KYC, AML and where your payments break

The MLR 2017 rules in one paragraph

The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 are the operative UK instrument, as amended to implement the Fourth, Fifth and Sixth Anti-Money Laundering Directives and preserved after retained EU law reform. They apply to a defined list of relevant persons including credit institutions, electronic money institutions, payment service providers, cryptoasset service providers registered with the Financial Conduct Authority, and a subset of gambling operators the regulations reach directly.

The duties they impose are practical rather than aspirational. Customer due diligence at onboarding, enhanced due diligence where a customer sits in a high-risk category, ongoing monitoring of the business relationship, source-of-funds enquiries where the transaction profile shifts materially, and internal escalation to a nominated officer where suspicion is formed.

A UK adult reading this page has already passed customer due diligence at their bank, and every subsequent transaction is monitored against that baseline.

The point that matters for a non-GamStop deposit is that the bank's regulatory duty does not travel with the payment. When a card authorisation leaves a UK issuer for a cross-border acquirer holding a Curaçao merchant on its books, the UK regulated entity in the chain remains the issuer, and its transaction monitoring team keeps watching.

The operator's own KYC is a separate regime under its home-jurisdiction rules, and even where a Curaçao Gaming Authority licence requires customer identification the standard is neither congruent with UK expectations nor enforceable against a UK complainant. The consequence is that identity friction concentrates upstream at the bank rather than downstream at the operator, and that most of the practical friction a UK adult encounters when funding an offshore account is a UK compliance cost paid in refused authorisations, temporary card holds and follow-up calls from a fraud team asking whether the customer intended the transaction.

How offshore KYC differs from UKGC-licensed checks

A UKGC-licensed operator applies customer due diligence under licence conditions that include age verification within the first 72 hours of any deposit, source-of-funds enquiries where affordability triggers are met and enhanced due diligence for politically exposed persons and higher-risk customer groups. The regulator publishes the licence conditions on gamblingcommission.gov.uk and enforces them through settlements, financial penalties and licence revocation.

The Spreadex Ltd penalty of 15 May 2025 at two million pounds turned in significant part on failures in customer interaction and anti-money-laundering controls, which tells a reader something useful about where UKGC pressure actually lands. When a UKGC licensee fails on KYC, the reader has a public route, a defined complaints pathway, an approved Alternative Dispute Resolution body to escalate to and, in the last resort, a regulator whose statutory powers cover restitution.

An offshore operator on a Curaçao Gaming Authority licence applies KYC under the Landsverordening op de Kansspelen that entered into force on 24 December 2024. The reform folded master licences into a single regulator and introduced direct licensee accountability, but the standard remains materially lower than UK expectations in three areas that affect a UK adult in practice.

Source-of-funds inquiry is discretionary rather than mandatory at defined thresholds. The evidentiary standard for a documentary submission is lower and the reviewer sits in a jurisdiction whose employment law does not apply in the UK. The recourse route available to a UK customer whose withdrawal has been refused under a KYC hold is a civil claim in a foreign jurisdiction rather than a complaint escalated to a body a UK ombudsman would recognise. The gap is not academic. It is where withdrawals get stuck.

A worked example

A UK adult deposits £250 by card to an offshore operator, plays through the deposit and requests a withdrawal of £900. The operator's cashier queues the withdrawal, the KYC team places a hold, and a request for a government photographic identity document, a proof of address dated within the last three months and a bank statement covering the deposit period arrives by email.

The customer submits the documents. The bank statement shows two other cross-border card transactions in the same month, and the KYC reviewer requests a source-of-funds narrative. The hold extends by twelve working days. At the end of that period the operator asks for a further declaration of employment income and a payslip, at which point the sum being recovered has become a documentation project on the customer's own time. Every step is legitimate under the operator's home-jurisdiction rules, and none of the steps is subject to a UK enforcement route.

Card gambling switches and blocks at HSBC, Monzo, Starling, Lloyds

HSBC, Monzo, Starling, Lloyds and Barclays each offer a voluntary card gambling switch that a customer can toggle inside a mobile banking app. The switch, once activated, causes the issuer to decline card authorisations tagged merchant category code 7995 at the network stage, before the operator's cashier receives the authorisation response.

The switch is a consumer safeguard rather than a regulatory requirement, and the five banks arrived at broadly compatible designs with materially different detail. The cool-off before the switch can be reversed ranges from around 48 hours at the shorter end to seven days at the longer end, the scope of transactions defined as gambling varies at the edges of the merchant category taxonomy, and the interaction between the switch and stored card credentials on file with an operator differs from one bank to the next.

The practical position for a UK adult who has ever considered a self-exclusion is that turning the switch on is not a substitute for GamStop, and turning it off is not a route around GamStop. GamStop is a scheme-wide block at the operator layer sitting on UKGC-licensed sites.

The bank switch is an issuer-side control sitting on the card. The two intersect at the point where a UK adult tries to deposit to a UKGC-licensed operator with the bank switch on, which produces a decline before the operator sees the transaction. The interaction with an offshore operator is different again.

Because the merchant category code assigned by a cross-border acquirer to an offshore casino is not always 7995, the switch will catch some offshore deposits and miss others. Where the coding is correct the switch works. Where the coding is masked, the switch has no visibility, and the transaction reaches a different set of controls further up the risk stack.

What the Visa and Mastercard taskforce means for you

Visa and Mastercard, working alongside UKGC, established a joint taskforce announced in 2025 with a mandate that includes merchant category code enforcement across cross-border acquirers, more consistent tagging of gambling merchants and greater visibility of the acquiring stack behind an offshore cashier. The mechanism is scheme-level rather than statutory.

It does not create a new offence in UK law. It tightens the rules of the card network, which are contractual obligations on acquirers and, through them, on the merchants those acquirers sponsor. The direction of travel is toward less ambiguity in the descriptor line a card statement shows, less flexibility for a merchant to be onboarded under a category that hides its true business, and more consistent visibility of the acquirer country code in the authorisation message.

For a UK adult who reads a card statement the visible change is small but real. Cross-border authorisations to offshore operators that were previously coded ambiguously now more often carry the 7995 tag and the acquirer's true country code, which means the bank's transaction monitoring team sees the transaction for what it is at the moment of authorisation rather than at the return leg.

Refused authorisations increase, follow-up fraud calls from the issuer's night desk increase and the frequency with which a bank asks a customer to confirm the intent behind a transaction increases. The taskforce is not a ban on cross-border gambling deposits. It is a tightening of the coding rules that determine which transactions the existing controls can see, and the effect at a customer's own account will be visible in more decisions being made by the bank at the moment of the transaction rather than after it.

Crypto rails still hit KYC at the exchange

Cryptoasset service providers offering services to UK residents are required to be registered with the Financial Conduct Authority under regulation 54 of the Money Laundering Regulations 2017. Registration carries with it customer due diligence duties broadly equivalent to those imposed on banks, including identity verification at onboarding, transaction monitoring on the business relationship and enhanced due diligence in higher-risk cases.

The financial promotions regime layered on top by the Financial Services and Markets Act 2000 order in force since October 2023 adds a further set of duties around marketing, appropriateness assessments and cooling-off periods for first-time cryptoasset customers. A UK adult buying cryptocurrency from a UK-facing exchange therefore passes exactly the same identity gate that opening a UK current account would require.

The point that catches a reader is that the KYC boundary does not sit at the operator, it sits at the exchange. When a UK adult buys cryptocurrency to fund an offshore operator, the identity record that could be subpoenaed by a UK court, disclosed to law enforcement under a production order or produced in response to a suspicious activity report is the one the exchange holds.

The transaction hash on the blockchain is publicly readable in a way a card authorisation is not, and the pattern of transfers from a UK-registered exchange wallet to a wallet cluster associated with an offshore gambling operator is a pattern that blockchain analytics tooling is calibrated to notice.

The privacy benefit a reader may have expected from a cryptocurrency payment is a benefit relative to a card transaction only for the segment of the payment that sits between the exchange withdrawal and the operator deposit, and that segment is short.

A worked example

A UK adult opens an account at a UK-facing cryptocurrency exchange, passes identity verification with a photographic document and a proof of address, funds the exchange account by faster payment from a UK current account and buys the equivalent of £500 in a stablecoin. The stablecoin is transferred out of the exchange to a wallet address supplied by an offshore operator.

The exchange retains the transaction record, the outbound wallet address, the timestamp and the customer identity. If the operator later comes under a UK enforcement action, a production order served on the exchange retrieves the identity behind the wallet address in a matter of days.

If the customer later complains to their bank about the transfer to the exchange, the bank has a full record of the outbound payment. There is no anonymous leg in the sequence.

Why your bank may freeze a suspect deposit

Banks apply transaction monitoring rules that trigger on velocity, on merchant category concentration, on cross-border acquirer country and on the ratio of gambling authorisations to income deposits over a rolling window. Where a rule triggers, the visible outcome on the customer side ranges from a decline at authorisation through a temporary card block to a full account restriction while a review runs.

Where the review escalates to a nominated officer, the internal path is toward a suspicious activity report under sections 330 and 331 of the Proceeds of Crime Act 2002, which is filed with the National Crime Agency. The report is not itself a criminal allegation.

It is a regulatory disclosure a UK bank is required to make when it has knowledge or reasonable suspicion, and the reporting duty carries statutory protection from liability for the making of the report.

What a customer sees in their app or on the phone is not the internal reasoning. What a customer sees is a decline, a follow-up call, a temporary hold or a request to visit a branch. What the customer will not be told, by statute, is whether a suspicious activity report has been made, because tipping off under section 333A of the Proceeds of Crime Act 2002 is itself an offence.

The practical consequence is that a UK adult experiencing repeated declines on cross-border card transactions to what appears to be an offshore operator should treat the friction as information rather than as inconvenience. The friction is the visible edge of a control that has already produced a paperwork trail, and the trail is retained for the statutory record-keeping period under regulation 40 of the Money Laundering Regulations 2017.

How UK suspicious activity reports (SARs) work

The UK analogue of the French Tracfin regime is the suspicious activity report filed with the UK Financial Intelligence Unit inside the National Crime Agency, made under Part 7 of the Proceeds of Crime Act 2002 and Part 3 of the Terrorism Act 2000. Regulated entities file reports through the SAR Online portal, and the volume of reports filed in a typical year runs into the high hundreds of thousands, of which a small share is escalated for further law enforcement action.

The report itself contains the customer identity, the account or product identifier, the transactions that triggered the reporting suspicion and the reporter's narrative on why suspicion was formed. Consent SARs, which seek NCA agreement to complete a transaction that would otherwise carry a laundering risk, are a distinct subset with a statutory response window of seven working days followed by a 31-day moratorium period where consent is refused.

The categorisation of gambling-related suspicious activity in NCA guidance has tightened over the last five years, and cross-border gambling deposits to jurisdictions on the FATF grey list or through cryptocurrency rails feature explicitly in the current typologies. What a UK adult should take from that is not paranoia but proportion.

A single deposit does not trigger a report. A pattern of deposits over a period, funded from a current account whose income profile does not obviously support the amounts, funded from a credit card whose balance is rising in parallel or funded from a new cryptocurrency exchange account opened for the purpose, are the patterns transaction monitoring is calibrated to notice.

The friction that a reader experiences at their bank is downstream of a set of criteria they cannot see, and the criteria are designed to be invisible so that they continue to work.

Practical steps to cut your financial exposure

The most useful step a UK adult can take before engaging with any offshore operator is to read their own card statement descriptor line and understand what it will show. A card authorisation carries a merchant name that the acquirer supplied, a merchant category code the acquirer assigned and an acquirer country code that identifies the jurisdiction the acquirer is based in.

All three appear on a bank statement in some form, and the way they read is what a lender, an underwriter or a professional advisor will see if the statement is ever disclosed in future. A mortgage application, an insurance underwriting decision, a professional practising certificate renewal or a settlement disclosure in a family court can each be affected by a pattern of gambling transactions that a customer has not thought about since the deposit was made.

The statement is a permanent record in the sense that matters, which is that it can be produced years later at a moment the customer no longer controls.

The second useful step is to activate the card gambling switch offered by HSBC, Monzo, Starling, Lloyds or Barclays before the moment when it is needed rather than after. The cool-off measured in days is a design feature of the control, and a reader who activates the switch in a clear moment retains the option and gives themselves the pause they might not otherwise be able to give themselves in a difficult moment.

The third useful step is to speak to the National Gambling Helpline on 0808 8020 133 before the money side of the question becomes the whole question. The advisers who answer are trained to talk about the money story as directly as the emotional story, and the number of readers who wish they had made that call earlier is the largest group in the correspondence NGC Insight receives.

Read next

• What GamStop is and how it actually works
• Legality for UK players and where UKGC remit ends
• Consumer-protection risks of offshore sites
• Cancelling GamStop the right way
• Help, support and where to talk to someone today

Frequently asked questions