Illegal gambling businesses rarely accept payments under their own name. More often players’ card payments pass through someone else’s ordinary-looking business, and that is exactly what card schemes and banks hold acquirers and payment companies to account for. We go through, according to primary sources, how such a scheme works, what Visa and Mastercard require, how the US Department of Justice case ended, and what a payment provider should do so as not to end up as a defendant.
Checked on 22 October 2026. Rules and sources are current as of this date.
How the scheme works
The scheme is built to make gambling payments look like payments for ordinary goods.
A front business
In the case the US Department of Justice made public in April 2011, the indictment alleged that US players’ payments were routed as payments to hundreds of nonexistent online merchants, for example selling jewellery and golf balls. Processors created phony corporations and websites for this.
Deceiving banks
According to the Department of Justice, a processor told banks that accounts would be used for payday loans or internet membership clubs, while poker payments actually ran through them. He also offered failing banks investments in exchange for agreeing to process such transactions.
Transaction laundering
Visa describes this practice as transaction laundering, or factoring. An unknown business processes payments through an approved merchant’s credentials for undisclosed goods or services. We wrote about this in detail in our article on transaction laundering and miscoding.
What the card schemes require
Card schemes do not ban gambling, but they allow it only under a special status.
Visa and high integrity risk
Visa places gambling in the High Integrity Risk category, Tier 1, the strictest. MCC 7995 is used, for card-absent transactions only. An acquirer must obtain registration from Visa before it starts soliciting such sellers, and approval is granted separately for each category.
Registering the seller
A Tier 1 seller must be registered with Visa before submitting transactions. The acquirer carries out enhanced due diligence, attests to Visa that the seller passed it, updates the registration when details change, for example website addresses, and confirms annually that its controls work.
Mastercard
An acquirer that handles sellers accepting non-face-to-face gambling (MCC 7801, 7802 and 7995) must register them with Mastercard as specialty merchants (Section 9.1 of the Security Rules and Procedures). Before acquiring such transactions under Section 9.4.2, it must register the seller and obtain from the licensing authority of each applicable jurisdiction a copy of the seller’s gambling licence, and furnish it to Mastercard. The transactions are identified with MCC 7995 and TCC (transaction category code) U, and MCC 7801 or 7802 may be used instead if the seller is additionally registered.
The law
Transactions must be legal in both the merchant’s and the cardholder’s jurisdiction (VARS, AACQ.C18). In the US, the UIGEA, 31 U.S.C. 5363, prohibits those in the business of betting from knowingly accepting payments, including credit card charges, from participants in unlawful internet gambling. In Brazil, under Provisional Measure No. 1,394, banks and payment institutions may not process transactions for fixed-odds betting, and we covered this in our article on the betting ban.
For an acquirer, gambling is a registered and costly category. That gives an illegal operator an incentive to hide under another MCC, and gives the provider a duty to look for mismatches.
Who is liable
Liability is spread along the whole chain.
The acquirer
Under the Visa Acceptance Risk Standards, the acquirer must ensure transactions are legal. If illegal activity is found, it must take legal action, cooperate with Visa and law enforcement, hold available settlement funds where possible and report the results to Visa (AACQ.C8.3).
Mastercard and the BRAM programme
The BRAM (Mastercard’s Business Risk Assessment and Mitigation program) programme investigates sellers referred to Mastercard as possibly engaged in illegal or brand-damaging transactions, including through law enforcement referrals. If a violation is found, Mastercard notifies the acquirer. In cases started by law enforcement the acquirer must report its findings within two business days, and in other cases within five. The response must include a remediation plan, the seller’s application and agreement, monthly transaction volumes and the MATCH (Mastercard’s list of terminated merchants) Pro check results. For breaching the rules on illegal transactions the acquirer may be assessed USD 200,000, or USD 2,500 per day if it proves the violation lasted less than 80 days. The amount may be reduced if the acquirer stopped the activity within two business days of notification.
PayFac and ISO
If an acquirer onboards high-risk sellers through third parties, it must register them with Visa, conduct due diligence, review their merchant diligence and monitoring, and provide formal oversight at least annually. A PayFac with such sellers is registered as a High-Risk Internet PayFac. We covered the allocation of responsibility in the article on PayFacs, aggregators and ISOs.
The processor and intermediaries
In the US case, a payment processor also bore criminal liability. Chad Elie, a processor for PokerStars, Full Tilt Poker and Absolute Poker, pleaded guilty to conspiracy to commit bank fraud and to operate illegal gambling businesses.
The seller
The agreement must require compliance with the law and Visa rules, prohibit transactions the seller knows or should have known are illegal, and recognise Visa’s right to limit or terminate the agreement. We covered which clauses to include in our article on merchant agreements and protection from transaction laundering.
Practice
The most detailed public description of such a scheme was given by the US Department of Justice in its case against online poker companies. It is a US case, and part of the information in it consists of the prosecution’s allegations, not facts established by a court.
The indictment, 15 April 2011
Eleven people linked to PokerStars, Full Tilt Poker and Absolute Poker were charged. The charges included conspiracy to violate the UIGEA, operating illegal gambling businesses, conspiracy to commit bank and wire fraud, and money laundering conspiracy. According to the prosecution, the companies processed billions of dollars in payments, of which about one-third or more went to them as rake. About 76 bank accounts in 14 countries were restrained, and the civil complaint sought at least $3 billion.
The settlement, 31 July 2012
PokerStars forfeited $547 million to the US and paid a further $225 million for the Full Tilt assets, while Full Tilt forfeited virtually all of its assets to the government. The settlements contained no admission of wrongdoing.
The processor’s sentence, 3 October 2012
Chad Elie pleaded guilty to conspiracy to commit bank fraud and to operate illegal gambling businesses. The court sentenced him to five months in prison, two years of supervised release and forfeiture of $500,000. He had earlier given up claims to about $25 million in seized accounts.
For banks and processors, the main risk is not the operator’s licence but that they helped disguise the payments. In the case described, the claims concerned precisely the deception of banks.
Warning signs
Signs pointed to by Visa rules and by the case materials.
In the data
An unusually high number of transactions, similar amounts, transactions that do not match the declared business, and a mismatch between merchant name and MCC.
On the website
The site does not sell what is declared, there is no cart or checkout, and there are suspicious URLs and backlinks.
In the intermediary’s behaviour
An intermediary offers benefits for fast onboarding, as in the US case where processors offered banks investments, or insists on separate payment pages.
Contracts and controls
Visa’s requirements for acquirers are easy to carry over into contracts and procedures.
The seller agreement
A ban on transactions the seller knows or should have known are illegal, a duty to comply with the law and card scheme rules, the right of the acquirer and the card scheme to limit or terminate the agreement, and a ban on accepting payments for third parties.
Checks and monitoring
A check against a terminated merchant file such as VMSS before signing, KYB (know your business, checks on corporate customers) and sanctions screening, tracking of mismatches and an annual confirmation of controls for high-risk sellers.
A website register
A register of websites and URLs, updated when they change, with checks of backlinks.
A right to audit and to make test payments on the site, withholding payouts on suspicion, a duty on the seller to report new sites and payment pages, and reimbursement of card scheme fines.
We will review your situation and propose a solution for your project.
Case analysis
A payment provider onboards an online hobby goods shop. After three months turnover is three times what was declared, amounts repeat and the site has no cart. A review shows that the payment page leads to another site offering real-money games. A sensible order of action is to pause payouts, preserve the evidence, check related sites and payments, inform the acquirer and, where the applicable law requires, law enforcement, terminate the agreement and rethink underwriting of similar clients.
What to do
Start by answering whether you have gambling clients, and then check for hidden ones.
Find out whether you work with gambling clients
List your sellers and MCCs and find those whose declared business does not match the actual one.
Start hereCheck registrations
Gambling sellers need acquirer and seller registrations with Visa and specialty merchant registration with Mastercard.
Set up monitoring for mismatches
Transaction data, websites, merchant names and MCCs, and backlinks.
Record the terms in contracts
A ban on hidden payments, audit rights, withholding of payouts and liability for card scheme fines.
Check intermediaries
PayFacs and ISOs that bring in clients must pass due diligence and annual oversight.
Prepare a plan for suspicion
Pausing payouts, preserving evidence, notifying the acquirer and deciding on termination.
For a payment provider, the costliest thing is not accepting a gambling client but accepting one under someone else’s name.The LegalBit team
Frequently asked questions
Can payments of gambling operators be accepted?
Yes, but only as a registered high-risk category. Visa requires registration of the acquirer and the seller, and Mastercard requires registration of specialty merchants.
What is transaction laundering in gambling?
According to Visa, it is when an unknown business processes payments through an approved merchant’s credentials for undisclosed goods or services. In gambling, gambling payments are dressed up as payments for ordinary goods.
Is the acquirer liable for hidden gambling at a client?
Under the Visa Acceptance Risk Standards, the acquirer must ensure that transactions are legal and, if illegal activity is found, take action, including cooperating with Visa and law enforcement.
Is the right MCC enough?
No. The actual business must be checked and monitored. Visa points to mismatches between merchant name and MCC and to checks of websites and backlinks.
Does this concern only the US?
The case and the UIGEA are American, but Visa and Mastercard rules apply in many countries. In addition, in other jurisdictions, for example Brazil, banks may not process betting transactions.
See also: Transaction Laundering and Miscoding: The Hidden Threats to Your Fintech Business; Payment Facilitators, Aggregators and ISOs: Who Is Responsible for Sub-Merchants; Brazil’s Betting Ban; Responsible gambling and AML for operators. Services: iGaming, fintech and payments.
- Visa: Visa Acceptance Risk Standards (October 2024)
- Visa: Visa Integrity Risk Program
- Mastercard: Mastercard Rules (2 June 2026 edition)
- Mastercard: Security Rules and Procedures, Merchant Edition (4 August 2026 edition)
- U.S. Attorney’s Office, SDNY: Press release on the indictment of 11 defendants in the online poker case (15 April 2011)
- U.S. Attorney’s Office, SDNY: Press release on the PokerStars and Full Tilt settlements (31 July 2012)
- U.S. Attorney’s Office, SDNY: Press release on the sentencing of payment processor Chad Elie (3 October 2012)
- U.S. Code: 31 U.S.C. § 5363, Prohibition on acceptance of any financial instrument for unlawful Internet gambling
