William Hill Malta: exact-address licence and payment audit

Following the money before the brand

Money leaves a trail that advertising cannot rewrite, so the audit starts at the cashier rather than the welcome screen. Two questions decide how exposed a player in Malta is: which legal entity receives the deposit, and which supervisor can be asked to act when a balance is not returned. An exact-address query in the Malta Gaming Authority checker, captured on 21 August 2026, returned a current named record for williamhill.com listing William Hill Malta PLC and licence reference MGA/CRP/121/2006-02. That record is the whole basis of the green signal, and also its limit. A licensed recipient of funds is not a payout guarantee, a verification-speed promise, or a statement that every cashier route behaves. No dated payment test, withdrawal timing or verified individual dispute is held for the brand, so from the record onwards the burden of proof moves to documents you keep yourself.

One exact address, one record

Licensing attaches to a precise address, not to a name spoken out loud. The record came from a literal string query — williamhill.com typed into the regulator's exact-address tool — and it is worth repeating rather than trusting anyone's capture. Run it yourself at the MGA URL checker and compare three values: the address you actually reached, the company returned, and the licence reference. A record for the .com address says nothing about another extension, a hyphenated variant, a subdomain sent to you in a message, or a mirror shared in a group chat. Copy the host from the browser bar after the page has loaded, never from an advertisement or a search snippet. An empty result usually means a typing slip or a redirect, so treat it as unresolved rather than adverse; only a returned record naming a company and a reference closes the question.

The licensed company behind the cashier

A deposit is a payment to a company, and the company is what a bank, a card scheme or a supervisor can act on. The returned record names William Hill Malta PLC, a Maltese public limited company, as the licensed party for the queried address. Two consequences are practical. The trading name in the lobby and the name on your statement need not match, because payments often surface as a corporate entity or an intermediary processor; note the descriptor verbatim with date, amount and reference. And corporate identity anchors any escalation: a complaint naming a brand loosely can be passed between group companies, while one naming the licensed company, the licence reference and the exact address you used is harder to deflect. The MGA licensee register lists licensed companies with their authorised addresses, so keep it beside the checker capture. Ownership structure and processor arrangements are not held and are not asserted.

Reading the licence reference and the legal frame

MGA/CRP/121/2006-02 is a lookup key, not a rating. Treat it as an exact-match value: a transposed digit or a dropped segment is the usual reason a genuine reference appears to return nothing, which then circulates as a warning. The reference belongs to the record as returned; no expiry date sits in the ledger, so none is stated, and the segments are not decoded into claims about class or scope. Supervision itself lives in statute: Chapter 583, the Gaming Act, sets Malta's statutory gaming framework, and authorisations are issued and conditioned under it. That is the difference between a footer badge, which is an image anyone can copy, and a record returned by the supervisor's own tool for the address you typed. For the practical reading of what a Maltese authorisation does and does not cover, keep our licence and law notes to hand.

Scam or legitimate: what the record supports

On the evidence held, the address under review is not an unlicensed operation: a current primary record names a Maltese licensee for the exact domain, checked on 21 August 2026. That is the entire basis of the green signal. Green means the address matched a current record for the named company on the check date; it is not a claim about payout reliability, bonus fairness, verification speed or the outcome of any individual dispute.

Sentiment is kept in a separate tier. A dated public review profile exists for the brand, and the capture below records only that it exists. Entries there are unverified accounts: useful for spotting a procedure to test in your own account, worthless as proof of theft or of solvency. Volume of anger proves nothing, and neither does volume of praise. Where a withheld payout is described, read the mechanics — the stage the money stopped at, the document requested — and treat the poster's verdict as an allegation.

If the address check is done and you still want to play, View the option and size the first deposit so a full deposit-to-withdrawal cycle can be tested cheaply.

Deposits and the trail your bank keeps

The cashier is where your own evidence starts, because no dated record of the operator's payment line-up or payout times is held; build that list yourself from the funding screen before transferring anything. Capture three things at deposit: the method and currency chosen, the confirmation reference shown after the transfer, and the bonus state of the account, since an opt-in you barely noticed can lock the balance you later try to withdraw. Match the entry on your bank or wallet statement against the cashier reference within a day, while the descriptor is still easy to trace. Keep it all in one dated folder rather than in a chat thread. Our payment records guide covers the same discipline in more depth.

Withdrawals: where payouts actually stall

Payouts stall for procedural reasons far more often than sinister ones, and each has a different fix. The frequent causes are an identity check never completed, a payout route that does not mirror the deposit route, a balance still bound by wagering conditions, a request above a per-transaction or per-period limit, and bank clearing that pauses over a weekend. None of these is asserted as behaviour observed at William Hill; they are the checks to run against your own terms and ticket history before escalating. Time-stamp the withdrawal request, note the state shown in the cashier each day, and avoid cancelling a pending payout to reuse the funds, because that resets the clock and weakens a later complaint.

Identity checks and the mismatch that freezes a balance

Most frozen balances are name mismatches. The account holder, the payment instrument and the identity document have to agree, so a card in a partner's name, a wallet opened with an abbreviated first name, or a document transliterating a surname differently is enough to hold a payout. Address proof is usually expected to be recent, and a household sharing one connection can trigger duplicate-account questions that need explaining rather than arguing. Complete verification before the first deposit, not after a win, and upload full-page documents rather than crops. Keep every upload, ticket number and reply, because a verification timeline you can show is the strongest single item in a complaint. Set deposit limits at the same time; our responsible gambling tools page lists what to switch on, and urgent help routes are there if control has already slipped.

Complaints in the order that moves money

Escalate in an order that keeps the money in view. First a written internal ticket, with the reference kept, because both later channels will ask what the operator was told and when. If that fails, two channels exist outside the operator's control: the Maltese supervisor, addressed with the licensed company, the licence reference and the exact address you used, and your payment provider, addressed with the statement descriptor and dates. Send facts and documents, not adjectives. No response times or dispute outcomes are held in the ledger, so none are promised. Our complaints and warnings notes record only what has been documented, and unverified accounts stay labelled as such.

Copies, lookalikes and search detours

The licensed record covers one address, which is exactly what a copy exploits. Reach the operator by typing the address rather than following a paid result, a push notification or a forwarded link. Then compare four things before logging in: the host in the browser bar character by character, the certificate name behind the padlock, the address shown on the payment step, and whether you are asked to fund a personal wallet, a bare crypto address or a bank account in an individual's name. Any of those last requests ends the session. Copies also live in unofficial app listings and in reactivation messages promising a held balance. When in doubt, re-run the exact-address check for whatever host you actually reached and compare it with the addresses listed for other reviewed brands.

Open questions, chronology and corrections

Everything above rests on records checked on 21 August 2026: the exact-address query and its capture, the licensee register, and the statutory framework. Nothing earlier is held, so no trend, no historical enforcement action and no licence expiry is described. Also absent: any payment test, any withdrawal timing, any verification case and any confirmed individual dispute for William Hill. The method is deliberately narrow — query the exact address, match the company, match the licence reference, keep primary records, operator statements and public accounts in separate tiers, and never let the weakest tier lift a verdict. Green is used only where a current primary record supports the precise address and company, red only for an official adverse record or corroborated documented evidence, amber for anything unresolved. Corrections follow the same rule: send a dated primary record through our contact route and the assessment is revised or downgraded, with the change dated. Our methodology and editorial policy set out the tiers in full.

Frequently asked questions

Government of Malta