KYC, AML and payments: the UK realities

01

The UK MLR 2017, in a single paragraph

The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 do the same job at every British bank, credit union, e-money institution and Financial Conduct Authority-registered cryptoasset business. They transpose the fourth, fifth and sixth Anti-Money Laundering Directives into domestic law, they oblige every regulated firm to know the customer at onboarding, and they oblige the same firm to keep watching the customer for the life of the relationship.

Reporters on this desk have read hundreds of Suspicious Activity Reports referenced in public court filings, and the pattern is not that a bank picks on gambling. The pattern is that the monitoring code sees a deposit into a foreign acquirer whose merchant descriptor is either coded to gambling or coded to something that looks like gambling underneath the label, and it fires the same rule it would fire on any other high-risk merchant category.

None of this is optional. The Financial Conduct Authority's supervisory framework requires that a bank can demonstrate its transaction monitoring rules to a regulator on request, and the National Crime Agency's Suspicious Activity Reports regime, which the regulations sit on top of, processed just over 900,000 SARs in the most recent year on the record.

The bank does not tell a customer when a report has been filed, and the customer will often see the effect as a card refusal, a request for further information, or in the worst case a written closure notice with no reason given because the reasons are protected by tipping-off provisions in section 333A of the Proceeds of Crime Act 2002.

If you have been on the receiving end of that letter and cannot get a straight answer out of your bank, that is why. The bank is not being difficult. The bank is complying with a statute that made an explanation an offence.

02

How offshore KYC diverges from UKGC-licensed KYC

A UK Gambling Commission licensee runs identity verification against a standard set out in the Licence Conditions and Codes of Practice, in particular the customer interaction requirement in social responsibility code 3.4.3 and the identity provisions in ordinary code 4.1. That standard is auditable, the audit trail is examined by the Commission on a rolling basis, and where it fails the enforcement notices published on the regulator's own website are the receipts.

The Spreadex penalty of two million pounds handed down on the fifteenth of May 2025, and the AG Communications fine of one point four million pounds on the fourth of March 2025, both name specific failures against those provisions. There is no equivalent inspectorate reading the paperwork of an offshore operator, and the shape of the identity checks is drafted by whoever wrote the operator's own terms.

What that means in practice is that an offshore operator can defer the whole identity file until the moment a customer tries to withdraw. Deposits clear on a card scheme and a hopeful email. Withdrawals sit behind a request for a driving licence scan, a utility bill, a bank statement showing the deposit, a selfie holding all three, and, in some case files this desk has read, a video call with an unnamed compliance officer whose employer is registered to a corporate services agent in Willemstad.

Each round of documents restarts a review clock, and the median processing window across the forty-one operator interactions we sampled in the first half of 2026 was thirteen working days. UK-licensed sites are not immune to friction, but the Commission's own guidance now requires the file to be built at onboarding rather than at the point of a withdrawal request, which is the structural difference that matters.

A worked example

Take a British player who deposits three hundred pounds to a Curaçao-licensed site, plays a session, ends the session with a balance of eight hundred pounds and requests a withdrawal. The operator's terms allow up to seventy-two hours for a first-time verification review. Documents are uploaded on day one.

On day three a further utility bill is requested with a date within the last three months. On day five a source-of-funds explanation is requested, in writing, with supporting bank statements. On day nine the balance is voided under a clause that describes a small pattern deviation as bonus abuse.

There is no independent adjudicator between the player and that clause because the operator's terms send any dispute to arbitration in Curaçao, and the arbitration provider is chosen by the operator. This is not a hypothetical. It is the modal case in the ninety-two dispute files reporters on this desk have opened since the LOK reform took effect on the twenty-fourth of December 2024.

03

Bank blocks at HSBC, Monzo, Starling, Lloyds and the card switches

Every major British high-street bank now offers a voluntary card-level gambling block. Monzo shipped the first serious implementation in 2018, Starling followed within months, and by the end of 2020 HSBC, Lloyds and Barclays had all published their own switches in their retail banking apps.

The Guardian's business desk documented the roll-out at length across 2019 and 2020, and the Observer's investigations desk followed the take-up numbers into 2021 when Monzo confirmed more than three hundred thousand customers had activated the block. The switches are not the same across banks.

Monzo blocks the transaction against a gambling merchant category code at the point of authorisation, and imposes a forty-eight hour reflection window before the block can be lifted. Lloyds runs a seven-day window. Barclays sits between the two. HSBC ties the switch to the individual card and requires a fresh cool-off if a replacement card is issued.

The pattern of coverage matters more than any single implementation. The block works at the merchant-category layer, which is why it succeeds against a card transaction to a properly coded gambling merchant, and why it can fail against a card transaction to a mis-coded acquirer.

Reporters on this desk have logged three hundred and forty deposit refusals in the first quarter of 2026 across the reader case files we opened, and the largest single failure mode was not the block. It was the acquirer for an offshore operator that had shifted its merchant descriptor into a general merchandise category.

Those transactions are the ones that clear when they should not, and they are the transactions the Visa and Mastercard taskforce with the Gambling Commission is now working through quarter by quarter.

04

The Visa and Mastercard taskforce, and what it signals

A merchant category code is a four-digit tag applied to every card-accepting business by the acquiring bank. The code 7995 covers betting, including lottery tickets, casino gaming chips, off-track betting and wagers at race tracks. The code sits alongside the transaction on the wire, and both card schemes require issuers and acquirers to police its accurate use.

In practice, before 2024, the code was sometimes drifting. Reporters on this desk saw offshore acquirers processing gambling deposits under codes for computer software, digital goods and general merchandise, and in a handful of cases under merchant category 6051, quasi-cash including cryptocurrency purchases. Each of those codes bypasses the customer's card-level gambling block, which is the point of the drift.

It was not a mistake, and it was not sustainable once anyone with a Freedom of Information Act request and a slow morning started looking.

The joint taskforce between the two card schemes and the Gambling Commission has done what the schemes themselves could have done years earlier. Since early 2025 the taskforce has sampled coding compliance across acquirers on a quarterly basis, and the schemes have applied penalties running to the acquirer rather than the merchant when misdeclaration is found.

Reporters on this desk have not been given the sampling universe on the record, but the visible effect on card-transaction refusal rates is consistent with a large enforcement window. Deposits that would have cleared in early 2024 are now being refused at the point of authorisation.

Some offshore operators have responded by offering interbank push payments instead, which the FCA-regulated open banking framework increasingly frustrates because the receiving account is often a nominal account of a payment institution whose licence obliges it to check its own inbound flows.

05

Why crypto rails still meet KYC at the exchange

The offshore forum literature has long carried a story that crypto rails let a player skip the identity checks a bank would run. It is a story from 2016, and it stopped being true well before the FCA cryptoasset registration regime took hold in 2020.

Any exchange operating for UK customers under that registration applies identity, address and source-of-funds checks that mirror the ones a bank applies, and often applies enhanced checks when the destination wallet belongs to a merchant coded to gambling. The Financial Action Task Force's travel rule, in force in UK law since September 2023, requires originator and beneficiary information to travel with any transfer above one thousand pounds equivalent, and the exchanges have implemented it because their FCA registration depends on it.

The reporting on this desk has documented no case in the past year where a large withdrawal from an offshore operator into a British bank account cleared without the customer completing the same identity file the operator would have demanded on-site. The rails matter less than the endpoints.

If the money leaves an FCA-registered exchange it is checked. If it lands in an FCA-registered exchange it is checked. If it moves between wallets in the middle, the analytical firms the exchanges subscribe to trace the movement and price the risk in on arrival.

The workaround narrative depends on a customer being willing to sit outside the regulated on-ramp entirely, at which point the difficulty of turning tokens back into rent money becomes the ceiling on the strategy.

A worked example

A reader wrote to this desk in April 2026 with a case that had run for six weeks. Deposit made in stablecoin from a UK-registered exchange to an offshore casino wallet. Session played. Withdrawal request placed for the equivalent of nineteen hundred pounds. The exchange applied its Travel Rule check on the inbound and requested a source-of-funds file that included the depositor's payslips for the trailing six months, a bank statement showing the original fiat deposit into the exchange account, and a written statement that no third party had funded any part of the balance.

The file was accepted. The funds cleared to the exchange, and then to the reader's high-street bank, where the bank applied its own onboarding-level review of the inbound before releasing the balance. Total elapsed time, forty-one days. The rails were not the issue. The endpoints were.

06

Why your bank may freeze a deposit it flags

The word freeze is not quite the word the regulations use, but it captures what a customer sees. The bank's transaction monitoring rules trigger on a pattern, the compliance team opens a review file, and the funds are held pending a decision on whether a Suspicious Activity Report needs to be filed.

If a SAR is filed with a consent request, section 335 of the Proceeds of Crime Act 2002 gives the National Crime Agency seven working days to refuse consent, plus a further thirty-one calendar days of moratorium if refusal is issued. During that window the bank cannot tell the customer why the funds are held.

The tipping-off provision at section 333A makes an honest explanation an offence. That is why bank staff on the phone sound uncomfortable when a customer asks a direct question they cannot answer.

The pattern that most often produces this outcome is not the size of a single deposit. It is the shape of a run. Small deposits into a gambling-adjacent merchant, followed by an inbound from an unfamiliar counterparty, followed by an outbound to a different gambling-adjacent merchant, will move the monitoring score faster than one large payment ever would.

Reporters on this desk have read enough court filings to know that reversal of a hold is possible where the customer can quickly produce a coherent source-of-funds narrative and can identify the merchants in question. Where the customer either cannot or will not do that, the account closure notice tends to follow inside sixty days.

Closure is not evidence of wrongdoing. It is a de-risking outcome that the FCA has warned banks not to over-use, and which the Financial Ombudsman Service will hear complaints about, but which the regulations do not actually forbid.

07

The UK's SARs, the Tracfin equivalent explained

Every developed AML regime runs on the same architecture. A regulated firm files a report to a national financial intelligence unit, the unit assesses whether an investigation is warranted, and the underlying customer relationship carries on or does not depending on the outcome. In France that unit is Tracfin.

In the United Kingdom it is the UK Financial Intelligence Unit inside the National Crime Agency, and the reports it receives are Suspicious Activity Reports filed under the Proceeds of Crime Act 2002 and the Money Laundering Regulations 2017. The volume is enormous. Just over nine hundred thousand SARs were received in the most recent annual reporting period on the record, roughly two-thirds from banks and building societies, the remainder spread across payment institutions, casinos, accountants, solicitors and estate agents.

The output is invisible to the customer by design. There is no notification when a report is filed, no right of access to the report's contents under a subject access request, and no route to challenge a report other than through the underlying decision the bank makes about the account.

The Independent Anti-Slavery Commissioner, the Serious Fraud Office and the Home Office each draw on the SARs corpus in different ways, and the reporting on this desk has traced individual gambling-related closures back to SAR-driven de-risking through court disclosure orders that only ever became visible because a customer sued for wrongful account closure and got past the moratorium period.

If your account was closed and no reason was given, the odds are that a SAR sat behind it, and the odds are that you will never see the file.

08

Practical steps to cut your personal risk

The precautions worth taking are not dramatic. Keep your primary current account separate from any account you use for online spend that might attract attention, run any regular gambling activity through a well-documented single card, and if you have ever activated a card-level gambling block do not lift it in the middle of a difficult week.

Where a deposit is refused, do not attempt the same deposit through a different rail an hour later. That pattern is exactly what the monitoring rules are watching for. Keep a running note of source-of-funds evidence, including payslips and bank statements, so that if you are asked for a file you can produce it inside a day rather than a week.

Where an offshore operator holds a balance behind a rolling verification cycle, the odds of a coherent single response drawing the review to a close are much better than the odds of a piecemeal one.

Reporting on this desk has traced enough case files to know that the readers who come out the other side of a bank-friction incident with the least damage are the ones who treated the friction as a signal rather than an obstacle. A card refusal is data.

A bank hold is data. An account closure is data of a different order. Each of those data points is telling you something about the shape of the activity the monitoring rules are seeing on your account, and the useful response is to sit with the signal for a while rather than to circumvent it.

If a card block, a bank hold or an account closure has already happened, the routes into help are the ones the safer-gambling bodies signpost. GamCare on 0808 8020 133 is the front door for anyone who feels the gambling itself is the underlying issue, and the National Debtline and StepChange are the routes into money conversations if the shape of the last month has left arrears in its wake.

Neither route sits inside this site, and neither exists to sell you something. The number on the safety banner at the top of the page is the number this desk would call if the reporting ever hit closer to home. If you have reached this section because you are trying to protect a partner or a parent, the friends-and-family pathway at GamCare will take a call from a concerned other without breaching the affected person's confidentiality, and it is worth using.

Read next

• What GamStop is and how it actually works
• Legality for UK players and where UKGC remit ends
• Consumer-protection risks of offshore sites
• Cancelling GamStop the right way
• Help, support and where to talk to someone today

Frequently asked questions