Blacklisting is not a judgment call at GamblScout.com — it is the output of a scoring threshold. Our algorithm does not ban a site for having a dated interface or a slow live-chat queue; it bans a site when scraped data matches the same violation patterns that regulators themselves have already penalized operators for: unlicensed market solicitation, anti-money-laundering (AML) control failures, withheld player funds, and certified game-fairness breaches. This piece walks through those four violation tiers using documented enforcement cases, and explains where the threshold actually sits.
Key takeaways
- Our blacklist logic is built around four violation tiers: licensing/market-abuse, AML/KYC failure, withheld-funds risk, and game-fairness/certification fraud.
- Regulators treat these tiers very differently in practice — the UK Gambling Commission typically fines and monitors AML failures, while bodies like the Malta Gaming Authority (MGA) and Curaçao Gaming Authority (CGA) suspend or revoke licenses outright for funds and commitment failures.
- A single confirmed violation in the withheld-funds or licensing-fraud tier is enough for an automatic ban; AML/KYC and advertising issues instead accumulate as score penalties until a threshold is crossed.
- Most publicized “rigged casino” complaints are RTP or certification disputes that regulators and testing labs resolve through audits, not blacklisting — this is a distinct, lower-severity track.
Table of contents
What counts as a violation, not a complaint
Every gambling site accumulates player complaints — slow withdrawals, bonus-term disputes, verification delays. None of these alone move a site toward blacklisting in our system. What does move the needle is a confirmed, documented violation: a regulator enforcement notice, a license suspension record, a market-conduct fine, or a pattern our data-scraping engine can independently verify against public registers. For background on how that scraping pipeline works, see our data scraping and technical engine hub, and on how we weight these inputs against everything else in a score, see the scoring system and algorithmic weights.
Four categories of documented violation drive almost every blacklist decision we make. They are ranked here roughly in order of how directly they threaten a player’s money, not by how often they appear in the press.
Tier one: licensing fraud and unlicensed market solicitation
The clearest-cut violation is an operator taking bets in a jurisdiction it has no license to serve, especially when it actively targets that market with localized marketing or payment rails. The Dutch regulator Kansspelautoriteit (KSA) has been one of the most active enforcers here.
The Dutch Gaming Authority imposed a fine of €3,082,000 on Chestoption Sociedad de Responsibilidad Limitada because it offered gambling without the necessary license.
In a separate action, the regulator went further:
KSA recently imposed a landmark €25 million sanction on unlicensed operator Novatech and has pursued enforcement actions against multiple licensed brands for promotional violations.
Curaçao’s reformed regime treats territorial breaches with similar severity under its post-2024 licensing framework.
Under the National Ordinance on Games of Chance — known by its Dutch acronym LOK — Curaçao has rebuilt its regime around direct licensing by the Curaçao Gaming Control Board, real KYC/AML obligations, key-person requirements, and local substance, abolishing the old master/sub-license model.
The regulator has also started naming impersonation fraud publicly:
the regulator issues public warnings regarding fraudulent operators, and the CGA exposed a site called trumpbet.cc in February 2026 that displayed a fake digital authorization seal.
For our algorithm, any of the following triggers an automatic tier-one flag: a license number that does not resolve on the issuing regulator’s public register, active solicitation of a jurisdiction the operator is not licensed for, or a fabricated/expired certification seal. This tier results in immediate blacklisting — there is no scoring probation period, because there is no license to hold the operator accountable under.
Tier two: AML and KYC control failures
This is the single most common violation category among licensed operators, and it is where the UK Gambling Commission (UKGC) has concentrated the bulk of its enforcement activity. The pattern across cases is remarkably consistent: controls exist on paper but fail to catch disproportionate spending in time.
In the QuinnBet case,
the UK Gambling Commission found QuinnBet let a customer stake £215,000 in a day and accepted deposits with no source of funds check.
The regulator’s own published findings go further:
between March 2023 and August 2025, QuinnBet had failed to address AML risks from disproportionate spending promptly — one customer earning around £2,000 monthly deposited and lost £9,000 in four days.
The resulting settlement was substantial:
a £609,104 payment in lieu of a financial penalty, including £193,118 disgorgement, to the Government’s Consolidated Fund.
A near-identical pattern appeared at L&L Europe, where
the UK Gambling Commission secured a £900,000 settlement with L&L Europe Limited over AML control weaknesses, inadequate source-of-funds checks, withdrawal restrictions and missed gambling harm indicators.
The case included alarming individual examples:
an 18-year-old lost £4,000 within eight minutes of registering, while a 21-year-old lost £6,500 over three days.
Videoslots Limited was fined on similar grounds, with the Commission noting that
social responsibility failures stemmed primarily from a reliance on systems which did not effectively monitor customer activity to identify harm or potential harm associated with gambling.
Even smaller operators are not exempt — Octopus Game Limited was
ordered to pay £26,000 in lieu of a financial penalty after identifying breaches of anti-money laundering, counterterrorist financing, and social responsibility requirements under the Gambling Act.
A standalone AML/KYC finding does not get a site blacklisted on day one in our system — regulators themselves generally resolve these through settlements rather than license removal, as the cases above show. Instead, each confirmed enforcement action is logged as a severe score penalty. A second confirmed finding within a defined lookback window, or a finding combined with any tier-one or tier-three violation, pushes the site past our blacklist threshold. For deeper context on how these cases are surfaced and ranked across the industry, see our related coverage of the biggest regulatory fines of 2025/2026.
Tier three: withheld funds and insolvency risk
This is the tier that triggers an automatic ban regardless of license tier, because it goes directly to whether a player’s balance is safe. The Malta Gaming Authority’s enforcement register is explicit about this category. In the Condor Malta case, the regulator suspended the operator’s authorization, citing grounds that include
regs. 9(1)(a), (c), (d), and (m) of the Regulations
, with earlier cases on the same register invoking the provision that
the Authorised Person has failed to meet commitments to players in a timely manner, or the Authority has reason to believe that such failure is imminent.
What makes this tier distinct from AML failures is the remedy the regulator imposes. Rather than a fine with continued trading,
the Authorised Person is thus no longer authorised to carry out any gaming operations, but is required to retain and provide access to all registered players to their player accounts for visibility purposes.
That is effectively a forced freeze, not a correction plan. Curaçao’s reformed framework builds a similar insolvency check directly into licensing:
all payment transactions run exclusively through the player account, deposits and winnings sit in a segregated account, credit for wagering is prohibited outright, and the CGA tests liquidity at application and can revoke a license where a holder cannot pay expected prizes immediately.
For a player-facing breakdown of what actually happens to balances when an operator collapses mid-dispute, see our companion piece, when a casino goes bankrupt: what actually happens to your wallet balance. In our scoring model, a single verified “failure to meet player commitments” finding from any licensing authority — MGA, UKGC, or CGA — is sufficient for immediate blacklisting, with no probation window, because the underlying risk (player funds not being segregated or payable on demand) cannot be mitigated by continued play.
Tier four: game-fairness and certification fraud
The fourth tier covers RNG and RTP integrity — whether the games themselves perform as advertised. This is the tier most associated with the word “rigged,” but it is also the one where documented regulator enforcement is sparser than player anecdote, precisely because licensed operators are required to route games through independent testing labs before launch and on an ongoing basis. A verified violation here looks like a certification seal that does not resolve to a current, named license on the testing lab’s own verification page, or a game variant that does not match the provider’s registered build. Because this is harder to verify at scale than a licensing or AML record, our algorithm treats unresolved fairness disputes as elevated scrutiny flags first and blacklist triggers only once a named regulator or testing lab publishes a finding — which keeps the model aligned with verifiable evidence rather than unconfirmed forum claims. For more on how we separate verified fairness signals from player sentiment noise, see security, fraud detection and fair play and NLP and sentiment analysis.
The severity matrix: what gets scored vs. what gets banned
| Violation category | Example enforcement case | Regulator / body | GamblScout outcome |
|---|---|---|---|
| Unlicensed market solicitation | Chestoption, €3.08m fine for operating without a license | Kansspelautoriteit (KSA) | Automatic blacklist |
| Fake or expired certification/license seal | trumpbet.cc impersonation warning | Curaçao Gaming Authority (CGA) | Automatic blacklist |
| AML / source-of-funds control failure | QuinnBet £609,104 settlement; L&L Europe £900,000 settlement | UK Gambling Commission | Severe score penalty; blacklist on repeat or combined finding |
| Social responsibility / harm-detection failure | Videoslots £650,000 fine | UK Gambling Commission | Severe score penalty |
| Failure to meet player payment commitments | Condor Malta authorization suspension | Malta Gaming Authority | Automatic blacklist |
| Self-exclusion register bypass | Optdeck/Unibet €400,000 fine for Cruks register failures | Kansspelautoriteit (KSA) | Severe score penalty |
The Cruks example is worth flagging on its own:
on 18 December 2024, the Dutch gambling regulator Kansspelautoriteit fined Optdeck Service Limited, operator of Kindred’s Unibet in the Netherlands, €400,000 for allowing players listed in the national self-exclusion register Cruks to register and gamble during late 2022 and early 2023.
Self-exclusion bypass sits in the same severity band as AML failure in our model, because both represent a control that exists on paper but failed in execution — the pattern that shows up repeatedly across the UKGC and KSA cases above.
How the algorithm escalates and re-evaluates
Violations are not static. Our scraping engine re-checks licensing registers, enforcement registers, and court/administrative filings on a recurring schedule, because regulator action is itself often staged. Malta’s own enforcement data shows escalating severity bands rather than a single penalty type:
in 2024 it issued 35 warnings, 25 administrative penalties, two licence suspensions and eight cancellations, alongside three regulatory settlements.
Curaçao’s new regime builds in a similarly graduated process before full revocation, moving from reminder notices through suspension to removal from the public register, which gives us a structured window to track an operator’s trajectory rather than relying on a single static snapshot.
This is also why insider-reported misconduct matters to the model even before a regulator publishes formal findings — it is a leading indicator that frequently precedes the enforcement actions described above. Our related investigation into how internal leaks have exposed rigged live-dealer operations covers how that signal gets weighted. For a broader view of how we think about review methodology generally, see our core principles and the problem with human reviews.
What does not trigger a ban
To be precise about the threshold, several common complaint types sit below the blacklist line even though they lower a site’s overall score:
- Slow but eventually resolved withdrawals, absent a regulator finding of pattern failure.
- High wagering requirements or unfavorable bonus terms, which are a design choice, not a violation, unless marketing misrepresents them.
- A single unverified player complaint about “unlucky” results, absent a certification or RTP discrepancy confirmed by a testing lab or regulator.
- Advertising warnings that result in a correction rather than a license action — the KSA, for example, uses warning letters extensively, including telling operators
to Betnation after missing Cruks checks — the Dutch Gaming Authority issued a warning to Smart Gaming, an online gambling provider under the brand name Betnation, because no checks were performed for a number of players in the Cruks exclusion register between January and March 2026.
A first warning without an escalated penalty is logged, but does not by itself cross the blacklist threshold.
Frequently asked questions
Does a single regulatory fine get a site blacklisted?
Not automatically. AML, KYC and social-responsibility fines from bodies like the UK Gambling Commission are logged as severe score penalties first. A site is blacklisted when a fine is combined with another violation, repeats within our lookback window, or falls into the licensing-fraud or withheld-funds tiers, which carry automatic bans.
What happens if a site’s license is only suspended, not revoked?
Suspension still triggers an immediate blacklist in our system. A suspended license means the regulator has already found grounds serious enough to stop trading, even if the appeal process is ongoing, as seen in cases where authorization is pulled while access to player accounts must still be preserved for visibility.
Are offshore-licensed sites automatically riskier in your model?
No — jurisdiction alone is not a violation. What matters is whether the specific license can be verified on the issuing regulator’s register and whether that regulator has an active, checkable enforcement history. Reformed regimes like Curaçao’s post-2024 framework now impose real segregation and liquidity checks that previously did not exist.
Can a blacklisted site come off the list?
Yes, but only through verifiable regulatory resolution, not through a PR statement or policy change announced by the operator. If the triggering license is reinstated, or a regulator publishes a closure of the enforcement action, our scraping engine picks up the updated status on its next re-check cycle.
Methodology
This ranking logic draws on signals our algorithm scrapes directly from public regulator registers and enforcement bulletins (UKGC, MGA, KSA, CGA), license-verification databases, and structured monitoring of operator disclosures, cross-referenced against our own data-scraping and NLP pipelines described in the data scraping and NLP and sentiment analysis hubs. No single player complaint or unverified forum post is weighted as a violation; only documented regulatory or lab findings move a site between score penalty and blacklist status.
Gambling involves risk. Only play with money you can afford to lose and use the deposit limits and self-exclusion tools available in your jurisdiction.
