Gaming and betting payment processing: the complete guide

Gaming and betting payment processing is ordinary card and bank payments with three extra layers on top: card network rules for gambling merchants, federal law aimed at unlawful internet gambling, and state rules on who may wager and how they may fund an account. Getting approved, and staying approved, comes down to proving your activity is legal wherever your players are and showing the controls that keep it that way.

This guide is the map for our series. It covers each vertical, the rules that apply, what underwriters ask for, how money moves in and out, and what to expect on cost and reserves. Each section points to a deeper post.

What makes gaming payments different

A sportsbook deposit and a sneaker purchase travel over the same card networks. The difference is everything around the transaction. The networks require gambling transactions to carry specific merchant category codes, and they require acquirers to register gambling merchants that take card-not-present payments and watch them more closely than ordinary retail.

Federal law adds its own duty. The Unlawful Internet Gambling Enforcement Act of 2006 (UIGEA) and its implementing rule, Regulation GG, require payment systems to have policies that identify and block transactions tied to unlawful internet gambling. That is why every bank and processor in the chain asks to see your license.

Then each state decides whether the activity is legal at all, who can play, and which funding methods are allowed. A product licensed in one state can be illegal one border over. Your payment setup has to follow the player's location, not your headquarters.

The verticals and how each is treated

"Gaming" covers several businesses that look alike on a website but sit in different legal boxes. Underwriters start by asking which box you are in, because that decides the license or legal support they expect and the risks they price.

Sportsbooks

Licensed sportsbooks are the most established online vertical. Each state issues its own licenses and writes its own rules on age, location, advertising and funding. Expect underwriters to ask for every state license, your geolocation provider and your deposit mix, because several states restrict credit cards. Our post on why sports betting deposits get declined covers the funding side in detail.

Online casino

Real-money online casino is legal in far fewer states than sports betting. The payment profile is similar, with more frequent deposits and a sharper friendly fraud problem, since a losing session can turn into an "unauthorized" claim weeks later.

Daily fantasy and pick'em

Traditional daily fantasy sits under state fantasy contest laws in many states, and UIGEA excludes fantasy contests that meet specific conditions. Pick'em formats are less settled: rules in New York, Michigan and Ohio prohibit contests that mimic proposition betting, which covers most house-banked pick'em, and Florida regulators have sent cease-and-desist letters to pick'em operators. See daily fantasy and pick'em payment underwriting.

Sweepstakes casinos

Sweepstakes casinos use a dual-currency model and rely on promotional sweepstakes law. A growing number of states have banned the model. California's law, effective January 1, 2026, makes it unlawful for any entity, including a financial institution, payment processor or geolocation provider, to knowingly and willfully support an online sweepstakes game that uses dual currencies. It reaches vendors, not only operators. Our sweepstakes state bans post tracks the details.

Skill games and esports

Paid-entry skill contests and esports tournaments are legal or not depending on how each state weighs skill against chance. Underwriters want a legal opinion that addresses your specific format and the list of states you block. See skill games and esports tournament payments.

Lottery couriers and cardrooms

Lottery couriers buy official tickets on a player's behalf, and their status depends entirely on state lottery law. Texas, for example, made online and app-based courier sales a crime in 2025. Cardrooms are mostly in-person businesses with a growing card and wallet footprint, and larger ones are financial institutions under the Bank Secrecy Act, which shapes how they handle cash.

Card network coding, registration and monitoring

Every card merchant gets a merchant category code (MCC) from its acquirer. Gambling has its own family of codes. MCC 7995 covers betting, including lottery tickets, casino chips, off-track betting and wagers at race tracks. In the US region, 7800 is for government-owned lotteries, 7801 for government-licensed online gambling (the code a registered, state-licensed online casino or sportsbook normally uses) and 7802 for government-licensed horse and dog racing. Mastercard uses 9406 for government-owned lotteries outside the US.

The code matters because issuers use it to decide what to approve and whether to treat a charge as a cash advance. Coding a gambling merchant as something else to get past issuer filters is one of the fastest ways to lose an account and land on Mastercard's MATCH list. Our gambling MCC guide explains each code and why miscoding ends accounts.

Beyond coding, both networks require acquirers to register high-risk merchants. Visa's Integrity Risk Program, which replaced its Global Brand Protection Program in 2023, treats card-absent gambling as a high-integrity risk category. Mastercard requires registration for non-face-to-face gambling merchants as well, and in 2026 it added new transaction fees to its Specialty Merchant Registration Program for some categories. Registration usually needs evidence that the activity is legal where you offer it. See Visa and Mastercard rules for gambling merchants.

Monitoring programs sit on top. Mastercard's Excessive Chargeback Merchant level is a ratio of 1.5% or more with at least 100 chargebacks in a month, and its High Excessive level is 3% or more with at least 300, both measured against the preceding month's transaction count. Visa replaced its separate dispute and fraud programs with the Visa Acquirer Monitoring Program (VAMP) and has revised the thresholds since, so ask your acquirer in writing which figure applies to you.

Federal law: UIGEA, Regulation GG and the BSA

UIGEA does not make any particular game legal or illegal. It relies on other federal and state law to decide what counts as unlawful internet gambling. It then bars gambling businesses from knowingly accepting payments tied to that gambling and requires payment systems to block these "restricted transactions." Regulation GG, published by Treasury at 31 CFR part 132 and by the Federal Reserve at 12 CFR part 233, spells out how.

For card systems, the rule offers a coding approach as an example: merchant and transaction codes that let an issuer identify and decline a restricted transaction. For onboarding, it describes due diligence. When the customer runs an internet gambling business, the provider obtains evidence of legal authority, such as a state or tribal license, or a reasoned legal opinion where no license exists. It also gets a written commitment to report changes and a third-party certification that the merchant's systems are built to stay within lawful limits, including age and location checks. The text is on the eCFR.

The statute carves out wagers made entirely within one state or on tribal lands when state or tribal law expressly authorizes them and requires age and location checks plus data security standards. It also excludes fantasy contests that meet set conditions: no fantasy team based on the current roster of a real sports team, prizes fixed and disclosed in advance and not tied to the number of entrants or the fees paid, outcomes that reflect skill and are determined predominantly by accumulated statistics across multiple real-world events, and no winning outcome based on the score or performance of any single team or combination of teams, or solely on one athlete's single performance in a single event. Our UIGEA and Regulation GG post goes deeper.

The Bank Secrecy Act is the other federal pillar. Licensed casinos and card clubs with more than $1 million in gross annual gaming revenue are financial institutions under 31 CFR 1010.100, with duties that include currency transaction reports and suspicious activity reports. Operators outside that definition still get asked about their AML program. See AML for gaming operators.

State rules that shape payments

States set the rules that touch payments most directly: minimum age, location checks, how player accounts can be funded, and how player money must be protected. Massachusetts puts two of them in one sentence: a sports wagering operator shall not accept a wager from anyone under 21, and shall not accept a credit card.

Credit card restrictions have spread. As of October 2026, the states that bar credit cards for sports wagering include Massachusetts, Iowa, Tennessee, Virginia and Illinois, and Ohio's regulator has proposed a similar rule. Most of the largest national sportsbooks stopped taking credit card deposits between August 2025 and spring 2026, whatever the state rule. Tennessee's rule goes further and requires that every funding method, including online and mobile payment services, be able to separate and block money that originates from a credit card.

Many states also require operators to protect player balances with a reserve, bond, letter of credit or segregated account. That obligation is separate from any reserve your processor holds. Because state law changes quickly, confirm current rules with counsel and your regulator before you design a funding flow.

What underwriters look at, and how to prepare

A gaming underwriter is answering two questions. Is this activity legal everywhere you accept players? And if something goes wrong, can the business cover refunds, disputes and fines? Your application should answer both before anyone has to ask.

• Legal authority. Every license, with the states and products it covers, or a reasoned legal opinion for formats that are not licensed, such as many skill, fantasy and sweepstakes models.
• Where your players are. Your geolocation provider and how you block players outside permitted states.
• Who your players are. KYC and age verification at signup and again at withdrawal. Our post on KYC, age verification and geolocation lists what processors usually ask to see.
• Responsible gambling. Deposit limits, cooling-off periods, self-exclusion, and how each one reaches the payment flow. See responsible gambling payment controls.
• AML program. Monitoring, escalation, and who files what.
• Processing history. Recent statements with dispute and refund ratios, if you have processed before.
• Ownership and financials. Beneficial owners, financial statements, and how player funds are held.
• Your site and terms. Clear terms, a working support channel, and a billing descriptor that matches your brand.
• Marketing. Who your affiliates are and where they send traffic.

A thin file is a common reason gaming applications stall. Sending the full package up front shortens the conversation, though no file guarantees approval. Expect follow-up questions on anything that relies on a legal opinion rather than a license.

Deposit rails

Most licensed operators offer several deposit methods because no single rail approves every player. Which ones you can offer depends on your regulator's approved list in each state.

Card declines are a common source of deposit friction, and many are issuer policy on gambling codes rather than suspected fraud. Correct coding and clean transaction data help, but they cannot change an issuer's policy. Offering bank transfer gives players a path that does not depend on a card issuer's appetite for gambling. Our ACH for gaming post covers Nacha's account validation rule for online debits and the fraud monitoring rules that took effect in 2026.

Withdrawal rails

Payouts are where regulators, processors and fraudsters all look hardest. If a withdrawal reaches anyone other than the verified player, you have a fraud loss or an AML problem.

The common pattern is closed loop: return funds to the method that funded the account where possible, and to a verified bank account in the player's name otherwise. ACH credits are the workhorse. Push-to-card services such as Visa Direct and Mastercard Move can put money on a debit card in seconds, but not every card program allows gaming payouts, so ask your processor whether gaming payouts are enabled for your program. Checks and cash at a cage fill the gaps.

Withdrawals are also a compliance checkpoint. Many operators repeat KYC at first cash-out, and federal tax reporting applies at set thresholds. The Form W-2G thresholds changed for 2026, with the slot machine threshold rising from $1,200 to $2,000, so check the current IRS instructions for each game type. Our payouts guide walks through each rail.

Chargebacks and fraud

Most gaming disputes are not stolen cards. The bigger problem is first-party misuse: a player deposits, loses, and tells the bank the charge was not theirs. Shared accounts, family members using a saved card, and players who forget a deposit add to it.

The defenses are layered. Strong KYC ties each account to a real person. Device and login records show who placed the bets. Clear descriptors and receipts cut "I don't recognize this" claims. 3-D Secure can add evidence, but Visa's US rules carve gambling codes 7995, 7801 and 7802 out of the fraud dispute protection that authentication normally brings, so do not assume an authenticated gaming deposit moves fraud losses to the issuer.

Track your ratio every month with the chargeback ratio calculator, and read our gaming chargebacks guide for reason codes and the evidence that wins representment.

Costs, reserves and settlement

Gaming accounts cost more to run than standard retail. Part of that is pass-through: interchange, network assessments, registration fees and any monitoring program fees. Part is the processor's own risk premium, which reflects the dispute exposure it carries for months after each deposit settles.

Reserves are the other lever. An acquirer may hold a percentage of each batch on a rolling basis, build a capped balance, or ask for cash up front. The terms that matter are the percentage, the hold period, the cap, and what triggers a change. Model the cash effect with the reserve impact calculator before you sign.

Settlement timing depends on the rail and your risk profile. At Flux, cards settle in 1-2 business days and ACH in 1-3 business days. Our guide to reserves, rates and settlement for gaming merchants covers what drives each term and what to negotiate.

How Flux fits

Flux works with high-risk verticals deliberately. Flux reviews gaming and betting businesses case by case, with a real underwriting review by people rather than a category-level automated no. Approval depends on your licenses, where your players are, and your controls, and not every business qualifies. Gaming and betting accounts are priced after underwriting.

Flux accepts Visa, Mastercard, Amex and Discover cards and ACH bank transfers. Each card network and state regulator sets its own rules for gambling, so not every method is open to every gaming business. Hosted payment fields keep card numbers off your servers, the payments API sends signed webhooks, and fraud detection scores each transaction in real time and flags or blocks risky ones before they settle, using rules you control. Flux is certified to PCI DSS SAQ-D Level 2. KYC, geolocation, age checks and responsible gambling tools stay with you and your vendors.

This guide is general information, not legal advice. When you are ready to talk about how your money moves, apply at fluxpayments.com/apply.html or email sales@fluxpayments.com. The gaming and betting hub collects the full series.