Finanstilsynet bars Inpay from new gaming clients over AML failures

Denmark's financial regulator walked into Inpay's Copenhagen offices in March 2026 and found what it later described as serious violations of the Money Laundering Act. Five months later, Finanstilsynet has issued an injunction that bars the payments firm from taking on new business customers in online gaming until it can document, to the regulator's satisfaction, that those violations have stopped.

Inpay is not a peripheral player in this space. The firm processes cross-border payments for gaming operators, handling both fiat and crypto transactions, and its gaming book draws heavily from clients outside Denmark and the EU. Finanstilsynet's own language is pointed: the violations concern the majority of the customer portfolio, which accounts for a significant portion of total transaction volume. When a regulator says that, they are not describing a compliance department that missed a form. They are describing a structural gap.

The specific findings matter for anyone pricing regulatory risk in fintech. Finanstilsynet cited three failures: inadequate customer due diligence when client circumstances change, insufficient assessment of the purpose of business relationships with high-risk gaming clients, and weak outgoing transaction monitoring. The third finding is the one I watch most closely. Outgoing monitoring is where the actual money moves. A firm can document its onboarding procedures in elaborate detail and still have no real visibility into what its clients are doing once the relationship is established. That is not a paperwork problem.

Inpay's board moved to halt new gaming onboardings on July 27, before Finanstilsynet issued the formal order. The firm's statement emphasizes this — and I understand why. Self-initiated pauses read better than regulatory compulsion in enforcement histories. But Finanstilsynet's timeline suggests the inspection findings were serious enough that the firm had already calculated it could not defend the existing posture. That calculation, made before the order arrived, tells you something about what the inspection actually turned up.

Existing gaming customers are not affected, and Inpay has said as much. The injunction is narrow in that sense. But narrow injunctions in AML enforcement have a tendency to widen. Regulators who find structural gaps in monitoring do not typically conclude their review at the first order.

I am adjusting for my own bias here: I default toward the more severe outcome when a regulator uses the phrase "real and significant risk" of supporting illegal gaming. That phrase is not decorative. It is the language regulators use when they are building a record. Whether Finanstilsynet is building toward something larger, or whether this injunction closes the matter, is not established by what the sources contain. But the documented failures — due diligence, purpose assessment, outgoing monitoring — sit in exactly the combination that precedes escalation in prior European AML enforcement actions I have watched closely.