Reference
iGaming Payments Glossary
Plain-English definitions of the payment terms every iGaming operator and provider needs to know. 88 terms covering acquiring, fraud, compliance, local payment methods, orchestration, and more.
88Terms defined
10Categories
UK EnglishThroughout
3
3DS2 (the current version) enables frictionless authentication for low-risk transactions — the issuer approves without asking the cardholder to take any additional action. For higher-risk transactions, a challenge step is presented (usually a one-time code by SMS or app notification). Under EU PSD2, SCA using 3DS is mandatory for online card payments, and operators who implement it correctly shift liability for fraud to the issuing bank.
A
Also called an acquiring bank. The acquirer holds the merchant account, settles funds, and takes on the financial risk of card transactions. In iGaming, finding a willing acquirer is often the biggest challenge — many banks decline gambling merchants entirely due to high chargeback rates and regulatory complexity.
APMs include bank transfers, e-wallets, vouchers, crypto, and local schemes like Pix in Brazil or iDEAL in the Netherlands. For iGaming operators, APMs are often essential — card penetration is low in many target markets, and APMs can offer lower processing fees, faster settlement, and fewer chargeback risks.
iGaming operators are legally required to implement AML controls. This includes transaction monitoring, suspicious activity reporting, and customer due diligence. Under UKGC rules, operators must have a documented AML policy and appoint a Money Laundering Reporting Officer (MLRO). Failure to comply results in significant fines — the UKGC issued over £100m in penalties between 2020 and 2024.
Most payment providers offer a REST API that allows operators to initiate payments, check transaction status, and receive webhooks. API integration gives operators full control over the checkout experience but requires developer resource. The alternative is a hosted payment page — simpler to integrate but less customisable.
Approval rate is one of the most important metrics for any iGaming operator. A rate of 75% means 1 in 4 deposit attempts fails — those are lost players and lost revenue. Rates above 80% are achievable with the right acquirer relationships and smart routing. Rates above 85% require payment orchestration across multiple acquirers.
ATOs are a significant problem in iGaming because accounts hold real money and can be emptied quickly. Common vectors include credential stuffing (using leaked username/password combinations from other breaches), phishing, and SIM swapping. Strong authentication (MFA, device fingerprinting) and behavioural analytics reduce ATO exposure.
When a player submits their card details, the acquirer sends an authorization request to the card scheme, which forwards it to the issuing bank. The issuer checks the cardholder's available funds and fraud risk, then responds with an approval or decline code. Authorization reserves the funds but does not move them — that happens at capture.
B
BaaS enables fintechs and iGaming companies to offer banking features — IBANs, card issuing, account management — without holding their own banking licence. Providers like Modulr, Banking Circle, and Railsr operate in this space. For iGaming, BaaS is used to create player e-wallets, ring-fenced fund accounts, and fast payout infrastructure.
BIN data tells the acquirer whether a card is credit or debit, which country it was issued in, and which bank issued it. Acquirers use BIN tables to route transactions and assess risk. iGaming operators can improve approval rates by routing transactions to acquirers with strong relationships in the cardholder's issuing country.
BLIK is the dominant payment method in Poland, used by over 15 million people. It's accepted at nearly all Polish-facing online casinos. Players generate a code in their banking app and enter it at checkout — no card details required, no chargeback risk for the operator. Approval rates are extremely high.
C
Authorization and capture are often two separate steps. A pre-authorisation holds funds on the cardholder's card; capture actually moves them. Most iGaming deposits are captured immediately (auth and capture happen together). Pre-auth/capture splits are more common in hotel bookings and rental payments.
Visa and Mastercard are the dominant card schemes globally. American Express operates as both scheme and issuer. Card schemes set interchange rates, chargeback rules, merchant category codes, and compliance requirements like PCI DSS. iGaming merchants (MCC 7995) face stricter rules than standard e-commerce under both Visa and Mastercard rules.
When the primary acquirer declines a transaction, cascading routes it to a secondary acquirer in real time. Done well, cascading recovers 5–15% of soft declines. Done poorly, it causes double charges or confusing bank statements. The key is only cascading on soft declines (insufficient funds, do not honour) — not on hard declines (stolen card, card not active).
CDD is a regulatory requirement for iGaming operators under AML legislation. Standard CDD includes verifying name, date of birth, and address. Enhanced due diligence (EDD) goes further — requiring proof of source of funds for high-risk players. The UKGC requires EDD before a player can deposit beyond defined thresholds.
Chargebacks are the biggest operational headache for iGaming merchants. When a player disputes a deposit with their bank — claiming they didn't authorise the transaction or didn't receive what they paid for — the acquirer reverses the funds. Each chargeback also carries a penalty fee (typically £15–£25). Chargeback ratios above 1% trigger scheme monitoring programmes, which can result in higher fees or losing your acquiring facility entirely.
Calculated as (number of chargebacks / number of transactions) × 100. Visa's threshold is 1% before the merchant enters the Visa Dispute Monitoring Programme (VDMP). Mastercard's Excessive Chargeback Programme (ECP) triggers at 1.5%. Sustained high chargeback ratios can result in termination of the merchant's acquiring facility — effectively shutting down card processing.
Clearing happens after a transaction is captured. The acquirer sends transaction data to the card scheme, which routes it to the issuing bank. The issuer checks the data matches the original authorisation and prepares to move funds. Settlement follows clearing, typically 1–3 business days later.
All online iGaming transactions are CNP by definition. This makes iGaming inherently higher risk than in-person retail — there's no PIN or physical card to verify. CNP fraud is the primary reason acquiring banks charge higher rates for gambling merchants and why 3D Secure authentication has become mandatory under PSD2 in Europe.
Common in land-based casinos where players may arrive with large amounts of cash. Online operators don't deal with cash directly, but equivalent transaction monitoring applies to large deposits or withdrawals. In the US, CTRs are filed for transactions above $10,000 under Bank Secrecy Act requirements.
CVV (Card Verification Value) on Visa cards, CVC on Mastercard, CVN on other schemes. Merchants are required to collect CVV at checkout but are not permitted to store it. Passing the CVV check increases authorisation rates and reduces fraud. Under PCI DSS, storing CVV data post-authorisation is a serious violation.
D
DCC lets a UK player depositing at a Malta-based casino see the amount in GBP rather than EUR. The player pays a marked-up exchange rate — typically 3–5% above the interbank rate. Revenue from DCC is split between the merchant and acquirer. Most payments industry professionals consider DCC a poor deal for consumers; some regulators have moved to restrict it.
Decline rate is the inverse of approval rate. A 25% decline rate means 1 in 4 players fails to deposit. Declines fall into two categories: soft declines (temporary — insufficient funds, do not honour) which can be retried, and hard declines (permanent — stolen card, card closed) which should not be retried. Chasing hard declines is a fraud signal to card schemes.
Device fingerprinting collects information like browser type, screen resolution, installed fonts, IP address, and timezone to build a "fingerprint" for each device. If the same card is used on multiple device fingerprints, or the same device fingerprint appears across multiple accounts, it's a fraud signal. Many iGaming operators use it to detect multi-accounting and bonus abuse.
E
EDD goes beyond standard identity verification. It typically requires proof of source of funds (e.g. payslips, bank statements), source of wealth documentation for PEPs and high-value players, and increased transaction monitoring. Under UKGC rules, EDD is triggered when a player's spend reaches defined thresholds — currently £2,000 in 24 hours or £4,500 in 90 days for many operators.
EMIs can hold customer funds (in the form of e-money), provide payment accounts, and facilitate money transfers. They cannot lend money or offer interest on balances. Many iGaming payment solutions are built on EMI infrastructure — providers like Modulr, OpenPayd, and PayDo operate as EMIs. EMIs in the UK are regulated by the FCA; in the EU by national competent authorities under PSD2.
EMV chips generate a unique cryptogram for each transaction, making them far harder to clone than magnetic stripe cards. EMV is relevant to iGaming primarily through the liability shift it created — merchants who don't support EMV (or 3DS for online transactions) bear the cost of fraudulent transactions that could have been prevented. This liability shift drove mass adoption of 3D Secure in European online payments.
F
Without failover, a PSP outage during a major sporting event means zero deposits for the duration. With failover configured in an orchestration layer, transactions route automatically to a secondary provider within seconds. iGaming operators with single-provider setups discover the cost of this gap at the worst possible moment.
The FCA authorises and supervises payment institutions and EMIs operating in the UK. It's separate from the UKGC, which regulates gambling operators. Any payment provider processing UK player funds typically needs FCA authorisation. Post-Brexit, UK firms lost their EU passporting rights — many UK-based payment providers now need separate authorisation in EU member states.
In iGaming, friendly fraud is common. A player deposits, loses, and then disputes the transaction with their bank claiming they didn't authorise it. The bank reverses the funds, leaving the operator out of pocket. Robust transaction records, device fingerprinting, and clear merchant descriptors all help operators fight chargeback disputes. Operators with strong evidence win the majority of representment cases.
iGaming operators processing payments in multiple currencies face FX exposure on every cross-currency transaction. The spread between the interbank rate and what a PSP charges can be 1–3% per transaction. At high volume, FX costs are material. Operators with significant multi-currency volume should negotiate FX rates as part of their PSP contract or use a dedicated FX provider.
G
The gateway is the technical connection between the checkout and the acquirer. It handles encryption, tokenisation, and communication with card schemes. Some PSPs include a gateway as part of their offering; others are gateway-only providers that connect to multiple acquirers. In iGaming, the gateway is often part of a wider payment orchestration stack.
GGR is the top-line revenue figure for gambling operators. If players wagered £10m and won back £9m, GGR is £1m. Payment processing costs, licensing fees, and bonuses are all deducted from GGR to arrive at NGR (net gaming revenue). Tax in many jurisdictions (including the UK's Remote Gaming Duty at 21%) is calculated on GGR, not NGR.
H
Hard decline codes include: stolen card (41), lost card (43), do not honour (permanent) (57), invalid card number (14), and card closed (46). Retrying a hard decline wastes attempts, irritates players, and signals poor risk management to card schemes. Payment orchestration systems are configured to identify hard decline codes and not cascade them.
iGaming is universally classified as high-risk. This means higher processing fees, rolling reserves, stricter underwriting, and fewer willing acquiring partners. The classification reflects the industry's elevated chargeback rates, regulatory complexity, legal status differences across jurisdictions, and reputational sensitivity for banks. Operators can mitigate high-risk status with clean processing history, proper licensing, and strong compliance programmes.
Hosted payment pages shift PCI DSS scope away from the merchant — card data never touches the operator's systems. Integration is simple: a redirect link. The trade-off is less control over the checkout experience and a visible redirect, which some players find jarring. The alternative is an embedded iframe or direct API integration, both of which keep the player on the operator's site.
I
IBANs are up to 34 characters and contain a country code, check digits, bank code, and account number. In iGaming, virtual IBANs (vIBANs) are widely used — each player or operator is assigned a unique IBAN for ring-fencing funds or receiving payments. Providers like Modulr, OpenPayd, and Banking Circle offer vIBAN infrastructure to iGaming clients.
iDEAL is the dominant payment method in the Netherlands, used for over 70% of all Dutch online transactions. For iGaming operators targeting the Dutch KSA-licensed market, iDEAL support is effectively mandatory. Funds transfer instantly, there are no chargebacks, and conversion rates are very high for Dutch players.
IDV is a core requirement for iGaming KYC compliance. It usually involves checking a government-issued document (passport, driving licence) and comparing a selfie or live video to the document photo. Providers like Jumio, Onfido, and Sumsub automate this process. The UKGC requires operators to verify players before they can deposit — many operators now do this at registration.
Interchange is set by the card schemes (Visa, Mastercard) and varies by card type, region, and merchant category. Consumer debit cards in Europe have a regulated cap of 0.2% under the EU Interchange Fee Regulation; consumer credit cards are capped at 0.3%. Commercial cards and non-EU cards are not regulated and can be significantly higher. Interchange is the largest component of the merchant's processing cost.
The issuer is the cardholder's bank. When a player deposits at an online casino, the issuer decides whether to approve or decline the transaction. Some issuers block gambling transactions by default (Monzo, Starling, and some high-street banks let customers set gambling blocks). Issuers bear the fraud risk on CNP transactions in markets without 3DS liability shift.
K
KYB is the business equivalent of KYC. PSPs, acquirers, and banks all conduct KYB on iGaming operators before onboarding them. This includes verifying company registration, ultimate beneficial ownership (UBO), licensing status, and directors' identities. For iGaming operators, KYB can take weeks — gathering and submitting the right documents upfront speeds the process significantly.
KYC is a legal requirement for regulated iGaming operators under AML legislation. It includes identity verification (name, date of birth, address), document checks, and ongoing transaction monitoring. Operators must complete KYC before allowing players to withdraw, and many now complete it at registration or at low deposit thresholds. Failure to maintain proper KYC processes is one of the most common causes of UKGC enforcement action.
KYT goes beyond knowing who your customer is — it's about understanding the pattern and context of their activity. Are they depositing unusually large amounts? Making rapid deposits and withdrawals without playing? Depositing from multiple payment methods? KYT systems flag these patterns for manual review. In crypto payments, KYT tools like Chainalysis trace the origin of on-chain funds.
L
When 3D Secure authentication is used and the issuer approves the transaction, the liability for any resulting fraud shifts from the merchant to the issuer. This is a significant protection for iGaming operators. Under EU PSD2, SCA (Strong Customer Authentication) is mandatory for online card payments, meaning operators who implement it correctly are not liable for fraud losses on authenticated transactions.
Examples include Pix in Brazil, BLIK in Poland, iDEAL in the Netherlands, Swish in Sweden, GCash in the Philippines, and M-Pesa in Kenya. Offering local payment methods is critical for operators targeting specific markets — in many countries, card penetration is low and players strongly prefer local alternatives. Operators who only offer cards in local-payment-method markets lose significant conversion.
M
M-Pesa is the default payment infrastructure for vast numbers of people across East Africa. In Kenya, it's the primary method for iGaming deposits and withdrawals at operators like SportPesa and Betika. Over 50 million people use M-Pesa across 7 countries. For operators targeting African markets, M-Pesa integration is essential — many potential players have no bank account but do have an M-Pesa wallet.
iGaming operators are typically assigned MCC 7995 (Betting, including Lottery Tickets, Casino Gaming Chips, Off-Track Betting, and Wagers). This MCC is heavily monitored by card schemes and many issuing banks block or restrict it. Operators occasionally attempt to use adjacent MCCs, but card schemes actively enforce correct classification and mislabelling carries significant penalties.
MDR is the all-in rate the operator pays their PSP or acquirer. It includes interchange, card scheme fees, and the acquirer's margin. For iGaming merchants, MDR typically ranges from 1.5% to 3.5% depending on card type, market, and volume. The MDR is what shows up in the contract — but operators should negotiate knowing that interchange is the largest component and varies significantly by card type.
The merchant account sits between the acquirer and the operator's bank. Funds from card transactions settle into the merchant account before being swept to the operator's main account on the agreed settlement cycle (typically T+1 to T+3 days). In iGaming, merchant accounts require more underwriting than standard businesses and often come with rolling reserves.
The MGA licence is one of the most widely held and internationally recognised iGaming licences. MGA-licensed operators can serve players in many jurisdictions (though not all — UK players require a UKGC licence). The MGA operates a Business-to-Consumer (B2C) licence for player-facing operations and a Business-to-Business (B2B) licence for software and service providers. Annual compliance costs, player fund segregation requirements, and anti-money laundering obligations are all significant.
ML scoring analyses hundreds of variables — transaction amount, device fingerprint, velocity, geolocation, behavioural patterns — to generate a risk score for each payment attempt. High-scoring transactions can be blocked, challenged with additional authentication, or flagged for manual review. ML models improve over time as they receive feedback on which transactions proved fraudulent. Most sophisticated fraud platforms use ML scoring as their primary decision engine.
N
Unlike merchant tokenisation (where the merchant stores a token), network tokens are issued by Visa or Mastercard and tied to the specific merchant. They update automatically when a card is lost, stolen, or renewed — eliminating the need for players to re-enter card details. Network tokens typically deliver 3–5% higher approval rates because issuers trust them more. They're a significant lever for operators with returning player card payments.
NGR is the revenue figure most operators use for commercial decision-making. A provider charging a 2.5% processing fee takes a meaningful bite out of NGR at scale — on £10m GGR with a 30% NGR margin, payment costs of 2.5% represent over 8% of NGR. This is why approval rate matters more than processing rate: recovering lost deposits at a higher rate outweighs negotiating a lower percentage.
O
In crypto iGaming, on-ramps allow players to buy crypto with a bank card or bank transfer in order to fund a crypto casino account. Off-ramps do the reverse — converting winnings back to fiat for withdrawal to a bank. Providers like MoonPay, Transak, and Guardarian provide on-ramp infrastructure that operators embed in their cashier flow.
Open banking payments bypass card networks entirely — the player authorises a direct bank transfer from their account to the operator. This means no interchange fees, no chargebacks, near-instant settlement, and real-time bank account data for affordability checks. Providers like Trustly, TrueLayer, and Token.io have built iGaming-focused open banking products. It's now mainstream in UK and Nordics, growing fast across Europe.
P
PayFacs take on more risk and more operational complexity than standard referral models — they underwrite their sub-merchants and are responsible for their processing. Stripe and Square are well-known PayFac models. In iGaming, PayFac structures are less common because the risk profile of gambling merchants makes most PayFacs unwilling to take them on.
Payment orchestration sits between the operator's checkout and their payment providers. It handles routing rules (send Visa cards to acquirer A, send LATAM transactions to PSP B), failover (if acquirer A is down, try acquirer B), and cascading (if transaction declines, retry with a different acquirer). Providers like PaymentIQ, Praxis Tech, and BridgerPay have built orchestration platforms specifically for iGaming. The benefit isn't just operational — smart routing typically delivers 5–10% higher approval rates.
PCI DSS has four compliance levels based on transaction volume, with different requirements at each. Most iGaming operators avoid the heaviest compliance burden (Level 1 — 400+ million Visa transactions annually) by using hosted payment pages or iframe integrations that keep card data off their servers entirely. Storing card data without PCI DSS compliance is illegal and will result in immediate termination of card processing facilities.
PEPs are considered higher risk from an AML perspective because their position creates greater opportunity for bribery and corruption. iGaming operators must screen players against PEP databases at onboarding and on an ongoing basis. Transacting with PEPs requires enhanced due diligence and senior management sign-off. Major screening databases include World-Check (LSEG), ComplyAdvantage, and Dow Jones Risk & Compliance.
Pix launched in November 2020 and rapidly became Brazil's dominant payment method. Since Brazil regulated sports betting and online casinos in January 2025, Pix is mandatory for licensed operators and the de facto standard for iGaming deposits and withdrawals. It's free for consumers, instant, available 24/7, and supports QR code payments. Operators without Pix cannot serve the Brazilian market effectively.
Pre-auth is used when the final transaction amount is unknown at authorisation time (hotels, car rentals). In iGaming, it's less common than in other verticals but is used in some deposit flow architectures — for example, pre-authorising a deposit and capturing only once the funds are credited to the player wallet. Uncaptured pre-authorisations must be released within the card scheme's timeframe (typically 7–30 days).
A PSP typically bundles a payment gateway, merchant account, and acquiring relationships into a single product. Some PSPs are direct acquirers; others aggregate merchant accounts under their own master account. In iGaming, PSPs vary significantly in their risk appetite, the markets they serve, and their willingness to take on gambling merchants. Finding a PSP that genuinely understands iGaming — rather than one that handles it reluctantly — makes a material difference to approval rates and service quality.
R
RTP schemes include Faster Payments in the UK, SEPA Instant in Europe, Pix in Brazil, and UPI in India. Real-time payments are increasingly the standard expectation for iGaming deposits and withdrawals — players expect to see funds in their account instantly. Legacy settlement windows (T+1, T+2) are becoming a competitive disadvantage for operators that haven't moved to real-time payment methods.
Unlike chargebacks, refunds are processed by the merchant voluntarily and do not carry penalty fees. In iGaming, refunds are typically issued for technical errors (failed deposits where the player was charged but funds didn't credit), responsible gambling requests, or duplicate transactions. Proactively refunding disputed transactions before they become chargebacks reduces the operator's chargeback ratio.
Responsible gambling tools include deposit limits, loss limits, time limits, cooling-off periods, self-exclusion, and reality checks. Payment processing connects directly to responsible gambling — operators must enforce deposit limits at the payment stage, and some payment providers now offer affordability checks (comparing deposit volumes to likely income). UKGC-licensed operators are required to offer all standard RG tools and to take action when players show signs of harm.
Risk scores are generated in real time by fraud detection systems and used to route transactions — low-risk scores proceed, medium-risk scores may require additional authentication, high-risk scores are declined or flagged for review. Scores are based on ML models trained on historical fraud data. The threshold for each action is configurable and should be calibrated to balance fraud prevention against unnecessary friction for legitimate players.
Common for high-risk merchants including iGaming operators. A typical rolling reserve is 5–10% of processing volume, held for 90–180 days before release. This protects the acquirer if the merchant exits suddenly and leaves unresolved chargebacks behind. Rolling reserves tie up working capital — operators should factor this into cash flow planning. Negotiating down the reserve percentage or rolling period is worthwhile once you've established a clean processing history.
S
In the UK, SARs are filed with the National Crime Agency (NCA). iGaming operators are legally required to file a SAR when they have reasonable suspicion of money laundering — and must not tip off the customer. The "consent SAR" allows operators to seek permission from the NCA to proceed with a transaction they suspect may be linked to criminal proceeds. Failure to file a SAR when required is a criminal offence.
Payment providers offer SDKs for iOS, Android, and web to simplify integration. A mobile SDK handles card data entry, 3DS authentication, and payment submission within the app, without the operator's servers touching card data. The quality of a PSP's SDK — its documentation, stability, and update frequency — is often as important as their commercial terms for operator tech teams.
GAMSTOP is the UK's national self-exclusion scheme, covering all UKGC-licensed operators. Players can self-exclude for 6 months, 1 year, or 5 years. Operators are required to block self-excluded players from depositing. Payment-level controls are part of this — responsible operators block payment attempts from self-excluded accounts even when those accounts attempt to deposit. Similar national schemes exist in Sweden (Spelpaus), Germany (OASIS), and elsewhere.
SEPA Credit Transfers move funds within 1 business day. SEPA Instant Credit Transfer (SCT Inst) moves funds within 10 seconds, 24/7. For iGaming operators in the Eurozone, SEPA is the standard for bank transfer deposits and withdrawals. SEPA Direct Debit allows recurring collections but is less common in iGaming due to chargeback risk.
Settlement typically occurs 1–3 business days after capture (T+1 to T+3). Some PSPs offer same-day or instant settlement for a fee. Settlement timing matters operationally — operators need predictable cash flow to fund player withdrawals. In crypto, settlement is effectively real-time (once the blockchain confirms the transaction), which is one reason some operators prefer crypto deposits for fast liquidity.
Smart routing considers factors like the cardholder's BIN (to route to acquirers with strong relationships in that issuing country), transaction amount (some acquirers approve larger tickets better than others), payment method, and historical approval rates. Effective smart routing is the primary driver of approval rate improvement in payment orchestration. The routing logic is typically configured in an orchestration platform like PaymentIQ or Praxis.
Common soft decline codes include: insufficient funds (51), do not honour (05), exceeds withdrawal limit (61), and system error (96). Unlike hard declines, soft declines can be retried — either immediately with a different acquirer (cascading) or after a delay. However, retrying the same transaction with the same acquirer immediately is rarely productive and adds to the operator's decline rate unnecessarily.
Source of funds checks are required for high-value or high-risk players as part of Enhanced Due Diligence. Acceptable evidence includes payslips, bank statements, P60s, or documentation of a business sale or inheritance. UKGC enforcement has repeatedly cited operators for failing to conduct adequate source of funds checks on players who deposited large amounts over extended periods. It's a compliance area that carries significant financial and reputational risk.
Common stablecoins include USDT (Tether), USDC (Circle), and EURT. In iGaming, stablecoins are used for player deposits and withdrawals in crypto-first casinos — they offer the speed and cost benefits of crypto without the price volatility of Bitcoin or Ethereum. For operators, USDT settlements mean no FX exposure on crypto transactions. Regulatory treatment of stablecoins varies significantly by jurisdiction.
SWIFT transfers are how international wire transfers work. They are reliable but slow (1–5 business days) and expensive (fees of £15–£40 per transfer, often plus a percentage). For iGaming, SWIFT wires are used for large B2B settlements and treasury movements — not typically for player-level transactions, where faster local schemes are preferable.
T
There are two types of tokenisation in payments: merchant tokenisation (the PSP generates a token for the merchant to store, enabling recurring payments without re-entering card details) and network tokenisation (the card scheme generates the token, providing higher approval rates and automatic card updates). Tokenisation is central to PCI DSS compliance — merchants storing tokens rather than card numbers significantly reduce their compliance burden.
Transaction monitoring systems analyse deposits, withdrawals, and player behaviour against defined rules and ML models. Alerts are generated when unusual patterns are detected — large single deposits, rapid deposit-withdrawal cycles, structuring (breaking large amounts into smaller ones to avoid thresholds), or deposits from jurisdictions with high money laundering risk. All MGA and UKGC-licensed operators are legally required to have transaction monitoring in place.
U
The UKGC issues operating licences to UK-facing gambling operators and personal management licences to key individuals. It sets technical standards, AML requirements, responsible gambling obligations, and player protection rules. The UKGC is one of the most demanding gambling regulators in the world. Licence fees, compliance costs, and the risk of enforcement (fines regularly exceed £5m for significant breaches) make UK regulation a significant operational overhead.
UPI processes over 10 billion transactions per month and is India's dominant digital payment method. For iGaming operators targeting India-facing players (where online gambling occupies a complex legal position), UPI is essential infrastructure. Players can transact via apps like PhonePe, Google Pay India, and Paytm. Integrating UPI requires a local payment partner with NPCI certification.
V
Examples: block any card that attempts 5 failed transactions within 10 minutes; alert if a new account deposits more than £1,000 in the first 24 hours; decline if the same IP address makes more than 20 transactions in an hour. Velocity rules are a baseline fraud control. Too tight and they generate false positives, frustrating legitimate players. Too loose and they miss fraud patterns. Most operators tune them based on their specific player base and risk profile.
vIBANs are widely used in iGaming for player fund segregation, treasury management, and B2B settlements. A player or operator is assigned their own IBAN number; transfers to that number automatically route to the correct account within the underlying infrastructure. Providers like Modulr, OpenPayd, and Banking Circle provide vIBAN services to iGaming clients.
A void cancels an authorisation and releases the hold on the cardholder's funds. It must be done before capture — once a transaction is captured, a refund is required instead. Voids are used to correct errors, cancel duplicate authorisations, or reverse pre-authorisations that are no longer needed. They carry no fee and do not affect chargeback ratios.
W
Webhooks are HTTP POST requests sent automatically when something happens — a payment is approved, a chargeback is filed, a refund is processed. Without webhooks, operators would have to poll the PSP's API constantly to check for updates. Well-implemented webhooks are signed (the PSP includes a signature in the header) and idempotent (safe to process multiple times if the same event is delivered more than once). Missed or unhandled webhooks cause reconciliation problems.
White-label PSP infrastructure allows operators or fintech companies to offer payment services under their own brand without building the underlying technology themselves. The provider handles the technical infrastructure, compliance, and banking relationships; the operator handles the commercial relationships and branding. Common in iGaming where some operators want to control their payments stack without the full cost of building it.
Wire transfers (also called bank wires or telegraphic transfers) are reliable for B2B payments but too slow and expensive for player-level transactions. Settlement takes 1–5 business days for international wires. Domestic wires via local schemes (Faster Payments in the UK, SEPA Instant in Europe) are much faster. For large settlement flows between operators and PSPs, or B2B treasury movements, wires remain the standard.
iGamingPayments.AI
Find the right payment provider for your operation
Browse 351 vetted PSPs, crypto processors, open banking providers and fraud vendors — filtered by region, vertical and payment method.