Sweepstakes Casino Payments: The Processors Are Now the Target

The sweepstakes casino model was, before anything else, a payments arbitrage. A player's card purchase bought Gold Coins, a virtual currency with no cash value, so the transaction processed as a digital-goods sale rather than a wager: mainstream MCC, mainstream acquirer, mainstream approval rates, none of the gambling surcharges. The free Sweeps Coins that arrived alongside, redeemable for cash prizes, carried the actual gambling economics. For a decade that split kept a multibillion-dollar casino vertical running on e-commerce rails that a licensed casino could only envy.

Seven states now have dual-currency bans in force or dated through this month, Oklahoma's follows in November, and Louisiana and Tennessee enacted theirs this year; the newest statutes do something the first wave did not, which is write the payment chain into the text. California created criminal exposure for payment processors. New York banned financial institutions, processors, geolocation providers and content suppliers from supporting the games at all. Maine wrote Sweeps Coins into its gambling definition as indirect consideration and, in a separate law taking effect the same day, barred credit cards from its licensed online books for good measure. This article reads the wave the way an acquirer's risk committee does: what the coding fiction was, which statutes reach the money and how hard, and what deposit stacks at the surviving operators are shifting toward.

The dual-currency cashier, as a payments object

Strip the marketing and a sweepstakes cashier is two flows wearing one interface. The purchase flow sells Gold Coins for dollars, by card, and settles to the operator like any game-credits sale; because Gold Coins cannot be cashed out, the industry position was that no bet had been placed, no gambling service sold, and therefore no gambling merchant category applied. The redemption flow moves the other way, converting Sweeps Coins winnings into cash prizes paid out by ACH, gift card or check, structured as sweepstakes prize fulfillment rather than casino withdrawal.

Every advantage the model enjoyed lived in that classification gap. Card-not-present gambling runs under MCC 7995 with issuer declines, 30-40% failure rates, scheme registration fees and acquirer reserves; digital goods run clean. Chargebacks on a Gold Coin purchase argued like a game-credits dispute, not a gambling dispute. And the operator never needed the one thing a real-money cashier cannot function without, a gambling license, because on paper there was no gambling to license.

The legal theory holding that structure up was always the same sentence: the purchase is not consideration for the chance to win. The 2025-26 statutes attack that sentence. Maine's LD 2007 is the bluntest, treating Sweeps Coins received with a purchase as indirect consideration, which makes the whole loop gambling under state law. Once a state makes that move, the payments consequence follows mechanically: the Gold Coin purchase stops being a digital-goods sale in that state and becomes an unlicensed gambling transaction that has been processing under the wrong merchant category the entire time.

Twelve months of statutes: the map an acquirer reads

The sequence matters more than the count, because each generation of statute reached further into the payment chain than the last.

What the statutes say about the money, specifically

Read as payments law rather than gambling law, the wave splits into three generations.

The first generation (Montana, Connecticut) bans the operator's conduct and stops there. A processor's exposure in those states is derivative: it is handling proceeds of a now-explicitly-illegal business, with everything that implies for BSA programs and acquirer underwriting, but the statute does not address it.

The second generation names the support chain. California's AB 831 is the pivot, because it attaches criminal liability, up to $25,000 per violation, to the entities that keep a prohibited sweepstakes running, payment processing included. A processor's compliance question in California stopped being reputational and became penal. New York went wider in scope if not in criminal form: S5935A's list runs from financial institutions through processors, geolocation vendors, content suppliers and media affiliates, with $10,000-$100,000 per violation, and it took effect the day it was signed. New York wrote down, in statute, the full vendor stack of a sweepstakes casino and told every layer of it to stop.

The third front is not legislative at all. Baltimore's March suit runs on a municipal consumer-protection ordinance against six operators, and its theory (illegal gambling disguised as free games) does not depend on any new state law. For a payments company the lesson is uncomfortable: the absence of a ban statute in a given state no longer means the absence of enforcement risk in that state.

Maine's second law deserves its own sentence, because it is a different instrument entirely. LD 2080 does not touch sweepstakes; it bars credit cards at Maine's licensed online sportsbooks and iGaming operators, with the regulator required to enforce card-type rejection across every channel. A state that just reclassified sweeps purchases as gambling consideration simultaneously decided that even lawful online gambling should not run on borrowed money. Operators watching only the sweeps column will miss that the credit-card perimeter is tightening on the licensed side too.

The processor's exposure, in order of arrival

For an acquirer or PSP with sweepstakes merchants in the portfolio, the risk stack now has four layers, and they arrive in a specific order.

Statutory liability arrives first and is the easiest to price: it exists in California and New York today, at $25,000 criminal and $10,000-$100,000 civil per violation respectively, and each additional state that copies the AB 831 pattern adds a jurisdiction where processing itself is the offense. Geoblocking the enacted states is the obvious control, and it inherits all the ordinary weaknesses of IP-based geolocation on a card transaction, which is why the New York statute's inclusion of geolocation providers in the banned-support list is more pointed than it first looks.

Reclassification risk arrives second. The moment a state defines the Gold Coin purchase as gambling consideration, the years of volume already processed in that state were, retroactively in substance if not in law, gambling transactions coded as digital goods. Card-scheme rules treat unlicensed gambling and miscoded gambling as termination-grade findings; the exit route is a MATCH listing under reason code 05, which follows the merchant's principals for five years and, in practice, follows the acquirer's audit file too. An acquirer that knew the vertical and kept coding it as e-commerce has a scheme-compliance conversation coming that no state statute is needed to trigger.

Underwriting contraction arrives third and is already visible: the documented pattern through 2025-26 is card rails withdrawing from the vertical and cashiers refilling with ACH, pay-by-bank and prepaid, the methods whose rails do not pass through a card scheme's rulebook. That substitution solves the scheme problem while concentrating a different one, because the replacement rails settle irrevocably and dispute weakly, which moves consumer-protection pressure from chargebacks to attorneys general, the pressure Baltimore's suit demonstrates.

Reputational contagion arrives last but prices worst: a processor named in one state's enforcement action becomes a discovery target everywhere else it processed the same merchant. The Baltimore complaint names operators, not vendors, but civil discovery in six-defendant litigation reads payment flows as a matter of course.

What the surviving cashiers actually run

We track which providers in our catalog touch this vertical, and the honest finding is how short that list is. Coinflow Labs is the clearest case: its model takes cards and ACH on the way in and settles the operator in USDC with full chargeback indemnification, built explicitly for US sweepstakes and prediction books, with named clients in the adjacent pick'em and prediction segment. Aeropay sits one risk class over, running pay-by-bank for regulated US gaming (PrizePicks, Kalshi and the DFS cohort) rather than sweeps casinos proper, and its presence in that neighborhood is the shape of where deposit stacks are heading: bank rails, operator-facing APIs, no card scheme in the loop.

Beyond those, verification gets thin fast, and the thinness is the finding. Vendor guides circulate tier-1 acquirer names as sweeps-friendly; none of those names publish a sweepstakes acceptance policy, and we do not publish other people's client lists as fact. What the model itself dictates is better ground: the purchase side was built for card rails and is refilling with bank-transfer and prepaid options as card appetite withdraws, while the redemption side runs ACH, gift card and check as prize fulfillment. Every statute that converts Sweeps Coins into consideration converts that redemption flow into a gambling payout with none of the payout controls a licensed book is required to run: no segregated player funds, no verified-name matching mandate, no regulator watching settlement times.

That last asymmetry is the quiet one. Licensed operators spend heavily making withdrawals fast, verified and auditable because the license demands it. A sweeps redemption is a sweepstakes prize in legal clothing, and in the states that have now reclassified the model, it becomes an unlicensed gambling payout the moment the statute bites, with the payments vendor that moved it standing closest to the paper trail.

The operator playbook until the map settles

For operators staying in the vertical, the work is unglamorous and mostly subtractive. State-by-state exit has to run off verified effective dates rather than trade-press estimates, because turning off a state three weeks late is exactly the fact pattern an AB 831 prosecution or an S5935A penalty letter wants; the compliance calendar tracks the enacted dates with primary sources. Payment segregation comes next: sweeps volume mixed into a MID that also carries lawful digital-goods traffic converts a state-level problem into a portfolio-level one the day an acquirer re-reviews the account. Descriptor and coding honesty is the conversation nobody wants and everybody needs, because the acquirer that hears the real classification risk from the merchant prices it, while the acquirer that finds it in an enforcement filing terminates it.

And the redemption flow deserves the same engineering a licensed payout gets, voluntarily: verified-name payouts, source-of-funds records, settlement logs. Not because a sweepstakes statute requires it, but because every legal theory now in play, from Maine's indirect consideration to Baltimore's consumer-protection claims, ends with someone reconstructing where the money went, and the operator whose payout records look like a licensed book's fares differently in that reconstruction than the one whose records look like a promotions department's.

The direction of the map is not ambiguous. Eight states in fourteen months, each statute reaching deeper into the payment stack than the last, municipal plaintiffs filling the gaps between legislatures, and the two largest US card-acceptance questions (who codes this, and who carries it when the coding is wrong) now sitting on acquirer risk committees with statutory citations attached. The dual-currency model was a payments arbitrage before it was anything else. The arbitrage is what the states came for.