Sportsbook payment processing: deposits, payouts and acquirer checks

Sportsbook payment processing is the set of systems that take a bettor's deposit, hold it in a player wallet while wagers settle, and pay winnings back out. It runs on ordinary card and bank rails, with three extra layers: card network coding and registration for gambling, federal rules aimed at unlawful internet gambling, and state rules on how players fund accounts and how fast they must be paid.

This guide follows one US sportsbook dollar from deposit to withdrawal, with the rule at each step and what your acquirer (the bank that sponsors your card processing) must prove it checked, as of November 2026. For other gaming verticals, see our gaming and betting payment processing guide.

Federally, Murphy v. NCAA (2018) struck down the federal bar on states authorizing sports betting, and the Unlawful Internet Gambling Enforcement Act (UIGEA) excludes wagers made entirely within a state that expressly authorizes them, if state law requires age, location and data security controls.

How money moves through a sportsbook

Each stage answers to different rules.

What acquirers check before boarding a sportsbook

Legal authority for every market

Visa requires an online gambling merchant to "have a valid license or other appropriate authority to operate its website and/or application" (Visa Core Rules and Visa Product and Service Rules, Section 5.8.18.1). Regulation GG, which implements UIGEA, gives acquirers a due diligence model (31 CFR 132.6). Under it, an acquirer boarding an internet gambling business obtains each of:

• evidence of legal authority, such as a state or tribal license, or a reasoned legal opinion where no license exists;
• your written commitment to notify it of any change in that authority;
• a third-party certification of your systems, including age and location verification.

That ties back to UIGEA's intrastate exclusion, which requires state law to include age and location verification "reasonably designed to block access to minors and persons located out of such State", plus appropriate data security standards (31 U.S.C. 5362(10)(B)). Acquirers want proof the controls work, not just a policy.

Network registration

Acquirers treat online gambling as high-integrity risk under Visa's Integrity Risk Program, whose list of merchant codes sits in a non-public guide, so the acquirer needs Visa's approval and must register each such merchant before processing (Section 1.9.5.1). It must answer Visa information requests within 7 business days (Section 1.9.2.2), so keep your file ready.

Mastercard requires acquirers to register card-absent gambling merchants coded 7801, 7802 or 7995. As acquirers describe it, Mastercard wants the same evidence, with changes reported within 30 days. See our guide to Visa and Mastercard gambling merchant rules.

What your site must show

Visa's Table 5-15 (Section 5.8.4.1) says a gambling merchant's homepage or payment page must include:

• the statement "Internet gambling may be illegal in the jurisdiction in which you are located; if so, you are not authorized to use your payment card to complete this transaction.";
• the cardholder's responsibility to know the law, and a ban on players under the lawful age;
• the rules of play, cancellation policies and payout policies, and a recommendation to keep transaction records;
• new from October 24, 2026 in the US: the merchant's consumer data privacy policy.

Your AML program

Bank Secrecy Act rules treat a licensed casino with over $1 million in gross annual gaming revenue as a financial institution (31 CFR 1010.100(t)(5)), with suspicious activity reports due within 30 days on suspicious transactions of $5,000 or more. Whether a sportsbook fits depends on its structure; acquirers ask about AML either way.

Deposits: coding, funding rules and declines

How a deposit is coded

Visa's base rule is MCC 7995 (Betting) "even when gambling services are not the Merchant's primary business", plus, in the US, the Quasi-Cash/Online Gambling Transaction indicator in both the authorization and the clearing record (Sections 5.8.18.1 and 7.4.5.1). Visa also defines a US-only MCC 7801 for government-licensed online gambling, which registered, state-licensed operators normally use. The public rulebook doesn't say exactly when 7801 replaces 7995, so your acquirer assigns the code under its registration.

If you can't separate gambling from other sales, Visa says to code all of it as gambling. A funds transfer to an individual for online gambling must also be identified as gambling (Section 5.8.18.2), so routing deposits through a money transfer product to avoid gambling coding breaks the rules.

Regulation GG lets issuers comply through "a code system, such as transaction codes and merchant/business category codes" (31 CFR 132.6(d)(1)(ii)), so the code is what issuers screen on. Mastercard's rules, as acquirers describe them, make US issuers decline e-commerce transactions coded 7995 from US cardholders but let them approve 7801 and 7802 transaction by transaction. For other decline causes, read why sports betting deposits get declined.

Credit card bans by state

Which funding methods are allowed is a state decision. Trade press also reports credit card bans in Illinois, Iowa, New Hampshire, Oregon, Rhode Island, Tennessee and Vermont; the table covers Massachusetts and the 2026 changes, as of November 2026:

In Colorado a credit card violation can bring a commission penalty of up to $25,000 and is a class 2 misdemeanor.

Tag every wallet dollar by funding source

In Massachusetts, the ban follows the money, not just the checkout. In a July 25, 2025 decision, the Massachusetts Gaming Commission fined an operator $450,000 after credit card funds deposited while players were outside Massachusetts were wagered in the state: 1,160 wagers, funded by 242 credit card deposits from 218 users, with $83,667.92 in handle.

The lesson: tag every wallet balance with how it was funded, and keep credit-sourced balances out of wagers in a ban state. Colorado's cap is a similar design job: count deposits per person per gaming day and block the seventh.

Bank transfer deposits

Since March 19, 2021, Nacha has required originators of online consumer debits (WEB entries) to validate an account the first time it is used and whenever it changes. Unauthorized returns have a 0.5% threshold, administrative returns 3.0% and all returns 15.0%; going over starts an inquiry. Unauthorized consumer debits can also come back well after the normal two-day return window, once the player's bank obtains a Written Statement of Unauthorized Debit.

The player wallet: player funds vs processor reserves

States require operators to protect the balances in player wallets, separately from any reserve your acquirer holds against chargebacks.

Wyoming's online sports wagering rule (038-4 Wyo. Code R. section 4-12) is a clear example. Operators and vendors must keep a reserve of at least the greater of $25,000 or the sum of patrons' cashable balances, pending withdrawals, unresolved wagers and winnings owed but not yet paid. It can be held as cash in a segregated Wyoming bank account, an irrevocable letter of credit, a bond, "payment processor reserves and receivables", or a combination.

Say a hypothetical Wyoming book ends a day with $180,000 in cashable balances, $40,000 in pending withdrawals and $60,000 riding on unsettled bets. With no winnings owed but unpaid, its reserve must be at least $280,000. If its acquirer also holds $50,000 against chargebacks, that money may count if the Wyoming commission approves the reserve plan, because Wyoming lists processor reserves as an acceptable form.

Many states have similar rules. The acquirer's reserve protects the acquirer, not your players; our guide to gaming merchant reserves, rates and settlement covers what to negotiate.

Withdrawals: rails, network rules and state deadlines

Paying winnings to a card

When winnings are paid to a Visa card, Visa requires an Original Credit Transaction (OCT), which pushes funds to the card, and a refund-style credit is not allowed (Section 5.8.18.3). The winning wager must also have been "lawfully made, properly identified, and processed according to the Visa Rules", so a miscoded deposit can taint the payout. Mastercard, as acquirers describe its rules, also prohibits using a refund to pay winnings. Ask your acquirer whether your program can send OCTs.

Paying winnings by ACH

ACH credits to players now fall under Nacha's 2026 fraud monitoring rules, which cover every non-consumer originator since Phase 2 took effect on June 19, 2026 (June 22 in practice). They require risk-based processes to identify entries suspected of being unauthorized or authorized under false pretenses, credits included. For a sportsbook, that risk is an account takeover that changes the payout bank account before a cash-out.

State withdrawal deadlines

States set how fast a withdrawal must be honored, and the deadlines differ:

Your duty is to process on time, so log when each withdrawal is requested, approved and sent. For rail choices and payout fraud controls, read paying out winnings.

Tax reporting on winnings

The IRS instructions for Form W-2G (revised January 2026) set "the minimum threshold amount for payments made in calendar year 2026" at $2,000. Sports wagering winnings are reportable when they meet the applicable threshold and are at least 300 times the wager. Regular withholding of 24% applies when winnings minus the wager exceed $5,000 and the 300-times test is met. Two hypothetical bets:

• $20 bet, $7,500 won. 300 times the wager is $6,000, so a W-2G is due, and $7,480 in winnings minus the wager is over $5,000, so 24% withholding applies: $1,795.20.
• $100 bet, $9,000 won. 300 times the wager is $30,000, so no W-2G and no regular withholding.

Backup withholding can apply when a winner gives no correct taxpayer ID. Confirm your reporting with IRS Publication 1099 and your CPA.

Disputes, monitoring and the 3-D Secure gap

3-D Secure (3DS) lets the issuer authenticate an online payment, which usually moves the loss on an eligible fraud dispute to the issuer. Not for US sportsbooks on Visa: acquirers must tell merchants that 3DS transactions coded 7801, 7802 or 7995 are not eligible for protection from Dispute Condition 10.4, card-absent fraud (Section 5.8.4.6). Mastercard still expects authentication data (a CVC 2 or 3DS result) on card-absent gambling authorizations, and 3DS adds dispute evidence, but don't plan as if fraud losses move to the issuer.

Both major networks also measure dispute levels monthly. As of November 2026:

Visa excludes disputes resolved through pre-dispute tools and fraud reports that qualify for Compelling Evidence 3.0. Mastercard's figures are as processors cite them; confirm with your acquirer.

Say a hypothetical book settles 120,000 card-not-present Visa deposits in a month and gets 1,100 fraud reports and 900 disputes: 2,000 counted items, about 1.67%, over both the ratio and the 1,500 floor. See gaming chargebacks and representment to bring both down.

Costs, taxes and what changed in 2026

One sportsbook cost is a tax, not a payments fee. Under 26 U.S.C. 4401, the federal excise tax on a wager authorized by the state where it is accepted is 0.25% of the amount wagered (2% for other wagers), paid by the business accepting it. Section 4411 adds a $50 yearly occupational tax for those accepting only state-authorized wagers. On a hypothetical $10 million month of handle, the excise tax is $25,000, profitable month or not. Repeal bills have been introduced in Congress, but the tax is in effect as of November 2026.

Card pricing for a sportsbook follows underwriting, so there is no reliable public rate, and we don't quote one. Ask for each cost line in writing: the card rate and its structure, the fee per payout (OCT or ACH credit), ACH debit and return fees, the chargeback fee, any network registration fees passed through, monthly minimums, the settlement schedule, and the reserve percentage, hold period and cap.

This guide is general information, not legal or tax advice: confirm what applies to you with your attorney, CPA and acquirer.

How Flux fits

Flux reviews gaming and betting businesses case by case: a person looks at your licenses, where your players are and your controls, and not every business qualifies.

• Cards and ACH in one integration. Visa, Mastercard, American Express and Discover, plus ACH. Cards settle in 1-2 business days and ACH in 3-5.
• Card data off your servers. Hosted fields capture card details in origin-isolated iframes on payments.fluxpayments.com, cards are tokenized at capture, and Flux is certified to PCI DSS SAQ-D Level 2.
• Fraud rules and events. Fraud detection scores each transaction and flags or blocks risky ones before they settle, and real-time event notifications go to your endpoints.
• 3-D Secure, with the caveat above. On card payments through hosted checkout, payment links and invoices, and you choose every payment or only riskier ones.

Gaming accounts are priced after underwriting, based on license, volume, average ticket and dispute history, and some carry a reserve. As the licensed operator, you own KYC, age and geolocation checks, W-2G reporting and state withdrawal deadlines, and underwriting will ask how you and your vendors run them.

Run a sportsbook platform? Flux works with software companies through its referral and partner program: each operator you refer applies, a person reviews it, and if approved it gets its own Flux account. Email support@fluxpayments.com to become a partner.

Bring your licenses, policies and a description of your identity, age and location checks, then apply here or email sales@fluxpayments.com.