Visa and Mastercard gambling merchant rules: what acquirers check

Visa and Mastercard both require your acquirer to register a card-absent gambling merchant with the network before the first transaction, to hold evidence that the merchant is licensed or otherwise authorized everywhere it takes players, and to keep monitoring it afterward. Visa runs this through the Visa Integrity Risk Program, which treats online gambling as a high-integrity risk business. Mastercard uses its Specialty Merchant Registration Program, backed by its Business Risk Assessment and Mitigation (BRAM) investigations.

Most of these rules are written for acquirers, not merchants, which is why operators usually meet them secondhand as a document request. This guide explains what each network requires, what legal-status evidence your acquirer has to collect, how dispute monitoring works at a high level, and what keeps a registration in good standing. The rules described are current as of October 2026 and change often, so treat this as a map rather than the rulebook.

Why the networks care so much about gambling

Card networks carry legal and reputational risk for every transaction on their rails. Mastercard's rules forbid its customers from engaging in or facilitating anything illegal or anything that may damage the brand or the integrity of the system, and forbid submitting any illegal transaction. Visa's rules let it bar merchants and their principals from its system and fine acquirers that let illegal or brand-damaging activity in.

Gambling adds a federal layer. Under Regulation GG, a bank or processor in a card system can meet its UIGEA obligations by relying on the network's own policies, as long as those policies are reasonably designed to identify and block restricted transactions. Issuers and acquirers across the system lean on Visa's and Mastercard's gambling rules for exactly that reason, so the networks write them tightly and enforce them. Our guide to UIGEA and Regulation GG covers the federal side.

The result is a chain of obligations. The network sets rules for the acquirer, the acquirer writes them into your merchant agreement, and your compliance is what keeps the acquirer's own network registration safe. When an acquirer asks for something that seems excessive, it is usually because the network will ask the acquirer for it.

The Visa Integrity Risk Program

Visa launched the Visa Integrity Risk Program (VIRP) in 2023 to replace its Global Brand Protection Program. It covers what Visa calls high-integrity risk merchants: businesses that are legal but, without proper controls, carry a heightened risk of processing transactions for activity that may not be legal.

When Visa launched the program, its guide sorted these merchants into three tiers. Card-absent gambling under 7995 sat in Tier 1, alongside adult content, dating and escort services, and pharmacies, the tier Visa reserves for activity that could harm people's health, safety or wellbeing if illegal transactions got through. Card-absent games of skill under 5816 sat in Tier 2. Visa says it reassesses the designations periodically, so confirm the current tier with your acquirer.

What Visa requires of the acquirer

• Acquirer registration first. An acquirer must apply for and receive High-Integrity Risk Acquirer Registration before soliciting, contracting with or processing for any high-integrity risk merchant. Each Tier 1 category needs its own approval, so an acquirer approved for one Tier 1 vertical is not automatically approved for gambling.
• Financial strength. Visa's rules call for a financial review and the required equity capital, investment-grade status, or compensating controls such as collateral.
• Agent registration. ISOs, payment facilitators and other agents that solicit these merchants must be registered and overseen, with formal assurance at least once a year.
• Merchant registration. Every high-integrity risk merchant must be registered with Visa before it submits transactions, after enhanced due diligence on its control environment, and the registration must be updated when activity changes, such as new URLs.
• Annual attestation. By registering a merchant, the acquirer certifies, and recertifies every year, that the merchant complies with Visa's rules and has effective controls to monitor and block illegal transactions.

Visa can also send requests for information under the program, and its rules give the acquirer no more than 7 business days to answer in writing. That deadline is why acquirers ask gaming merchants to keep compliance evidence organized and ready to send.

Visa's gambling transaction rules in practice

Beyond registration, Visa's rules set out how a gambling merchant has to run its checkout and its payouts. The main points for online operators:

• Authority to operate. An online gambling merchant must have a valid license or other appropriate authority to operate its website or app.
• Coding. Online gambling uses 7995, even when gambling is not the merchant's primary business, plus Visa's quasi-cash and online gambling indicator in the US and several other regions. US merchants that qualify for 7800, 7801 or 7802 use those codes instead. Our guide to gambling MCC codes covers each one.
• Website disclosures. The homepage or payment page must warn that internet gambling may be illegal where the cardholder is located, say that the cardholder is responsible for knowing the law, prohibit participation by anyone under the lawful age, describe the rules of play and the cancellation and payout policies, and recommend that cardholders keep their records. Effective October 24, 2026, US online gambling merchants must also show their consumer data privacy policy there.
• Winnings. Gambling winnings may be paid to a cardholder only through a Visa Original Credit Transaction, not by cash, check or a refund-style credit, and only for a winning wager that was lawfully made and properly coded. Ask your processor whether gaming payouts are enabled for your program, and see our guide to paying out winnings.
• Descriptors. Acquirers must prohibit their agents from using dynamic merchant descriptors for gambling merchants.

One rule is easy to miss. In the US, Visa does not extend its usual protection against card-absent fraud disputes to 3-D Secure transactions coded 7801, 7802 or 7995. Authentication still helps approvals and fraud screening, but it does not move fraud liability to the issuer the way it does for most online retailers.

Mastercard's Specialty Merchant Registration Program

Mastercard requires acquirers to register certain merchant types through its Specialty Merchant Registration Program (older editions of its manuals called it the Mastercard Registration Program, or MRP). Non-face-to-face gambling merchants coded 7801, 7802 or 7995 are on the list, along with government-owned lotteries (7800 in the US, 9406 elsewhere) and skill games merchants, including fantasy sports, coded 7994.

Registration is more than a form. By registering a merchant, the acquirer affirms that the merchant conducts the activity only in jurisdictions where the acquirer has confirmed it is legal, and that the merchant has controls to keep it out of places where it is prohibited or where its legality has not been confirmed. The acquirer has to supply, among other things:

• The merchant's legal name, DBA and address, plus customer service contact details
• The principal owners, with addresses and tax identification numbers
• A detailed description of the products and services offered to cardholders
• Payment processing procedures, cardholder disclosures, return policies and data security practices
• Any previous business relationships of the principal owners
• Every website URL from which gambling transactions may arise
• A certification by the acquirer officer responsible for compliance that, after a diligent and good faith investigation, the information is true and accurate

Mastercard charges the acquirer an annual fee for each registered merchant, and it can assess an acquirer that processes for one of these merchant types before registering it, with escalating assessments if the problem is not fixed after notice. Processing an unregistered gambling merchant can also be treated as a violation of Mastercard's rule against illegal or brand-damaging transactions.

Legal-status evidence for US gambling merchants

For merchants in the US and its territories, Mastercard asks for a fuller due diligence package, and Mastercard has to approve the registration before the acquirer processes any non-face-to-face gambling transactions. The items line up closely with what Regulation GG describes for banks.

The independent certification deserves the most planning. It has to come from a qualified third party, not from the acquirer, an ISO or the merchant, and it must show that the merchant's systems include effective age and location verification and are reasonably designed to keep the business within legal limits, including for interstate transactions. Mastercard expects the certification to include screenshots, for example of the age verification flow.

For 7801 merchants, Mastercard says not to submit a legal opinion with the registration, though it may ask for one. For 7802, the legal opinion has to identify every relevant gambling law that applies to the merchant and to the cardholders it accepts, show that their activity complies or is exempt, and be acceptable to Mastercard. In both cases the acquirer must affirm that it will not submit restricted transactions from the merchant for authorization.

Lotteries, skill games and sweepstakes

US government-owned lottery registrations need evidence of legal authority to sell lottery tickets, a reasoned legal opinion addressed to the acquirer, and the same independent controls certification. Skill games and fantasy sports registrations need a license that expressly authorizes the particular type of skill game, a merchant attestation and the controls certification; if no license exists for your contest type, raise it with your acquirer early rather than assuming. For a US registration involving a merchant that runs a sweepstakes, the acquirer must file a sweepstakes intake form with a reasoned legal opinion from a US lawyer on whether the sweepstakes is gambling under all relevant laws. Our guides to daily fantasy and pick'em and sweepstakes casinos cover the state law side.

Mastercard's rules on gambling transactions

Mastercard also requires specific terms in every merchant agreement with a gambling merchant:

• A legality notice. Internet gambling merchants must show a notice, before account information is requested, that internet gambling may not be lawful in some jurisdictions, including the US, and suggest that the cardholder check local law.
• No chips for other venues. A merchant must not sell chips or other value usable for gambling at locations it does not wholly own.
• No refunds as payouts. A merchant must not use a refund to credit winnings to a card. Winnings move through Mastercard's separate gaming payment transaction where it is available. A refund that returns a recent deposit not used for play, within the time limit the rules set, or that responds to a cardholder fraud claim, is not treated as paying winnings.
• Authentication data. Every card-absent gambling authorization must carry authentication-related data, such as the CVC 2 value or a 3-D Secure authentication result.

Mastercard also sets coding rules. Non-face-to-face gambling uses 7995 with Mastercard's "unique transaction" category code unless the merchant is registered for 7801 or 7802. In the US, Mastercard requires issuers to block or decline e-commerce transactions coded 7995 or 9406 from US cardholders, and lets them approve 7800, 7801 and 7802 transactions individually. By using a US code, the acquirer asserts that the activity is legal and indemnifies Mastercard, which explains why acquirers scrutinize these registrations so closely.

BRAM investigations and MATCH Pro

Mastercard's BRAM program investigates merchants referred as potentially engaging in illegal or brand-damaging transactions. Referrals come from law enforcement and government agencies, intellectual property holders, industry groups, complaints from banks and cardholders, and Mastercard's own monitoring. Published acquirer guidance on BRAM lists illegal or miscoded internet gambling among the violation types.

Once a case opens, the clock is short. The acquirer has two business days to report the results of its investigation when law enforcement or another government body started the case, and five business days otherwise. It must send a remediation plan, the merchant application and signed agreement, and the approved business description and URLs. It must also send evidence linking any violating URL to the approved merchant, monthly transaction counts and volumes, the identity of any service provider involved in signing the merchant, and details of its MATCH Pro inquiry where one was made.

A bad case usually ends in termination. Mastercard can list a noncompliant merchant on MATCH Pro, its database of terminated merchants, and acquirers must list merchants they terminate for reasons such as transaction laundering, illegal transactions or violation of standards. Listings stay for five years. On the Visa side, acquirers must report terminated merchants, including those identified in Visa Integrity Risk Program reports, and add them to the Visa Merchant Screening Service where its criteria are met.

Dispute and fraud monitoring at a high level

Registration gets you in; monitoring decides whether you stay. Both networks measure disputes and fraud at the merchant level every month, and gaming is exposed because a player who lost can claim a deposit was unauthorized.

• Visa. Visa replaced its separate dispute and fraud monitoring programs with the Visa Acquirer Monitoring Program (VAMP), which took effect in 2025 and combines fraud and disputes into one measure. Its thresholds have been revised since launch, so ask your acquirer which figure applies to you. The often-quoted 0.9% rule of thumb comes from Visa's older dispute program, which engaged at 0.9% with at least 100 disputes.
• Mastercard. Under the Excessive Chargeback Program, a merchant becomes an Excessive Chargeback Merchant at 1.5% or more with at least 100 chargebacks in a month, and a High Excessive Chargeback Merchant at 3% or more with at least 300, measured against the preceding month's transaction count. After six months in the program, Mastercard may advise on the acquirer's action plan or require a risk review of the acquirer itself.

For a gaming merchant, crossing these lines threatens more than fees. It puts the network registration and the acquirer's appetite for the account at risk. Check your numbers with our chargeback ratio calculator, read our overview of chargebacks, and see our guide to gaming chargebacks and representment for evidence that holds up.

What your acquirer will ask you for

Put together, the network rules produce a fairly predictable document request. For a US online gambling program, expect most of the following:

1. Licenses for every jurisdiction where you accept players, and a clear list of where you do not
2. A reasoned legal opinion wherever the network or the bank requires one, such as for racing, lotteries, sweepstakes or contest types without a license
3. An independent third-party certification of your age verification and geolocation controls, with screenshots
4. A completed merchant attestation, and your agreement to the network-required merchant terms
5. Every website, app and URL where you take payments, and the brands that run on them
6. Ownership and principal details, including prior processing relationships
7. Your website disclosures, terms, payout policy and responsible gambling tools, such as deposit limits and self-exclusion
8. Your KYC, AML and fraud controls, and processing statements from prior providers

The acquirer is also checking things you do not see, such as MATCH Pro and Visa's screening tools, its own standing under its network registrations, and whether your business fits its risk appetite. Our guides to KYC, age verification and geolocation and AML for gaming operators cover the controls themselves.

Keeping your registration in good standing

A registration describes your business at one moment. When the business changes, the registration has to change with it, and the practical burden lands on you to tell your acquirer early. Mastercard requires the acquirer to report changes in law, merchant activities and merchant systems within 30 days, with updated legal opinions or certifications where needed. Visa requires registrations to be updated with new activity, such as URLs, and recertified every year.

Changes that commonly trip operators up include new states, new domains or apps, new products such as adding casino to a sportsbook, a change of ownership, and a new white-label or B2B partner taking payments. Each can need a new registration, a new license copy or a new certification before the first transaction. Treat your payments compliance file like your licensing file: current, organized and ready to send within days.

How Flux fits

Flux reviews gaming and betting businesses case by case. Approval depends on your licenses, where your players are, and your controls, and gaming and betting accounts are priced after underwriting. Our underwriting is a real review by people rather than an automated category decision. Not every business qualifies.

For card acceptance, our hosted payment fields keep card numbers off your servers, fraud detection scores each transaction in real time with rules you control, and our payments API sends signed webhooks. Cards settle in 1-2 business days and ACH in 1-3 business days.

This article is general information, not legal advice, so confirm the current network requirements with your acquirer and counsel. Our gaming and betting hub and complete guide to gaming payments cover the rest of the series. If your licenses and compliance file are in order and you want to talk about how your money moves, apply or email sales@fluxpayments.com.