William Hill fined nearly £20m for money laundering failings

The Gambling Commission announced the largest penalty ever issued by the regulator. William Hill, the betting giant, was slapped with a fine of £19.2M, for failing to protect consumers and stop money laundering.

The Commission’s Chief Executive, Andrew Rhodes, revealed that the problems at the three companies owned by William Hill were “widespread and alarming,” and the regulator seriously considered suspending the firm’s licence.

Rhodes said, “We found serious non-compliance issues around safer gambling measures… and also anti-money laundering control failings across the company.” Shares in 888, the online gaming and betting operator that owns William Hill, plummeted by 1% in early deals.

The situation was reminiscent of the gambling industry’s problematic practices, which have forced regulators to issue several large fines in recent years. The government has also stepped in to tighten gambling rules, capping the maximum stake on terminals and banning the use of credit cards to place bets.

The failures identified by the regulator in the latest fine included allowing customers to open accounts and spend thousands of pounds without any checks. Due to “ineffective controls,” 331 customers were able to gamble with WHG (International) Limited despite having self-excluded themselves with Mr Green.

Anti-money laundering failures allowed customers to deposit large sums without appropriate checks. Sums deposited were as high as £70,134, which one customer spent and lost in a month. Another lost £38,000 in five weeks, while a third lost £36,000 in four days.

It was not the first time William Hill has faced fines for such failures. In 2018, the regulator issued a £6.2m fine for systemic social responsibility and money laundering failures.

888, which completed its takeover of William Hill and related companies last year, said the problems that led to the fines related to the period before its ownership. An 888 spokesperson said, “After William Hill was acquired, the company quickly addressed the identified issues with the implementation of a rigorous action plan.”

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

“In a world older and more complete than ours they move finished and complete, gifted with extensions of the senses we have lost or never attained, living by voices we shall never hear.”