Payment provider due diligence for gambling operators

Before comparing prices, an operator needs to know that a payment provider is properly regulated, willing and able to process gambling in each market, and registered with the card schemes where required. Most of this can be checked against official registers rather than taken from a sales deck.

By Clera Dukuk · Published 24 October 2026

Coverage

Great Britain, EU and card scheme requirements

Sources checked

24 October 2026

Next review

24 April 2027

1. Regulatory status

United Kingdom. The FCA says "All non-bank payment service providers (such as APIs, EMIs and SPIs) must be authorised or registered with us" (FCA guidance, updated 8 January 2026). Search the Financial Services Register by the operating company's name. The FCA notes that authorised and e-money institutions must safeguard customer money, but small payment institutions do not have to. For British operators this check also supports licence condition 5.1.2; see our guide to that condition.

European Union. The EBA's register of payment and electronic money institutions is built from national registers. The EBA states that its register has no legal significance; the national competent authority's register is the authoritative record.

2. Gambling acceptance in each market

• Does the provider's licence and risk policy allow gambling, and in which countries? Ask for its written acceptance policy, not a verbal assurance.
• Does it support local rules, for example blocking credit cards in Great Britain, Ireland or Massachusetts, or rejecting payments to unlicensed operators where a regulator requires it?
• Will it support the payout methods you need?

3. Card scheme registration

Visa's Integrity Risk Program lists gambling (MCC 7995) as a Tier 1 high integrity risk category. Acquirers need high integrity risk registration, with separate approval for each Tier 1 category, and "All High Integrity Risk Merchants must be registered with Visa prior to submitting transactions." Mastercard's security rules have a specialty merchant registration section for non-face-to-face gambling merchants. Ask the provider to confirm, in writing, which entity acquires your transactions and that the registrations are in place.

4. AML and integrity controls

De Nederlandsche Bank's good practices for payment institutions on gambling and gaming (December 2022, non-binding) name risk factors including "the high amounts associated with Gambling", "the use of anonymous payment methods" and "the execution of pay-ins and pay- outs". It describes transaction checks for illegal gambling and checking that online providers hold a Dutch licence. Ask a prospective provider how it screens for these risks and how it will share alerts with you.

5. Safeguarding and settlement

Ask how the provider holds money between collection and payout. In the UK, safeguarding of relevant funds by payment and e-money firms is governed by the Payment Services Regulations 2017, the Electronic Money Regulations 2011 and, since 7 May 2026, the FCA's CASS 15 rules. Confirm the settlement schedule, reserves and reporting, which belong in the contract; see our contract review checklist.

6. Operations and resilience

• Service levels, incident notification and escalation contacts.
• Reporting formats that support daily reconciliation.
• Data protection terms and where data is processed.
• Exit support if the relationship ends or the provider withdraws from gambling.

Recording the evidence

Keep a file for each provider separating three kinds of information: facts verified on an official register (with the date checked), claims the provider made in writing, and open questions. A logo or a claimed licence on a website is not proof of permission for your specific use.

Questions about payment provider due diligence