Danish payments company Inpay A/S has been ordered to stop establishing new business relationships with online gambling companies after Finanstilsynet found serious breaches of the Money Laundering Act. The order, published in August, followed an anti-money-laundering inspection carried out in March 2026.
The restriction first surfaced on 20 August as a voluntary step by the company, while the regulator’s published decision shows that a formal order sits behind it. The measure is relatively narrow: it does not revoke Inpay’s licence or prevent it from serving existing customers, but it does stop the company from adding new gambling-sector clients until Finanstilsynet is satisfied that the identified deficiencies have been corrected.
The case is also notable because it shows how gambling-related supervision can extend beyond operators themselves and into the payment infrastructure that supports them.
Supervision Moves to the Payment Layer
Inpay is a Danish e-money institution authorised under the Payments Act, with a significant share of its business linked to cross-border payments for corporate clients in online gambling.
The regulator identified three main shortcomings: insufficient due diligence when a client’s circumstances changed, inadequate assessment of the purpose and intended nature of relationships with gambling clients classified as high risk, and weaknesses in ongoing monitoring.
Finanstilsynet described the violations as serious and highlighted the scale and complexity of the affected client relationships, including ownership structures and cross-border activity spanning multiple countries.
The order prevents Inpay from establishing new relationships with gambling companies until it can document that the breaches have ceased.
Why the Client Base Matters
The regulator’s concerns focused less on the mechanics of individual payment transactions and more on the risks presented by Inpay’s gambling-sector client base.
Finanstilsynet noted that the deficiencies affected the majority of Inpay’s gambling clients, that those clients represented a significant share of the company’s total transaction volume, and that many were based outside Denmark and, in some cases, outside the EU.
The company also lacked visibility into deposits made by the gambling operators’ own end users.
According to the regulator, those gaps created a real and material risk that Inpay could be misused in connection with illegal gambling or unlicensed payment services.
That distinction matters because licensed and unlicensed gambling operators are not subject to the same level of regulatory oversight. Denmark maintains an official register of licensed gambling operators, and companies on that register are subject to regulatory requirements including anti-money-laundering obligations.
What Licensed Operators Actually Run On
Licensed gambling operators use a range of payment methods, including cards, bank transfers and third-party payment services. The exact options available, along with fees and withdrawal times, can vary between operators.
The Danish Gambling Authority’s register is designed to show which companies are licensed to operate in the market, rather than to compare each operator’s payment methods or payout times.
That type of operator-level information is often published separately by commercial comparison sites. For example, an overview of Denmark’s licensed gambling sites maintained by Peter Danielsson at bedrageri.com includes information on payment methods and other operator features. As with any third-party comparison resource, those details are best checked against the operator’s current terms.
The Inpay case is important because payment providers occupy a central position between gambling operators and the wider financial system. Weak controls at that level can create risks that extend beyond any single operator.
Payment Restrictions as an Enforcement Tool
Other European markets have also used payment controls as part of their response to unlicensed gambling.
Norway, for example, restricts banks from processing certain payments to and from gambling operators that do not hold the required Norwegian authorisation. It has also introduced DNS blocking for unlicensed gambling websites.
The two approaches work differently. Website blocking targets access to a gambling site, while payment restrictions target the financial infrastructure that allows deposits and withdrawals to move.
The European Banking Authority’s guidelines on ML/TF risk factors identify involvement in the gambling sector as one factor that can contribute to increased money-laundering and terrorist-financing risk.
The Inpay decision can therefore be seen as part of a broader supervisory trend in which financial institutions are expected to understand the nature of their gambling-sector clients, their ownership structures and the risks associated with cross-border activity.
What Operators and Payment Firms Should Watch
The wider signal from the Inpay case is that the distinction between licensed and unlicensed gambling activity is relevant not only to gambling regulators but also to financial institutions.
A payment provider with a significant gambling client base may need to demonstrate that it understands which clients are authorised to operate, how they are structured and how risks are monitored over time.
In Denmark, gambling policy and operator supervision sit with the relevant government and regulatory bodies, including the Danish Gambling Authority and the framework established under the Gambling Act.
For Inpay, the remaining issue is evidentiary. The restriction can be lifted once the company demonstrates to Finanstilsynet that the identified failures have been corrected. No fixed deadline has been announced.
Until then, Inpay can continue serving existing gambling clients, but it cannot add new ones.
The case is a useful reminder that gambling regulation increasingly extends beyond licences and advertising rules. Payment providers, banks and other financial intermediaries are also being expected to understand where gambling-related funds are coming from, who is behind the businesses they serve and whether the appropriate regulatory safeguards are in place.