Payment risk controls across deposits and withdrawals
Gambling payment flows carry three kinds of risk: money laundering, fraud and harm to the customer. Regulators expect operators to monitor deposits and withdrawals for all three, using indicators such as mismatched payment details, multiple payment methods and rapid net deposits.
- Coverage
- Great Britain, Ontario, FATF and Dutch supervisory guidance
- Sources checked
- 24 October 2026
- Next review
- 24 January 2027
Key points
- The FATF's September 2026 indicators include "discrepancies between customer and payment information" and "the use of multiple accounts and payment methods under different identities".
- Great Britain: financial vulnerability check when net deposits exceed £150 in a rolling 30 days (social responsibility code 3.4.4).
- Great Britain: staged financial risk assessments decided on 7 July 2026, starting at £5,000 net deposits in 24 hours; start date not yet set.
- Ontario: AML policies must set when to verify source of funds and escalating measures, including refusing transactions (AGCO standard 6.03).
Three risks, one payment flow
| Risk | Signs in payment data | Typical controls |
|---|---|---|
| Money laundering | Deposits with little play then withdrawal; payment details that do not match the customer; many methods or accounts. | CDD at thresholds, source-of-funds checks, transaction monitoring, suspicious activity reporting. |
| Fraud | Stolen cards, account takeover, chargeback-prone patterns, bonus abuse through multiple accounts. | Strong authentication, device and identity checks, velocity limits, chargeback monitoring. |
| Customer harm | Rising net deposits, repeated declined deposits, reversing withdrawals (where allowed), limits raised often. | Deposit limits, affordability and vulnerability checks, customer interaction. |
Money laundering indicators
The FATF's September 2026 report on gaming and gambling is its first detailed look at online and illegal gambling. It names payment systems "such as cash, e-wallets, mobile money and virtual assets" and lists indicators including "discrepancies between customer and payment information" and "the use of multiple accounts and payment methods under different identities". De Nederlandsche Bank's good practices for payment institutions point to high amounts, anonymous payment methods and pay-in and pay-out flows as the main gambling risk factors.
In Great Britain, casinos must apply customer due diligence to transactions of £2,000 or more under the Money Laundering Regulations 2017; in Ontario, AGCO standard 6.03 requires policies on when to verify source of funds and escalating risk-based measures, including refusing transactions. Our KYC guide covers thresholds in detail.
Affordability and vulnerability checks in Great Britain
Social responsibility code 3.4.4 requires a financial vulnerability check when a customer's deposits minus withdrawals exceed £150 in a rolling 30 days; it came into force on 30 August 2024 at a £500 threshold, lowered on 28 February 2025. The Commission says these checks use publicly available data rather than credit reference data.
On 7 July 2026 the Commission decided to introduce financial risk assessments in stages:
| Stage | Age 25 and over | Under 25 |
|---|---|---|
| Stage 1 (initially largest operators) | Net deposits over £5,000 in 24 hours | Over £2,500 in 24 hours |
| Interim stages | To be set after further engagement | |
| Final stage | Over £1,000 in 24 hours or £3,000 in 90 days | Over £750 in 24 hours or £2,000 in 90 days |
Fraud controls
- Strong customer authentication for card payments, required in the EU since September 2019 for remote electronic payments.
- Identity verification before gambling (required in Great Britain) and matching payment names to the verified customer.
- Limits on new payment methods per account and on deposit attempts in a short period.
- Monitoring chargebacks per method and provider; see our chargebacks guide.
Controls at withdrawal
Withdrawal is a natural checkpoint, but regulators do not want it to become a barrier. In Great Britain, identity information that could reasonably have been requested earlier should not be asked for only at withdrawal (licence condition 17.1.1), and the Commission has said operators should not keep accepting deposits indefinitely while AML checks are outstanding. Withdrawals paid to the original method or to an account the player holds, as Ontario requires, reduce third-party risk.
Questions about payment risk controls
What triggers an affordability check at a UK gambling site?
A financial vulnerability check is required when net deposits exceed £150 in a rolling 30 days. Fuller financial risk assessments, starting at £5,000 net deposits in 24 hours, have been decided but were not yet in force when we checked.
What are red flags for money laundering in gambling payments?
FATF indicators include discrepancies between customer and payment information and the use of multiple accounts and payment methods under different identities. Deposits followed by withdrawal with little play are another common warning sign.
Sources
- FATF, Risks of Gaming and Gambling, press release of 9 September 2026
- De Nederlandsche Bank, good practices for payment institutions on gambling and gaming (December 2022)
- Gambling Commission: SR code 3.4.4; financial risk assessments news and blog (July 2026); LCCP 17.1.1; blog of 18 July 2024
- AGCO, Registrar's Standards for Internet Gaming, 6.02 and 6.03
- All sources checked 24 October 2026.