Gambling Enforcement Actions: Fines, Cease-and-Desist Letters and License Penalties

The pattern in the licensing system is instructive, and it is the single most useful thing on this page. The biggest fines are not for cheating at the tables. They are for failures of the protective machinery around the games: a self-excluded player who was let back in, an account opened with someone else’s identity, a title that was supposed to be switched off and stayed reachable, an unlicensed employee with access to customer data. That is what a working regulator actually catches.

The largest online-casino penalty of the period came from the Pennsylvania Gaming Control Board on Jan. 29, 2025: $260,905 against BetMGM LLC for 152 instances in which someone on the board’s interactive self-exclusion list was permitted to gamble on its sites. The arithmetic is deliberate. Pennsylvania priced the violation per incident, so the total scaled with the number of players failed.

New Jersey reached the same conduct differently. In October 2025 the Division of Gaming Enforcement resolved a matter against Digital Gaming Corporation, the Super Group subsidiary behind Betway, Jackpot City and Spin Casino in the state, for failing to add self-excluded patrons to New Jersey’s list promptly between March 2024 and January 2025 and for letting some keep playing or exceed their own deposit caps. DGC paid $112,188.96 and remitted a further $5,278.73, the amount its platforms had won from those patrons. Its U.S. operations had already wound down; the liability survived the exit.

Casino floors are policed the same way. Pennsylvania fined Holding Acquisition Co., operator of Rivers Casino Pittsburgh, $70,000 on Feb. 25, 2026 for seven instances of self-excluded individuals reaching the floor and gambling. Worth knowing before you sign up for self-exclusion: these programs are enforced against the operator, not only the player.

The second large cluster involves identity verification. On March 25, 2026 Pennsylvania fined BetMGM LLC $100,000 for know-your-customer protocols weak enough to let accounts be created using other people’s personal identifying information and funded with stolen or fraudulently obtained payment devices. The release described four separate fraud rings running 19 to 34 months, more than 2,000 fraudulent accounts and roughly $2 million in combined wagering.

On May 20, 2026 the same board fined Wind Creek Bethlehem $50,000 for KYC failures that produced more than $92,000 in fraudulent withdrawals from iGaming accounts. That is the scenario players fear most, someone else emptying their balance, and the regulator treated it as the operator’s failure rather than the customer’s.

Greenwood Gaming and Entertainment, the Parx Casino licensee, absorbed $80,000 on May 20, 2026, split evenly between three instances of underage play and letting five unlicensed people hold jobs with access to iGaming account holders’ personal data. Live! Casino Pittsburgh’s licensee paid $10,000 on Feb. 25, 2026 for allowing someone under 21 to gamble.

A quieter category that shows the approval chain has teeth. Pennsylvania fined Stadium Casino Westmoreland $7,500 in January 2025 for running revoked software in 11 slot machines, Relax Gaming North America $32,500 in February 2026 for executing a change of control before board approval, Play’n GO New Jersey $10,000 in April 2026 for the same failure, and Rush Street Gaming $13,800 over an unfiled principal license renewal for its chief financial officer. Every game must match an approved prototype and every company with a stake in the operator must be vetted; this is what enforcing that looks like.

The largest gaming penalties of 2025 were AML cases in Nevada, not online casino cases. A February 2026 WilmerHale review of gaming enforcement counted close to $27 million in Nevada penalties across several Las Vegas Strip operators for failing to identify high-risk patrons and verify source of funds, including a $5.5 million settlement in mid-2025. Nevada licenses online poker but not online casino blackjack, so those are land-based cases.

These platforms offered blackjack and slots for “coins” redeemable for cash and argued that a free-entry route kept them outside gambling law.

The Illinois action was the largest single one. Compliance was poor: months on, only a handful had geoblocked Illinois, among them Smiles Casino, WOW Vegas, Spin Saga and Rolling Riches. That gap between order and outcome is the honest measure of what a letter can do.

Legislatures have been filling the gap. New Jersey’s ban splits enforcement between the Division of Consumer Affairs and the Division of Gaming Enforcement. What that means for coin-redemption blackjack is on our sweepstakes blackjack page.

So if your state is issuing letters, take these three steps now rather than after the announcement.

If it has already happened, the guide to confiscated winnings covers the recovery options, which are thin. In a licensed state, filing a complaint produces a case number rather than a shrug.

When Pennsylvania priced BetMGM’s self-exclusion failures at $260,905, the company paid, because the alternative was a fight with the agency controlling its access to the largest iGaming market in the country.

Curacao overhauled its regime when the Landsverordening op de kansspelen took effect Dec. 24, 2024 and the old master-and-sublicense structure ended in January 2025, moving operators to direct licensing under the Curacao Gaming Authority. That is a real improvement in form, but the authority states that it does not handle individual player complaints, so a player with a frozen balance has nowhere to go. Kahnawake is the substantive exception, with a dispute resolution officer under sections 267 to 281 of its regulations and a published annual complaint summary, the 2025 edition of which appeared Feb. 9, 2026. What each license is worth is covered on our page on offshore licensing bodies.