Paying out winnings: push-to-card, ACH, and safe fast withdrawals

Most licensed gaming operators pay out winnings in a set order: card deposits go back to the card that funded them, larger amounts go by ACH credit to a bank account you have verified belongs to the player, and push-to-card is the fast option when your program and the player's card both support it. The rules that keep this safe are closed-loop payouts, identity checks before money leaves, fraud controls on payout destinations, and tax reporting when a win crosses the IRS threshold.

In practice, the withdrawal is where much of a gaming business's operational risk shows up: stolen cards trying to become clean bank deposits, account takeovers that redirect a payout, and players who wait too long and dispute their deposits instead. This guide covers each rail and the controls that let you pay quickly without paying the wrong person.

Why the withdrawal is the moment that counts

Withdrawals decide whether a player trusts you. A slow or confusing cash-out reads as a refusal to pay, and players who feel stuck complain to the regulator or call their bank. That call turns a support ticket into a dispute on a deposit that was perfectly valid.

Withdrawals are also where bad actors get paid. Someone who deposits with a stolen card gains nothing until money leaves your system for an account they control. Every payout control in this post exists to close that gap: send the money back to the real player, through a channel tied to how they funded, after checks that fit the risk.

Regulators and players want speed, and your risk team wants time to look. The way through is to do the heavy checking at registration and at the first withdrawal, so routine payouts to known destinations can move fast. The broader picture of deposit and withdrawal rails is in our gaming and betting payment processing guide.

The payout rails, side by side

Each rail has a different speed, a different way to fail, and a different fraud profile. Most operators offer two or three of these and steer players toward the ones that match how they deposited.

Two points hold across all of them. Money pushed to a player is hard to recover, so verification happens before the payout, not after. And the right rail for a withdrawal depends on how the player funded the account.

Closed loop and return-to-source

A closed-loop payout policy sends money back out the way it came in, as far as possible. The reasoning is part anti-money laundering and part dispute control. If a card deposit can only come back to that card, a stolen card cannot be laundered into a bank deposit, and a player who later claims the deposit was unauthorized has already received that money back on the same card.

State rules often build this in, and New Jersey's internet gaming rules (N.J.A.C. 13:69O-1.3) are a clear example.

Before any withdrawal, if a patron funded the account with a credit or debit card, the remaining balance up to the deposit amount must be refunded to that card, as long as the issuer permits it. The same rule lists the other approved withdrawal routes, including a transfer to the patron's own bank account once the licensee has verified the account with the bank, and a reloadable prepaid card verified as issued to the patron and non-transferable.

Other states write their own versions. Read the rule in every state where you hold a license, and check that your payout logic meets each one rather than assuming one state's version covers the rest.

Turning the principle into payout logic

• Track net deposits by method. Your ledger should know how much each card, bank account and other method put in, so the payout engine can return card deposits first.
• Pay winnings above deposits to a verified destination in the player's name. That usually means an ACH credit to a verified account, or push-to-card to an eligible card the player has already used.
• Write down the exceptions. Cards expire and accounts close. When the original source cannot take the money, route the withdrawal to manual review, verify the new destination, and keep the record.
• Do not let the player pick an unrelated destination. A new bank account that has never funded the wallet is a common route for fraud proceeds.

How push-to-card payouts work

Push-to-card payouts run as original credit transactions: instead of pulling money from a card, the sender pushes money to it. On Visa the service is Visa Direct. On Mastercard it is Mastercard Send, which sits inside Mastercard's Move portfolio of money movement services. Both networks market gaming payouts as a use case, and both reach debit and reloadable prepaid cards in the United States.

Speed depends on the receiving issuer. Visa says it requires issuers enabled for fast funds to make the money available within 30 minutes of approving the transaction. Other issuers can take longer, so show a fast-payout promise only for cards that qualify.

Check the card before you promise anything

Visa offers an account attributes inquiry that a payout provider can run against a card before sending. It returns whether the card can receive push payments at all, whether the issuer participates in fast funds, and an online gambling block indicator that shows whether the account can receive online gambling payouts. Some cards that took a deposit will not accept a gambling payout, so run the check, and fall back to ACH when the answer is no.

Gaming payouts also travel with their own transaction coding. Visa Direct tags each push with a business application identifier that tells the issuer what kind of payment it is, and gambling payouts have their own identifiers. The coding has to be right for the same reason deposit coding does, which we cover in gambling merchant category codes explained.

Program enablement is not automatic

Access to a push-to-card product does not mean you can use it for winnings. Network rules, your processor's program terms and your state license all apply. Ask your processor whether gaming payouts are enabled for your program before you design a cash-out screen around it.

Treat a push as final

Once an issuer approves an original credit, getting the money back depends on the recipient. Visa's dispute condition 13.8 (Original Credit Transaction Not Accepted) covers credits the recipient refused or the law prohibits, not a payout sent to the wrong person. Pay only to a card the player deposited with, in the player's name, that passed your authentication checks.

ACH credits for withdrawals

ACH credits are the workhorse for larger withdrawals. Almost every player has a bank account, and the account can be tied to a verified identity. The tradeoff is time: an ACH credit typically takes 1-3 business days, and a credit to a bad account comes back as a return a couple of days later.

The control that matters most is account ownership. New Jersey's rule requires the licensee to verify the validity of the account with the bank before a cash-out transfer, and many operators go further by matching the account holder's name to the verified player. Common methods include bank-login account verification services and micro-entries (small credits of less than $1, labeled ACCTVERIFY under Nacha's rules). A prenote, a zero-dollar test entry, checks only that the account number is valid and open, not who owns it.

What changed for credits in 2026

Nacha's new fraud monitoring rules reach credits as well as debits. Non-consumer originators must now run risk-based processes to identify entries suspected of being unauthorized or authorized under false pretenses. The largest originators have had to comply since March 20, 2026, and all others since June 2026.

In the payout context, the false pretenses risk is a fraudster posing as your player to redirect a withdrawal. Banks receiving credits now have their own monitoring duty and can return a suspect credit. The full rule set is in our post on ACH for gaming and betting.

Plan for returned credits too. A credit to a closed account (R02), a nonexistent account (R03), or an invalid account number (R04) comes back to you. Put the funds back in the player's wallet, tell them why, and require a newly verified account before you try again.

KYC at cash-out

Regulated operators verify identity, age and location at registration. Cash-out is the second checkpoint, where you confirm the destination belongs to the person you verified. Underwriters ask how your payout flow handles each trigger below.

• First withdrawal. Confirm identity verification is complete and the payout destination matches the verified name.
• Change of payout details. A new bank account or card is a step-up event: re-authenticate the player, notify them on the old contact channel, and consider a cooling-off period before paying to the new destination.
• Large or unusual withdrawals. Set review thresholds that reflect the player's history, and ask for source-of-funds information where your AML program calls for it.
• Tax identification. Collect a taxpayer identification number before paying a reportable win, which the tax section covers below.

If your business is a casino or card club for Bank Secrecy Act purposes, cash-out activity also feeds your suspicious activity reporting. FinCEN's casino rule requires a report for suspicious transactions involving at least $5,000 (31 CFR 1021.320). Our posts on KYC, age verification and geolocation and AML for gaming operators cover those programs in depth.

Payout fraud patterns to design against

Most payout fraud follows a handful of patterns. All of them leave traces in your data if you look at deposits, play and withdrawals together rather than separately.

1. Stolen card in, clean money out. A deposit with a stolen card, little or no play, and a withdrawal request to a bank account. Closed-loop payouts defeat most of this. Flag withdrawals where wagering activity is small relative to deposits.
2. Account takeover and payout redirection. An attacker logs in with stolen credentials, swaps the bank account, and withdraws. Step-up authentication on payout changes and a hold on newly added destinations are the main defenses.
3. Win, withdraw, then dispute. A player wins, cashes out to a bank account, then disputes the card deposits as unauthorized. Refunding card deposits to the card first, and keeping strong evidence, limits the damage. See gaming chargebacks and representment.
4. Multi-accounting and bonus abuse. Many accounts sharing a device, address or payout account to farm promotions. Link accounts by device and by payout destination.
5. Mule destinations. Several unrelated players cashing out to the same bank account or card. One verified payout destination per player, owned by that player, closes this off.
6. Insider overrides. Staff who can change payout details or release held withdrawals. Require dual control and keep an audit trail of every manual override.

Tax reporting touchpoints: W-2G in 2026

Form W-2G reporting changed this year. The IRS instructions for Forms W-2G and 5754 state that the minimum reporting threshold for payments made in calendar year 2026 is $2,000, and that it will be adjusted for inflation each year after that. The change follows the information reporting thresholds Congress set in the One Big Beautiful Bill Act in 2025, and it replaces the $1,200 figure that applied to slot machine and bingo winnings for decades.

The game type still matters. Under the current instructions:

• Bingo, keno and slot machines are reportable when winnings meet the applicable threshold, with keno measured after subtracting the wager.
• Poker tournaments are measured on net winnings, reduced by the buy-in.
• Sports wagering and most other wagers are reportable only when winnings meet the threshold and are at least 300 times the amount wagered. Most straight bets never get there; long-shot parlays and futures can.

Withholding has its own tests. Regular gambling withholding at 24% generally applies when winnings, reduced by the wager, exceed $5,000 for sweepstakes, wagering pools, lotteries and other wagers that meet the 300-times test. It does not apply to bingo, keno or slot machine winnings. Backup withholding at 24% applies when a winner does not give you a correct taxpayer identification number and the winnings meet the reporting threshold, and it does reach bingo, keno, slots and poker.

What that means for the payout system

Store the wager amount with every settled bet so the 300-times test runs automatically. Prompt for a taxpayer identification number before a reportable payout, and decide in advance whether you hold the payout or apply backup withholding when the player does not provide one. State withholding rules vary.

Some contest products are reported on Form 1099-MISC instead of W-2G, and that threshold also moved to $2,000 for 2026. Check the current IRS instructions for Form W-2G and your tax advisor for the figure that applies to each product.

Speed, holds, and responsible gambling

How long you take to pay is a regulatory question as well as a product one. New Jersey's Division of Gaming Enforcement addressed it directly in Director's Advisory Bulletin 2021-01, issued in January 2021 after patrons complained that withdrawals could take up to two weeks.

The Division's position is a useful template even outside New Jersey. Withdrawals do not have to be instant, because operators need reasonable time to rule out fraud and money laundering. But they should be delayed only for as long as those checks take.

The Division also concluded that its rules prohibit operators from soliciting or incentivizing players to cancel a pending withdrawal and keep playing, and said that offering bonus money to reverse a withdrawal would be an aggravating factor in any penalty proceeding. If a withdrawal stalls or is canceled because the player did not provide requested documents, the Division does not treat that as a delaying tactic by the operator. You can read the full bulletin on the Division's site.

That lines up with responsible gambling design generally:

• Never prompt a player to reverse a withdrawal, and never attach a bonus to doing so.
• Publish expected processing times for each rail, and tell the player what is holding a payout and what you need from them.
• When a player self-excludes or closes an account, return the remaining balance under the rules of the state where they play.
• Treat repeated deposit and cancel cycles as a possible sign of harm, not only as a fraud signal.

Our post on responsible gambling payment controls covers deposit limits, self-exclusion and affordability in more detail.

A payout policy underwriters can read

When a processor or acquirer reviews a gaming business, the payout policy is one of the documents they want to see. It should answer these questions in plain language:

1. Which rails you offer, and in what order the payout engine uses them.
2. Your return-to-source rule, and how exceptions are approved and recorded.
3. Which events trigger identity checks, re-authentication or manual review.
4. How you verify bank accounts and cards before the first payout to them.
5. Holds on new destinations and on uncleared deposits, and how long they last.
6. Daily or weekly payout limits, and who can approve amounts above them.
7. How tax identification is collected and how withholding is applied.
8. Your target processing times, and how you report against them.
9. Who can change payout details or release held funds, and how those actions are logged.

Expect questions on how payouts fit network rules and your license conditions too. Our guide to Visa and Mastercard rules for gambling merchants covers what acquirers have to check on their side.

How Flux fits

Flux reviews gaming and betting businesses case by case. Approval depends on your licenses, where your players are, and your controls, including the payout policy above. For accounts we approve, Flux accepts player deposits by ACH bank transfer, which settle in 1-3 business days, and by card, with hosted payment fields so card numbers never touch your servers. Flux's fraud detection scores each transaction in real time against rules you control, and the Payments API sends signed webhooks.

Flux also offers Instant Payouts, which uses Visa Direct to push money to a recipient's debit card in seconds. It is a disbursement tool, not faster merchant settlement, and nothing here should be read as saying it can carry gambling winnings. Whether any push-to-card program can be used for gaming payouts is a program and underwriting question, so ask your processor whether gaming payouts are enabled for your program before you build around it.

This post is general information, not legal or tax advice. Confirm current rules with your counsel, your tax advisor and your regulator. If you want to talk through how your money moves in and out, see our gaming and betting hub, apply here, or email sales@fluxpayments.com.