iGaming Acquirer Underwriting 2026: Files That Win, What Kills It

An MGA license does not guarantee a merchant account. Acquirers decline iGaming applications on the chargeback ratio in the processing statements, a MATCH listing on a director, or a license they do not underwrite, and an operator with a clean license can fail on any of the three. All three sit in the file the operator submits, which means the decline can be seen coming before the application goes in.

iGaming merchant account underwriting documents

The underwriting kit is the package an operator submits with the merchant application. An acquirer asks an iGaming operator for a fixed set of files and reads them in a fixed order.

These are the files, ranked by the weight each carries in the underwriting decision:

1. Merchant processing statements for the last 6 months from the current processor, full pages, every month. The floor any reputable acquirer accepts is 3 months. The 6-month mark matters because Section 7.2.1 of Mastercard's August 2026 Security Rules and Procedures applies extra scam-monitoring triggers until a merchant has more than 6 months of Mastercard acceptance history. Refunds plus chargebacks above 5 percent of at least 500 purchases in a rolling 30 days trip an investigation, and so do fraud reports coded 56 from two issuers. A new book with no processing history carries a different risk profile from an established book with 6 clean months, and the underwriter prices it differently from the first read.
2. Operating bank statements for the last 3 to 6 months, business and personal, with full account and routing numbers. Cash-flow stability and reserve-coverage math come from these.
3. The gambling license document itself, plus the original Memorandum and Articles of Association, certificate of incorporation, and the shareholder register.
4. KYC/KYB program documentation including UBO identification, source-of-funds escalation rules, sanctions and PEP screening configuration, transaction monitoring thresholds, and SAR escalation flow. The acquirer reads it to confirm the operator is not the weak AML link in the payment chain.
5. Traffic source and affiliate disclosure. Acquirers want explicit visibility into acquisition channels because affiliate-driven traffic patterns are a reliable predictor of dispute volume.
6. Website compliance: terms and conditions, privacy policy, refund and payout policy, AML and responsible-gambling policy, complaints handling. The acquirer checks each one at a working URL on the live site, and a draft PDF does not count.
7. Financial statements and projections (cash flow, balance sheet, income statement) plus working-capital evidence sufficient to cover rolling reserves for at least the first 6 months.
8. Refund and chargeback handling SOPs, with the customer service flow that backs them.

Most of these eight categories pass or fail on a yes/no basis. One file is read in detail, and it decides whether a human underwriter ever opens the rest of the kit.

What acquirers check in iGaming processing statements

The acquirer takes four numbers from the processing statements: the trailing chargeback ratio, the volume trend, the issuer-level decline rate and the refund-to-deposit ratio. Each one is computed against a set denominator and read against a set threshold. Together they decide whether the application moves from the queue to a human underwriter or is declined on the statements alone.

The chargeback ratio carries the most weight of the four. On the Visa side the numerator combines TC40 fraud reports and TC15 chargebacks, and the denominator is the count of settled card-not-present transactions in the same monitoring window, so authorization declines never enter it. The underwriter reads the trailing 6-month ratio first and then each month inside it, because VAMP measures monthly and one bad month can trigger an identification even when the 6-month average looks clean.

The volume trend tells the underwriter whether the operator is growing into the application or out of it. A declining volume reads as the prior acquirer tightening risk on the merchant ahead of a termination. A spiking volume reads as an operator that has outgrown the prior relationship and needs more capacity.

The issuer-level decline rate shows how much approval-rate uplift the new acquirer can offer. A high concentration of declines on specific BINs points to issuer-side flags that follow the merchant to any acquirer, which limits what the new acquirer can fix and goes into the price of the offer.

The refund-to-deposit ratio is the check on the chargeback ratio. Some operators refund disputes preemptively to keep the chargeback count down, and heavy refund volume can hold the ratio low artificially. The underwriter sets refunds against the dispute count to see whether the merchant runs a low chargeback rate or buys it with refund spend.

Chargeback ratio limits for iGaming merchant accounts

Acquirers decline iGaming books well below the merchant thresholds of the Visa and Mastercard monitoring programs.

Visa's Acquirer Monitoring Program cut the merchant Excessive ratio from 2.2 percent to 1.5 percent on April 1, 2026, with a floor of 1,500 fraud and dispute items a month. Visa bills the acquirer $8 per item for an Excessive merchant. The program has no merchant tier below Excessive, and a first identification in a rolling 12-month window carries a 3-month grace period. Acquirer portfolios are flagged Above Standard at 0.5 percent and Excessive at 0.7 percent, both unchanged in April 2026. The full program math, including the double count and the exclusions, is in our VAMP deep dive. Mastercard's Excessive Chargeback Program has identified an Excessive Chargeback Merchant at 1.5 percent and 100 chargebacks in the same month since April 2020.

Acquirer risk teams price iGaming portfolios against Visa's 0.5 and 0.7 percent acquirer thresholds, and a merchant running anywhere near the 1.5 percent merchant line uses up a disproportionate share of the acquirer's headroom under them. That is why acquirers set the rejection line for MCC 7995 books in the sub-1 percent band. The exact cutoff depends on portfolio composition, the acquirer's existing iGaming exposure and the month-to-month variance in the operator's last 6 months. The levers that bring the ratio down (cascading, retries keyed to decline codes, network tokens) are in the card approval and soft-decline playbook.

Underwriting stops at three points. First, a 6-month rolling chargeback ratio above the acquirer's internal cutoff gets the file declined on the processing statements alone. Second, any single month above 1.5 percent inside the trailing 6 months gets flagged even when the average sits under the cutoff. Third, when a director or UBO is on a current MATCH listing, mainstream acquirers decline the file before anyone reads the chargeback math, and only specialist high-risk acquirers price a listed merchant.

How a MATCH listing affects an iGaming application

MATCH, short for Mastercard Alert To Control High-risk Merchants and still called TMF (Terminated Merchant File) in the trade, is the Mastercard database of merchants whose acquirers terminated them for cause. Mastercard requires every acquirer with merchant activity to query it before signing a merchant, and a listing stays in the system for 5 years. The rules allow an acquirer to onboard a listed merchant. The decline is the acquirer's own risk call, and mainstream acquirers make it on a current listing against the operator entity or any director in the kit.

The August 4, 2026 edition of Mastercard's Security Rules and Procedures keeps the eleven reason codes of the February 2026 edition unchanged, and our MATCH list guide reads that edition in full, including the rights a listed merchant holds under the rulebook. Three codes matter most for a gambling application:

• Code 04, Excessive Chargebacks. The prior acquirer terminated the merchant for chargebacks above 1.5 percent of sales over the previous 3 months, totaling at least $5,000. That bar sits below the Excessive Chargeback Merchant floor of 100 chargebacks a month, so an acquirer can list a book Mastercard's chargeback program never identified. A book that reapplies under a new entity after a bad chargeback season carries this code.
• Code 10, Violation of Standards. It is the broad code and covers the accuracy of the transaction data the merchant controls, the MCC included. A casino coded as digital goods or running on an e-commerce descriptor gets this code when the acquirer terminates it.
• Code 13, Illegal Transactions. The prior acquirer found the merchant processing transactions that are illegal where the cardholder lives. The common iGaming case is an offshore-licensed book taking US deposits without geo-IP blocking.

Two more details shape the underwriter's read. First, the listing follows the principals into any new company. A listing carries up to five principal owners and matches them on exact and phonetic logic, so an operator who closed Curaçao Co. A after a termination and applied as Curaçao Co. B with the same UBO surfaces in the search. Second, Mastercard removes a listing early in only two cases, when the listing acquirer reports it was filed in error or when the merchant validates PCI compliance after a code 12 (PCI DSS Noncompliance) listing. Every other listing, Excessive Chargebacks included, runs the full 5 years.

Which acquirers take MGA, UKGC, Curaçao and Anjouan licenses

The license decides which acquirers will look at the application at all, before the documents or the ratios come into play.

MGA (Malta). Worldpay, Nuvei, Paysafe and Adyen underwrite MGA-licensed books at production volume, and the orchestrator IXOPAY routes MGA traffic to acquirers without jurisdictional caveats. The MGA's Player Protection Directive requires the player-funds account to cover every player balance at all times and makes the operator top up any shortfall from its own money right away, which matches the segregation European acquirers want to see anyway. The friction sits in the operator's KYC and KYB program, which acquirers check against MGA AML standards and the FIAU's published guidance.

UKGC (United Kingdom). The same five names serve UKGC licensees, and Worldpay, Nuvei, Paysafe and IXOPAY each run a dedicated gaming vertical team. UKGC license condition 4.1.1 governs how the operator segregates player money from its own funds. Under LCCP 4.2.1 the operator rates the insolvency protection of player funds (not protected with no segregation, not protected with segregated customer funds, medium protection or high protection) and discloses the rating to players. Since October 31, 2025, an operator rated not protected must remind each player every 6 months that the funds are unprotected, state the balance held and get an acknowledgment before the player can gamble again. Both duties sit with the operator, and the acquirer reads the segregation arrangement and the protection rating in the kit.

Curaçao. The LOK took effect on December 24, 2024, and replaced the master-license system with licenses the Curaçao Gaming Authority issues directly. The CGA publishes a status for every online gaming license it has issued, and on October 9, 2026, it had 666 licenses on record: 209 granted for an indefinite period, 289 under assessment, 60 provisional licenses inside their 6-month term, 58 expired and 50 revoked at the operator's request. The CGA issued 163 of the indefinite licenses on December 24, 2025, the last day of the transition. It has also revoked 31 licenses on its own initiative and refused to extend one. The status tells the underwriter how far the CGA's review has gone, since an indefinite license has passed the full review and a license under assessment has not.

A direct CGA license reads better to an acquirer than a legacy sub-license did, because the CGA's fit-and-proper, AML and responsible-gambling controls now sit closer to the MGA's. An operator that carried a sub-license book into the new regime still faces two risks. Terminations from the master-license era surface against its directors, and the acquirers that pulled out of Curaçao volume in 2023 and 2024 have not all returned.

Worldpay and Nuvei underwrite CGA-direct applications on their own merits when the kit is clean, with high-risk onboarding of 4 to 6 weeks at Worldpay and 2 to 4 weeks at Nuvei. Paysafe takes them case by case, anchored to an existing Skrill, Neteller or paysafecard relationship. On the crypto side, NOWPayments, CoinPayments and Finassets serve Curaçao licensees. CoinsPaid, which carried Curaçao volume through the master-license era, has restricted its activities while Estonia's financial regulator decides on its CASP application, so a new book cannot open with it. The Curaçao and Anjouan payment access map covers both licenses rail by rail.

Anjouan. The Anjouan Offshore Finance Authority (AOFA) registers companies and issues gambling licenses, but an Anjouan-only book has no card-acquiring path. NOWPayments, CoinPayments and Finassets take Anjouan-licensed operators on crypto rails too, and the orchestrator Praxis Tech routes Anjouan volume to the PSPs it connects, depending on the operator. An operator that holds Anjouan alongside a CGA or MGA license applies to the acquirer with the second license, and the acquirer underwrites only the entity that holds it.

Four inputs decide an iGaming acquirer application: the completeness of the kit, the chargeback ratio in the processing statements, the MATCH status of the principals and whether the acquirer underwrites the license. Three of them cannot be fixed quickly. A current MATCH listing runs 5 years, a bad chargeback history takes 6 clean months of statements to replace, and an Anjouan-only license has no card acquirer at all. The kit is the one input the operator controls in the week before submission, and an operator who sends the same package a retail e-commerce merchant would send gets declined on the first read. What happens after approval, from transaction flows to cost structure and the metrics a live stack is judged on, is covered in the iGaming payment processing guide.