How to Underwrite Gambling Merchants: A US Licensing and Payments Framework
How to Underwrite Gambling Merchants: A US Licensing and Payments Framework
Master the complexities of US gambling merchant underwriting. This comprehensive guide breaks down essential licensing requirements, payment frameworks, and risk mitigation strategies to help financial institutions confidently navigate and scale within the highly regulated online gaming industry.
US gambling underwriting is a licensing problem first, payments problem second.
When a merchant approaches you for US card acceptance for betting, casino, DFS, or similar gambling services, the complexity isn't in the payment rails - it's in navigating a fragmented regulatory landscape where each state operates as its own jurisdiction. Unlike most merchant categories where you verify business legitimacy and fraud controls, gambling requires you to become a quasi-regulatory auditor, validating licensing status across multiple jurisdictions before you even consider payment risk.
This guide walks you through the complete underwriting framework Ballerine uses to evaluate US gambling merchants.
The Regulatory Patchwork
The United States operates under a state-by-state gambling framework following the 2018 Supreme Court decision in Murphy v. NCAA, which struck down the Professional and Amateur Sports Protection Act (PASPA). This decision allowed states to legalize sports betting independently, creating a complex jurisdictional map.
As of 2025, the landscape includes:
38+ states
With some form of legal sports betting, online, retail, or both
6 states
With legal online casino or iGaming: NJ, PA, MI, WV, DE, CT
19 states
Where daily fantasy sports is explicitly legal and regulated
Tribal gaming
Jurisdictions operating under separate federal frameworks under IGRA
Before examining state licenses, understand the federal requirements that apply to all US gambling operators:
1. Wire Act(18 U.S.C. § 1084): Prohibits interstate gambling-related wire communications for sports betting. The 2011 DOJ opinion narrowed this to sports betting only, opening the door for online poker and casino where states permit.
2. Unlawful Internet Gambling Enforcement Act(UIGEA, 31 U.S.C. §§ 5361-5367): Doesn't prohibit gambling itself, but prohibits payment processors from knowingly accepting payments for unlawful internet gambling. This places compliance burden on payment facilitators.
3. Bank Secrecy Act/AML Requirements: Gambling businesses accepting $10,000+ in cash equivalent (including electronic deposits) must register as Money Services Businesses with FinCEN (31 CFR § 1021.380).
Key takeaway: Even with state licenses, federal law makes YOU (the payment processor) liable for facilitating unlawful gambling transactions. Your underwriting must verify state-level legality to maintain UIGEA compliance.
What We Verify: The Complete Checklist
1. License Type and Issuing Authority
Why it matters: Different gambling verticals require different licenses, issued by different state authorities, with varying levels of scrutiny. A merchant saying "we're licensed" is meaningless without specifics.
License Categories
Sports Betting Licenses
Operator License: Authorizes accepting wagers, setting odds, holding player funds
Online Casino/iGaming Licenses - Only available in NJ, PA, MI, WV, DE, CT. These are the most stringent licenses, requiring:
Partnership with existing land-based casino (market access)
Multi-year probity investigations
$10M-20M in licensing fees
Ongoing technical audits
Example: In New Jersey, you need an Internet Gaming Permit issued by the Division of Gaming Enforcement (DGE), which requires a partnership with an Atlantic City casino license holder.
Daily Fantasy Sports (DFS) Registrations - DFS operators often require registrations rather than full licenses in states where DFS is classified as a "game of skill" rather than gambling:
Lighter regulatory touch
Lower fees ($5K-50K vs millions)
Still requires consumer protection compliance
Example: In New York, DFS operators must register with the Gaming Commission and pay a 15% tax on gross revenue.
Social Casino Exemptions - Some operators claim exemption by offering "social casino" (play-money only, no cash prizes). This is NOT gambling in most jurisdictions BUT:
Verification required that no real-money prizes are awarded
In-app purchases for virtual currency have payment implications
Some states still regulate (Washington prohibits social casino)
What to Request -
Required documents:
Primary License Certificate: Official document from state gaming authority showing:
License number and type
Legal entity name (must match merchant application)
Issue and expiration dates
Authorized activities and limitations
State(s) of operation
License Verification: Don't rely solely on provided documents. Verify directly:
Call the regulatory body's licensing department to confirm active status
Multi-State Operators: If they claim licenses in multiple states, request ALL state licenses. We've seen merchants show their "best" license (usually New Jersey) while operating unlicensed in other states.
Vendor Agreements: For platform providers/suppliers, request operator agreements showing which licensed operators they serve. They should NOT be accepting consumer payments directly unless they hold operator licenses.
Red Flags
"We're pursuing licenses": Not licensed = cannot process payments. Period.
Offshore licenses: Curacao, Malta, or UK licenses are irrelevant for US operations and often signal intent to serve US customers unlawfully
Tribal licenses without state compacts: Tribal gaming operates under IGRA, but online gambling from tribal lands serving customers off-reservation requires state compacts (see Michigan v. Bay Mills Indian Community)
Mismatched entities: License issued to "ABC Gaming LLC" but merchant application from "ABC Inc."
2. State Coverage Mapping
A license doesn't grant nationwide rights. You need precise geographic boundaries to configure payment blocking and comply with UIGEA.
State
Legal status
License status
Go-live date
Restrictions
NJ
Legal - Sports & Casino
Licensed (IG-123456)
Active
21+ only
PA
Legal - Sports & Casino
Licensed (PA-SB-789)
Active
21+ only
NY
Legal - Sports only
Licensed (NY-2023-001)
Active
21+, in-person registration required
CA
Not legal
N/A
N/A
BLOCKED
NV
Legal - Sports (retail only)
No online license
N/A
BLOCKED for online
Key considerations:
In-person registration requirements: Some states require initial registration at physical locations:
New York (until 2022): Required in-person registration at upstate casinos for online sports betting
Illinois: Required in-person registration initially, later removed
Check current requirements as these evolve
Some licenses restrict betting to on-property only:
Nevada: Most online sports betting apps are geo-restricted to casino property
New Jersey: Can accept bets statewide, not just casino premises
Age requirements:
Most states: 21+
Montana, Rhode Island, Washington State (tribal): 18+ allowed
Your payment systems should enforce age verification before processing
Which geolocation vendor they use (GeoComply, Localize, Neosurf)
How they handle edge cases (near state borders, mobile users)
Logs showing blocking effectiveness
Review their Terms of Service and restricted jurisdiction lists: Should clearly list prohibited states
Test their platform:
Use VPN to attempt access from prohibited states
Check if they accept registrations with addresses in unauthorized states
Verify age gates and identity verification flow
Check regulatory actions: Search "[Company Name] + cease and desist" or check:
State gaming commission enforcement actions
Attorney General consumer protection actions
Better Business Bureau complaints
Example: In 2022, multiple state AGs sent cease-and-desist letters to offshore gambling sites. If your merchant received one, they have demonstrated willful non-compliance.
3. Operator vs Supplier Classification
Why it matters: Operators and suppliers have fundamentally different risk profiles and regulatory requirements. Misclassification leads to improper underwriting and compliance gaps.
Operator Definition -
An operator (or "license holder") is an entity that:
Accepts wagers directly from consumers
Sets odds and betting lines (or contracts with odds provider under their license)
Vendor/supplier license or verification of exemption
Contracts with licensed operators showing relationship
Proof they do NOT hold consumer funds directly
Data security and tech compliance certifications
If processing payments: PCI-DSS, SOC 2 reports
The Gray Area: White-Label and API Arrangements
Many modern gambling operations blur operator/supplier lines -
White-label arrangements:
Operating model
How it works
Payments & funds handling
Risk & notes
White-label arrangements
Supplier provides the full platform including technology, odds, and risk management.
Operator holds the gambling license and owns the customer relationship.
Clarify who processes payments and who holds player funds. This must be explicitly documented in contracts.
High risk if payment responsibility is unclear.
Always obtain written confirmation.
API integrations
Operator consumes supplier APIs for odds, pricing, and bet settlement.
Core platform and customer experience remain with the operator.
Operator maintains payment processing and fund custody.
Generally clearer classification.
Still verify data flow and fund ownership.
Affiliate networks
Affiliates promote gambling sites in exchange for commission.
Affiliates must never process payments or accept wagers.
If payments or wagers are involved, classification is incorrect.
Affiliates should not require gambling payment processing.
What to request?
Business model documentation: Detailed explanation of their role in the value chain
Operator agreements (for suppliers): Contracts showing which licensed operators they serve
Payment flow diagrams: Visual showing money movement from consumer to ultimate recipient
Account structure:
Do they hold consumer funds? (Operator)
Do they only receive B2B payments from operators? (Supplier)
State vendor licenses: Even suppliers often need state registration:
Gambling businesses are FinCEN-regulated MSBs under the Bank Secrecy Act (31 CFR 1021.380). Inadequate AML programs expose you to regulatory liability as their payment processor.
Federal Registration Requirements
FinCEN MSB Registration (Required if the merchant):
Accepts $10,000+ in cash or cash equivalents within a gaming day (31 CFR 1021.380(b)(3))
For online gambling, "cash equivalents" include deposits via cards, ACH, e-wallets
What to verify:
Form 107 (Registration of Money Services Business): Request copy showing:
Business name and address
Type of MSB activity (check "casino/gambling")
Registration number
Filed within 180 days of meeting threshold
Verify registration: Search FinCEN MSB Registrant Search (Note: Public access limited; may need to request proof from merchant)
Renewal compliance: Registration expires every 2 years, must be renewed
Under 31 CFR 1021.210, gambling MSBs must maintain a written AML program including:
1. Internal Policies and Procedures
Request their BSA/AML Policy Manual covering:
Customer Due Diligence (CDD) procedures
Enhanced Due Diligence (EDD) triggers
Transaction monitoring thresholds and rules
Record retention policies (5 years minimum)
Suspicious activity identification criteria
What good looks like: 50-100+ page manual with specific dollar thresholds, escalation procedures, examples of suspicious patterns
Red flag: Generic template without gambling-specific scenarios
2. Designated AML Compliance Officer
Must appoint individual responsible for AML program:
Request name, title, qualifications
Verify they have authority and resources
Should be senior-level, not outsourced overseas
3. Ongoing Training Program
Employees handling transactions must receive AML training:
Request training materials and attendance records
Should cover gambling-specific typologies (structuring, chip dumping, collusion)
Annual refresher training minimum
4. Independent Testing/Audit
Annual independent review required:
Request most recent audit report
Should be conducted by external firm or separate internal audit dept
Report should identify deficiencies and remediation plans
Red flag: No audit conducted, or audit is 2+ years old
Transaction Monitoring Requirements
Currency Transaction Reports (CTRs):
Required for cash transactions over $10,000 in a gaming day (31 CFR 1021.311)
For online gambling: Typically triggered by deposit aggregation
Request their CTR filing procedures and evidence of filed CTRs
Suspicious Activity Reports (SARs):
Required within 30 days of detecting suspicious activity (31 CFR 1021.320)
Common gambling SAR triggers:
Structuring: Multiple deposits just under reporting thresholds
Rapid movement: Deposit followed immediately by withdrawal (money laundering)
Minimal play: Deposits with little actual gambling activity
Third-party funding: Payments from accounts not matching player name
Request SAR filing statistics (numbers only, not actual SARs which are confidential)
What to ask: "How many SARs did you file last year?" Reputable operators file dozens to hundreds. Zero SARs suggests inadequate monitoring. Source: FinCEN - Casino and Card Club Red Flags
Enhanced Due Diligence (EDD) Requirements
Gambling operators must conduct EDD for high-risk customers:
```
Control area
What it covers
What to request
Key expectations
PEP screening
Identification and enhanced monitoring of Politically Exposed Persons.
PEP screening vendor details (World-Check, Dow Jones, etc.).
Screening required at onboarding and periodically thereafter.
OFAC / sanctions screening
Real-time screening against SDN lists and sectoral sanctions.
OFAC and sanctions compliance procedures and escalation flows.
Transactions must be blocked immediately upon a confirmed match.
High-value player monitoring
Enhanced oversight for players with large transaction volumes.
Must include source of funds verification and ongoing monitoring.
```
If they cannot provide these, they are not ready for payment processing.
5. Age and Geo Controls (Technical Verification)
Why it matters: Unlike license verification (administrative) and AML (financial), age and geo controls are technical safeguards preventing unlawful transactions in real-time. These are your first line of defense against UIGEA liability.
Geolocation Technology Requirements
Why self-reported location is insufficient: Users can easily lie about location. You need device-level verification that's harder to spoof.
State regulatory requirements: Most states mandate specific geolocation technology:
New Jersey: Requires real-time geolocation "within acceptable limits to determine location" (interpreted as within state borders)
Pennsylvania: Requires geolocation that ensures player is within state boundaries
Michigan: Mandates geolocation system approved by Gaming Control Board
Multi-factor location verification- Best practice uses 3+ signals:
GPS (Device Location Services)
Latitude/longitude from device GPS chip
Most accurate (3-10 meter precision)
Can be disabled by user or spoofed with modified devices
Wi-Fi Positioning
Triangulates location based on nearby Wi-Fi access points
Works indoors where GPS signal is weak
Database of Wi-Fi AP locations (Google, Skyhook, etc.)
Cell Tower Triangulation
Uses cellular network tower signals
Less accurate (100-1000 meter precision)
Harder to spoof than GPS
IP Address Geolocation
Least accurate (city-level at best)
Should be LEAST weighted factor
Easily bypassed with VPN/proxy
What good looks like: Geolocation vendor uses weighted algorithm combining all signals, requires 2-3 factors to agree before allowing transaction.
Geofencing Edge Cases
State border proximity:
Problem: User 50 feet from state border may show GPS coordinates in neighboring state
Solution: Request their "border buffer" policy. Reputable operators deny service within 1-2 miles of unlicensed state borders or require additional verification.
VPN/Proxy detection:
Problem: Users in restricted states use VPNs to mask location
Solution: Request their VPN detection methods:
IP address blacklists (known VPN/proxy servers)
DNS leak detection
WebRTC leak detection
Port scanning for VPN indicators
Multiple failed geolocation attempts = red flag
Location spoofing apps:
Problem: Rooted/jailbroken phones can run location spoofing apps
Solution: Ask about device integrity checks:
Jailbreak/root detection
Developer mode detection
Mock location setting detection (Android)
Tribal land complications:
Problem: User physically on tribal casino property in state without online gambling
Solution: Should be blocked unless tribal-state compact explicitly allows
Request map of tribal geofences if applicable
What to Request from Merchant
Control area
What to review
What to request
Key expectations
Geolocation vendor contract
Third-party provider used to determine player location.
Executed contract with approved vendor (GeoComply, Localize, Neosurf, GeoGuard).
Homegrown or unknown vendors are a red flag due to insufficient testing.
Geolocation configuration documentation
Technical logic used to determine user location.
Signals used, weighting logic for conflicting signals, accuracy thresholds, and border buffer zones.
Configuration must meet jurisdiction-specific precision requirements.
VPN / proxy blocking procedures
Controls to prevent location masking and circumvention.
Detection methods, blacklists in use, and blacklist update frequency.
Outdated or static lists increase evasion risk.
Geolocation testing evidence
Validation that controls work as intended.
Penetration testing reports, regulatory approvals if required, and logs of blocked out-of-state attempts.
Evidence should demonstrate consistent blocking of unauthorized states.
Failure handling
Behavior when location confidence is insufficient.
Decision logic and fallback rules.
Must default to DENY to prevent unauthorized wagering.
User experience
How and when geolocation checks are presented to the user.
Screenshots or recordings of the geolocation flow.
Geolocation must occur before accepting deposits, not after.
Age Verification Technology
Why age gates are insufficient: Checkbox "I am 21+" is not verification. Underage gambling is both illegal and reputationally catastrophic.
State requirements:
All states require age verification, but rigor varies
New Jersey: Must verify age and identity using "reliable third-party databases"
Pennsylvania: Must verify age at registration before allowing play
Confirmed licensing status via regulatory phone call
Reviewed sample of marketing materials (compliant)
Common Misses: Red Flags That Disqualify Merchants
1. "We are licensed" without state scope
The claim: "We're a licensed gambling operator in the United States."
The problem: This is meaningless without specifics. There is no "US gambling license."
What's really happening:
They have ONE state license but are serving customers in unauthorized states
They have an offshore license (Curacao, Malta, etc.) and mistakenly think it authorizes US operations
They're in the application process but not yet approved
They're operating under someone else's license without proper white-label agreements
How to catch it:
Ask: "Please provide your license number and issuing state for every state where you accept customers."
If they hesitate, provide only one license, or mention "international" licenses, STOP.
Cross-reference their website's Terms of Service - which states do they list as eligible?
Check their geolocation - attempt access from multiple states
Real-world example: A DFS operator claimed to be "licensed in the US" but only held a New York registration. Investigation revealed they were accepting players from Texas (where DFS is legally gray) and Florida (explicitly illegal at the time). They were facilitating unlawful gambling under UIGEA.
Why it matters: Processing payments for unlawful gambling violates UIGEA. The payment processor (you) faces potential penalties, even if the merchant claimed to be licensed.
Affiliates using aggressive tactics (bonuses with no playthrough, "guaranteed" language)
What good looks like:
Detailed affiliate compliance manual
Regular affiliate audits (quarterly reviews of marketing materials)
Affiliate training on regulatory compliance
Ability to immediately terminate non-compliant affiliates
<30% of traffic from affiliates (diversified acquisition)
Real-world example: A sports betting operator used affiliates to drive traffic from states where they weren't licensed. Affiliates ran Google Ads targeting those states. When state AG investigated, operator claimed ignorance, but payment processor was named in enforcement action for facilitating unlawful gambling.
3. Unclear payout roles
The claim: "We're a technology platform connecting players with gambling opportunities."
The problem: This vague description obscures who actually holds player funds and processes payouts, making it impossible to properly assess risk.
What's really happening:
They're trying to avoid operator-level licensing by claiming to be "just tech"
They DO process payments but don't want to admit it
They have a complex multi-party arrangement they don't want to explain
Regulatory: If they're processing payouts, they're likely operating as an operator (or payment processor) and need appropriate licenses
Reserve requirements: You can't properly calculate reserves if you don't know who holds funds
Chargeback liability: Unclear who's responsible for funding chargebacks
Fraud risk: Complex payment flows obscure fraud
How to catch it:
Ask the direct question: "When a player deposits $100 and wins $50, where does that $150 go before they withdraw it?"
What good looks like: "Deposit goes into player account held in our name at [Bank Name], segregated from operational funds. Winnings are credited to the same player account. Withdrawal goes from that account via ACH to player's bank."
Red flags:
"It depends..."
"Funds flow through our technology partners..."
"We're just the platform, the operators handle payments..."
Who does the customer have a financial relationship with?
Whose name appears on bank/card statements?
Request bank statements:
Where are player funds actually held?
In whose name is the account?
Is it segregated or comingled?
Complex scenarios that require extra scrutiny:
Peer-to-peer gambling:
Example: Poker rooms where players bet against each other, not the house
Platform takes "rake" (commission)
Question: Who holds the prize pool before the game concludes?
Risk: If platform holds funds, they need operator license even though they're not "house"
Multi-party white-label:
Platform Provider provides tech
Licensed Operator provides license
Payment Processor processes transactions
Question: Who is the merchant of record? Who holds player funds?
Risk: Everyone points fingers when something goes wrong
Offshore-US hybrid:
Technology platform hosted offshore
US-licensed entity as "face"
Question: Where do funds actually flow?
Risk: Potentially structured to evade US regulations
What good looks like:
Single entity as merchant of record
That entity holds licenses in all operating states
Clear custody of player funds
Direct payment processing relationship
Transparent Terms of Service
Real-world example: A "fantasy sports platform" claimed to be just technology, but investigation revealed they held player entry fees in pooled accounts before distributing prizes. They were operating as a fantasy sports operator but only had a technology vendor license. This was unlicensed money transmission.
4. Additional Red Flags
Financial red flags:
Reluctance to provide financial statements
Negative cash flow
Player balances exceed liquid assets (insolvency risk)
Recent ownership changes without regulatory approval
Pending litigation (especially class actions)
Operational red flags:
High employee turnover (especially compliance team)
No US-based compliance staff (overseas outsourcing)
Generic email addresses (support@, info@) rather than named contacts
Website down frequently or poor user experience
Minimal social media presence or negative sentiment
Marketing red flags:
Celebrity endorsements without responsible gambling disclosures
Advertising that appeals to minors (cartoons, youth sports, etc.)
Industry news (Legal Sports Report, CDC Gaming Reports)
Your First Question: The Critical Artifact
After reviewing all the above, the single most important artifact to request first is:
"Please provide copies of all active gambling licenses, including license numbers, issuing authorities, and state-specific scope of authorization."
Why this is the first question:
Foundation: Without valid licenses, nothing else matters. No amount of compliance or technical sophistication can overcome unlicensed operation.
Efficiency: Requesting licenses first saves time. If they can't produce proper licenses, you stop here.
Verification: Licenses can be independently verified with regulatory authorities, giving you ground truth.
Scope definition: Licenses tell you exactly which states they're authorized to operate in, defining the geographic boundaries for all other verification.
Risk classification: License types (operator vs supplier, sports vs casino, etc.) determine which underwriting standards apply.
What you're looking for in the response:
✅ Good response
New Jersey Internet Gaming Permit #IG-123456 (expires 12/31/2026) - sports betting and casino
Michigan Internet Gaming Operator License #MI-IG-345678 (expires 3/15/2027) - sports betting and casino
🚩 Red flag response
"We're licensed to operate in the United States. We're currently in the licensing process in several states."
Follow-up if response is inadequate:
"I need to see the actual license certificates issued by state gaming authorities. Applications in progress do not constitute authorization to operate. We cannot proceed until you provide copies of all active licenses for states where you currently accept customers."
Immediate next steps after receiving licenses:
Verify authenticity (same day):
Call state gaming authority licensing department
Confirm license number is active and in good standing
Ask about any enforcement actions or pending investigations
Cross-reference scope (same day):
Compare licensed states to states listed on merchant's website
Check Terms of Service for geographic restrictions
Verify they're not accepting customers from unlicensed states
Determine license type (same day):
Operator or supplier/vendor?
Sports, casino, DFS, or other?
This determines which sections of this guide apply
Request remaining documentation (based on findings):
If operator licenses: Request full AML, financial, technical documentation
If supplier licenses: Request operator agreements, vendor registrations
If any concerns: Request explanation before proceeding
This single artifact acts as the gateway to the entire underwriting process. No merchant should proceed past initial inquiry without producing valid, verifiable gambling licenses.
Conclusion: Building a Sustainable Gambling Payments Practice
Gambling merchant underwriting is fundamentally different from standard merchant risk assessment. You're not just evaluating fraud risk and chargeback rates - you're validating regulatory compliance across multiple jurisdictions, assessing technical controls to prevent unlawful transactions, and ensuring financial stability to protect player funds.
The framework we've outlined gives you:
Regulatory validation: License verification and state-by-state scope mapping
Compliance assessment: AML programs, FinCEN registration, suspicious activity monitoring
Technical verification: Geolocation, age verification, responsible gaming controls
Licensing is foundational: Never process payments for unlicensed gambling. UIGEA liability flows to you.
State-by-state verification: There is no "US gambling license." Each state must be verified independently.
Operator vs supplier classification matters: Different risk profiles require different underwriting standards.
Technical controls are your first defense: Geolocation and age verification prevent unlawful transactions in real-time.
Financial reserves protect everyone: Proper reserves ensure players can be paid and chargebacks can be funded.
Documentation is non-negotiable: "We're compliant" means nothing without evidence.
Building expertise in gambling payments -
As you underwrite more gambling merchants, you'll develop pattern recognition:
Which license types indicate sophisticated operators
Which geolocation vendors are reliable
What chargeback rates are sustainable
Which states have the most rigorous requirements
This expertise becomes a competitive advantage, allowing you to:
Price risk more accurately
Approve quality merchants faster
Identify problems earlier
Build long-term relationships with reputable operators
The gambling industry is evolving rapidly:
More states are legalizing online gambling each year
Regulatory standards are increasing
Technology is improving (better geofencing, faster payouts)
Consolidation is occurring (large operators acquiring smaller ones)
Your underwriting framework must evolve with the industry. Stay current by:
Monitoring state legislative developments (Legal Sports Report, CDC Gaming Reports)
Following regulatory actions (state gaming commission press releases)
Participating in industry associations (Payments Innovation Alliance, AGA)
Reviewing updated guidance from FinCEN and DOJ
Ballerine's role: We provide the infrastructure to make this complex underwriting process manageable - automated license verification, real-time monitoring, risk scoring, and regulatory change alerts.
But the foundational knowledge in this guide gives you the expertise to ask the right questions, identify the red flags, and protect your payment processing business while supporting the growth of regulated gambling.
Secure Your High-Risk Merchant Onboarding With Ballertine
US gambling underwriting is a licensing problem first, payments problem second.
When a merchant approaches you for US card acceptance for betting, casino, DFS, or similar gambling services, the complexity isn't in the payment rails - it's in navigating a fragmented regulatory landscape where each state operates as its own jurisdiction. Unlike most merchant categories where you verify business legitimacy and fraud controls, gambling requires you to become a quasi-regulatory auditor, validating licensing status across multiple jurisdictions before you even consider payment risk.
This guide walks you through the complete underwriting framework Ballerine uses to evaluate US gambling merchants.
The Regulatory Patchwork
The United States operates under a state-by-state gambling framework following the 2018 Supreme Court decision in Murphy v. NCAA, which struck down the Professional and Amateur Sports Protection Act (PASPA). This decision allowed states to legalize sports betting independently, creating a complex jurisdictional map.
As of 2025, the landscape includes:
38+ states
With some form of legal sports betting, online, retail, or both
6 states
With legal online casino or iGaming: NJ, PA, MI, WV, DE, CT
19 states
Where daily fantasy sports is explicitly legal and regulated
Tribal gaming
Jurisdictions operating under separate federal frameworks under IGRA
Before examining state licenses, understand the federal requirements that apply to all US gambling operators:
1. Wire Act(18 U.S.C. § 1084): Prohibits interstate gambling-related wire communications for sports betting. The 2011 DOJ opinion narrowed this to sports betting only, opening the door for online poker and casino where states permit.
2. Unlawful Internet Gambling Enforcement Act(UIGEA, 31 U.S.C. §§ 5361-5367): Doesn't prohibit gambling itself, but prohibits payment processors from knowingly accepting payments for unlawful internet gambling. This places compliance burden on payment facilitators.
3. Bank Secrecy Act/AML Requirements: Gambling businesses accepting $10,000+ in cash equivalent (including electronic deposits) must register as Money Services Businesses with FinCEN (31 CFR § 1021.380).
Key takeaway: Even with state licenses, federal law makes YOU (the payment processor) liable for facilitating unlawful gambling transactions. Your underwriting must verify state-level legality to maintain UIGEA compliance.
What We Verify: The Complete Checklist
1. License Type and Issuing Authority
Why it matters: Different gambling verticals require different licenses, issued by different state authorities, with varying levels of scrutiny. A merchant saying "we're licensed" is meaningless without specifics.
License Categories
Sports Betting Licenses
Operator License: Authorizes accepting wagers, setting odds, holding player funds
Online Casino/iGaming Licenses - Only available in NJ, PA, MI, WV, DE, CT. These are the most stringent licenses, requiring:
Partnership with existing land-based casino (market access)
Multi-year probity investigations
$10M-20M in licensing fees
Ongoing technical audits
Example: In New Jersey, you need an Internet Gaming Permit issued by the Division of Gaming Enforcement (DGE), which requires a partnership with an Atlantic City casino license holder.
Daily Fantasy Sports (DFS) Registrations - DFS operators often require registrations rather than full licenses in states where DFS is classified as a "game of skill" rather than gambling:
Lighter regulatory touch
Lower fees ($5K-50K vs millions)
Still requires consumer protection compliance
Example: In New York, DFS operators must register with the Gaming Commission and pay a 15% tax on gross revenue.
Social Casino Exemptions - Some operators claim exemption by offering "social casino" (play-money only, no cash prizes). This is NOT gambling in most jurisdictions BUT:
Verification required that no real-money prizes are awarded
In-app purchases for virtual currency have payment implications
Some states still regulate (Washington prohibits social casino)
What to Request -
Required documents:
Primary License Certificate: Official document from state gaming authority showing:
License number and type
Legal entity name (must match merchant application)
Issue and expiration dates
Authorized activities and limitations
State(s) of operation
License Verification: Don't rely solely on provided documents. Verify directly:
Call the regulatory body's licensing department to confirm active status
Multi-State Operators: If they claim licenses in multiple states, request ALL state licenses. We've seen merchants show their "best" license (usually New Jersey) while operating unlicensed in other states.
Vendor Agreements: For platform providers/suppliers, request operator agreements showing which licensed operators they serve. They should NOT be accepting consumer payments directly unless they hold operator licenses.
Red Flags
"We're pursuing licenses": Not licensed = cannot process payments. Period.
Offshore licenses: Curacao, Malta, or UK licenses are irrelevant for US operations and often signal intent to serve US customers unlawfully
Tribal licenses without state compacts: Tribal gaming operates under IGRA, but online gambling from tribal lands serving customers off-reservation requires state compacts (see Michigan v. Bay Mills Indian Community)
Mismatched entities: License issued to "ABC Gaming LLC" but merchant application from "ABC Inc."
2. State Coverage Mapping
A license doesn't grant nationwide rights. You need precise geographic boundaries to configure payment blocking and comply with UIGEA.
State
Legal status
License status
Go-live date
Restrictions
NJ
Legal - Sports & Casino
Licensed (IG-123456)
Active
21+ only
PA
Legal - Sports & Casino
Licensed (PA-SB-789)
Active
21+ only
NY
Legal - Sports only
Licensed (NY-2023-001)
Active
21+, in-person registration required
CA
Not legal
N/A
N/A
BLOCKED
NV
Legal - Sports (retail only)
No online license
N/A
BLOCKED for online
Key considerations:
In-person registration requirements: Some states require initial registration at physical locations:
New York (until 2022): Required in-person registration at upstate casinos for online sports betting
Illinois: Required in-person registration initially, later removed
Check current requirements as these evolve
Some licenses restrict betting to on-property only:
Nevada: Most online sports betting apps are geo-restricted to casino property
New Jersey: Can accept bets statewide, not just casino premises
Age requirements:
Most states: 21+
Montana, Rhode Island, Washington State (tribal): 18+ allowed
Your payment systems should enforce age verification before processing
Which geolocation vendor they use (GeoComply, Localize, Neosurf)
How they handle edge cases (near state borders, mobile users)
Logs showing blocking effectiveness
Review their Terms of Service and restricted jurisdiction lists: Should clearly list prohibited states
Test their platform:
Use VPN to attempt access from prohibited states
Check if they accept registrations with addresses in unauthorized states
Verify age gates and identity verification flow
Check regulatory actions: Search "[Company Name] + cease and desist" or check:
State gaming commission enforcement actions
Attorney General consumer protection actions
Better Business Bureau complaints
Example: In 2022, multiple state AGs sent cease-and-desist letters to offshore gambling sites. If your merchant received one, they have demonstrated willful non-compliance.
3. Operator vs Supplier Classification
Why it matters: Operators and suppliers have fundamentally different risk profiles and regulatory requirements. Misclassification leads to improper underwriting and compliance gaps.
Operator Definition -
An operator (or "license holder") is an entity that:
Accepts wagers directly from consumers
Sets odds and betting lines (or contracts with odds provider under their license)
Vendor/supplier license or verification of exemption
Contracts with licensed operators showing relationship
Proof they do NOT hold consumer funds directly
Data security and tech compliance certifications
If processing payments: PCI-DSS, SOC 2 reports
The Gray Area: White-Label and API Arrangements
Many modern gambling operations blur operator/supplier lines -
White-label arrangements:
Operating model
How it works
Payments & funds handling
Risk & notes
White-label arrangements
Supplier provides the full platform including technology, odds, and risk management.
Operator holds the gambling license and owns the customer relationship.
Clarify who processes payments and who holds player funds. This must be explicitly documented in contracts.
High risk if payment responsibility is unclear.
Always obtain written confirmation.
API integrations
Operator consumes supplier APIs for odds, pricing, and bet settlement.
Core platform and customer experience remain with the operator.
Operator maintains payment processing and fund custody.
Generally clearer classification.
Still verify data flow and fund ownership.
Affiliate networks
Affiliates promote gambling sites in exchange for commission.
Affiliates must never process payments or accept wagers.
If payments or wagers are involved, classification is incorrect.
Affiliates should not require gambling payment processing.
What to request?
Business model documentation: Detailed explanation of their role in the value chain
Operator agreements (for suppliers): Contracts showing which licensed operators they serve
Payment flow diagrams: Visual showing money movement from consumer to ultimate recipient
Account structure:
Do they hold consumer funds? (Operator)
Do they only receive B2B payments from operators? (Supplier)
State vendor licenses: Even suppliers often need state registration:
Gambling businesses are FinCEN-regulated MSBs under the Bank Secrecy Act (31 CFR 1021.380). Inadequate AML programs expose you to regulatory liability as their payment processor.
Federal Registration Requirements
FinCEN MSB Registration (Required if the merchant):
Accepts $10,000+ in cash or cash equivalents within a gaming day (31 CFR 1021.380(b)(3))
For online gambling, "cash equivalents" include deposits via cards, ACH, e-wallets
What to verify:
Form 107 (Registration of Money Services Business): Request copy showing:
Business name and address
Type of MSB activity (check "casino/gambling")
Registration number
Filed within 180 days of meeting threshold
Verify registration: Search FinCEN MSB Registrant Search (Note: Public access limited; may need to request proof from merchant)
Renewal compliance: Registration expires every 2 years, must be renewed
Under 31 CFR 1021.210, gambling MSBs must maintain a written AML program including:
1. Internal Policies and Procedures
Request their BSA/AML Policy Manual covering:
Customer Due Diligence (CDD) procedures
Enhanced Due Diligence (EDD) triggers
Transaction monitoring thresholds and rules
Record retention policies (5 years minimum)
Suspicious activity identification criteria
What good looks like: 50-100+ page manual with specific dollar thresholds, escalation procedures, examples of suspicious patterns
Red flag: Generic template without gambling-specific scenarios
2. Designated AML Compliance Officer
Must appoint individual responsible for AML program:
Request name, title, qualifications
Verify they have authority and resources
Should be senior-level, not outsourced overseas
3. Ongoing Training Program
Employees handling transactions must receive AML training:
Request training materials and attendance records
Should cover gambling-specific typologies (structuring, chip dumping, collusion)
Annual refresher training minimum
4. Independent Testing/Audit
Annual independent review required:
Request most recent audit report
Should be conducted by external firm or separate internal audit dept
Report should identify deficiencies and remediation plans
Red flag: No audit conducted, or audit is 2+ years old
Transaction Monitoring Requirements
Currency Transaction Reports (CTRs):
Required for cash transactions over $10,000 in a gaming day (31 CFR 1021.311)
For online gambling: Typically triggered by deposit aggregation
Request their CTR filing procedures and evidence of filed CTRs
Suspicious Activity Reports (SARs):
Required within 30 days of detecting suspicious activity (31 CFR 1021.320)
Common gambling SAR triggers:
Structuring: Multiple deposits just under reporting thresholds
Rapid movement: Deposit followed immediately by withdrawal (money laundering)
Minimal play: Deposits with little actual gambling activity
Third-party funding: Payments from accounts not matching player name
Request SAR filing statistics (numbers only, not actual SARs which are confidential)
What to ask: "How many SARs did you file last year?" Reputable operators file dozens to hundreds. Zero SARs suggests inadequate monitoring. Source: FinCEN - Casino and Card Club Red Flags
Enhanced Due Diligence (EDD) Requirements
Gambling operators must conduct EDD for high-risk customers:
```
Control area
What it covers
What to request
Key expectations
PEP screening
Identification and enhanced monitoring of Politically Exposed Persons.
PEP screening vendor details (World-Check, Dow Jones, etc.).
Screening required at onboarding and periodically thereafter.
OFAC / sanctions screening
Real-time screening against SDN lists and sectoral sanctions.
OFAC and sanctions compliance procedures and escalation flows.
Transactions must be blocked immediately upon a confirmed match.
High-value player monitoring
Enhanced oversight for players with large transaction volumes.
Must include source of funds verification and ongoing monitoring.
```
If they cannot provide these, they are not ready for payment processing.
5. Age and Geo Controls (Technical Verification)
Why it matters: Unlike license verification (administrative) and AML (financial), age and geo controls are technical safeguards preventing unlawful transactions in real-time. These are your first line of defense against UIGEA liability.
Geolocation Technology Requirements
Why self-reported location is insufficient: Users can easily lie about location. You need device-level verification that's harder to spoof.
State regulatory requirements: Most states mandate specific geolocation technology:
New Jersey: Requires real-time geolocation "within acceptable limits to determine location" (interpreted as within state borders)
Pennsylvania: Requires geolocation that ensures player is within state boundaries
Michigan: Mandates geolocation system approved by Gaming Control Board
Multi-factor location verification- Best practice uses 3+ signals:
GPS (Device Location Services)
Latitude/longitude from device GPS chip
Most accurate (3-10 meter precision)
Can be disabled by user or spoofed with modified devices
Wi-Fi Positioning
Triangulates location based on nearby Wi-Fi access points
Works indoors where GPS signal is weak
Database of Wi-Fi AP locations (Google, Skyhook, etc.)
Cell Tower Triangulation
Uses cellular network tower signals
Less accurate (100-1000 meter precision)
Harder to spoof than GPS
IP Address Geolocation
Least accurate (city-level at best)
Should be LEAST weighted factor
Easily bypassed with VPN/proxy
What good looks like: Geolocation vendor uses weighted algorithm combining all signals, requires 2-3 factors to agree before allowing transaction.
Geofencing Edge Cases
State border proximity:
Problem: User 50 feet from state border may show GPS coordinates in neighboring state
Solution: Request their "border buffer" policy. Reputable operators deny service within 1-2 miles of unlicensed state borders or require additional verification.
VPN/Proxy detection:
Problem: Users in restricted states use VPNs to mask location
Solution: Request their VPN detection methods:
IP address blacklists (known VPN/proxy servers)
DNS leak detection
WebRTC leak detection
Port scanning for VPN indicators
Multiple failed geolocation attempts = red flag
Location spoofing apps:
Problem: Rooted/jailbroken phones can run location spoofing apps
Solution: Ask about device integrity checks:
Jailbreak/root detection
Developer mode detection
Mock location setting detection (Android)
Tribal land complications:
Problem: User physically on tribal casino property in state without online gambling
Solution: Should be blocked unless tribal-state compact explicitly allows
Request map of tribal geofences if applicable
What to Request from Merchant
Control area
What to review
What to request
Key expectations
Geolocation vendor contract
Third-party provider used to determine player location.
Executed contract with approved vendor (GeoComply, Localize, Neosurf, GeoGuard).
Homegrown or unknown vendors are a red flag due to insufficient testing.
Geolocation configuration documentation
Technical logic used to determine user location.
Signals used, weighting logic for conflicting signals, accuracy thresholds, and border buffer zones.
Configuration must meet jurisdiction-specific precision requirements.
VPN / proxy blocking procedures
Controls to prevent location masking and circumvention.
Detection methods, blacklists in use, and blacklist update frequency.
Outdated or static lists increase evasion risk.
Geolocation testing evidence
Validation that controls work as intended.
Penetration testing reports, regulatory approvals if required, and logs of blocked out-of-state attempts.
Evidence should demonstrate consistent blocking of unauthorized states.
Failure handling
Behavior when location confidence is insufficient.
Decision logic and fallback rules.
Must default to DENY to prevent unauthorized wagering.
User experience
How and when geolocation checks are presented to the user.
Screenshots or recordings of the geolocation flow.
Geolocation must occur before accepting deposits, not after.
Age Verification Technology
Why age gates are insufficient: Checkbox "I am 21+" is not verification. Underage gambling is both illegal and reputationally catastrophic.
State requirements:
All states require age verification, but rigor varies
New Jersey: Must verify age and identity using "reliable third-party databases"
Pennsylvania: Must verify age at registration before allowing play
Confirmed licensing status via regulatory phone call
Reviewed sample of marketing materials (compliant)
Common Misses: Red Flags That Disqualify Merchants
1. "We are licensed" without state scope
The claim: "We're a licensed gambling operator in the United States."
The problem: This is meaningless without specifics. There is no "US gambling license."
What's really happening:
They have ONE state license but are serving customers in unauthorized states
They have an offshore license (Curacao, Malta, etc.) and mistakenly think it authorizes US operations
They're in the application process but not yet approved
They're operating under someone else's license without proper white-label agreements
How to catch it:
Ask: "Please provide your license number and issuing state for every state where you accept customers."
If they hesitate, provide only one license, or mention "international" licenses, STOP.
Cross-reference their website's Terms of Service - which states do they list as eligible?
Check their geolocation - attempt access from multiple states
Real-world example: A DFS operator claimed to be "licensed in the US" but only held a New York registration. Investigation revealed they were accepting players from Texas (where DFS is legally gray) and Florida (explicitly illegal at the time). They were facilitating unlawful gambling under UIGEA.
Why it matters: Processing payments for unlawful gambling violates UIGEA. The payment processor (you) faces potential penalties, even if the merchant claimed to be licensed.
Affiliates using aggressive tactics (bonuses with no playthrough, "guaranteed" language)
What good looks like:
Detailed affiliate compliance manual
Regular affiliate audits (quarterly reviews of marketing materials)
Affiliate training on regulatory compliance
Ability to immediately terminate non-compliant affiliates
<30% of traffic from affiliates (diversified acquisition)
Real-world example: A sports betting operator used affiliates to drive traffic from states where they weren't licensed. Affiliates ran Google Ads targeting those states. When state AG investigated, operator claimed ignorance, but payment processor was named in enforcement action for facilitating unlawful gambling.
3. Unclear payout roles
The claim: "We're a technology platform connecting players with gambling opportunities."
The problem: This vague description obscures who actually holds player funds and processes payouts, making it impossible to properly assess risk.
What's really happening:
They're trying to avoid operator-level licensing by claiming to be "just tech"
They DO process payments but don't want to admit it
They have a complex multi-party arrangement they don't want to explain
Regulatory: If they're processing payouts, they're likely operating as an operator (or payment processor) and need appropriate licenses
Reserve requirements: You can't properly calculate reserves if you don't know who holds funds
Chargeback liability: Unclear who's responsible for funding chargebacks
Fraud risk: Complex payment flows obscure fraud
How to catch it:
Ask the direct question: "When a player deposits $100 and wins $50, where does that $150 go before they withdraw it?"
What good looks like: "Deposit goes into player account held in our name at [Bank Name], segregated from operational funds. Winnings are credited to the same player account. Withdrawal goes from that account via ACH to player's bank."
Red flags:
"It depends..."
"Funds flow through our technology partners..."
"We're just the platform, the operators handle payments..."
Who does the customer have a financial relationship with?
Whose name appears on bank/card statements?
Request bank statements:
Where are player funds actually held?
In whose name is the account?
Is it segregated or comingled?
Complex scenarios that require extra scrutiny:
Peer-to-peer gambling:
Example: Poker rooms where players bet against each other, not the house
Platform takes "rake" (commission)
Question: Who holds the prize pool before the game concludes?
Risk: If platform holds funds, they need operator license even though they're not "house"
Multi-party white-label:
Platform Provider provides tech
Licensed Operator provides license
Payment Processor processes transactions
Question: Who is the merchant of record? Who holds player funds?
Risk: Everyone points fingers when something goes wrong
Offshore-US hybrid:
Technology platform hosted offshore
US-licensed entity as "face"
Question: Where do funds actually flow?
Risk: Potentially structured to evade US regulations
What good looks like:
Single entity as merchant of record
That entity holds licenses in all operating states
Clear custody of player funds
Direct payment processing relationship
Transparent Terms of Service
Real-world example: A "fantasy sports platform" claimed to be just technology, but investigation revealed they held player entry fees in pooled accounts before distributing prizes. They were operating as a fantasy sports operator but only had a technology vendor license. This was unlicensed money transmission.
4. Additional Red Flags
Financial red flags:
Reluctance to provide financial statements
Negative cash flow
Player balances exceed liquid assets (insolvency risk)
Recent ownership changes without regulatory approval
Pending litigation (especially class actions)
Operational red flags:
High employee turnover (especially compliance team)
No US-based compliance staff (overseas outsourcing)
Generic email addresses (support@, info@) rather than named contacts
Website down frequently or poor user experience
Minimal social media presence or negative sentiment
Marketing red flags:
Celebrity endorsements without responsible gambling disclosures
Advertising that appeals to minors (cartoons, youth sports, etc.)
Industry news (Legal Sports Report, CDC Gaming Reports)
Your First Question: The Critical Artifact
After reviewing all the above, the single most important artifact to request first is:
"Please provide copies of all active gambling licenses, including license numbers, issuing authorities, and state-specific scope of authorization."
Why this is the first question:
Foundation: Without valid licenses, nothing else matters. No amount of compliance or technical sophistication can overcome unlicensed operation.
Efficiency: Requesting licenses first saves time. If they can't produce proper licenses, you stop here.
Verification: Licenses can be independently verified with regulatory authorities, giving you ground truth.
Scope definition: Licenses tell you exactly which states they're authorized to operate in, defining the geographic boundaries for all other verification.
Risk classification: License types (operator vs supplier, sports vs casino, etc.) determine which underwriting standards apply.
What you're looking for in the response:
✅ Good response
New Jersey Internet Gaming Permit #IG-123456 (expires 12/31/2026) - sports betting and casino
Michigan Internet Gaming Operator License #MI-IG-345678 (expires 3/15/2027) - sports betting and casino
🚩 Red flag response
"We're licensed to operate in the United States. We're currently in the licensing process in several states."
Follow-up if response is inadequate:
"I need to see the actual license certificates issued by state gaming authorities. Applications in progress do not constitute authorization to operate. We cannot proceed until you provide copies of all active licenses for states where you currently accept customers."
Immediate next steps after receiving licenses:
Verify authenticity (same day):
Call state gaming authority licensing department
Confirm license number is active and in good standing
Ask about any enforcement actions or pending investigations
Cross-reference scope (same day):
Compare licensed states to states listed on merchant's website
Check Terms of Service for geographic restrictions
Verify they're not accepting customers from unlicensed states
Determine license type (same day):
Operator or supplier/vendor?
Sports, casino, DFS, or other?
This determines which sections of this guide apply
Request remaining documentation (based on findings):
If operator licenses: Request full AML, financial, technical documentation
If supplier licenses: Request operator agreements, vendor registrations
If any concerns: Request explanation before proceeding
This single artifact acts as the gateway to the entire underwriting process. No merchant should proceed past initial inquiry without producing valid, verifiable gambling licenses.
Conclusion: Building a Sustainable Gambling Payments Practice
Gambling merchant underwriting is fundamentally different from standard merchant risk assessment. You're not just evaluating fraud risk and chargeback rates - you're validating regulatory compliance across multiple jurisdictions, assessing technical controls to prevent unlawful transactions, and ensuring financial stability to protect player funds.
The framework we've outlined gives you:
Regulatory validation: License verification and state-by-state scope mapping
Compliance assessment: AML programs, FinCEN registration, suspicious activity monitoring
Technical verification: Geolocation, age verification, responsible gaming controls
Licensing is foundational: Never process payments for unlicensed gambling. UIGEA liability flows to you.
State-by-state verification: There is no "US gambling license." Each state must be verified independently.
Operator vs supplier classification matters: Different risk profiles require different underwriting standards.
Technical controls are your first defense: Geolocation and age verification prevent unlawful transactions in real-time.
Financial reserves protect everyone: Proper reserves ensure players can be paid and chargebacks can be funded.
Documentation is non-negotiable: "We're compliant" means nothing without evidence.
Building expertise in gambling payments -
As you underwrite more gambling merchants, you'll develop pattern recognition:
Which license types indicate sophisticated operators
Which geolocation vendors are reliable
What chargeback rates are sustainable
Which states have the most rigorous requirements
This expertise becomes a competitive advantage, allowing you to:
Price risk more accurately
Approve quality merchants faster
Identify problems earlier
Build long-term relationships with reputable operators
The gambling industry is evolving rapidly:
More states are legalizing online gambling each year
Regulatory standards are increasing
Technology is improving (better geofencing, faster payouts)
Consolidation is occurring (large operators acquiring smaller ones)
Your underwriting framework must evolve with the industry. Stay current by:
Monitoring state legislative developments (Legal Sports Report, CDC Gaming Reports)
Following regulatory actions (state gaming commission press releases)
Participating in industry associations (Payments Innovation Alliance, AGA)
Reviewing updated guidance from FinCEN and DOJ
Ballerine's role: We provide the infrastructure to make this complex underwriting process manageable - automated license verification, real-time monitoring, risk scoring, and regulatory change alerts.
But the foundational knowledge in this guide gives you the expertise to ask the right questions, identify the red flags, and protect your payment processing business while supporting the growth of regulated gambling.
.png){kind=logo}
.png)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.png)
