Online casino payment processing: cards, ACH and state-by-state rules

Online casino payment processing in the US runs on ordinary card and bank rails with three extra layers: the card networks' gambling rules, federal law (the Unlawful Internet Gambling Enforcement Act, or UIGEA), and the funding rules each licensing state writes into its regulations. Getting approved, and staying approved, comes down to correct coding, the right registrations and a cashier that follows each state's rules.

Real-money online casino is legal in eight states as of November 2026, and live in seven. For sportsbooks, fantasy and sweepstakes too, see our gaming and betting payment processing guide. This guide explains the rules and is not legal advice; talk to your attorney about your own situation.

Where real-money online casino is legal, and why it shapes payments

Maine legalized online casino through LD 1164, which reserves licenses for the state's federally recognized tribes, but had not launched at our last check.

The state line matters because of federal law. UIGEA bars a gambling business from knowingly accepting credit (including credit card payments), electronic fund transfers, money transmitter funds or checks for unlawful internet gambling (31 U.S.C. §5363). A bet falls outside that definition when, among other conditions, it is made entirely within one state, is "expressly authorized by and placed in accordance with the laws of such State," and the state requires age and location checks plus data security standards (31 U.S.C. §5362(10)(B)). That is why state online casinos geofence players to the state line.

Regulation GG, which carries out UIGEA, covers five payment systems, ACH and cards among them (12 CFR 233.3), and gives merchant category codes as an example card policy. That is why card coding carries so much weight in gambling, and why your bank asks for licenses before you pull ACH deposits.

Card acceptance: coding, registration and disclosures

Visa's rules dated October 24, 2026 require an online gambling merchant to hold a valid license or other appropriate authority for its website or app.

MCC 7801, not 7995

Visa's general rule codes online gambling as MCC 7995 (betting). But US gambling transactions that qualify for MCC 7800, 7801 or 7802 must use that code. MCC 7801, Government Licensed On-Line Casinos, is for merchants licensed by a US government entity and registered with Visa, so a state-licensed, Visa-registered online casino codes 7801. Visa lists sweepstakes under 7995.

The quasi-cash flag

Online gambling transactions must carry a Quasi-Cash Transaction indicator in the authorization request and the clearing record, and US merchants add Visa's Quasi-Cash/Online Gambling Transaction indicator. That flag tells the issuer a deposit is gambling. What happens next is issuer policy: some decline gambling deposits, and some treat them as cash advances.

Registration and monitoring

Visa treats card-absent gambling as high-integrity risk, which puts much of the work on the acquirer (the bank that signs the merchant). Before submitting transactions, the acquirer needs Visa's approval, a financial review and a Visa registration for each such merchant. It then builds a "normal daily activity" profile over at least a month and starts daily monitoring of volume, average ticket, transaction count and disputes on the 31st calendar day from the merchant's first deposit of card transactions with the acquirer.

Visa can fine the acquirer USD 100,000 a month (for Tier 1 and Tier 2 merchants) plus USD 2,000 per unregistered merchant per month for missing registrations. For altering merchant data to evade Visa's monitoring, it can fine the acquirer USD 25,000 per merchant per month, permanently disqualify the merchant and its principals, or both. Mastercard runs its own gambling registration, so confirm both networks with your acquirer.

The disclosures on your site

Visa requires these on the homepage or payment page:

• Visa's statement that internet gambling may be illegal where the cardholder is, and if so, they may not use their card for it
• The cardholder's responsibility to know the law
• A ban on underage play
• The rules of play and the cancellation and payout policies
• A recommendation to keep transaction records
• New in the US region from October 24, 2026: the merchant's consumer data privacy policy

From the same date, Visa's new Age Validate and Birthdate Validate services are closed to MCCs 7800, 7801, 7802 and 7995, so network data can't replace the age checks your state requires (see the Visa rules).

Credit and debit cards: what New Jersey, Pennsylvania and Michigan allow

State regulations list the funding methods players may use, and anything else needs the regulator's approval.

"Not listed" means the rule doesn't name the method, not that it is banned, since each state's regulator can approve other means.

Where credit is restricted

• Maine bans it. Under 8 M.R.S. §1412-A, an operator, or a management services licensee running internet gaming for one, "may not accept a wager from a person using a credit card."
• Pennsylvania allows credit cards, but the operator "shall neither extend credit to a player" nor accept deposits derived from credit extended by its affiliates or agents (§812a.7(b)).
• Connecticut limits players to one debit card or one credit card per account, and licensees must cap credit card use over set periods (Conn. Gen. Stat. §12-863(c)(2)).

The market has moved further than the law. By May 2026, several of the largest US operators had stopped taking credit card deposits nationwide on their own, and states such as Massachusetts, Iowa, Tennessee and Virginia bar credit cards for sports bets.

So if one wallet serves several states, or a sportsbook too, tag each deposit with its funding source (credit, debit, prepaid or ACH) and the player's state at the time. Those tags decide which deposit and withdrawal rules apply.

ACH for online casino deposits

An ACH deposit is a WEB debit: the player authorizes it online and the operator pulls the funds. All three lists above include ACH, and Pennsylvania and Michigan require anti-fraud controls with it.

Validate the account on first use

Since March 19, 2021, Nacha has treated account validation as part of a "commercially reasonable fraudulent transaction detection system" for WEB debits, on the first use of an account number and whenever it changes. The minimum is confirming a legitimate, open account. Ownership checks are optional and no method is mandated: prenotes, micro-entries and validation services all count.

Return rate limits

Each is measured over the preceding 60 days or two calendar months. Breaching the administrative or overall level starts a preliminary inquiry, not an automatic fine, while an unauthorized rate over 0.5% obliges the ODFI to bring it down and exposes it to Nacha enforcement.

Fraud monitoring is now required

Nacha's fraud monitoring rules took effect on March 20, 2026 for ODFIs (the banks that originate entries) and originators with 6 million or more ACH entries in 2023, and in June 2026 for everyone else (Nacha set June 19, a federal holiday, so the practical date was Monday, June 22). They cover non-consumer Originators, which includes operators pulling deposits: each needs "risk-based processes and procedures" to catch entries that are unauthorized or authorized under false pretenses, reviewed at least yearly.

State lockouts for failed deposits

In New Jersey, five consecutive failed deposit attempts within 10 minutes require a temporary block for a fraud investigation, and five more within 10 minutes a suspension (N.J.A.C. 13:69O-1.3(e)). Michigan applies the same pattern to failed ACH deposits (R 432.655b), except that a failed attempt is not considered fraudulent if the player has a prior successful ACH deposit and no outstanding chargebacks. Count attempts per account, not per session.

A debit can also come back after the money is played, so consider limiting play on a first ACH deposit, and holding withdrawals of ACH-funded balances, until it clears. Our ACH for gaming guide covers return codes and time limits.

Withdrawals: closed loop, OCTs and ACH credits

New Jersey's refund-to-card rule

Before any withdrawal, if a player funded the account by card, New Jersey requires "any remaining balance in the account up to the amount of the deposit" to be refunded to that card, where the issuer permits it (N.J.A.C. 13:69O-1.3(f)). Hypothetically, a player deposits $300 by debit card and $200 by ACH, wins, and asks to withdraw $900. The first $300 goes back to the debit card, and the other $600 can go out another approved way, such as an ACH credit.

Winnings to a card: Original Credit Transactions only

Visa lets a gambling merchant pay winnings to a Visa card only through an Original Credit Transaction (OCT), a payment pushed to the card. Cash, checks and refund-style credits are not allowed, and the winning wager must have been lawfully made and properly identified.

So keep the two apart in your ledger: New Jersey's rule returns the player's own deposit, while winnings to a Visa card go as an OCT. An ACH credit to the player's verified bank account is the other common route. Our guide to paying out winnings compares the options.

Tax reporting on winnings

For payments made in 2026, the Form W-2G minimum reporting threshold is $2,000, up from $1,200 for slot jackpots, and adjusted for inflation in later years. The IRS instructions for Form W-2G have the detail; work through your reporting with a CPA.

Disputes, friendly fraud and the 3-D Secure carve-out

The dispute every casino plans for is friendly fraud: a real player who deposits, loses and then tells the bank the charge wasn't theirs. Elsewhere, 3-D Secure can move the loss on a fraud chargeback to the issuer. Not on Visa for a US online casino: under Visa rule 5.8.4.6, US acquirers must tell merchants in MCCs 7801, 7802 and 7995 (among others) that their 3-D Secure transactions get no dispute protection under Dispute Condition 10.4 (Other Fraud: Card-Absent Environment), and Visa's dispute rights table applies that to US domestic e-commerce whatever the Electronic Commerce Indicator value. 3DS can still play a part in approvals and in your evidence file, but it is not a liability shield.

Your defense is the record you keep on each player: the identity and age check at signup, geolocation results per session, device and login history, deposit and play history, and accepted terms. Our gaming chargebacks guide covers reason codes and representment.

Watch the ratios too. Mastercard's Excessive Chargeback Program flags a merchant at a ratio of 1.5% or more with at least 100 chargebacks in a month. Visa has revised its VAMP thresholds since the program launched in 2025, and they sit outside its public rule book, so ask your acquirer, in writing, which figure applies to you.

What the processor needs, not just the casino

In three of the live states, a payment company can need the gaming regulator's approval too:

• Pennsylvania. An interactive gaming service provider that offers "payment processing and related money-transmitting services with direct contact with a registered player's interactive gaming account" must apply to the Gaming Control Board for certification (58 Pa. Code §807a.1(a)(2)).
• Michigan. Payment processors must register as vendors, and operators may not use unregistered vendors (Mich. Admin. Code R 432.629).
• New Jersey. Companies serving internet gaming permit holders file with the Division of Gaming Enforcement as ancillary casino service industry enterprises (N.J.S.A. 5:12-92a(3)) or vendor registrants (N.J.S.A. 5:12-92d); the Division's list, last updated in 2020, shows payment companies in both groups.
• Visa. The acquirer needs high-integrity risk approval and registers each casino it signs, as above.

Ask any processor how it meets these in each state you serve, and how it prices and reserves a casino. Acquirers size a reserve by estimating what could come back in disputes and refunds after settlement: a rolling reserve holds a percentage of each batch for a set period, while a capped reserve stops withholding at a ceiling. Pricing adds the processor's margin and risk premium to network costs, and your license, volume, average ticket and dispute history drive both. Our gaming reserves, rates and settlement guide covers what to negotiate.

What the processor will ask you for

Regulation GG describes the baseline due diligence (12 CFR 233.6(b)): a license that expressly authorizes the business, or a reasoned legal opinion where there is no license; a written commitment to report changes in legal authority; and a third-party certification that your systems keep you within lawful limits, including age and location verification. Expect underwriting to ask for:

1. Your license in every state you serve, and the third-party certification of your age and location controls.
2. Your identity and age checks. Michigan, for example, requires identity verification before an account is created and before any wager.
3. Your AML program. Licensed casinos with gross annual gaming revenue over $1 million are financial institutions under the Bank Secrecy Act (31 CFR 1010.100(t)); ask counsel how that applies online.
4. Your terms, rules of play, payout, cancellation, privacy and responsible gambling policies, which double as your Visa disclosures.
5. Your cashier flows for each state, and recent processing statements if you have them.

Confirm what applies to you with gaming counsel and a CPA.

How Flux fits

Flux reviews gaming and betting businesses case by case. Approval depends on your licenses, where your players are and the controls you run. A person reviews every application, and not every business qualifies.

Flux takes Visa, Mastercard, American Express and Discover cards and ACH bank transfers through one integration. Hosted fields capture card details in origin-isolated iframes on payments.fluxpayments.com, off your servers, and Flux is PCI DSS SAQ-D Level 2 certified. Fraud detection flags or blocks risky transactions using rules you control. Cards settle in 1-2 business days and ACH in 3-5 business days.

Gaming accounts are priced after underwriting, and some accounts carry a reserve. If one applies, Flux walks you through the percentage, release lag, cap and review triggers before you sign. KYC, age and location checks, responsible gambling tools and state licensing stay with you and your vendors. More on the gaming and betting hub.

Casino platform and software companies can work with Flux through its referral and partner program: each operator they refer applies, a person reviews it, and it gets its own Flux account, with Flux running the payments, security and support. To become a partner, email support@fluxpayments.com. Operators can apply or email sales@fluxpayments.com.