Danish Inpay gets regulator order over AML breaches in iGaming

Denmark’s financial regulator has issued payment company Inpay an order over “serious breaches” of anti-money-laundering rules and temporarily barred it from onboarding new business clients in online gambling until it proves the problems have been fixed. For high-risk PSPs, the interesting part is not the headline itself; it is the mix of AML controls, iGaming exposure, and transaction monitoring that regulators are now willing to test in one go.

1. Inpay A/S, a Copenhagen-based fintech, provides cross-border payments in fiat and crypto for the gambling sector and other industries. It also markets itself as a provider of low-cost real-time payments 24/7. In 2022, the company was named the fastest-growing company in Denmark in the FT 1000 ranking.
2. The Danish financial regulator said its inspection took place in March 2026 and identified three main issues: insufficient due diligence when customer circumstances changed, an inadequate assessment of the purpose and nature of business relationships with high-money-laundering-risk iGaming clients, and weak outgoing monitoring after onboarding.
3. The regulator said the problems affected “most” of the company’s client portfolio, which accounts for a significant share of total transaction volume and comes mostly from outside Denmark and the EU. It also said the shortcomings in due diligence and transaction monitoring create a “real and significant risk” that Inpay is supporting illegal gambling activity and payment services without a license.
4. Inpay said it takes the decision seriously and stated that, on 27 July, before the formal order was issued, its board had already decided to suspend onboarding of new iGaming clients. The company said existing clients, both in gambling and other sectors, are not affected; the restriction applies only to new business relationships in online gambling.

For gambling operators and their PSPs, this is a reminder that onboarding files are only half the job. Regulators are looking just as hard at what happens after the client is live: how risk profiles are refreshed, how outgoing flows are monitored, and whether the provider can actually separate licensed activity from everything else.