Payment processors impose more due diligence on iGaming merchants because gambling businesses can carry higher regulatory, fraud, dispute and anti-money laundering risks. A payment provider wants to ensure that the merchant accepting customer funds through its payment infrastructure is legitimate and accountable and has proper controls for managing the transactions it processes.
For the iGaming operator, payment acceptance is closely linked with licensing, transaction monitoring, fraud prevention and accountability. In this context, a payment provider may scrutinise the ownership structure of the iGaming company, licences, target jurisdictions, transaction methods and operating procedures before accepting an application and opening an account.
In practice, merchant underwriting may be carried out by an acquiring bank, payment service provider (PSP), payment facilitator or processor, depending on how the payment arrangement is structured. Although their exact responsibilities can differ, the term “payment processor” is often used broadly when discussing merchant onboarding.
Here is a typical due diligence checklist for high-risk iGaming merchants:
| Area Reviewed | What May Be Checked |
| Business verification | Company registration, directors and corporate details |
| Ownership | Ultimate beneficial owners (UBOs) and ownership structure |
| Gambling licence | Licence status, regulator and authorised activities |
| Business model | Gambling products, websites, target customers and expected transaction volumes |
| AML and KYC | Customer identification, transaction monitoring and enhanced due diligence |
| Fraud controls | Payment fraud, stolen payment instruments and account takeover controls |
| Payment flows | Deposits, withdrawals, refunds and settlement arrangements |
| Geographic exposure | Customer markets and restricted or non-approved jurisdictions |
| Processing history | Transaction volumes, refunds, disputes and chargebacks |
| Consumer protection | Age verification and responsible gambling controls |
The exact requirements can vary depending on the provider, jurisdiction, gambling product and risk profile of the merchant.
Why iGaming Merchants Receive Extra Scrutiny
Payment processors categorise merchants according to their potential risk based on the type of business, customers and transactions associated with the company. Gambling-related businesses can involve additional exposure to chargebacks, disputes, payment fraud, money laundering and regulatory issues.
The processor may therefore need to understand not only the merchant’s products but also its customers’ payment methods, payouts and geographic exposure.
Not every iGaming merchant carries the same level of risk. An operator’s licensing structure, target markets, payment methods, transaction volumes and previous processing history can all affect how much scrutiny an application receives.
Verifying the Business
The first step is usually to check whether the particular merchant is a legitimate company. Hence, most processors require documentation confirming the company’s registration, directors, ownership and other corporate details.
Besides, since processors generally need to know who ultimately owns or controls the businesses they support, they are highly interested in cross-checking ownership information. So, it is vital to provide precise details on the organisation’s ownership structure, since complex structures may require additional screening steps before approval.
Differences between the company information provided in the application and the details shown on licences, websites or settlement accounts may also lead to additional questions.
Checking the Gambling Licence
Where a gambling licence is required, a valid licence is among the documents that the processor will typically review during onboarding. The provider may confirm the validity of the licence with the relevant authority and check whether its scope applies to the activities the merchant plans to undertake.
The processor may also verify the jurisdictions covered by the licence, since holding a licence in one jurisdiction does not automatically allow a merchant to provide gambling services to customers in another.
For this reason, providers may compare the operator’s licensed jurisdictions with the markets from which it intends to accept customers. The wider regulatory developments across gambling markets can also affect how operators approach licensing and compliance in different jurisdictions.
Regulatory requirements can also extend directly to payment arrangements. For example, the UK Gambling Commission’s current payment conditions require applicable remote licensees accepting certain payment services from customers in Great Britain to use a qualifying payment service provider.
Reviewing the Business Model
Processors typically conduct risk-based due diligence to evaluate the merchant. For example, they might ask for a general description of the gambling products that the entity plans to provide, the applicant’s marketing strategy and the expected number of customers from different jurisdictions, along with projected transaction volumes.
In addition, processors may need to determine whether the proposed business model of the applicant is compatible with its licence and the provider’s own requirements.
If the proposed activity does not match the licence, websites, target markets or information submitted in the merchant application, the provider may ask for clarification or additional documentation before approval.
Operators choosing how their business is structured may also need to consider how licensing, ownership and operational responsibilities differ between a White Label vs Self-Built Casino.
Assessing AML Controls
Anti-money laundering controls are an essential component of conducting high-risk merchant due diligence. Processors may evaluate a merchant’s policies and procedures relating to customer identification, transaction monitoring and the detection and escalation of suspicious activity.
Current anti-money laundering requirements from the UK Gambling Commission, for example, require applicable licensees to assess money laundering and terrorist financing risks and maintain appropriate policies, procedures and controls based on that assessment.
Procedures and policies relating to the merchant’s enhanced due diligence and source-of-funds controls may also be reviewed to understand whether the operator can identify and manage financial crime risks effectively.
Such measures are generally risk-based. Enhanced due diligence or source-of-funds checks may be triggered by higher-risk customers, unusual transactions or other risk indicators rather than being applied in exactly the same way to every player.
KYC, AML and fraud controls remain closely connected in modern iGaming operations, particularly as operators expand into regulated markets. Changes affecting KYC, AML and fraud can therefore have wider implications for how operators manage compliance.
Reviewing Transaction Monitoring
A processor wants to understand how the merchant identifies potentially suspicious deposits, withdrawals and account activity and how such cases are investigated.
The processor may achieve this by reviewing information about the merchant’s internal escalation procedures and how it conducts enhanced due diligence investigations at both the transaction and customer level.
For example, unusual deposit and withdrawal patterns, significant changes in transaction behaviour or activity that does not appear consistent with normal gambling behaviour may require additional review.
Recent Gambling Commission guidance on customer and transaction monitoring also emphasises a risk-based approach to monitoring and greater scrutiny for higher-risk customers.
Evaluating Fraud Risk
Fraud management is another important component of payment underwriting. Processors may assess the iGaming merchant’s ability to detect and prevent the use of stolen payment instruments, account takeovers, identity-related fraud and other fraudulent activities related to payments.
Moreover, the processor may review the fraud and chargeback history of the iGaming business if it already processes payments. A high level of fraud or chargebacks may prompt the provider to apply additional controls, such as reserve requirements, delayed settlement, lower processing limits or other restrictions, depending on the circumstances.
Historical processing information can be particularly useful because it shows how the merchant has performed with actual customers rather than relying only on projected transaction figures.
Examining Payment Flows
Understanding where funds come from and where they go is one of the critical aspects of merchant underwriting. During the due diligence stage, the service provider may analyse customer deposits, player withdrawals and refunds, as well as the merchant’s settlement arrangements.
These are different parts of the payment flow. Customer deposits represent money entering the gambling environment, while withdrawals and refunds return funds to customers. Merchant settlement involves funds being transferred through the payment arrangement to the operator’s approved settlement account.
Reviewing these flows allows the provider to understand whether the payment structure is consistent with the merchant’s stated business model and whether unexplained third parties or unusual fund movements are involved.
For example, if the merchant applies under one legal entity but asks for funds to be settled into an unrelated company’s bank account, the provider may request an explanation and supporting documentation.
Unusual or unexplained payment flows may trigger additional review, documentation requests, transaction restrictions or escalation.
Payment methods themselves can change the risk profile. The UK Gambling Commission’s emerging money laundering and terrorist financing risks, for example, identifies certain pre-paid payment methods as high risk and expects operators to account for payment methods within their risk assessments.
Checking Geographic Exposure
The geographic exposure of an iGaming merchant can be a significant risk factor. Processors may consider the jurisdictions where the company is registered and licensed, the location of its customers and the countries involved in its payment activity.
Sanctioned, restricted or higher-risk jurisdictions can require deeper investigation. However, these categories are not necessarily the same. A market may be restricted because of sanctions, financial-crime concerns, gambling regulations or the payment provider’s own policies.
In addition, the processor may need to ensure that payments are not being accepted from customers in jurisdictions that fall outside the merchant’s authorisation or the provider’s permitted geographic coverage.
The differences between markets can also be seen in regions such as iGaming in LATAM, where gambling regulations, licensing and payment methods vary between countries.
Reviewing Responsible Gambling Controls
Payment processors can also consider the extent to which the merchant provides consumer protections. For example, responsible gambling tools, as well as age verification and procedures for identifying or managing vulnerable customers, may be taken into account as part of a broader merchant review.
These aspects can help a provider assess the regulatory and reputational risks associated with the merchant. Weak consumer-protection controls can potentially expose both the operator and its payment partners to additional scrutiny.
The payment provider is not necessarily determining whether the operator has satisfied every responsibility imposed by its gambling regulator. Rather, these controls may form part of its overall assessment of the risks involved in supporting the merchant.
Enhanced Due Diligence
Not all high-risk merchants are assessed in the same way. If an application presents elevated risk indicators, the processor may conduct what is known as enhanced due diligence, or EDD.
This can involve requesting additional information from the company, including corporate, financial, beneficial ownership, licensing or transaction information. The provider may also ask for explanations of particular transactions, settlement arrangements or business relationships to evaluate the risks they pose.
Possible reasons for additional scrutiny can include an unclear ownership structure, high-risk geographic exposure, significant previous chargebacks or fraud, licensing concerns, unusual payment flows or inconsistencies between the merchant application and the business’s actual operations.
EDD is therefore more than simply requesting additional paperwork. It allows the provider to investigate specific risks in greater detail before deciding whether the merchant falls within its risk appetite.
Ongoing Merchant Monitoring
Approval is not necessarily the end of the compliance process, since payment processors usually reserve the right to continue monitoring whether a merchant meets the established requirements.
In other words, if any of the factors that influenced the initial decision to accept the business for processing change, the processor may reassess the merchant’s risk profile and take appropriate action.
Such factors may include changes in the ownership structure of the company, licences, transaction volumes and methods, markets served, websites or brands, settlement arrangements and payment patterns.
This means operators should treat payment compliance as an ongoing process rather than something that ends once the merchant account is approved.
Transaction and Chargeback Monitoring
Payment activity can provide useful information when reassessing the initially established risk level. Therefore, processors may monitor significant changes in payment volumes, refunds, chargebacks, fraud and other irregularities.
Card-network monitoring can also influence this process. For example, Visa’s Visa Acquirer Monitoring Program (VAMP) monitors fraud, disputes and enumeration levels and identifies acquirers or merchants that exceed applicable programme thresholds.
Significant outliers may lead to additional investigation, remediation requirements, lower processing limits, reserve requirements or other restrictive measures. In serious cases, a provider may ultimately terminate its services.
The important point for an iGaming merchant is that approval does not remove the need to manage fraud and disputes once payment processing begins.
What Can Cause an Application to Fail?
There are no universal reasons why a payment processor would decline an iGaming merchant, because providers have different underwriting standards and risk appetites.
However, licensing discrepancies, an unclear ownership structure, inadequate anti-money laundering controls, unexplained payment activity and exposure to restricted jurisdictions are some of the common red flags that can make approval more difficult.
Conflicting information about the company’s corporate data, licensing, websites, transaction expectations and other aspects may prompt a payment processor to ask the gaming company to clarify specific details. Some processors may also require the applicant to pass additional rounds of identity or business verification.
Other concerns may include undisclosed websites, significant historical fraud or chargebacks, unusual third-party payment flows, misleading customer-facing information or settlement arrangements that do not match the disclosed corporate structure.
For this reason, consistency is important. The merchant application, gambling licence, websites, target markets and payment arrangements should describe the same underlying business.
Why Vetting Matters
Payment processors operate in a financial ecosystem in which customers, merchants, acquiring institutions, issuing institutions and payment networks interact. In the case of insufficient due diligence, different participants in that ecosystem may be exposed to fraud, money laundering, regulatory repercussions and reputational damage.
Therefore, high-risk iGaming merchants can be subject to increased scrutiny of their business verification, licensing, anti-money laundering procedures, fraud detection measures, geographic risk and ongoing monitoring, among other factors.
The exact level of scrutiny may vary depending on the payment provider, jurisdiction, gambling product, transaction profile and other risk factors.
It is also important to understand that being categorised as high risk does not automatically mean that an iGaming business is illegal or poorly managed. Instead, it means that the nature of the business can require additional controls and monitoring before and after payment acceptance.
Final Considerations
Payment processors have good reasons to apply additional scrutiny to high-risk iGaming merchants, as payment processing can expose providers to financial, regulatory and reputational risks. A provider needs to understand who controls the business, whether the company is legitimate and appropriately authorised, how customers and transactions are managed, and whether payment flows can be clearly explained.
Merchants may find the additional paperwork and requirements demanding. Nevertheless, for payment providers, extra precautions can be necessary to reduce exposure to money laundering, fraud, excessive disputes and other prohibited or high-risk activity.
For an iGaming operator, the strongest application is therefore not simply the one with the most documents. It is the one in which the ownership structure, gambling licence, websites, target markets, compliance controls and payment flows consistently describe the same business.
