in relation to due diligence measures and ongoing monitoring for sub-licensees, including enhanced measures for high-risk”.

The regulatory settlement is a payment in lieu of a financial penalty of GBP 4,750,000, a varied licence condition requiring an independent audit within 12 months of the review concluding, publication of a statement of facts, and a contribution to the Commission’s investigation costs. Mitigating factors recorded include swift remediation, full cooperation, and early acceptance of the failings.

Why it matters

Read as analysis, the striking feature here is not the sum but the party. Evolution supplies games. It does not take the bets. The regulated harm arrived through its customers’ customers, and the finding is that its own risk assessment was not built to see that layer at all.

The timeline is the sharpest lesson. The regulator spotted the games in August 2024. The firm learned about them in December 2024. Four months separate detection by the supervisor from knowledge by the supplier, and once told, Evolution acted at once. That gap is a monitoring gap, not an intent gap, and it is the kind of gap that shows up in any firm whose product travels further than its direct contract does.

This reads across well beyond gambling. Distribution chains, reseller networks, white-label arrangements, and introducer books all create the same structure: a counterparty you diligenced, and a downstream population you never saw. The Commission’s finding on sub-licensee due diligence and ongoing monitoring is the transferable point.

Practitioner angle

Use the Commission’s own three questions as a control test. Ask them of your distribution chain this quarter, not next year.

• Have you identified third party risks and put AML policies and procedures in place to mitigate them? Check whether your business-wide risk assessment has a named section on onward distribution, or whether it stops at direct counterparties.
• What proactive measures reduce the risk of your product reaching an unlicensed or unauthorised market? Detection should be yours, not your regulator’s.
• Do you know every site, platform, or channel where your product appears, and do you have procedures to monitor that periodically? Set a frequency and an owner, and evidence the check.

Then test the sub-licensee layer specifically. Confirm your due diligence standard covers onward supply, that ongoing monitoring is scheduled rather than event-driven, and that enhanced measures trigger for high-risk downstream parties. Confirm your annual risk assessment review actually captures new products, new distribution routes, and new markets.

The one thing to do this week: pick your largest distribution partner and answer, with evidence, who their customers are.