Gambling companies lose payment partners more often than most businesses, and rarely because of one violation. Banks and card acquirers put the whole sector in a high-risk group, and a project that cannot explain its business and money flows gets declined. This article covers why refusals happen, what card rules and regulators actually say, and how to arrange entities, accounts and providers so that onboarding passes and the setup survives the loss of one partner. It is based on primary sources: the Visa and Mastercard rulebooks, European Banking Authority (EBA) documents, the EU anti-money laundering regulation and the Malta Gaming Authority’s player protection directive.
Checked on 26 October 2026. Rules and sources are current as of this date.
Why banks and processors refuse
A refusal rarely cites one rule. Usually several reasons add up, and most of them can be seen coming.
The sector is rated high risk
The EBA’s report on de-risking lists gaming operators among sectors treated as higher risk for money laundering, including in the European Commission’s risk assessment. Visa puts MCC 7995 (gambling) on its list of high-integrity-risk codes for card-absent payments. A bank with a category-wide policy can decline before it reads your file.
They do not understand the business
The EBA names a poor understanding of customers’ business models as one of three drivers of de-risking, and gaming operators are among its examples. Banks worry about fast transactions that are hard to trace. If your application does not show how money moves, the bank fills the gap with its own worst assumption.
Monitoring costs too much
Enhanced monitoring of a high-risk client takes staff time and capital. For a young project with small volumes, the bank may decide the margin does not cover that cost. The EBA lists compliance cost as the third driver.
Gambling is hidden under another code
Visa requires an online gambling merchant to use MCC 7995, even if gambling is not its main business, and a business with several lines needs a separate code for each. The rule extends to gambling wallets: loading one takes MCC 7995, not a crypto code. Processing gambling under another category is the fastest way to lose an acquirer.
Thin AML and weak own checks
A bank or acquirer wants to see your own KYC and AML working, not handed over to a payment processor. If your own checks are thin, it sees you as the weak link in its chain.
Unclear markets and owners
Players from countries where you hold no licence, offshore entities with opaque ownership and payments passing through third parties all raise questions. Our article on illegal gambling through third-party card payments covers the related risk.
Who refuses, and what helps
Different partners refuse for different reasons, so the answer to each is different too.
| Partner | Typical reason | What helps |
|---|---|---|
| Bank (corporate account) | Sector risk, unclear business model, cost of monitoring | A short plain-language memo on the model and the money flow, the licence, AML policy, owner documents |
| Card acquirer | Card scheme rules, licence evidence, wrong category, chargebacks | MCC 7995, licence evidence for each market served, a fixed descriptor, the disclosures the acquirer asks for |
| Payment institution or PSP | Its own bank’s limits, depth of your KYB file | Full KYB pack, list of markets, a clear scheme for player funds |
| Crypto on-ramp or off-ramp | Travel Rule, wallet screening, gambling classification of card purchases | Wallet screening, source records, correct classification. See accepting crypto payments and the Travel Rule |
What the rules and regulators say
Four sources matter. Two limit how banks may refuse, two set what you must do yourself.
EBA opinion on de-risking, 5 January 2022
The EBA says a risk-based approach does not require refusing whole categories of customers. De-risking an entire category without looking at each customer’s risk can be unwarranted and may signal weak risk management. The EBA also notes complaints from gambling operators hit by category-wide decisions.
EBA Guidelines EBA/GL/2023/04, 31 March 2023
Before refusing or ending a relationship on AML grounds, a bank must consider mitigating measures, such as closer monitoring or limited services, and record its reasons for the supervisor. Blanket refusal of whole customer categories is not allowed. The bank must also tell the person that they may complain to the competent authority or an alternative dispute body.
Visa Merchant Data Standards Manual, October 2026
Gambling uses MCC 7995 and sits on the high-integrity-risk list for card-absent payments. Acquirers must prohibit agents from using dynamic descriptors for gambling merchants. You accept these conditions through your acquirer.
EU anti-money laundering regulation (AMLR), from 10 July 2027
Gambling providers fall under the regulation. Member States may exempt some gambling services as proven low risk, but not casinos and not providers whose principal activity is online gambling or sports betting. Plan for full obligations.
The EBA texts bind EU credit and financial institutions and their supervisors. They do not give a company a right to an account, and the guidelines do not require a bank to give a business its reasons (consumers are covered separately by the Payment Accounts Directive). Their real use is as an argument: a bank that refuses a licensed operator without looking at its file departs from what its own regulator expects.
What Visa asks of the acquirer, and so of you
The acquirer that takes gambling is itself supervised. That is why it is slow and picky, and why your file has to help it pass its own checks.
The acquirer needs its own approval
Under Visa’s Integrity Risk Program, an acquirer must register as a high-integrity-risk acquirer before it solicits or processes for such merchants, and gambling needs a separate approval. It gives Visa a written attestation, passes a financial review and meets capital requirements.
The merchant registers too
The merchant is registered with Visa before submitting transactions, and the registration is updated when activity changes, for example new website addresses.
Enhanced due diligence on you
The acquirer reviews your control environment before onboarding, attests to Visa that you passed, and keeps monitoring to prevent illegal transactions.
Assessments and annual attestation
The acquirer runs an initial control assessment for the gambling category, repeats it periodically, performs an annual self-assessment and signs an annual attestation about its merchants.
Contract terms
The merchant agreement must require compliance with law and with Visa rules and give Visa the right to limit or end the agreement (Rule ID 0003356). Expect these clauses in your contract.
The Visa document is dated 6 April 2023 and marked confidential, so details may have been updated since. Confirm the current requirements with your acquirer. Mastercard’s rules are covered in the next section.
What Mastercard asks
Mastercard is stricter about registration and about what happens when a merchant is reported. The source is its Security Rules and Procedures, Merchant Edition, 4 August 2026.
Registration before the first payment
Non-face-to-face gambling (MCC 7801, 7802 and 7995) falls under the Specialty Merchant Registration Program. The acquirer must register the merchant, with each website address, before acquiring, and must obtain and keep a copy of the merchant’s licence from the licensing authority of each jurisdiction concerned and give it to Mastercard.
What the file contains
Names and addresses, owners with their tax numbers, a description of the services, payment procedures and cardholder disclosures, and any earlier business of the owners. By registering, the acquirer affirms that the activity runs only where it has confirmed it to be legal and that controls keep it out of prohibited jurisdictions.
Prior consent and fines
From 1 May 2026 an acquirer needs Mastercard’s written consent for specialty merchant acquiring, and for the Europe region this applies from 1 October 2026 (with some countries earlier). Acquiring for an unregistered gambling merchant costs the acquirer up to USD 10,000, then USD 5,000 a month for up to three months and USD 25,000 a month after that.
BRAM investigations
Mastercard’s Business Risk Assessment and Mitigation (BRAM) program investigates merchants reported for illegal or brand-damaging transactions, for example by law enforcement or complaints. The acquirer must answer in two business days for government cases and five for others, with a remediation plan, the merchant agreement, website addresses and monthly volumes. Assessments can reach USD 200,000 per merchant.
Your acquirer has its own money at stake: a fine, a case and possible loss of permission. It will want every website address, a licence for each market and proof that you block prohibited ones. New domains or markets that the acquirer does not know about are a direct risk to your account.
We will review your situation and propose a solution for your project.
How to build the structure
The details depend on your licence and markets, but the logic is the same.
Put gambling in one licensed entity
The licence holder runs the gambling and receives the gambling payments. Other activities, such as software or marketing, sit in separate companies with their own contracts and codes. Visa asks for a separate code for other business lines anyway.
Start hereDraw the flow of funds on one page
Where a player’s money goes, who holds it at each step, how withdrawals come back and where fees are taken. Show which entity signs with which provider. Banks decline what they cannot picture.
Use more than one provider
Two or three acquirers or payment institutions, and an account at a second bank. Losing a single partner should slow you down, not stop you. Keep an onboarding pack ready for each.
Keep player funds apart
Hold player balances separately from operating money. Malta, for example, treats them as a separate patrimony and requires coverage at all times (see below). Check the rule in your own licence.
Fix the card setup
MCC 7995, a fixed descriptor, the disclosures your acquirer requires and licence evidence for every market you serve. Block players from markets where you hold no licence.
Prepare the onboarding pack
Licence, corporate chart with owners, AML and responsible gambling policies, risk assessment, list of markets, payment methods, affiliates and financial statements. See our article on responsible gambling and AML for the policies and KYC and KYB for payment providers for what providers ask of you.
Treat crypto separately
Visa’s manual says a ramp that buys crypto for gambling uses MCC 7995. For direct crypto acceptance, the regime is different and has its own checks.
Player funds: what a regulator requires, using Malta as an example
Banks like a flow they can follow. A licensing regime that ring-fences player money gives you one.
A separate patrimony
Under Malta’s Player Protection Directive (Directive 2 of 2018), player funds are a separate and distinct patrimony of the players, and the licensee’s creditors have no claim on them (Art. 37).
Where the money sits
Funds are held in a licensed credit, financial or payment institution, subject to the regulator’s approval of the setup, in Malta, the EU or EEA or another approved jurisdiction (Arts. 31 and 33).
Coverage
The balance, including funds in transit, must at least equal player credit balances, and at least 90% must sit in the player funds account. A shortfall is covered at once from the licensee’s own funds (Art. 38).
Withdrawals
Funds must be withdrawable at any time (Art. 31). Payout should be made within five working days where practicable, and the licensee may take reasonable time for checks. Withdrawals may be delayed for AML and fraud prevention (Arts. 29 and 30).
Whatever your licence, a bank or acquirer reads a ring-fenced player account with a clear coverage rule as lower risk than commingled money. Check the equivalent rule in your own licence conditions and the current version of the directive.
If you have already been refused
Do not argue with the first no. Work out which kind it is.
Ask for the reason in writing
Find out whether it is a category-wide policy or something in your file. An EU bank must at least tell you how to complain.
First stepLook for a fixable cause
Wrong MCC, missing licence evidence for a market, unclear owners, a flow the bank cannot follow. These are fixed in days.
Reapply with a memo and your own risk profile
Describe the model, the licence, the controls and the flow of funds. In the EU, ask the bank to assess your individual risk, as the EBA expects.
Escalate where it is justified
For an EU bank, the competent authority or an alternative dispute body. For others, the complaints route your contract provides.
Move volumes while you still have time
Agree a notice period and the settlement of balances, and bring the second provider live before the first one leaves.
Do not spread volumes across hidden accounts or intermediaries after a refusal. Acquirers and banks treat that as a new red flag, and under Visa’s rules gambling must stay visible as MCC 7995.
A typical situation
An illustration, not a real client.
An operator with a Curaçao licence takes cards through one acquirer, and all funds sit in one account opened by the parent company. The acquirer ends the contract on 30 days’ notice.
The new acquirer asks for the same documents again and finds that the account owner is not the licence holder. The flow of funds exists only in people’s heads.
Move the account to the licensed entity, prepare a one-page flow of funds, onboard a second acquirer in parallel and keep the pack current.
A bank refuses what it cannot picture. Show it the money flow on one page.LegalBit team
Frequently asked questions
Which merchant category code does gambling use?
MCC 7995. Visa’s manual requires it for online gambling even if gambling is not the merchant’s main business, and a business with several lines gives the gambling line this code and the others their own. Loading a gambling wallet also takes MCC 7995.
Can a bank refuse the whole gambling sector?
Banks generally choose their clients, and no company has a right to an account. But for EU banks the EBA expects individual assessment, not blanket refusal of a category, and a bank must document its reasons for its supervisor.
Does a gambling licence guarantee a bank account?
No. A licence is the first document banks ask for, not the last. They also want the owners, the flow of funds, the AML policy and a view of your markets.
Can I process gambling through another company’s account?
Do not. Visa requires gambling to be coded MCC 7995, and processing it under another category or through a third party is the pattern that gets merchants terminated.
What changes when the AMLR applies?
From 10 July 2027 gambling providers are covered by the regulation, and online gambling and sports betting providers cannot be exempted as low risk. Expect banks and providers to ask for more of your AML documents, not fewer.
Can I accept crypto instead of cards?
You can, but it is a separate regime with its own checks, and card ramps that buy crypto for gambling are still classified as gambling by Visa. See our article on accepting crypto payments.
Why does a gambling acquirer take weeks to onboard me?
Under Visa’s program the acquirer needs its own registration and a separate approval for gambling, performs enhanced due diligence on each merchant and attests to Visa that you passed. That process takes time and costs money, so complete files move faster.
See also: Responsible gambling and AML for iGaming operators; Online casino licence; Illegal gambling through third-party card payments; KYC and KYB for payment providers; Accepting crypto payments. Services: iGaming legal services.
- EBA: Opinion on de-risking, EBA/Op/2022/01, with annexed report (5 January 2022)
- EBA: Guidelines EBA/GL/2023/04 on ML/TF risk management and access to financial services (31 March 2023)
- Visa: Merchant Data Standards Manual (October 2026)
- EUR-Lex: Regulation (EU) 2024/1624 on preventing use of the financial system for money laundering (AMLR)
- Visa: Integrity Risk Program (6 April 2023)
- Malta Gaming Authority: Player Protection Directive (Directive 2 of 2018)
- Mastercard: Security Rules and Procedures, Merchant Edition (4 August 2026)
This topic is our service
More on how we help iGaming companies:
