Payments and checks, banks, cards, crypto, KYC

UK Money Laundering Regulations 2017 in a paragraph

The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, referred to in shorthand as MLR 2017, are the statutory instrument through which the United Kingdom brought the Fourth Money Laundering Directive into domestic law, and through which the Fifth Directive was subsequently transposed by the 2019 amendment. The Sixth Directive is in effect for scope purposes, with its predicate-offence provisions read across through the Proceeds of Crime Act 2002 and the Criminal Finances Act 2017. MLR 2017 sits on top of that primary legislation and puts direct obligations on relevant firms, including banks, electronic money institutions, payment institutions, cryptoasset businesses registered with the Financial Conduct Authority, and, importantly for this site, UKGC-licensed gambling operators. Those obligations are customer due diligence, source-of-funds enquiry, ongoing monitoring, and the reporting of suspicious transactions to the National Crime Agency. The Regulations reach every regulated firm that operates in the United Kingdom and every UK customer of one.

The reach of MLR 2017 stops at the boundary of the UK regulated perimeter. A Curaçao-licensed operator, an Anjouan-licensed operator, an MGA-licensed operator that does not hold a UKGC continuation licence, and a Gibraltar Regulatory Authority licensee that has stepped out of the UK market are all outside that perimeter for the purposes of the Regulations. That does not leave the transaction unregulated at the UK end. Your bank remains bound by the Regulations, your card scheme remains bound by them through its issuing bank, and any UK-registered cryptoasset exchange you use to buy or off-ramp coins remains bound. The Regulations therefore reach the UK side of the transaction, without reaching the operator. A useful shorthand is that MLR 2017 covers your money before it leaves the country, and the operator's own domestic rules pick up from there.

How offshore KYC differs from UKGC-licensed KYC

A UKGC-licensed operator runs Know Your Customer to a schedule set out in the Licence Conditions and Codes of Practice, referred to as LCCP. That schedule takes an identity check at or shortly after registration, escalates to enhanced due diligence at defined deposit or velocity thresholds, and layers affordability checks on top following the 2023 White Paper package. The purpose of the schedule is to prevent underage play, prevent play by self-excluded individuals through the GamStop database, prevent play with the proceeds of crime, and, since the White Paper, to sanity-check whether the level of play sits within what the LCCP characterises as safer gambling for the individual concerned. That schedule is public, is auditable, and is enforced through the UKGC's compliance and enforcement powers, which in the 2024 to 2025 financial year produced 770-plus cease-and-desist notices and licence penalties running into the millions of pounds against UK-facing operators.

Offshore KYC runs on a different schedule for the simple reason that a different regulator sets the rulebook. A Curaçao operator licensed directly by the Curaçao Gaming Authority under LOK is required to run customer due diligence to the Curaçao domestic anti-money-laundering regime, which is thinner than the UK equivalent and does not incorporate GamStop, does not require an affordability check on the UK 2023 model, and does not require reporting into a UK Financial Intelligence Unit. An MGA operator runs a KYC schedule closer to the UK model but calibrated to the Malta framework, and does not query GamStop. A Gibraltar operator is calibrated to the Gibraltar rulebook. An Anjouan operator sits under the Union of the Comoros AML framework, which has a lighter footprint than any of the others. The practical consequence for a UK reader is that the identity check that would take five minutes at a UKGC-licensed site may take longer, take shorter or take no different a form at an offshore site, but the check being performed is not measuring against UK safer-gambling parameters and does not sit in the enforcement chain that the UKGC controls.

A closer look

The most consequential single difference in day-to-day terms is the treatment of source-of-funds documentation on a withdrawal. A UKGC-licensed operator holding a winnings balance is required by LCCP to complete its source-of-funds enquiry before paying out, and cannot use the enquiry as a delay tactic; the UKGC has fined operators for exactly that misuse. An offshore operator conducting a source-of-funds enquiry on withdrawal is bound by the terms and conditions the customer accepted at registration and by the operator's own domestic regulator, and the escalation route if the enquiry stalls does not run to a UK ombudsman or ADR body. Where a UK customer has a dispute with a Curaçao-licensed operator about a delayed source-of-funds review, the effective route is through the Curaçao Gaming Authority's complaints channel, in Dutch or English, and, failing that, through civil action in the jurisdiction named in the terms of service.

Bank blocks and card gambling switches in 2026

The UK personal current account has changed materially at the payments-friction tier over the last thirty-six months. The voluntary gambling block on cards is now offered by HSBC, Monzo, Starling, Lloyds and Barclays, alongside a growing list of building societies that have followed the same design pattern. Turning the block on is a switch inside the mobile banking application, and once on it prevents card transactions to any merchant coded under merchant category code 7995, which is the international MCC for gambling. Turning the block off carries a friction period, which the UKGC-published safer-gambling review of 2024 records as ranging from one hour to forty-eight hours depending on the provider. Monzo and HSBC have both been public about their forty-eight hour cool-off. The design intent is that the switch is easy to turn on and deliberately harder to turn off, which mirrors the 24-hour cool-off design in GamStop and draws on the same behavioural evidence base.

What the switch reaches is the retail card layer, which is where a majority of offshore deposits sit. Where the switch does not reach is the account-to-account payment layer, which includes Faster Payments transfers to a third-party wallet or crypto exchange from which funds subsequently move to an offshore operator. Some of the newer banking applications now surface a spending-category flag on outbound Faster Payments to known gambling wallets, but the flag is informational rather than blocking. This creates a two-tier picture for a UK adult who has turned on the gambling switch: card deposits to offshore operators will fail at the issuer level, and account-to-account routes through a payment institution or exchange are visible but not stopped. Reading the picture correctly means reading each of the two rails against the specific switch state on your account.

Visa, Mastercard and the UKGC 2025 taskforce

In 2025 Visa and Mastercard formally joined a taskforce led by the Gambling Commission, working alongside UK Finance and a small number of participating issuing banks, to tighten enforcement of merchant category code 7995 for online gambling. The published purpose of the taskforce is to reduce the incidence of gambling merchants being miscoded as retail or entertainment, which has historically allowed a small but material volume of offshore deposits to bypass gambling blocks. The mechanism is a combination of enhanced merchant onboarding checks by the acquiring banks and a scheme-level enforcement escalation where miscoding is identified. Both schemes have published statements confirming their participation. The taskforce does not itself block any operator; it corrects the coding so that a customer switch or a bank rule engine can act on accurate information.

The practical downstream effect on the offshore deposit path from a UK card is that routes that worked reliably in 2023 have become less reliable through 2025 and into 2026. A payment processor that had been coding gambling transactions imperfectly is now more likely to be flagged, and once flagged the transactions route through with correct coding, at which point the customer's gambling block, if switched on, catches them. Some processors have exited the UK-facing gambling flow entirely rather than absorb the compliance overhead of correct coding. This is not a total block on offshore card deposits, but it is a step-change in the friction gradient, and a reader who last attempted a card deposit to an offshore operator in 2023 should not assume that what worked then still works now.

Crypto rails and why they still hit KYC eventually

A cryptocurrency deposit path is often described online as a way to avoid UK checks. As a description of the plumbing it is inaccurate. UK-registered cryptoasset exchanges are required under the Money Laundering Regulations 2017, as extended by the 2020 amendment to include cryptoasset activities, to run customer due diligence to the same standard as a UK bank. That includes identity verification, sanctions and politically-exposed-person screening, and, on higher-value transactions, source-of-funds enquiry. The Financial Conduct Authority maintains the register of authorised firms, and firms not on the register are prohibited from marketing to UK consumers under the financial promotions regime that took full effect on 8 October 2023. What this means in practice is that the KYC step which sits at the operator on a card path sits at the exchange on a crypto path, and the identity check is met either way.

The path that then runs from the exchange to a self-custody wallet and out to an offshore operator does exit the FCA-regulated perimeter, but the transaction chain remains visible on the public ledger of whichever chain is in use, and the exchange retains the on-ramp record of the identity behind the wallet. When a customer subsequently off-ramps winnings back to a UK bank account through a UK-registered exchange, the exchange runs its source-of-funds enquiry on the incoming coin and can require documentation of the origin, which will include the offshore operator name. A crypto route does not remove the paper trail, it re-orders it. For a UK adult reading the payments layer honestly, this matters because it disposes of the common misconception that crypto delivers anonymity from UK authorities; it does not, and the arithmetic of the FCA registration regime is the reason.

A closer look

The stablecoin question sits inside this picture rather than outside it. Sterling-referenced or dollar-referenced stablecoins issued by an FCA-authorised or in-scope issuer under the incoming UK stablecoin regime carry the same customer due diligence obligations at the point of issue and redemption. Stablecoins issued by a non-UK issuer without a UK marketing permission are not exempted; they are simply less visible until they touch a UK on-ramp or off-ramp. The design of the Financial Services and Markets Act 2023 stablecoin regime is that the reach follows the customer, not the token, and any UK adult using stablecoins to route funds to an offshore operator remains bound at the moment their sterling touches the chain and at the moment it comes back.

When your bank flags a suspicious deposit

A retail bank in the United Kingdom runs its transaction monitoring against a rules engine that scores every outbound and inbound transaction on a basket of variables. The variables typically include amount, frequency, merchant category, counterparty jurisdiction, historical customer pattern, and any manual flags placed on the account. A deposit routed through a payment processor that codes as gambling and lands at a Curaçao or Anjouan-jurisdiction counterparty will score higher than an equivalent-value transaction to a UK retail merchant. Most transactions that score above the internal threshold trigger a soft review, which is invisible to the customer and resolves within a working day. A subset trigger a hard review, which produces a temporary decline or a request for additional customer information before the payment is re-attempted. A smaller subset trigger a Suspicious Activity Report, which is the mechanism through which the UK Financial Intelligence Unit at the National Crime Agency becomes involved.

What a UK adult experiences at the counter of this process is usually a declined transaction with a limited explanation, sometimes a call from the bank fraud team, and, in a smaller number of cases, a request to visit a branch with identification. The bank is not required to tell the customer that a SAR has been filed, and in most cases it will not; the tipping-off provisions of the Proceeds of Crime Act 2002 restrict what a bank may say to a customer whose transaction it has reported. For an offshore gambling deposit that is legally permissible for the adult concerned to make, the deposit itself is not the target of the reporting regime; the reporting regime is the bank's obligation to file its concern with the NCA and let the NCA determine whether any further step is warranted. In the ordinary case, no further step is taken.

What a Suspicious Activity Report actually is

A Suspicious Activity Report, referred to as a SAR, is a report made by a regulated firm to the UK Financial Intelligence Unit at the National Crime Agency under Part 7 of the Proceeds of Crime Act 2002. It records that the reporting firm has grounds to suspect that a transaction, a customer, or a pattern of activity relates to the proceeds of crime, the funding of terrorism, or a related predicate offence. The report is not an accusation, is not disclosed to the customer, and does not carry any automatic sanction. The NCA holds an annual publication that records the volume of SARs filed across the UK regulated sector, which for the 2024 to 2025 reporting year sat above 900,000 for the sector as a whole. The overwhelming majority of SARs result in no further action being taken beyond the record itself.

Where a SAR filed on an offshore gambling flow does move onward, it moves through the Egmont Group information-sharing arrangements between financial intelligence units, or through a bilateral mutual legal assistance channel if the underlying suspicion sits within a criminal investigation. The counterpart FIU in Curaçao, Malta, Gibraltar or Anjouan may then share the information with its own domestic regulator, subject to its own domestic rules. That cross-border transmission is slow, requires probable cause on the receiving side, and, in the case of Anjouan, meets a counterpart FIU with materially less operational capacity than the UK-side equivalent. The practical relevance to a UK adult is small, because the paper trail exists whether they see it or not, and for a lawful adult deposit the paper trail is simply a record.

Practical steps to reduce personal risk

If a UK adult is going to read the payments layer of the offshore market honestly, the payments layer suggests a small number of concrete steps that reduce personal risk without pretending to remove it. The first is to turn the voluntary gambling switch on the bank card either on or off deliberately rather than by default, and to know which state the account is in. The second is to keep the identity documentation used at registration current and honest, since a mismatch between the identity registered at the operator and the identity on the funding card is one of the fastest routes to a frozen withdrawal. The third is to read the operator's terms of service specifically on the source-of-funds documentation required at withdrawal and to have those documents ready in advance rather than as a scramble at the point of cash-out.

The wider picture, which sits outside the payments layer in a narrow sense, is that no combination of card switch, exchange choice, or documentation preparation delivers the consumer protection that a UKGC licence delivers on its own. The steps above reduce the friction of a lawful adult transaction and reduce the probability of a frozen balance, but they do not deliver an ADR pathway, do not deliver fund segregation, and do not deliver the enforcement backstop that a UK regulator provides. The Getting support chapter sets out the routes available when the gambling itself has started to feel like something being done to the adult rather than by them, and this page sits alongside that chapter rather than in front of it. Every reader who has read this page down to its final paragraph is invited to keep the helpline number visible.

Read next

• GamStop explained, the scheme, the periods, the checks
• The legal position for UK players outside GamStop
• The risks, explained without the marketing
• Coming off GamStop, the official route
• Getting support, helplines, clinics, family, money

Frequently asked questions