A bank account for a gambling business is a licence, not a formality.

Online gambling sits near the top of every mainstream bank's prohibited or restricted business list, and the reasons are structural rather than moral. Gambling transactions carry chargeback risk that behaves differently from ordinary e-commerce, the sector attracts money laundering typologies that AML teams are specifically trained to look for, card scheme rules (Visa and Mastercard high-brand-risk merchant category codes) impose extra registration and monitoring obligations on any acquirer that touches the flow, and the regulatory perimeter varies so much between licences that a compliance officer cannot simply rely on 'the company is licensed' as an answer.

The result is a two-tier banking market. A small number of specialist banks, EMIs and acquirers actively court licensed gambling operators and have built the underwriting frameworks, card-scheme registrations and monitoring tooling to do it properly. Everyone else declines at intake, often through an automated industry-code filter before a human ever reads the file. Founders who apply to generalist banks or EMIs first tend to collect a string of declines that then have to be explained to the specialist institutions that would otherwise have taken the business.

The operators who get this right treat banking as a workstream that runs in parallel with licensing, not a task that starts once the licence certificate arrives. The banking file needs almost everything the licence application needed — ownership, source of funds, policies, financial projections — repackaged for a different reader with a different set of concerns. Building both files from the same underlying documentation set is far more efficient than treating them as separate projects months apart.

This guide sets out what banks and payment institutions actually ask for when underwriting an iGaming account: how licence quality is read, how player funds and operational funds are expected to be kept apart, the difference between a PSP relationship, a card-acquiring relationship and a settlement banking relationship, how chargebacks and rolling reserves work in this sector specifically, geo-blocking and prohibited-market controls, the compliance policy pack underwriters expect to see, corporate structure, realistic timelines, and the failure modes that close accounts after they have been opened.

None of what follows guarantees an outcome. Every bank and EMI makes its own independent decision, appetite changes without notice, and the honest starting position for any operator is that a well-prepared file materially improves the odds — it does not remove the risk that an institution says no.

Underwriters do not treat gambling licences as interchangeable. They rank them, informally but consistently, by the strength of the regulator behind them, and that ranking drives which institutions will even open a file. At the strong end sit licences from established, well-resourced regulators — Malta's MGA, the UK Gambling Commission, the Isle of Man Gambling Supervision Commission, Gibraltar — where the regulator conducts real fit-and-proper checks on directors and beneficial owners, requires audited player-fund segregation, runs ongoing supervision, and has enforcement history that shows the regime is more than paper. Banks read these licences as a meaningful layer of pre-vetting that reduces their own diligence burden.

In the middle sit licences such as Curaçao's newer master/sub-licence regime and Anjouan (Comoros), which have improved on paper in recent years but still carry a track record of thin oversight, historically limited enforcement, and — in Curaçao's case — a recent and still-bedding-in reform of what used to be a much looser sub-licensing model. Some specialist banks and EMIs will take these licences; most will apply materially higher scrutiny to the operator's own controls precisely because they are compensating for weaker regulatory pre-vetting, and pricing and reserve terms tend to reflect that.

At the harder end sit licences issued by very small or newly formed licensing authorities — including several First Nations and small-island regimes that have marketed themselves aggressively to operators priced out of stronger jurisdictions — where banks frequently apply a blanket no regardless of the individual operator's controls, because the regulator itself has no meaningful track record for the bank's own compliance committee to point to. If your business plan depends on one of these licences, the honest conversation to have before spending money is which specific institutions, if any, currently accept it, because the list is short and changes.

Licence quality interacts with market focus. An MGA-licensed operator serving EU markets under EU payment rails is a fundamentally easier file than the same operator claiming the same licence covers grey-market traffic into jurisdictions where online gambling is restricted or unregulated. Banks will ask, directly, which countries you accept players from and how you know a licence actually authorises that traffic — a question that catches out more applicants than any document checklist item.

The practical takeaway: licence selection is a banking decision as much as a legal one. We routinely see operators who chose a licence purely on cost and speed of issuance discover, months later, that the licence itself is the reason no serious bank will open the account. Getting the banking read on a prospective licence before applying for it saves that outcome.

Most credible gambling licences require operators to hold player funds separately from operating capital, and increasingly to demonstrate that those funds are protected if the operator becomes insolvent. Banks treat this as a fundamental control, not a nice-to-have, because commingled funds are both a regulatory breach in the operator's home licence and a direct AML red flag — an account where customer deposits, operator revenue and third-party payouts move through the same pool is very difficult to monitor and even harder to defend in a suspicious activity report.

In practice this means a segregated player-funds account (sometimes a designated trust or ring-fenced account depending on the licence's requirement), a separate operating account for salaries, suppliers, marketing and tax, and clean, documented rules for how money moves between them — typically only as recognised revenue after wagering activity settles, never as a working-capital transfer to cover shortfalls. Underwriters ask for the account structure diagram, the trust or segregation mechanism specified by the licence, and evidence — bank statements, reconciliation reports, an auditor's letter — that the separation is actually operated day to day rather than described in a policy document nobody follows.

Some licences (the UK Gambling Commission's ring-fencing categories are the clearest public example) grade the level of player-fund protection from basic segregation up to fully insured or trust-backed arrangements, and disclose which level the operator holds to players. Banks read the disclosed protection level as another proxy for the seriousness of the operator's controls, and an operator claiming the top tier without documentation to support it will simply be asked to prove it before the file proceeds.

A second, less obvious expectation is reconciliation frequency and evidence. Banks increasingly ask how often the operator reconciles the player-liability ledger (the sum owed to players) against the actual cash held in the segregated account, and want to see that this happens at least daily for active operators rather than at month-end. A gap between the ledger and the cash — even a small one that is explainable — is the kind of finding that turns a routine account review into an account closure if it is not proactively flagged and explained.

For operators building this from scratch, the sequencing that works is: confirm the licence's specific segregation requirement, design the account structure with the bank or EMI before launch rather than after, build the reconciliation process into the finance function from day one, and keep the auditor's or licensor's confirmation letter on file to hand to any bank that asks — which every serious one eventually will.

Founders new to the sector often talk about 'getting a payment processor' as a single task. In practice an iGaming operator typically needs three distinct relationships that serve different functions and are underwritten by different teams even within the same institution. Understanding the difference changes how you sequence applications and what you ask for from each counterparty.

A payment service provider (PSP) or gateway sits closest to the player experience — it presents payment methods (cards, bank transfers, e-wallets, in some regulated markets open banking rails) and routes the transaction. Card acquiring is the specific relationship that lets the operator accept Visa/Mastercard payments and requires the acquirer to register the merchant under a high-brand-risk MCC (7995) with the card schemes, which triggers extra scheme-level monitoring, higher scrutiny and, usually, higher pricing and reserve requirements than standard e-commerce acquiring. Settlement banking is the corporate bank account that actually receives net settlement from the PSP/acquirer, holds operating capital, pays suppliers and staff, and — separately — holds segregated player funds.

These three relationships frequently sit at different institutions, and that is normal, not a sign of a weak setup. A specialist gambling acquirer may process cards, a separate EMI may handle the settlement account and alternative payment methods, and a traditional or private bank may hold the segregated player-funds account and the corporate operating account. Each institution wants to see how the others in the chain fit together, so a clear payments architecture diagram — who processes what, where funds land, how often settlement occurs — is one of the most useful documents an operator can produce before any application goes in.

A structural point worth flagging early: some operators try to run acquiring through an in-house or affiliated payments entity to capture margin. That is workable but changes the regulatory analysis materially, because operating a payments business for others (or even structuring flows that look like it) can itself require a payments or e-money licence in some jurisdictions. If you are building or considering a payments entity alongside the operating business, get the licensing question answered before it is built into the banking architecture — unwinding it later is expensive and slows every relationship in the chain.

Realistic expectations on cost and terms: high-brand-risk card acquiring in this sector typically carries a discount rate multiple times standard e-commerce pricing and rolling reserves in the mid-to-high single digits as a percentage of volume, held for a fixed period after each transaction. Alternative payment methods and open banking rails, where available in the operator's markets, often carry materially better economics than cards and are worth building into the payment mix from the start rather than as an afterthought once card costs bite.

Chargeback ratio is the single number that most influences how an acquirer prices and treats an iGaming merchant over time, and it is worth understanding the mechanics rather than treating it as an abstract compliance metric. Card schemes set thresholds (Visa's and Mastercard's monitoring programmes typically trigger review at chargeback-to-transaction ratios in the region of 0.65%–1%, with escalating consequences above that) above which a merchant enters a monitoring or excessive-chargeback programme, which can bring fines, forced reserve increases, or termination of the acquiring relationship entirely.

In gambling specifically, chargebacks cluster around a few recurring patterns: players disputing losses as 'unauthorised' after the fact, friendly fraud from players who forget or regret a deposit, disputes arising from confusion about which entity's name appears on the card statement (a frequent, easily fixed cause), and — in the worst cases — genuine account takeover fraud. A mature operator tracks chargeback reason codes, not just the headline ratio, because the fix differs: clearer billing descriptors and pre-transaction confirmation reduce friendly-fraud disputes; stronger 3-D Secure and device-fingerprinting reduce account-takeover fraud; and a responsive, well-staffed dispute-response process recovers a meaningful share of representments regardless of cause.

Rolling reserves exist because the acquirer is exposed to chargebacks and refunds for a window after settlement, and in gambling that window is treated as longer and riskier than in most retail e-commerce. Typical structures hold back a percentage of processing volume — commonly in the mid-single digits up to the high teens depending on the acquirer's read of the operator's licence, track record and market mix — for a fixed period (often 90 to 180 days) before releasing it, and some acquirers use a rolling structure where a portion of each day's reserve releases as the corresponding chargeback window closes rather than releasing everything at once.

New operators, operators entering new markets, or operators with a recent history of licence changes or chargeback spikes should expect reserves at the higher end of the range and should build that into cash-flow planning explicitly — a 10–15% reserve on meaningful volume is a real working-capital cost, not a rounding error, and underestimating it is a common cause of operators running short on cash in their first two quarters live. Reserve terms are negotiated and typically step down as a track record of low chargebacks and stable volume is established, usually reviewed at 6–12 month intervals.

The document trail that helps here is straightforward but frequently missing: a documented dispute-response workflow with evidence templates, a rolling chargeback and refund ratio report the operator can produce on demand, clear pre-authorisation and billing-descriptor practices, and — where volumes are meaningful — a dedicated chargeback analyst rather than an ad hoc process. Acquirers price risk they cannot see; showing them the control reduces the price.

Every serious bank or EMI underwriting an iGaming operator will ask for a precise, documented list of the jurisdictions the operator markets to and accepts players from, cross-referenced against the specific licence held and the legal status of online gambling in each of those markets. A licence authorises operation in the markets it covers — it does not authorise the operator to accept traffic from every country in the world, and banks are acutely aware that grey-market or restricted-market traffic is one of the most common enforcement and reputational risks in the sector.

The technical control underwriters expect to see evidence of is geo-blocking: IP-based geolocation, device and billing-address cross-checks, and — for markets with local licensing regimes — active blocking of players from jurisdictions where the operator is not licensed rather than a passive terms-of-service statement that players 'must' be located in permitted markets. A terms-of-service disclaimer with no technical enforcement behind it is read by compliance teams as evidence the operator does not actually control its market exposure, which is a worse signal than having a smaller, clean footprint.

Payment-method mix compounds this. Card BIN (bank identification number) data reveals the issuing country of a card even when a player claims a different address, and acquirers monitor BIN geography against the operator's declared market list as a matter of course. A mismatch — meaningful volume of cards issued in countries the operator claims not to serve — is one of the fastest routes to a for-cause account review and, if unresolved, termination.

United States exposure deserves specific mention given how often it surfaces in applications. Online gambling legality in the US is state-by-state, several major card networks and banks apply blanket restrictions on US-facing gambling transactions regardless of state-level legality, and an operator with any US player exposure needs a specific, current legal opinion on which states are addressable and how — this is not a generic global-licence question, and banks will ask for it separately from the main jurisdiction analysis.

The practical fix, and the thing that most improves a marginal file, is a written market-access matrix: licence held, markets it authorises, technical geo-blocking evidence, BIN-monitoring process, and a named compliance owner responsible for updating the matrix when either the licence scope or a market's local law changes. Underwriters who see this document unprompted treat it as a strong positive signal, because most applicants do not have one.

Beyond the licence certificate itself, banks and EMIs underwriting gambling operators want to see the operational policies that make the licence real day to day, because the licence tells them what is required in theory and the policy pack tells them what actually happens. At minimum this pack should include a written AML/CTF policy calibrated to the operator's actual product and markets (not a generic template), a customer due diligence and enhanced due diligence procedure with defined triggers for higher-risk players, a transaction-monitoring methodology describing what patterns are flagged and how alerts are actioned, and a suspicious activity reporting procedure naming the money-laundering reporting officer and the regulator or financial intelligence unit reports go to.

Responsible gambling (RG) policy sits alongside AML as a second pillar underwriters increasingly weight heavily, partly because RG failures generate the reputational and regulatory enforcement stories that make headlines and partly because weak RG controls correlate, in underwriters' experience, with weak controls generally. Expect to be asked for the deposit-limit and self-exclusion mechanism (including participation in any national self-exclusion scheme the licence requires), affordability-check triggers and thresholds, staff training records on problem-gambling indicators, and evidence of how RG interventions are logged and escalated.

Source-of-funds and source-of-wealth documentation for high-value players is a recurring gap. A licensed operator is generally expected to trigger enhanced due diligence at defined deposit or loss thresholds and to obtain documented evidence of a player's ability to fund their play at higher tiers — payslips, bank statements, business ownership evidence — rather than accepting large deposits on the strength of a successful card charge. Banks ask for the threshold table and a sample of how it has actually been applied, and a policy that exists only on paper with no evidence of application is treated the same as no policy at all.

Ongoing regulatory reporting and audit evidence matters too: recent licence renewal correspondence, any regulator findings or remediation history (disclosed proactively rather than discovered), the most recent independent AML or RG audit if the licence requires one, and staff organisational chart showing who owns compliance, RG and finance functions with enough seniority and independence to be credible. A one-person compliance function covering AML, RG, licensing liaison and finance in a business processing meaningful volume is a finding banks will raise, because it suggests the controls exist on paper more than in practice.

Building this pack takes real time — typically four to eight weeks for an operator assembling it from scratch with input from licensed compliance counsel — and it is far more efficient to build it once, calibrated properly to the actual licence and product, than to patch together a thinner version for the licensing regulator and a separate version for banks. Institutions increasingly cross-reference the two, and inconsistency between what was told to the regulator and what is told to the bank is itself a red flag.

How the group is structured has a direct effect on both licensing efficiency and banking outcomes, and getting it wrong is expensive to unwind once accounts, contracts and licences are already tied to the wrong entity. The pattern that works well for most mid-sized operators separates three functions: an operating entity that holds the gambling licence and contracts with players and suppliers, a holding entity above it that owns the group's IP, brand and equity and through which investors typically hold their stake, and — where the group runs its own payments infrastructure rather than relying entirely on third parties — a separate regulated or licensed payments entity that never touches the licensed gambling activity directly.

Separating the licensed operator from the group holding company protects the licence and the operating relationships from unrelated group-level events (a financing round, an unrelated subsidiary's problems, a shareholder dispute) and gives banks a cleaner underwriting target: a single-purpose entity whose activity, revenue and cash flows are all explainable by one licensed business, rather than a group where gambling revenue is mixed with unrelated ventures. Banks and EMIs consistently prefer to underwrite the narrower entity.

Jurisdiction choice for the operating entity usually follows the licence — many licensing regimes require or strongly favour a locally incorporated operating company — while the holding entity is more often placed in a jurisdiction chosen for investor familiarity, corporate law flexibility and tax residence planning for the ultimate owners, done properly and disclosed rather than structured to obscure beneficial ownership, which banks will not accept regardless of how the rest of the file reads.

Beneficial ownership transparency is non-negotiable in this sector specifically. Gambling licensing regimes require disclosed, verified ultimate beneficial owners and typically run fit-and-proper checks on anyone holding a meaningful stake or exercising control; banks run the same check independently and will not proceed if the ownership on the bank's KYC file does not match the ownership disclosed to the regulator. Nominee arrangements or opaque intermediate holding layers designed to obscure who actually controls the operator are one of the most reliable ways to have an otherwise strong file declined.

For groups running affiliate marketing, white-label partnerships, or multiple skins under one licence, the contractual and financial relationships between entities need to be documented with real, arm's-length agreements — revenue-share terms, marketing spend, IP licensing — because underwriters will ask how money moves between related entities and an undocumented answer reads as a control gap even where nothing improper is happening.

A realistic timeline for a first-time iGaming operator building a full payments and banking stack from a standing start runs three to six months from a completed licence application to a working, tested payment flow — longer where the licence itself is still in process, since most banks and acquirers will not complete underwriting on an application that has not yet secured the licence, and shorter only where the operator already holds a strong licence, a clean track record from a prior venture, and a fully prepared compliance pack going in.

The sequencing that tends to work: confirm the licence and its specific segregation and reporting requirements first, build the compliance and RG policy pack in parallel with the licence application rather than after approval, approach specialist gambling-focused banks and EMIs (not generalist institutions) with a complete file rather than a partial one, expect two to six weeks of underwriter questions and follow-ups per institution, and build the acquiring relationship and the corporate/settlement banking relationship in parallel rather than sequentially since each institution wants to see how the other pieces of the payments chain fit together.

The single most common failure mode is applying with an incomplete or generic file to institutions whose stated appetite does not match the operator's licence or market mix, collecting declines, and then having to explain a string of prior rejections to the specialist institutions that would otherwise have said yes — every application after the first is read partly through the lens of why the previous ones failed. A close second is underestimating rolling-reserve cash-flow impact and running short of working capital in the first two quarters live, which then triggers exactly the kind of financial-stress signals that make a bank nervous about the relationship it just opened.

A third recurring failure is concentration risk: relying on a single acquirer or a single settlement bank with no tested backup. Gambling-focused institutions change sector appetite, get acquired, or exit specific licence categories with limited notice more often than mainstream banks do, and an operator with no live backup relationship can lose the ability to process payments or pay staff with very little runway to fix it. Building and lightly testing a second relationship while the first is healthy is materially cheaper than building one from scratch under time pressure after a closure notice.

A fourth, quieter failure mode is scope creep after onboarding: an operator approved for one licence and one set of markets that later adds new licences, new markets, new payment methods, or a new skin without updating the bank or acquirer proactively. Because the original approval was scoped to a specific, documented activity, undisclosed expansion is routinely treated as a material change that was not reported, and it is a common trigger for account review or closure even where the new activity would itself have been approvable if disclosed upfront.

Stripped to its practical core, the file a gambling-focused bank or EMI underwriter works from typically includes: the gambling licence certificate and any conditions attached to it, corporate documents for every entity in the group (certificate of incorporation, register of directors and members, ownership chart to the ultimate beneficial owners), certified identification and proof of address for all directors and beneficial owners above the disclosure threshold, and a business description written for a compliance reader — what the product is, who the customers are, which markets are served, how revenue is earned.

On the money side, expect requests for a flow-of-funds diagram covering the full payment chain from player deposit to settlement to payout, documented player-fund segregation mechanics and evidence it is operated (not just described), the last available financial statements or, for a pre-launch operator, credible financial projections with the assumptions shown, and source-of-wealth documentation for beneficial owners covering how the capital funding the business was earned.

On the control side: the AML/CTF policy and named MLRO, the RG policy and self-exclusion mechanism, the market-access and geo-blocking matrix described earlier, chargeback and refund policy with historical ratios if the operator has processing history elsewhere, and any prior regulatory correspondence, findings or remediation — disclosed proactively. A gap here that is discovered by the bank rather than disclosed by the operator does more damage to the relationship than the underlying finding usually would on its own.

Practical tips that consistently improve how a file is received: organise the pack with a short compliance-reader summary at the front rather than making the underwriter assemble the picture from raw documents, keep every figure in the projections traceable back to a stated assumption, use consistent entity names and ownership percentages across every document (mismatches, even typos, generate unnecessary follow-up rounds), and have a single named point of contact who can answer follow-up questions within a day or two — slow, inconsistent responses to underwriter questions are read as a proxy for how the operator will respond to compliance queries once the account is live.

This is general information, not legal or tax advice, and the exact document list varies by institution, licence and market mix; a proper scoping conversation before assembling the pack saves rebuilding it later.

Engagements start with a scoping call covering the licence you hold or plan to hold, your target markets and their legal status, your existing processing history if any, and your product's risk profile — live casino, sportsbook, RNG slots, poker, and B2B/white-label all read differently to underwriters. We come back with an honest read on which institutions are realistically in scope, what the account architecture should look like, the timeline we consider realistic, and where we think the current plan will not work before you spend money assembling a file for it.

We then build the compliance pack — AML/CTF policy, RG policy, market-access and geo-blocking matrix, flow-of-funds documentation, source-of-wealth files for beneficial owners — calibrated to the specific licence and product rather than a generic template, and we sequence applications so the first institutions approached are the ones most likely to say yes, protecting the file's track record for the institutions approached afterward.

On the corporate side we can advise on and help implement the operator/holding/payments entity structure most likely to be underwritten cleanly, working alongside your licensed gambling counsel rather than replacing it — licensing law and banking underwriting are related but distinct disciplines and we are clear about which is which.

On banking and payments itself, we position applications across a network of more than 120 banking and payment institutions with actual gambling-sector appetite, build a layered architecture — settlement banking, segregated player-funds account, card acquiring, contingency relationships — rather than a single point of failure, and stay engaged through the follow-up question rounds that decide most outcomes. We do not guarantee accounts; every institution decides independently, and we say so before any engagement starts.

After go-live we support the ongoing maintenance that keeps relationships healthy: reserve step-down negotiations as track record builds, market-expansion disclosures before they become undisclosed scope creep, annual policy refreshes, and building the second and third relationships in the stack before they are needed. Tell us the licence, the markets and the product, and we will tell you plainly what we think is realistic.