Key Points
- Finanstilsynet found “serious violations” of Denmark’s Money Laundering Act covering the majority of Inpay’s iGaming customer portfolio, far beyond isolated cases.
- Inpay’s board voluntarily halted new iGaming onboardings on 27 July 2026, three weeks before the formal injunction was publicly announced on 18 August.
- Most of Inpay’s iGaming clients operate outside Denmark and often outside the EU entirely, which the regulator says magnifies the money laundering risk significantly.
A Growth Freeze Nobody in iGaming Payments Saw Coming
Denmark’s Finanstilsynet has issued a formal injunction against Copenhagen-based payments firm Inpay A/S, barring it from signing any new agreements with online gaming companies. The order, announced on 18 August 2026, follows a money laundering inspection from March that found the firm had breached Denmark’s Money Laundering Act across several areas at once. The restriction holds until Inpay can prove to Finanstilsynet that those violations have stopped.
What makes this case different from most regulatory actions in this sector is scale. The regulator found the failures ran through the majority of Inpay’s iGaming customer base, a customer group that also accounts for a significant share of the company’s total transaction volume. Among Inpay’s named iGaming clients are 888, Betsson, NetBet, Lottoland, LiveScore and Delasport. No wrongdoing has been attributed to any of those operators. The regulatory focus falls entirely on how Inpay managed, monitored, and documented those relationships on its own side.
Three Failures, One Inspection, Most of the Portfolio
The March inspection did not surface a vague compliance concern. It identified three specific, documentable failures in Inpay’s anti-money laundering controls: the firm was not keeping customer due diligence up to date when a client’s circumstances changed; it was not properly assessing the purpose and nature of relationships with iGaming clients already classified as high risk for money laundering or terrorist financing; and it was not running sufficient ongoing monitoring on those customers’ transactions.
Finanstilsynet stated: “The Danish FSA assesses that the violations are serious, and that the scope and type of customer, including the complexity of ownership structures and activities across many countries, are aggravating factors in terms of how significant the violation is.”
One finding in particular deserves attention. Inpay had no real insight into deposits from the gaming providers’ end users, the actual players funding the operators it was processing payments for. Without that downstream visibility, the firm had no reliable way to detect whether money moving through its systems came from legitimate sources. For a regulator treating iGaming as a high-risk sector, that blind spot was a structural problem, not a paperwork gap.
The cross-border dimension added further weight. Most of Inpay’s iGaming clients sit outside Denmark and often outside the EU. Operators based beyond EU borders are not bound by the same anti-money laundering rules that apply inside the bloc, which means Inpay was processing significant volumes for operators it could not fully scrutinise.
Inpay Moved Before the Regulator Did
Something about this story does not follow the usual script. Inpay did not wait to be told to stop. The board voluntarily halted new iGaming customer onboarding on 27 July 2026, nearly three weeks before Finanstilsynet published the formal injunction. In a statement, the company said: “Inpay’s board decided on its own initiative to halt the establishment of new business customer relationships within online gaming, rather than wait for the decision.”
That self-imposed pause signals the board had enough awareness of where the March inspection was heading to act without being forced to. Whether that reflects genuine compliance culture or a calculated move to soften the regulatory narrative is a fair question. What it does is change the optics considerably. The company also confirmed that existing iGaming clients are entirely unaffected. The injunction targets new relationships only.
Behind the Numbers: A Firm That Has Already Been Reshaped
Since that leadership change, Inpay’s revenue fell 13.1% in 2025, though EBITDA reached a record high. The 2026 year brought a new CCO, a new CFO, and an auditor switch from PwC to a smaller firm. The March 2026 inspection happened nearly two years into Nielsen’s tenure. Those compliance gaps were identified on the new team’s watch, which means the responsibility for closing them also sits there.
Inpay was established in Copenhagen in 2008, and was named the fastest-growing firm in Denmark by the Financial Times in 2022 in its FT 1000 list. This was at the height of Thomas Jul’s leadership as CEO until he resigned from Inpay in May 2024, along with other top management personnel in the firm. Board member Steen Nielsen, with over 32 years of experience in the financial services industry having worked at Nordea and Jyske Bank, became the new CEO.
Since the change in leadership, the firm saw a decrease of 13.1% in revenues in 2025, although the EBITDA set a record for the company. The 2026 period saw new additions, including the CCO and the CFO, and the auditing firm changed from PwC to a smaller firm. The March 2026 audit was conducted when the new leadership had been in place for about two years. The non-compliances found are thus on their watch.
Despite the turbulence, Inpay’s market position in iGaming remains notable. The company holds EMI, PSP, and TPP licences, making it the first Scandinavian fintech to hold all three simultaneously. Roughly a quarter of iGaming’s Power50 operators use its payout services. A growth freeze at that scale carries commercial consequences well beyond one regulatory filing.
Denmark Has Done This Before
Finanstilsynet did not invent this approach with Inpay. In December 2024, the regulator inspected electronic money institution Safenetpay ApS and found persistent deficiencies in its financial crime prevention, including failure to assess the purpose of business relationships and risk models that did not reflect the true exposure of high-risk clients. That case ended with orders to completely rebuild the firm’s risk classification systems, and an explicit threat of licence withdrawal if problems were not resolved.
That is the escalation track Inpay now sits on. Finanstilsynet does not treat AML failures in payments as administrative oversights. It treats them as material risks requiring documented proof of remediation. Denmark’s regulatory environment is also tightening around gambling more broadly. A sweeping reform package, Gambling Package 1, cleared European Commission review in early 2026 and is set to take effect from January 2027, extending operator duty-of-care obligations and requiring more active customer behaviour monitoring across the sector.
The Clock Is Now Running
Inpay must document to Finanstilsynet that violations of Section 10(1)(1) and Section 11(1)(4) and (5) of Denmark’s Money Laundering Act have been fully resolved. Practically, that means revised due diligence procedures, updated risk assessments for high-risk gaming clients, and a transaction monitoring system with genuine downstream visibility into where player deposits come from.
No public deadline has been set. The restriction does not lift automatically; it lifts only when the regulator is satisfied the failures are genuinely fixed. Every week it stays in place is another week competitors can approach new iGaming operators without that same barrier.
Expert Analysis
What the Inpay case exposes is a gap between how cross-border payments firms have historically approached iGaming compliance and what Finanstilsynet now demands. Running a standard onboarding check is not enough when clients operate under complex ownership structures across many jurisdictions and sit outside EU regulatory oversight. The regulator’s findings make clear that ongoing monitoring, purpose documentation for each relationship, and direct visibility into end-user deposit flows are the standard against which Danish-licensed payments providers will be measured. Any firm in this space with comparable iGaming exposure should read this case as a direct reference point for what the regulator expects to find.
Explore more:
Share
3 views
