{"id":8331,"date":"2026-10-26T10:00:00","date_gmt":"2026-10-26T07:00:00","guid":{"rendered":"https:\/\/legalbit.top\/en\/igaming-payments-banking\/"},"modified":"2026-10-26T16:58:13","modified_gmt":"2026-10-26T13:58:13","slug":"igaming-payments-banking","status":"publish","type":"post","link":"https:\/\/legalbit.top\/en\/igaming-payments-banking\/","title":{"rendered":"Payments and Banks for Gambling Projects: Why They Refuse and How to Build the Structure"},"content":{"rendered":"\n
<\/symbol><\/symbol><\/symbol><\/symbol><\/symbol><\/symbol><\/symbol><\/symbol><\/symbol><\/symbol><\/symbol><\/symbol><\/symbol><\/svg>

Gambling companies lose payment partners more often than most businesses, and rarely because of one violation. Banks and card acquirers put the whole sector in a high-risk group, and a project that cannot explain its business and money flows gets declined. This article covers why refusals happen, what card rules and regulators actually say, and how to arrange entities, accounts and providers so that onboarding passes and the setup survives the loss of one partner. It is based on primary sources: the Visa and Mastercard rulebooks, European Banking Authority (EBA) documents, the EU anti-money laundering regulation and the Malta Gaming Authority\u2019s player protection directive.<\/p>

Checked on 26 October 2026. Rules and sources are current as of this date.<\/p><\/div><\/section>

Why banks and processors refuse<\/h2>

A refusal rarely cites one rule. Usually several reasons add up, and most of them can be seen coming.<\/p>

<\/svg><\/span>

The sector is rated high risk<\/h3>

The EBA\u2019s report on de-risking lists gaming operators among sectors treated as higher risk for money laundering, including in the European Commission\u2019s risk assessment. Visa puts MCC 7995 (gambling) on its list of high-integrity-risk codes for card-absent payments. A bank with a category-wide policy can decline before it reads your file.<\/p><\/div>

<\/svg><\/span>

They do not understand the business<\/h3>

The EBA names a poor understanding of customers\u2019 business models as one of three drivers of de-risking, and gaming operators are among its examples. Banks worry about fast transactions that are hard to trace. If your application does not show how money moves, the bank fills the gap with its own worst assumption.<\/p><\/div>

<\/svg><\/span>

Monitoring costs too much<\/h3>

Enhanced monitoring of a high-risk client takes staff time and capital. For a young project with small volumes, the bank may decide the margin does not cover that cost. The EBA lists compliance cost as the third driver.<\/p><\/div>

<\/svg><\/span>

Gambling is hidden under another code<\/h3>

Visa requires an online gambling merchant to use MCC 7995, even if gambling is not its main business, and a business with several lines needs a separate code for each. The rule extends to gambling wallets: loading one takes MCC 7995, not a crypto code. Processing gambling under another category is the fastest way to lose an acquirer.<\/p><\/div>

<\/svg><\/span>

Thin AML and weak own checks<\/h3>

A bank or acquirer wants to see your own KYC and AML working, not handed over to a payment processor. If your own checks are thin, it sees you as the weak link in its chain.<\/p><\/div>

<\/svg><\/span>

Unclear markets and owners<\/h3>

Players from countries where you hold no licence, offshore entities with opaque ownership and payments passing through third parties all raise questions. Our article on illegal gambling through third-party card payments<\/a> covers the related risk.<\/p><\/div><\/div><\/section>

Who refuses, and what helps<\/h2>

Different partners refuse for different reasons, so the answer to each is different too.<\/p>

Partner<\/th>Typical reason<\/th>What helps<\/th><\/tr><\/thead>
Bank (corporate account)<\/th>Sector risk, unclear business model, cost of monitoring<\/td>A short plain-language memo on the model and the money flow, the licence, AML policy, owner documents<\/td><\/tr>
Card acquirer<\/th>Card scheme rules, licence evidence, wrong category, chargebacks<\/td>MCC 7995, licence evidence for each market served, a fixed descriptor, the disclosures the acquirer asks for<\/td><\/tr>
Payment institution or PSP<\/th>Its own bank\u2019s limits, depth of your KYB file<\/td>Full KYB pack, list of markets, a clear scheme for player funds<\/td><\/tr>
Crypto on-ramp or off-ramp<\/th>Travel Rule, wallet screening, gambling classification of card purchases<\/td>Wallet screening, source records, correct classification. See accepting crypto payments<\/a> and the Travel Rule<\/a><\/td><\/tr><\/tbody><\/table><\/div><\/section>

What the rules and regulators say<\/h2>

Four sources matter. Two limit how banks may refuse, two set what you must do yourself.<\/p>

<\/svg><\/span>

EBA opinion on de-risking, 5 January 2022<\/h3>

The EBA says a risk-based approach does not require refusing whole categories of customers. De-risking an entire category without looking at each customer\u2019s risk can be unwarranted and may signal weak risk management. The EBA also notes complaints from gambling operators hit by category-wide decisions.<\/p><\/div>

<\/svg><\/span>

EBA Guidelines EBA\/GL\/2023\/04, 31 March 2023<\/h3>

Before refusing or ending a relationship on AML grounds, a bank must consider mitigating measures, such as closer monitoring or limited services, and record its reasons for the supervisor. Blanket refusal of whole customer categories is not allowed. The bank must also tell the person that they may complain to the competent authority or an alternative dispute body.<\/p><\/div>

<\/svg><\/span>

Visa Merchant Data Standards Manual, October 2026<\/h3>

Gambling uses MCC 7995 and sits on the high-integrity-risk list for card-absent payments. Acquirers must prohibit agents from using dynamic descriptors for gambling merchants. You accept these conditions through your acquirer.<\/p><\/div>

<\/svg><\/span>

EU anti-money laundering regulation (AMLR), from 10 July 2027<\/h3>

Gambling providers fall under the regulation. Member States may exempt some gambling services as proven low risk, but not casinos and not providers whose principal activity is online gambling or sports betting. Plan for full obligations.<\/p><\/div><\/div>

<\/svg><\/span>
What this means<\/b>

The EBA texts bind EU credit and financial institutions and their supervisors. They do not give a company a right to an account, and the guidelines do not require a bank to give a business its reasons (consumers are covered separately by the Payment Accounts Directive). Their real use is as an argument: a bank that refuses a licensed operator without looking at its file departs from what its own regulator expects.<\/p><\/div><\/div><\/section>

What Visa asks of the acquirer, and so of you<\/h2>

The acquirer that takes gambling is itself supervised. That is why it is slow and picky, and why your file has to help it pass its own checks.<\/p>

<\/svg><\/span>

The acquirer needs its own approval<\/h3>

Under Visa\u2019s Integrity Risk Program, an acquirer must register as a high-integrity-risk acquirer before it solicits or processes for such merchants, and gambling needs a separate approval. It gives Visa a written attestation, passes a financial review and meets capital requirements.<\/p><\/div>

<\/svg><\/span>

The merchant registers too<\/h3>

The merchant is registered with Visa before submitting transactions, and the registration is updated when activity changes, for example new website addresses.<\/p><\/div>

<\/svg><\/span>

Enhanced due diligence on you<\/h3>

The acquirer reviews your control environment before onboarding, attests to Visa that you passed, and keeps monitoring to prevent illegal transactions.<\/p><\/div>

<\/svg><\/span>

Assessments and annual attestation<\/h3>

The acquirer runs an initial control assessment for the gambling category, repeats it periodically, performs an annual self-assessment and signs an annual attestation about its merchants.<\/p><\/div>

<\/svg><\/span>

Contract terms<\/h3>

The merchant agreement must require compliance with law and with Visa rules and give Visa the right to limit or end the agreement (Rule ID 0003356). Expect these clauses in your contract.<\/p><\/div><\/div>

<\/svg><\/span>
Note on the source<\/b>

The Visa document is dated 6 April 2023 and marked confidential, so details may have been updated since. Confirm the current requirements with your acquirer. Mastercard\u2019s rules are covered in the next section.<\/p><\/div><\/div><\/section>

What Mastercard asks<\/h2>

Mastercard is stricter about registration and about what happens when a merchant is reported. The source is its Security Rules and Procedures, Merchant Edition, 4 August 2026.<\/p>

<\/svg><\/span>

Registration before the first payment<\/h3>

Non-face-to-face gambling (MCC 7801, 7802 and 7995) falls under the Specialty Merchant Registration Program. The acquirer must register the merchant, with each website address, before acquiring, and must obtain and keep a copy of the merchant\u2019s licence from the licensing authority of each jurisdiction concerned and give it to Mastercard.<\/p><\/div>

<\/svg><\/span>

What the file contains<\/h3>

Names and addresses, owners with their tax numbers, a description of the services, payment procedures and cardholder disclosures, and any earlier business of the owners. By registering, the acquirer affirms that the activity runs only where it has confirmed it to be legal and that controls keep it out of prohibited jurisdictions.<\/p><\/div>

<\/svg><\/span>

Prior consent and fines<\/h3>

From 1 May 2026 an acquirer needs Mastercard\u2019s written consent for specialty merchant acquiring, and for the Europe region this applies from 1 October 2026 (with some countries earlier). Acquiring for an unregistered gambling merchant costs the acquirer up to USD 10,000, then USD 5,000 a month for up to three months and USD 25,000 a month after that.<\/p><\/div>

<\/svg><\/span>

BRAM investigations<\/h3>

Mastercard\u2019s Business Risk Assessment and Mitigation (BRAM) program investigates merchants reported for illegal or brand-damaging transactions, for example by law enforcement or complaints. The acquirer must answer in two business days for government cases and five for others, with a remediation plan, the merchant agreement, website addresses and monthly volumes. Assessments can reach USD 200,000 per merchant.<\/p><\/div><\/div>

<\/svg><\/span>
What this means<\/b>

Your acquirer has its own money at stake: a fine, a case and possible loss of permission. It will want every website address, a licence for each market and proof that you block prohibited ones. New domains or markets that the acquirer does not know about are a direct risk to your account.<\/p><\/div><\/div><\/section>

Need help with this topic?<\/b>

We will review your situation and propose a solution for your project.<\/p><\/div>Contact us<\/a><\/div>

How to build the structure<\/h2>

The details depend on your licence and markets, but the logic is the same.<\/p>

  1. <\/svg><\/span>

    Put gambling in one licensed entity<\/h3>

    The licence holder runs the gambling and receives the gambling payments. Other activities, such as software or marketing, sit in separate companies with their own contracts and codes. Visa asks for a separate code for other business lines anyway.<\/p>Start here<\/span><\/div><\/li>

  2. <\/svg><\/span>

    Draw the flow of funds on one page<\/h3>

    Where a player\u2019s money goes, who holds it at each step, how withdrawals come back and where fees are taken. Show which entity signs with which provider. Banks decline what they cannot picture.<\/p><\/div><\/li>

  3. <\/svg><\/span>

    Use more than one provider<\/h3>

    Two or three acquirers or payment institutions, and an account at a second bank. Losing a single partner should slow you down, not stop you. Keep an onboarding pack ready for each.<\/p><\/div><\/li>

  4. <\/svg><\/span>

    Keep player funds apart<\/h3>

    Hold player balances separately from operating money. Malta, for example, treats them as a separate patrimony and requires coverage at all times (see below). Check the rule in your own licence.<\/p><\/div><\/li>

  5. <\/svg><\/span>

    Fix the card setup<\/h3>

    MCC 7995, a fixed descriptor, the disclosures your acquirer requires and licence evidence for every market you serve. Block players from markets where you hold no licence.<\/p><\/div><\/li>

  6. <\/svg><\/span>

    Prepare the onboarding pack<\/h3>

    Licence, corporate chart with owners, AML and responsible gambling policies, risk assessment, list of markets, payment methods, affiliates and financial statements. See our article on responsible gambling and AML<\/a> for the policies and KYC and KYB for payment providers<\/a> for what providers ask of you.<\/p><\/div><\/li>

  7. <\/svg><\/span>

    Treat crypto separately<\/h3>

    Visa\u2019s manual says a ramp that buys crypto for gambling uses MCC 7995. For direct crypto acceptance, the regime is different and has its own checks.<\/p><\/div><\/li><\/ol><\/section>

    Player funds: what a regulator requires, using Malta as an example<\/h2>

    Banks like a flow they can follow. A licensing regime that ring-fences player money gives you one.<\/p>

    <\/svg><\/span>

    A separate patrimony<\/h3>

    Under Malta\u2019s Player Protection Directive (Directive 2 of 2018), player funds are a separate and distinct patrimony of the players, and the licensee\u2019s creditors have no claim on them (Art. 37).<\/p><\/div>

    <\/svg><\/span>

    Where the money sits<\/h3>

    Funds are held in a licensed credit, financial or payment institution, subject to the regulator\u2019s approval of the setup, in Malta, the EU or EEA or another approved jurisdiction (Arts. 31 and 33).<\/p><\/div>

    <\/svg><\/span>

    Coverage<\/h3>

    The balance, including funds in transit, must at least equal player credit balances, and at least 90% must sit in the player funds account. A shortfall is covered at once from the licensee\u2019s own funds (Art. 38).<\/p><\/div>

    <\/svg><\/span>

    Withdrawals<\/h3>

    Funds must be withdrawable at any time (Art. 31). Payout should be made within five working days where practicable, and the licensee may take reasonable time for checks. Withdrawals may be delayed for AML and fraud prevention (Arts. 29 and 30).<\/p><\/div><\/div>

    <\/svg><\/span>
    What this means<\/b>

    Whatever your licence, a bank or acquirer reads a ring-fenced player account with a clear coverage rule as lower risk than commingled money. Check the equivalent rule in your own licence conditions and the current version of the directive.<\/p><\/div><\/div><\/section>

    If you have already been refused<\/h2>

    Do not argue with the first no. Work out which kind it is.<\/p>

    1. <\/svg><\/span>

      Ask for the reason in writing<\/h3>

      Find out whether it is a category-wide policy or something in your file. An EU bank must at least tell you how to complain.<\/p>First step<\/span><\/div><\/li>

    2. <\/svg><\/span>

      Look for a fixable cause<\/h3>

      Wrong MCC, missing licence evidence for a market, unclear owners, a flow the bank cannot follow. These are fixed in days.<\/p><\/div><\/li>

    3. <\/svg><\/span>

      Reapply with a memo and your own risk profile<\/h3>

      Describe the model, the licence, the controls and the flow of funds. In the EU, ask the bank to assess your individual risk, as the EBA expects.<\/p><\/div><\/li>

    4. <\/svg><\/span>

      Escalate where it is justified<\/h3>

      For an EU bank, the competent authority or an alternative dispute body. For others, the complaints route your contract provides.<\/p><\/div><\/li>

    5. <\/svg><\/span>

      Move volumes while you still have time<\/h3>

      Agree a notice period and the settlement of balances, and bring the second provider live before the first one leaves.<\/p><\/div><\/li><\/ol>

      <\/svg><\/span>
      Avoid this<\/b>

      Do not spread volumes across hidden accounts or intermediaries after a refusal. Acquirers and banks treat that as a new red flag, and under Visa\u2019s rules gambling must stay visible as MCC 7995.<\/p><\/div><\/div><\/section>

      A typical situation<\/h2>

      An illustration, not a real client.<\/p>

      <\/svg><\/span>
      Situation<\/b>

      An operator with a Cura\u00e7ao licence takes cards through one acquirer, and all funds sit in one account opened by the parent company. The acquirer ends the contract on 30 days\u2019 notice.<\/p><\/div><\/div>

      <\/svg><\/span>
      Analysis<\/b>

      The new acquirer asks for the same documents again and finds that the account owner is not the licence holder. The flow of funds exists only in people\u2019s heads.<\/p><\/div><\/div>

      <\/svg><\/span>
      What we would do<\/b>

      Move the account to the licensed entity, prepare a one-page flow of funds, onboard a second acquirer in parallel and keep the pack current.<\/p><\/div><\/div><\/section>

      A bank refuses what it cannot picture. Show it the money flow on one page.<\/q>LegalBit team<\/cite><\/figure>

      Frequently asked questions<\/h2>
      Which merchant category code does gambling use?<\/summary>

      MCC 7995. Visa\u2019s manual requires it for online gambling even if gambling is not the merchant\u2019s main business, and a business with several lines gives the gambling line this code and the others their own. Loading a gambling wallet also takes MCC 7995.<\/p><\/details>

      Can a bank refuse the whole gambling sector?<\/summary>

      Banks generally choose their clients, and no company has a right to an account. But for EU banks the EBA expects individual assessment, not blanket refusal of a category, and a bank must document its reasons for its supervisor.<\/p><\/details>

      Does a gambling licence guarantee a bank account?<\/summary>

      No. A licence is the first document banks ask for, not the last. They also want the owners, the flow of funds, the AML policy and a view of your markets.<\/p><\/details>

      Can I process gambling through another company\u2019s account?<\/summary>

      Do not. Visa requires gambling to be coded MCC 7995, and processing it under another category or through a third party is the pattern that gets merchants terminated.<\/p><\/details>

      What changes when the AMLR applies?<\/summary>

      From 10 July 2027 gambling providers are covered by the regulation, and online gambling and sports betting providers cannot be exempted as low risk. Expect banks and providers to ask for more of your AML documents, not fewer.<\/p><\/details>

      Can I accept crypto instead of cards?<\/summary>

      You can, but it is a separate regime with its own checks, and card ramps that buy crypto for gambling are still classified as gambling by Visa. See our article on accepting crypto payments<\/a>.<\/p><\/details>

      Why does a gambling acquirer take weeks to onboard me?<\/summary>

      Under Visa\u2019s program the acquirer needs its own registration and a separate approval for gambling, performs enhanced due diligence on each merchant and attests to Visa that you passed. That process takes time and costs money, so complete files move faster.<\/p><\/details><\/div>

      See also: <\/b>Responsible gambling and AML for iGaming operators<\/a>; Online casino licence<\/a>; Illegal gambling through third-party card payments<\/a>; KYC and KYB for payment providers<\/a>; Accepting crypto payments<\/a>. Services: iGaming legal services<\/a>.<\/p>

      Sources<\/b>