KYC, age checks, and geolocation: what gaming underwriters expect

Gaming underwriters expect you to prove three things about every player account: that you know who the player is, that the player meets the minimum age for that product in that state, and that the player is physically somewhere the wager is legal when it is placed. They want to see how you prove it, not just hear that you do: the vendors you use, the rules you set, the logs you keep, and what happens when a check fails.

This guide walks through each layer of that stack the way a payments underwriter reviews it. It covers what state rules require at account opening, the minimum ages we could confirm in state law as of October 2026, how geolocation requirements are written, and the documentation that shortens a review. If you are new to how gaming accounts get underwritten, start with our complete guide to gaming and betting payment processing.

Why a payment processor cares about your compliance stack

A processor is not your gaming regulator, but it inherits your risk. Card network rules expect acquirers to confirm that a gambling merchant can legally accept wagers from the players it serves, and the most direct evidence of that is proof you only take money from verified adults located in states where you are licensed. Our post on Visa and Mastercard rules for gambling merchants covers the network side.

There is also a plain loss argument. An account opened with a stolen identity becomes a fraud chargeback when the real cardholder sees the statement. A minor who gets through becomes a refund demand from a parent. A player who bets from across a state line is a regulatory problem for you and a reputational one for everyone in the payment chain.

The federal government sees the same risk. Treasury's 2026 National Money Laundering Risk Assessment says misuse of licensed online sports betting platforms using stolen personal information remains a major risk, and it describes a case in which stolen identities were used to open a sportsbook account, deposit criminal proceeds, and withdraw them. Identity checks at the front door are the first control against that pattern.

What underwriters ask to see

Every processor has its own questionnaire, but the substance is consistent. Expect questions about each control below, and expect to be asked for proof rather than a description.

None of this is unusual for a licensed operator, because your regulator has already asked most of the same questions. The fastest reviews come from operators who hand over the packet they prepared for licensing, updated to show how payments actually flow.

KYC at account opening: what states actually require

State gaming rules set the floor for player identity checks, and they are more specific than many founders expect. New Jersey's internet gaming regulations (N.J.A.C. 13:69O) require a casino licensee to build an electronic patron file before play that includes the player's legal name, date of birth, address, email address, phone number, and the entire or last four digits of the Social Security number if voluntarily provided. The file must also record the method used to verify identity and the date of verification.

New Jersey allows identity to be verified against a government-issued credential or through remote multi-sourced authentication approved by the regulator. Tennessee's sports gaming rules (Tenn. Comp. R. & Regs. 1350-01-.08) require a licensee to verify a player's identity before the account is established, including a date of birth verified as an exact match. Other states word the requirement differently, but the pattern holds: verify before the player can deposit or wager, record how you did it, and keep the record.

If your business is a casino or card club covered by the Bank Secrecy Act, federal recordkeeping adds a layer. Under 31 CFR 1021.410, a covered casino must secure and keep the name, permanent address, and Social Security number of the person involved in each deposit of funds or account opened, and verify the name and address at that time. Our guide to AML duties for gaming operators explains who that rule reaches.

Step-up checks

Most operators run a database match first and escalate when it fails or when risk rises. Typical step-up points include a failed or partial database match, a large first deposit, a new payment method, and the first withdrawal. Escalation usually means a document check with a selfie or liveness test. Write down which events trigger a step-up and what the player must provide, because underwriters will ask.

Protecting the data you collect

New Jersey's rules also require operators to encrypt Social Security numbers, passwords and PINs, and card and bank account numbers held in the patron file. The less raw financial data you hold, the smaller that burden. Hosted card fields and tokenization keep card numbers out of your systems entirely, which also narrows your PCI scope.

Minimum ages for sports betting and online casino

The working rule is 21 for most licensed sports betting and online casino markets, with a handful of states allowing 18 for sports betting. The table lists only states whose rules we confirmed in the statute or regulation as of October 2026. It is not a complete list, and it will change, so confirm current status with counsel and your regulator before you configure anything.

Kentucky is the reminder that ages move. Its 2026 gaming bill, HB 904, became law in April 2026 when the legislature overrode the governor's veto, and it changed the age for sports wagering from 18 to 21. An operator that hard-coded 18 for Kentucky would now be accepting wagers it should refuse.

Ages also differ by product within a single state. Lottery, pari-mutuel wagering, fantasy contests and sports betting can each carry their own threshold, and some operators set 21 everywhere as house policy even where state law allows 18. Configure age by state and by product, and keep the rule table under change control so you can show an auditor when each value changed and why.

Age verification in practice

Age verification usually rides on the same identity check as KYC: a verified date of birth from a trusted source. The weak points are elsewhere. Watch for accounts where the verified identity belongs to a parent or older sibling, where a device or payment instrument is shared across family members, or where the player's behavior does not fit the profile on file.

Payment data helps. A funding card or bank account in a different name than the player account is a signal worth stopping on, and state rules commonly restrict funding to instruments that belong to the account holder. New Jersey's rules, for example, allow reloadable prepaid cards only when they have been verified as issued to the patron and non-transferable.

Have a written procedure for an underage account found after the fact. It should cover suspending the account, what happens to balances and open wagers under your regulator's rules, refunds to the original funding source, and any report the regulator requires. Underwriters care less that an underage account got through and more that you caught it and followed your written procedure.

Geolocation requirements for licensed online wagering

Licensed online wagering in the US is generally intrastate, which is why location gets checked so carefully. The Unlawful Internet Gambling Enforcement Act exempts intrastate bets only when the state's law or regulations include age and location verification requirements reasonably designed to block access to minors and to people located outside the state (31 U.S.C. 5362(10)(B)). That federal hook is a large part of why state rules are so specific. Our UIGEA and Regulation GG guide covers the rest of the statute.

State laws then write the location rule directly. A few examples from the texts themselves:

• New Hampshire: an authorized sports bettor must be physically present in the state, and mobile wagers must be initiated and received within its borders (RSA 287-I).
• Massachusetts: mobile and digital wagers may be accepted only from individuals physically located in the Commonwealth (G.L. c. 23N, section 13).
• Wyoming: the gaming commission's rules must require each operator to use a geolocation system to ensure a patron is physically present in the state when wagering, unless the commission authorizes otherwise (W.S. 9-24-102).
• New Jersey: the gaming system must detect the patron's physical location at login and as often as the operator's approved submission specifies, and must not accept wagers while the patron is in an unauthorized area (N.J.A.C. 13:69O).

Both UIGEA and New Hampshire's statute also say that the intermediate routing of wager data through other states does not determine where a wager is made. That covers data passing through, not where the wager is received: the federal exemption still requires the bet to be initiated and received within a single state, and New Hampshire bars intentionally routing mobile wagers out of state.

Wyoming's law also shows how wide the circle of regulated vendors is. Its definition of a sports wagering vendor names geolocation services, know your customer services, and payment processors side by side. Expect the regulator, and your processor, to look at all three as part of one system.

How geofencing works, and what underwriters check

Geolocation providers combine device signals such as GPS, Wi-Fi and cell data with IP checks, and they look for signs that a location is being faked: VPNs, proxies, remote desktop software, emulators and location-spoofing apps. The operator sets the policy around those results, including how often to recheck, how to treat players near a state line, and how to handle tribal lands or other areas with separate rules.

Underwriters do not need to understand the signal math. They want to know four things: that a check runs before wagering and again at the interval your regulator requires, that a failed check blocks the wager rather than just logging it, that you investigate repeated spoofing attempts, and that you keep the logs. A month of block and pass statistics, plus a few redacted sample records, usually answers the question.

Geolocation is not only for licensed sportsbooks and casinos. Sweepstakes, skill gaming and fantasy operators use geofencing to keep players out of states where their model is restricted, and underwriters treat those controls just as seriously. See our posts on sweepstakes casino payments and state bans and skill gaming and esports tournament payments for how those models are treated.

Self-exclusion and prohibited player screening

Identity checks also tell you whether a verified adult is allowed to play at all. State self-exclusion programs, such as those run by New Jersey's Division of Gaming Enforcement and the Pennsylvania Gaming Control Board, let players bar themselves for set periods, and operators must keep those players out. Sports wagering laws also define prohibited bettors. New Hampshire's statute, for example, lists categories of prohibited sports bettors alongside the age rule.

Screen at registration, screen again when lists refresh, and decide in advance what a match does to deposits, wagers, marketing and balances. A self-excluded player who gets through the front door is a responsible gambling failure first and a payments problem second, since those deposits can be disputed later. Our post on responsible gambling payment controls covers deposit limits, cool-offs and exclusions in more depth.

Verification at cash-out

Withdrawals are where weak KYC becomes a direct loss. A fraudster who opened an account with a stolen identity wants the money out, and the payout is the last chance to stop it. Treat the first withdrawal, a change of payout destination, and unusually large withdrawals as step-up events.

The common practice in licensed markets is closed loop: money returns to the instrument that funded the account where possible, and payouts go to accounts in the player's own name. New Jersey's rules direct card-funded balances back to the funding card up to the deposit amount where the card issuer allows it.

A push-to-card payout through a program such as Visa Direct can reach a debit card in seconds, which leaves no window to catch a mistake, so verification and name matching have to happen before release. Ask your processor whether gaming payouts are enabled for your program before you build around them. Our guide to paying out winnings covers each payout rail and its fraud controls.

On the deposit side, ACH has its own verification rule. Nacha rules require originators of WEB debits to use a fraud detection system that includes account validation the first time an account number is used. Validation confirms the account is open and can take ACH entries; it does not by itself prove the player owns it, so pair it with name matching where your validation method supports that. The ACH for gaming and betting post covers the details.

The documentation pack that shortens a review

Put the following in one folder before you apply. It turns a long back and forth into a short list of follow-up questions.

1. Every license and approval you hold, with the states and products each covers, plus any pending applications.
2. Contracts or order forms for your KYC, age verification and geolocation vendors, and any regulator approvals of those systems.
3. Written policies: KYC and step-up rules, age rules by state and product, location policy, exclusion screening, and payment instrument ownership.
4. Any test or certification reports your regulator required for your platform.
5. Redacted sample logs: a verified account, a failed verification, a geolocation block, and an exclusion match.
6. Incident procedures for underage accounts, location breaches and identity fraud, and a log of past incidents and how you resolved them.
7. A map of how money moves: deposit methods, payout methods, and where verification happens along the way.

Keep it current. Underwriting is not a one-time event, and processors review high-risk accounts periodically. An operator who can send an updated pack on request looks like a business that runs its controls, not one that wrote them down once.

How Flux fits

Flux does not provide KYC, age verification or geolocation services. Those controls belong to the operator and its specialist vendors. Flux reviews gaming and betting businesses case by case, and approval depends on your licenses, where your players are, and your controls. Underwriting is done by people, and not every business qualifies.

Where Flux fits is the payment layer around those controls. Hosted payment fields keep card numbers off your servers, tokenization lets you store payment methods without holding raw card data, and fraud detection scores each transaction in real time and flags or blocks risky ones before they settle, using rules you control. Cards settle in 1-2 business days and ACH in 1-3 business days. Gaming and betting accounts are priced after underwriting.

This article is general information, not legal advice. If your compliance stack is in place and you want to talk about how your money moves, see our gaming and betting overview, apply here, or email sales@fluxpayments.com.