iGaming Payments Compliance Calendar
Every dated obligation that touches a gambling cashier, in one timeline: card-network programs, crypto licensing cliffs, market launches, AML enforcement. Law firms track their own practice areas and vendors track their own products; nobody keeps the payments view in one place. Each row links to our full breakdown, the way the compliance guide covers the standing rules.
The unit here is a date a payments team can put in a sprint plan. Regulatory mood music (consultations, ministerial hints, industry lobbying) stays off the calendar until it produces an effective date from a primary source; where a window is real but the day is not fixed, the row says TBC instead of pretending.
Read it in three passes: what is already binding and still generating operational work, what lands next quarter, and what belongs in the architecture roadmap rather than the current sprint. Filter by your regions and by the rule families that touch your stack.
- Dated entries tracked
- 36
- Regions covered
- 7
- Rule families
- 5
- Horizon
- 2026-2030
Upcoming deadlines
Dated obligations ahead, nearest first. Rows marked TBC are expected windows, not fixed dates; they firm up here as primary sources publish.
- US & CanadaLicensing & market access
Alberta opens to private operators
Canada's second open market after Ontario: 28 operators approved at launch under Alberta iGaming Corporation with AGLC oversight. Payment-rule detail is thin pre-launch; the Interac rails and the Gigadat-versus-Paramount question carry over from Ontario.
Interac for Canadian iGaming - US & CanadaCrypto
GENIUS Act: final stablecoin rules due from six agencies
The statutory 12-month deadline for OCC, FDIC, NCUA, Treasury, FinCEN and OFAC implementing regulations. Every rule is still an NPRM as the date approaches, so watch for final texts or slippage; the Act's own effective date runs off whichever lands later.
GENIUS Act for US cashiers - GlobalCard networks
Mastercard SMMP enforcement begins
Scam-flagged merchants go on a 72-hour investigation clock; a confirmed scam means immediate Mastercard termination with no fine tier and no grace. Refund-plus-chargeback ratios above 5% are among the published triggers, and merchants under six months of history get the strictest read.
Mastercard EFM and ECP breakdown - US & CanadaLicensing & market access
Maine: sweepstakes ban and online credit-card ban in force
Two laws land together (non-emergency statutes from the session that closed April 29): LD 2007 outlaws dual-currency sweeps with $10,000-$100,000 civil penalties, and LD 2080 bars credit cards for licensed online sports betting and iGaming. Early trade press said July 14; the legislature's own effective date is July 29.
- EUAML & enforcement
Sweden: Spelpaus verification rules tighten (SIFS 2026:3)
Real-time API checks against the self-exclusion register at every login and deposit. A Pay N Play stack gets the deposit-side check as a by-product of the bank-login flow; a card-first stack has to build it.
Pay N Play architecture - EUPayment railsdate not final
PSD3/PSR: Official Journal publication window
The April 2026 Council texts locked scope; the OJ stamp starts the clocks (PSD3 transposition 21 months from entry into force, PSR application on its own schedule). Impersonation-fraud refunds on the player's PSP and the open-banking API mandate both run off this date.
PSD3 and PSR for iGaming - EUAML & enforcementdate not final
AMLA: first direct-supervision selection round
The EU's new AML authority (operating from Frankfurt since January) is expected to pick its first directly supervised entities, and cross-border iGaming is a named target sector. Selection puts an operator's PSPs inside a new supervisory perimeter with fines up to 10% of turnover.
- BrazilPayment rails
Brazil: MP 1.355 conversion deadline
The provisional measure carrying the Pix Credito betting ban either converts into permanent law or lapses (it was extended 60 days). Either outcome changes the compliance basis for credit-linked instant payments in the cashier.
Brazil credit ban playbook - UKLicensing & market access
UK: RTS 12B phase 2, gross deposit limits mandatory
Only gross limits qualify from this date: withdrawals no longer reset the cap, which breaks the running-counter pattern in legacy deposit-limit subsystems. UKGC extended this from the originally planned June 30, so the migration window was a gift; the hard stop at limit is not negotiable.
RTS 12 migration playbook - OffshoreLicensing & market access
Curacao: B2C player-terms deadline
Every B2C licensee must have CGA-compliant player-facing terms uploaded: payout processing times, refunds, crypto specifics (lost wallets, sanctioned addresses, forks), dormant accounts. These are the cashier clauses acquirer underwriters read next.
Curacao payment access map - BrazilAML & enforcement
Brazil: virtual-asset reporting duty starts (BCB 569)
The virtual-asset category of the fraud data-sharing mandate goes live ahead of the December full-reporting date. Crypto rails serving Brazilian-facing books get their own reporting lane.
- US & CanadaLicensing & market accessdate not final
Oklahoma: sweepstakes veto-override vote expected
A veto-override attempt is expected in the November window. If it lands, Oklahoma joins the 2026 ban wave; watch processor exits ahead of any effective date.
- EUPayment rails
SEPA: structured-address mandate
Legacy free-text address formats in SEPA messages are rejected after this date. A payout file that still carries unstructured beneficiary addresses starts bouncing at the scheme layer, which surfaces as unexplained payout failures.
SEPA Instant payouts audit - BrazilAML & enforcement
Brazil: Fraud Marker reporting mandatory
Institutions must be implemented by November 30 and reporting unlicensed-betting indicators from December 1. Flags land on player counterparty accounts and on payment intermediaries alike, so a grey-book's Brazilian rails become visible to every participating institution.
LATAM payments map - OffshoreLicensing & market access
Curacao: critical B2B suppliers must be CGA-registered
End of the two-year LOK transition: licensees cannot buy critical services from unregistered suppliers after this date, and the registration duty can reach payment vendors. Local staffing enforcement follows on April 1, 2027, with detail still unpublished.
Curacao payment access map
Already in force, 2026 year-to-date
Binding since earlier this year. Kept on the calendar because the operational tail (migrations, ratio effects, enforcement) is still live.
- US & CanadaLicensing & market access
California AB 831: sweepstakes ban in force
Dual-currency sweepstakes casinos become unlawful, and the statute reaches the money: payment processors face criminal exposure up to $25,000 per violation. The first state law to put processors, not just operators, in the liability chain.
North America payments - GlobalCard networks
Visa VAMP: merchant Excessive threshold drops to 1.5%
Down from 2.2% in NA, Europe and AP (CEMEA stays at 2.2%). Fraud-coded disputes count twice (TC40 plus TC15), so a casino book where bet-regret disputes dominate reaches the line at roughly 0.75% real dispute rate.
Visa VAMP deep dive - GlobalCard networks
Visa CE 3.0 expands to non-disputed fraud reports
Qualified Compelling Evidence 3.0 remediation now also reaches TC40 fraud reports that never became chargebacks, taking them out of the VAMP ratio. A per-qualification fee applies from April 17. Casinos hold exactly the evidence CE 3.0 wants: login IDs, device IDs, deposit history.
CE 3.0 in the VAMP math - AsiaLicensing & market access
India: PROG Rules in force, OGAI payment gate live
Real-money online gaming is federally banned, and Rule 19 makes banks and payment intermediaries verify a game's Certificate of Registration before processing, then block flagged transactions on OGAI direction. Repeat violations carry up to 2 crore rupees and 3-5 years.
Asia payments map - EULicensing & market access
Sweden: total credit-funded gambling ban
Credit cards, overdrafts, personal loans and BNPL are all barred at licensed operators; only own-funds debit survives. The start moved from the proposed April 1 to May 1. First EU state to go this far, with fines up to 10% of revenue.
Credit-ban tracker - BrazilPayment rails
Brazil: Pix Credito banned for betting deposits (MP 1.355)
Article 16 bars financial institutions from extending credit operations tied directly to betting transfers, closing the credit-linked-Pix loophole left by the 2023 credit card ban. Bradesco and Banco do Brasil kept the feature live until mid-May. Conversion vote due September 14.
Brazil credit ban playbook - BrazilAML & enforcement
Brazil: illegal-betting indicators join BCB fraud data-sharing (Resolucao 569)
The central bank's fraud-marker system now covers signs of unlicensed betting operation, including financial and payment services rendered to unauthorized operators. Phased duties follow: virtual-asset category by October 30, mandatory reporting from December 1.
LATAM payments map - BrazilAML & enforcement
Brazil: 24-hour blocking orders and joint tax liability (Decreto 13.033 + Portaria 1.766)
On an SPA irregularity notice, banks and payment institutions must block an unlicensed operator's funds within 24 hours and confirm within 48. The June 17 Portaria adds joint tax liability for institutions that keep serving an operator after formal notification. The PSP now carries the illegal book's tax risk.
LATAM payments map - UKLicensing & market access
UK: RTS 12 phase 1, new deposit-limit definition live
The Annex 2 definitional change lands: deposit limits move to the gross model in regulation, ahead of the phase 2 systems mandate. Cashier and PSP webhook contracts feel this before players do.
RTS 12 migration playbook - EUCrypto
MiCA transitional cliff: unauthorized CASPs out of EU crypto
The eighteen-month grandfathering window closed with no extension. A crypto processor without a CASP authorization (or an Article 60 bank notification) can no longer lawfully serve EU clients; pending applicants can onboard nobody new. Check the register by legal entity, not brand.
MiCA register audit - US & CanadaLicensing & market access
Indiana: sweepstakes ban in force
Third state wave of 2026 after California and the late-2025 signings. The pattern that matters for payments: each new statute names the money chain, and processors keep exiting the vertical ahead of effective dates.
North America payments
2027 and beyond
The build-planning horizon: far enough out to architect for, dated enough to put in a roadmap.
- US & CanadaCryptodate not final
US: PPSI AML program requirements take effect
Per the April 2026 FinCEN/OFAC proposed rules, stablecoin-issuer AML and sanctions program duties take effect in January 2027. Still an NPRM timeline until final rules land, so treat as planning date, not law.
GENIUS Act for US cashiers - EUPayment rails
SEPA Instant: non-euro EU must receive
PSPs in Sweden, Denmark, Poland and the rest of the non-eurozone EU group must be reachable for SEPA Instant, with equality of charges applying in non-euro currencies. Reachability gaps in those corridors stop being an excuse.
SEPA Instant payouts audit - US & CanadaCrypto
GENIUS Act: effective-date floor
Section 20 makes the Act effective at the earlier of 18 months after enactment (this date) or 120 days after final rules. If rulemaking slips past mid-2026, this floor is what operators plan against.
GENIUS Act for US cashiers - OffshoreLicensing & market accessdate not final
Curacao: local key-person enforcement begins
The delayed local-substance mandate starts, with the detailed requirements still unpublished as of mid-2026. Watch CGA guidance through late 2026 before committing to a staffing structure.
Curacao payment access map - EULicensing & market access
Finland: licensed market opens
The Veikkaus monopoly ends for online casino and betting; applications have been open since March 2026 at a 22% GGR tax. A new regulated cashier perimeter in a Pay N Play heartland.
Europe payments map - EUPayment rails
SEPA Instant: non-euro EU must send
The sending mandate completes the non-eurozone rollout. Until then, instant-payout claims from Stockholm or Warsaw banks are voluntary products with patchy reachability.
SEPA Instant payouts audit - EUAML & enforcement
EU AML Regulation: anonymous prepaid squeeze
Acquirers are barred from accepting anonymous prepaid cards issued in third countries, and anonymous instruments generally tighten. Account-based voucher flows survive this world; purely anonymous ones do not.
Voucher payments hub - EUPayment rails
Netherlands: iDEAL decommissioned, Wero takes over
The rail carrying 50%+ of Dutch deposits changes name, not necessity: mandatory iDEAL-Wero co-branding since Q1 2026, consumer migration from Q4 2026, and the old scheme switches off end-2027. Cashier logos, statement descriptors and PSP contracts all touch this.
Europe payments map - US & CanadaCrypto
GENIUS Act: non-PPSI stablecoin prohibition (the USDT cliff)
Digital asset service providers can no longer offer or sell a stablecoin to US persons unless the issuer is a Permitted Payment Stablecoin Issuer. Unless Tether clears the foreign-issuer path, USDT drops off US-facing rails; treat USDT lines in any US integration as a dated feature.
GENIUS Act for US cashiers - GlobalAML & enforcement
FATF Recommendation 16: payment-transparency compliance deadline
The June 2025 update extends the Travel Rule's scope to fraud prevention and proliferation financing, with financial institutions required to comply by 2030. Expect PSPs to push for richer originator data fields from 2027-2029 as the deadline approaches.
FATF Travel Rule audit
Watch list: no date yet, real consequences
Items that will earn a dated row the moment a primary source fixes one.
Malta Article 56A / CJEU C-683/24
The Commission's infringement procedure over Bill 55 (June 2025 formal notice) is paused in practice while the Court decides C-683/24; the Advocate General opined in April 2026 and a ruling is expected late 2026 to early 2027. If Article 56A falls, refund-claim exposure for MGA books on German and Austrian players lands back in chargeback and acquirer-risk territory.
Visa VAMP: next threshold move
No further threshold change is announced after April 2026. The ratio to actually watch is your own: fraud-coded double counting means the effective tolerance for a casino book is roughly half the printed line.
Visa VAMP deep diveUS sweepstakes wave, next states
Bills naming payment processors keep moving (New York's signed processor-liability statute, Tennessee, Louisiana, Minnesota). Effective dates get added here once they are verifiable from the legislatures rather than trade press.
How we maintain this
Dates come from primary sources: regulator publications, legislature records, card-network and acquirer bulletins, the Federal Register and the EU Official Journal. Trade-press dates get re-verified before they earn a row, because they drift; two entries on this page (Sweden's credit ban and Maine's effective date) had wrong dates circulating in industry coverage until we checked the legislature's own records.
The calendar is a by-product of the research behind our articles, so it updates whenever the underlying pieces do: rows move from upcoming to in-force by hand at each refresh, TBC rows get real dates when primary sources publish, and new obligations get added the day we verify them. The visible "Updated" date above reflects the last substantive pass, and it is the same date our sitemap and structured data carry, not a decorative timestamp.
Spot a payments deadline we are missing? Tell us and include the primary source; that is the fastest way onto the page. And treat all of this as research rather than legal advice: confirm anything load-bearing with counsel before you commit a build or a contract to it.
FAQ
The dated ones: Mastercard SMMP enforcement July 24 (72-hour scam investigations, termination with no fine tier), Maine's sweepstakes and online credit-card bans July 29, Sweden's tightened Spelpaus verification August 1, Brazil's MP 1.355 conversion vote September 14, UK RTS 12B gross deposit limits September 30, Curacao's B2C terms deadline October 8 and B2B supplier registration December 24, the SEPA structured-address mandate November 15, and Brazil's mandatory Fraud Marker reporting December 1. AMLA's first direct-supervision selections are expected in Q3 without a fixed date.
Three 2026 changes work as one system. Visa VAMP's merchant threshold fell to 1.5% on April 1, and fraud-coded disputes count twice, so a casino's effective tolerance is roughly 0.75%. CE 3.0's April 18 expansion is the subtraction lever: qualified evidence takes disputes, and now undisputed TC40s, out of that ratio. Mastercard SMMP starts enforcing July 24 with a different shape entirely: no ratio glide path, just a 72-hour investigation and termination if the scam flag sticks.
EU and US clocks run separately. MiCA's transitional period ended July 1, 2026: a crypto processor without CASP authorization can no longer lawfully serve EU clients. The US GENIUS Act cascade runs longer: final agency rules were due July 18, 2026, the Act's effective-date floor is January 18, 2027, and the prohibition on non-PPSI stablecoins (the USDT cliff for US-facing rails) lands July 18, 2028.
Every row comes from a primary source (regulator publications, legislature records, network bulletins, the Federal Register) verified during the research behind our articles, and most rows link to the full breakdown. Rows move between sections manually when we refresh the underlying article, so the page never auto-claims a deadline passed that actually slipped. Expected-but-unfixed dates carry a TBC flag instead of a guessed day.
No. It is independent research built for payments and compliance teams to plan against, with sources one click away. Effective dates change, transitional guidance gets issued, and jurisdictions differ in how they enforce, so confirm anything load-bearing with counsel and the primary source before you commit a build or a contract to it.
The rules behind the dates
The calendar tells you when. The compliance guide and the network-program deep dives tell you what to build.