Skip to content

78 providers

Open the full catalog

iGaming Payment Compliance

An iGaming operator answers to the rules of its license and to the law of every country its players deposit from. Together they decide when KYC runs, which cards the cashier may take, how deposit limits count and when an affordability check fires.

Regulators now write their rules into the cashier. In the UK only a gross limit has counted as a deposit limit since September 30, 2026, and net deposits trigger the financial vulnerability check. Sweden banned every form of credit-funded gambling on May 1, 2026, and since October 8, 2026, the Dutch KSA has required the bank account a player pays from to carry every first name and the surname on the player's ID. Crypto cashiers answer to the FATF Travel Rule, to MiCA in the EU and, for US stablecoin acceptance, to the GENIUS Act. PSD3 and the PSR are not adopted yet, with the Parliament vote set for the plenary of December 14, 2026, and publication in early 2027 at the earliest.

€2,000
Malta deposits that trigger CDD
€1,000
German monthly deposit cap
£150
UK 30-day net deposit check trigger

iGaming Payment Compliance Requirements by Country

Pick a market to see when KYC runs, whether credit cards are allowed, which self-exclusion register applies and the main payment rule an operator has to build for.

Pick a market above to open its requirements.

Which Compliance Rules Apply to an iGaming Operator

  1. Rules that apply everywhere

    PCI DSS for card data and data protection law, with GDPR for EU players, whatever the license.

  2. Your license

    The conditions of the license you hold, from the UKGC, the MGA, the CGA, the GGL, the KSA or a US state regulator.

  3. Your players' countries

    The law where each player lives sets deposit limits, banned payment methods, KYC timing and the self-exclusion register.

  4. Your PSP

    Each PSP adds its own KYC, reserves and country restrictions through the merchant contract.

The layers stack. An MGA licensee that takes UK players also needs a UKGC license, and deposits from those players then run under UK rules, from the credit card ban to gross deposit limits.

PCI DSS Requirements for iGaming Operators

The card brands set an operator's PCI DSS level by its yearly card transaction count. The SAQ an operator files depends on how card data reaches the PSP, and a hosted payment page keeps card data off the operator's servers entirely.

PCI DSS Merchant Levels by Transaction Count

  • Level 1
    Card Transactions a Year
    Over 6 million
    Requirements
    On-site QSA audit and an annual Report on Compliance
  • Level 2
    Card Transactions a Year
    1 million to 6 million
    Requirements
    Annual SAQ and a quarterly scan
  • Level 3
    Card Transactions a Year
    20,000 to 1 million
    Requirements
    Annual SAQ and a quarterly scan
  • Level 4
    Card Transactions a Year
    Under 20,000
    Requirements
    Annual SAQ

Which PCI DSS SAQ Applies to an iGaming Operator

SAQ AShortest questionnaire

The PSP's hosted payment page collects all card data

Smallest PCI scope

SAQ A-EPLonger, and it covers your web servers

Your website affects the security of the card transaction

SAQ DEvery applicable PCI DSS requirement

You store, process or transmit card data yourself

KYC and AML Requirements for iGaming Operators

KYC timing for each market sits in the country cards above. The thresholds below decide when an operator moves a player from basic checks to customer due diligence, enhanced due diligence or an affordability check.

CDD, EDD and Affordability Check Triggers

In Malta, deposits of €2,000, single or cumulative, counted from account opening or over any 180 days, trigger CDD. The player cannot withdraw until it is complete, and the relationship ends if the documents are not in within 30 days.
From July 10, 2027, the EU AML Regulation sets CDD at €2,000 in stakes or winnings, linked transactions included, and no member state can exempt online gambling.
In the UK, £150 in net deposits over a rolling 30 days triggers the light-touch financial vulnerability check under LCCP 3.4.4, at that threshold since February 28, 2025.
In the UK, the stage-one Financial Risk Assessment starts at £5,000 in net deposits in a rolling 24 hours (£2,500 under 25). The UKGC confirmed the trigger on July 7, 2026, and it is rolling out in stages from the largest operators.
In Germany, raising the €1,000 monthly cap to €10,000 takes documentary proof of economic capacity, and a self-declaration does not count.
A player from a country on the FATF increased-monitoring list gets enhanced monitoring.
A politically exposed person needs senior management approval and ongoing monitoring.
Deposits withdrawn after little or no play go to suspicious activity review.

Which Countries Ban Credit Cards for Gambling

National bans run from Belgium in 2019 to Sweden, which on May 1, 2026, barred every form of credit-funded gambling, overdrafts and BNPL included. US rules split by state, from statutory bans in Massachusetts and Maine to New Jersey, which permits credit cards by regulation.

Belgium2019

Credit cards banned for online gambling. The Council of State upheld the ban and extended it to e-wallets topped up by credit card.

United Kingdom2020

Banned for all gambling since April 2020 under license condition 6.1.2, credit-funded wallet balances included.

Australia2024

Credit cards banned for online gambling since June 2024.

Brazil2025

Credit cards banned at licensed books from January 1, 2025. Every rail closed to betting on September 25, 2026.

Ireland2026

Credit cards banned for gambling from February 5, 2026.

Sweden2026

Credit cards, overdrafts, personal loans and BNPL barred from gambling since May 1, 2026.

How to Block Credit Cards at the Cashier

BIN-level blocking by player country

A card's BIN tells the PSP whether it is credit, debit or prepaid, so the gateway can decline credit BINs for each player country with a ban. A credit card from a UK, Irish or Swedish player is declined, while a German or Maltese player's goes through.

Credit-funded wallets count too

The UK ban follows the money, so a credit card tokenized in Apple Pay or Google Pay is still a credit card and a wallet balance funded by credit is still credit. Spelinspektionen's guidance of April 30, 2026, names credit-funded e-wallet balances as inside the Swedish ban.

Other ways to deposit

A player whose credit card is declined needs another way in. Debit cards, open banking and e-wallets funded from a bank account fill the gap.

Responsible Gambling Payment Controls by Market

  • Player-set deposit limits
    How It Works
    Daily, weekly and monthly limits the player chooses. UK limits count gross deposits since September 30, 2026.
    Required In
    UK, Malta, Sweden, Netherlands
  • Regulatory deposit cap
    How It Works
    €1,000 a calendar month across all licensed operators, enforced through LUGAS
    Required In
    Germany
  • Monthly deposit block
    How It Works
    Deposits stop at €700 in net deposits a month (€300 for young adults) until the player shows enough disposable income
    Required In
    Netherlands
  • Limit decrease
    How It Works
    Takes effect at once
    Required In
    UK, Malta, Netherlands
  • Limit increase wait
    How It Works
    24 hours in the UK and Malta, at least 72 hours in Sweden and at least 7 days in the Netherlands
    Required In
    UK, Malta, Sweden, Netherlands
  • Self-exclusion register
    How It Works
    GAMSTOP, Spelpaus, CRUKS, OASIS and Australia's national register, checked before play
    Required In
    UK, Sweden, Netherlands, Germany, Australia
  • Reality check
    How It Works
    Reminder of time played and money spent
    Required In
    UK
  • Financial vulnerability check
    How It Works
    Public-record check at £150 in net deposits over 30 days
    Required In
    UK

Operator vs PSP Compliance Responsibilities

You

What the Operator Owns

●KYC checks and record keeping
●AML monitoring and suspicious activity reports
●Deposit limit enforcement
●Self-exclusion register checks
●Affordability checks (UK)
●Responsible gambling controls
●LUGAS limit and activity checks (Germany)
●Telling players about their limits
●Audit trail and documentation

The license holder answers for every item here, even when a PSP tool does the work.

PSP

What the PSP Handles

●PCI DSS for its own infrastructure
●3DS authentication
●Its own fraud rules and screening
●Card BIN identification (credit or debit)
●Card data tokenization
●Settlement and reporting
●KYC tools, where the PSP sells them

iGaming Payment Compliance Checklist

Every Market

PCI DSS validation, at least SAQ A with a hosted payment page
TLS encryption on every payment page
No card data on your servers, with PSP tokenization in its place
Transaction logs with an audit trail, kept 5 years or longer
Privacy policy covering payment data, with GDPR for EU players
Published refund and cancellation policy
Statement descriptor that shows your brand

KYC and AML

KYC at the stage each market requires
Age verification before any gambling
Document flow for ID and proof of address
CDD and EDD triggers configured, with deposits linked across every channel
Documented suspicious activity reporting with a named MLRO
PEP and sanctions screening at onboarding and on an ongoing basis
KYC records kept at least 5 years after the relationship ends
Annual AML training for staff, documented

Responsible Gambling

Player-set daily, weekly and monthly deposit limits
Limit cuts that apply at once and increases that wait out the required period
Self-exclusion register checks
Reality check reminders
Affordability checks at the UK thresholds
Credit card bans enforced by player location

Market by Market

Credit card BIN blocking in every country and US state with a ban
Geofencing at US state borders
OASIS self-exclusion and LUGAS limit checks in Germany
CRUKS checks and the counter-account name match in the Netherlands
BankID and Spelpaus checks at registration and every login in Sweden
No offer to players in Brazil, where sports betting and online casino are banned
3DS and SCA on EEA card payments under PSD2

KYC, AML and Responsible Gambling Tools by PSP

Six payment providers that serve licensed operators get a grade from None to Advanced on KYC, AML, responsible gambling and credit card blocking. Trustly runs on open banking and takes no cards.

ProviderKYCAMLResponsible GamblingCredit Card Blocking
NuveiNuveiAdvancedGoodGoodAdvanced
AdyenAdyenAdvancedAdvancedGoodAdvanced
PaysafePaysafeGoodGoodGoodAdvanced
TrustlyTrustlyGoodBasicGoodNo cards
IXOPAYIXOPAYBasicGoodGoodAdvanced
WorldpayWorldpayGoodGoodBasicAdvanced
NoneBasicGoodAdvanced

8 Payment Compliance Mistakes That Lead to Fines

Verifying UK players only at withdrawal

UKGC rules require age and identity checks before a player can deposit, so every deposit from an unverified account breaks them.
Verify every player before the first deposit.

Taking credit cards where they are banned

Massachusetts fined DraftKings $450,000 in July 2025 for 1,160 credit-card-funded wagers it should have blocked.
Have the PSP decline credit BINs in every country and state with a ban.

Ignoring Germany's cross-operator cap

A player who goes past €1,000 in a calendar month across operators puts the GGL license at risk.
Check the LUGAS limit file before every deposit.

Counting deposits per channel instead of per player

The FIAU fined Stanleybet Malta €225,730 plus €2,000 a day on March 23, 2026, because its shops could not link one customer's deposits to spot the CDD threshold. Stanleybet is appealing.
Total each player's deposits across every channel against the €2,000 threshold.

Filing suspicious activity reports late or not at all

A missed or late report is an AML breach of its own, separate from the activity behind it.
Name an MLRO and file as soon as suspicion forms.

Thin affordability checks in the UK

The UKGC answers with license reviews and added license conditions.
Run the light-touch check at £150 in net deposits over 30 days and build for the £5,000 stage-one Financial Risk Assessment trigger.

No audit trail on payment decisions

The operator cannot prove compliance when the regulator asks.
Log every decision with a timestamp and the reason.

An unauthorized crypto processor for EU players

Since July 1, 2026, a processor without a MiCA CASP authorization or an Article 60 notification cannot lawfully serve EU clients.
Check the provider's legal entity on the ESMA register.

FAQ

Find a PSP That Serves Your License

Browse payment providers by the gambling licenses they serve and the regions they cover.

Browse Providers Fraud PreventionProcessing Guide