UIGEA and Regulation GG: what federal law asks of gaming payments

The Unlawful Internet Gambling Enforcement Act (UIGEA) does not make any kind of gambling illegal by itself. It bars gambling businesses from knowingly accepting payments for internet gambling that is already unlawful under some other federal or state law, and its implementing rule, Regulation GG, requires banks, card networks and processors to keep written policies reasonably designed to identify and block, or otherwise prevent, those restricted transactions.

For a licensed operator, the practical effect is due diligence. Your bank or processor will ask for your license or a reasoned legal opinion, a written commitment to tell it if your legal authority changes, and an independent certification that your age and location controls keep play inside the law. This guide covers the statute, the rule, the exclusions, the Wire Act, and what it all means for your payment stack.

What UIGEA does and does not do

UIGEA was enacted on October 13, 2006, as Title VIII of the SAFE Port Act, and it is codified at 31 U.S.C. 5361-5367. The core prohibition is in section 5363: a person engaged in the business of betting or wagering may not knowingly accept, in connection with another person's participation in unlawful internet gambling, credit or the proceeds of credit, electronic fund transfers or money sent through a money transmitting business, checks and similar instruments, or the proceeds of other transactions the regulators designate. Violations carry criminal penalties of up to five years in prison.

What UIGEA does not do is decide which gambling is illegal. Its rule of construction says nothing in it alters, limits or extends any federal or state law or Tribal-State compact on gambling. Whether a bet is unlawful depends on the law where it is initiated, received or otherwise made. The Federal Reserve's examination guidance explains that variations among federal and state laws preclude a uniform definition of unlawful internet gambling, so the rule leans on due diligence rather than transaction-by-transaction legal calls.

The prohibition generally does not fall on payments companies, because the statute's definition of the business of betting or wagering excludes the activities of a financial transaction provider. Banks and processors have a different job: the policies and procedures that Regulation GG requires.

The definitions that do the work

A handful of defined terms carry most of the weight. Regulation GG repeats the statute's definitions and adds several of its own.

Two details matter for operators. First, the statute says the intermediate routing of electronic data does not determine where a bet is made, so a server or payment route in a legal state does not make a bet from a prohibited one lawful. Second, Regulation GG says a legal opinion that does nothing more than recite the facts and state a conclusion is not reasoned.

Who has to do what under Regulation GG

Regulation GG is a joint rule of the Federal Reserve Board and the Treasury, published in identical form at 12 CFR part 233 and 31 CFR part 132. The final rule was published in November 2008, and after a six-month extension, compliance became mandatory on June 1, 2010.

The rule designates five payment systems, then exempts most participants in four of them. In general, the participants left with obligations are those with the direct commercial customer relationship, since they can do the due diligence. Card systems are the exception: no card system participant is exempt.

Third-party processors have their own obligations, independent of their banks. The rule applies only to the US offices of participants, and every non-exempt participant must establish and implement written policies and procedures reasonably designed to identify and block, or otherwise prevent or prohibit, restricted transactions.

The card system approach: coding and monitoring

Card systems get special treatment because they already label every transaction. The Federal Reserve's guidance notes that they are the only designated system that commonly uses merchant and transaction coding able to flag suspect transactions during processing, so they are the only system where the rule contemplates blocking a transaction before it completes.

Regulation GG gives card system participants a safe harbor with two alternative routes. One is the due diligence approach used for the other systems. The other is a code system, such as transaction codes and merchant category codes, that must accompany each authorization request, with:

• The operational ability for the network or the issuer to identify and deny authorization for a transaction the coding indicates may be restricted
• Ongoing testing by the network of whether authorization requests are coded correctly
• Monitoring and analysis of payment patterns to detect suspicious payment volumes from a merchant

On top of either route, networks, acquirers and processors need procedures for when they have actual knowledge that a merchant has received restricted transactions, covering when to cut off card system access and when to close the merchant account. A participant may also rely on the network's written statement that its policies are designed to comply, unless its regulator tells it otherwise.

How the networks implement it

This is why gambling coding is so strict. Mastercard's US rules require issuers to block or decline e-commerce transactions coded 7995 or 9406 from US cardholders, and let them approve, one at a time, transactions from registered US merchants coded 7800, 7801 or 7802. Visa requires online gambling to be coded 7995 with a quasi-cash and online gambling indicator, with the US codes reserved for licensed merchants registered with Visa. Our guides to gambling MCC codes and to Visa and Mastercard gambling merchant rules cover the detail.

Due diligence at onboarding

For ACH, checks, wires and money transmitters, due diligence on commercial customers is the heart of the safe harbor, and card participants can use it too. The rule's example has three steps:

1. A risk-based review at account opening. The bank or processor conducts due diligence on the customer and its activities, scaled to its own judgment of the risk the business presents.
2. A minimal-risk determination. If the participant concludes the customer presents a minimal risk of being an internet gambling business, it needs no further documentation. Entities directly supervised by a federal functional regulator, and federal and state government bodies, can be deemed minimal risk. If it cannot reach that conclusion, it collects documentation: a certification that the customer is not an internet gambling business or, if it is one, the package below.
3. Notice to every commercial customer. All commercial customers are told, through the account agreement or otherwise, that restricted transactions may not be processed through the account.

For a customer that is an internet gambling business, the documentation is:

• Evidence of legal authority: a copy of the license that expressly authorizes the internet gambling business, issued by the appropriate state or tribal authority, or, if there is no such license, a reasoned legal opinion showing the business does not involve restricted transactions
• A written commitment to notify the bank or processor of any change in that legal authority
• A third-party certification that the customer's systems are reasonably designed to keep the business within licensed or otherwise lawful limits, including age and location verification

The same documentation applies when a participant learns that an existing customer has become an internet gambling business, so adding real-money play to an existing product works like a new onboarding. See our guide to KYC, age verification and geolocation for the controls a certifier will test.

Actual knowledge, liability and enforcement

Regulation GG is not a strict liability regime. The Federal Reserve's guidance says neither the Act nor the rule imposes strict liability for processing restricted transactions, and that UIGEA does not require financial institutions to go looking for information to build actual knowledge. Actual knowledge means a fact is known by, or brought to the attention of, an officer or the person responsible for compliance for that customer, and the guidance expects it to come from reliable information, such as notice from a government agency.

The statute also protects the decision to say no. A participant that blocks or refuses a transaction is not liable to any party if the transaction is restricted, if it reasonably believes it is, or if it acted in reliance on the payment system's policies. That protection covers only those three cases. UIGEA also requires that the rule itself not block transactions for the activity it excludes, such as authorized intrastate wagering.

Enforcement is split. The federal functional regulators enforce Regulation GG against the participants they supervise, and the Federal Trade Commission covers participants that no functional regulator oversees. The Attorney General and state attorneys general can seek injunctions against restricted transactions, but the statute limits those actions against financial transaction providers acting as such. An anti-circumvention section can still reach a provider with actual knowledge and control of bets that also operates, or is affiliated with, an unlawful gambling site.

Regulation GG does not change any obligation to file suspicious activity reports, and the Federal Reserve treats UIGEA compliance as separate from Bank Secrecy Act compliance. Our guide to AML for gaming operators covers the BSA side.

What is not covered: intrastate, intratribal and horseracing

UIGEA carves three kinds of activity out of unlawful internet gambling, and Regulation GG says nothing in it requires or suggests that payment systems should block transactions for them:

• Intrastate transactions. A bet initiated and received or otherwise made exclusively within one state, expressly authorized by and placed in accordance with that state's law, where the state's law or regulations include age and location verification reasonably designed to block minors and people outside the state, plus appropriate data security standards. The bet also must not violate the Interstate Horseracing Act, the federal sports betting statute known as PASPA, the Gambling Devices Transportation Act or the Indian Gaming Regulatory Act.
• Intratribal transactions. A bet made exclusively within the Indian lands of a single tribe, or between tribes' lands where intertribal gaming is authorized under the Indian Gaming Regulatory Act, expressly authorized by a tribal ordinance or resolution approved by the Chairman of the National Indian Gaming Commission and, for class III gaming, by the Tribal-State compact. The same age, location and data security requirements and the same four federal statutes apply.
• Interstate horseracing. Activity allowed under the Interstate Horseracing Act of 1978 is excluded, and the statute says it is not intended to change, or to resolve disagreements over, how that Act relates to other federal law.

Two points follow. The intrastate exclusion is what keeps state-licensed online sports betting and casino outside UIGEA, which is why geolocation sits at the center of US online wagering programs: a wager placed from outside the state is outside the exclusion. And PASPA, still named in the definition, was struck down by the Supreme Court in Murphy v. NCAA in 2018, the decision that freed states to authorize sports betting.

The fantasy sports carve-out and other exclusions

UIGEA's definition of a bet or wager excludes several categories outright: securities transactions, transactions on or subject to the rules of a registered entity or exempt board of trade under the Commodity Exchange Act, over-the-counter derivatives, insurance, indemnity and guarantee contracts, and deposits with insured depository institutions. It also excludes free-play games where participants risk nothing but their personal effort, their internet access, or points the sponsor hands out free that can only be used in the sponsor's own games.

The fantasy sports exclusion, as written in the statute, covers fantasy or simulation sports games and educational games or contests in which no fantasy team is based on the current membership of an actual amateur or professional team, and that meet three conditions:

1. All prizes and awards are established and made known to participants in advance, and their value does not depend on the number of participants or the amount of fees paid.
2. All winning outcomes reflect the relative knowledge and skill of the participants and are determined predominantly by accumulated statistical results of individuals' performance in multiple real-world events.
3. No winning outcome is based on the score, point spread or performance of any single real-world team or combination of teams, or solely on any single performance of an individual athlete in a single event.

A contest whose prizes scale with entries fails the first condition, and one whose winning outcome rests solely on one athlete's single performance fails the third. Even a contest that meets all three is excluded for UIGEA purposes only. The carve-out does not make it legal under state law, because the statute expressly leaves state gambling law untouched, and states have taken their own views. Our guide to daily fantasy and pick'em contests covers the state picture as of October 2026.

Where the Wire Act fits

UIGEA is a payments statute. The Wire Act, 18 U.S.C. 1084, is the older criminal statute that most directly governs interstate betting.

It prohibits a person in the business of betting or wagering from knowingly using a wire communication facility to transmit interstate or foreign bets or wagers, or information assisting in placing them, on any sporting event or contest, with penalties of up to two years in prison. It exempts information used in news reporting, and information that assists in placing bets when that information is sent from a state or foreign country where the betting is legal into one where it is also legal.

Its scope has moved. In 2011, the Justice Department's Office of Legal Counsel concluded the Wire Act reached only sports betting. In 2018, it reversed that view.

In 2021, the First Circuit held in New Hampshire Lottery Commission v. Rosen that the Wire Act's prohibitions apply only to sports wagering. That ruling binds federal courts in the First Circuit, so check with counsel on how the question stands where you operate.

For operators, the Wire Act and UIGEA point the same way: keep each wager inside a jurisdiction that authorizes it, and be able to prove it to your payment providers.

What this means for your payment stack

Federal law sets the floor, and network rules and bank policies build on it. A licensed operator should plan for the following:

• Have the evidence ready before you apply. Licenses for every jurisdiction you serve, and a reasoned legal opinion for anything not expressly licensed.
• Commission the controls certification early. An independent review of age and location verification is part of the Regulation GG package, and Mastercard asks for one at registration too.
• Read the account agreement as a real obligation. The clause prohibiting restricted transactions is the notice the rule requires.
• Get card coding right. Register under the correct US code where you qualify instead of accepting 7995 declines, and never ask for a code that hides what you do.
• Expect the same diligence on ACH. The bank originating your debits, and any processor acting for you, runs its own review. See our guide to ACH for gaming and betting.
• Remember withdrawals. Restricted transactions are payments a gambling business may not accept, but the definition of a bet or wager also covers instructions to move funds out of a betting account, so payout flows deserve the same controls; see our guide to paying out winnings.
• Report changes fast. New states, license conditions, suspensions and ownership changes can all trigger your commitment to notify.

The controls that keep you inside the intrastate exclusion also serve players: age verification keeps minors out, and the same account infrastructure supports the deposit limits and self-exclusion that responsible gambling rules require.

How Flux fits

Flux works with high-risk verticals deliberately and reviews gaming and betting businesses case by case. Approval depends on your licenses, where your players are, and your controls, and gaming and betting accounts are priced after underwriting. Each business gets a real underwriting review by people, not a category-level automated no. Not every business qualifies.

Subject to each card network's and regulator's rules for gambling, Flux accepts cards and ACH bank transfers; cards settle in 1-2 business days and ACH in 1-3 business days. Your KYC, age verification, geolocation and responsible gambling tools are yours to run, and we will ask how they work.

This article is general information, not legal advice, so confirm your obligations with counsel and your regulator. To talk about how your money moves, start at our gaming and betting hub or the complete guide to gaming payments, then apply or email sales@fluxpayments.com.