Payments and checks, banks, cards, crypto, KYC

UK Money Laundering Regulations 2017 in a paragraph

The Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017, usually shortened to the Money Laundering Regulations 2017, are the current UK statutory instrument that puts obligations on banks, e-money firms, payment institutions and UKGC licensees to identify their customers, understand the source of the funds and report anything that looks off. They came into force to implement the fourth EU anti-money-laundering directive, they have since been amended to reflect the fifth, and their operational reach across the sixth directive has settled into steady practice. In the UK licensed gambling market, the effect is that a UKGC operator sits inside a public-law framework of customer due diligence, ongoing monitoring and structured reporting that is auditable by the regulator. In household-economics terms this is not paperwork for its own sake, it is a set of institutional guardrails that raise the cost of using the licensed market for laundering, and that create a paper trail if something goes wrong later.

The reason a page on non-GamStop sites has to start with this paragraph is that the same regulations do not apply to an operator holding no UKGC licence. An offshore site can decide, at its own discretion, how much identity and source-of-funds paperwork it wants to collect and at what point. The result is not a lawless environment, because the payment rails on the way in and out are still subject to UK rules, but it is a very different customer experience. The operator has less legal obligation to know who its customer is, less obligation to ask where the money came from, and less obligation to escalate a suspicious pattern to a UK authority. For a household reading the friction of a UK-licensed sign-up as annoying, the frame flips once the alternative is set alongside it. The paperwork was doing something.

There is a household reading of that paragraph worth stating out loud. When a person removes friction from a spending category, they raise the volume they will move through that category, and behavioural research on default sign-up flows across consumer finance is consistent on the point. A frictionless flow is not a neutral convenience, it is a lever on the size and speed of the underlying decision. That is why the UK licensing regime is deliberately unhurried in its due diligence, and it is also why a smoother offshore alternative can feel like a kindness in the moment and cost more overall by the end of a quarter. The Money Laundering Regulations do not exist to slow a customer down for the sake of it, they exist to slow the money down enough for the household to notice what it is doing.

How offshore KYC differs from UKGC-licensed KYC

Know Your Customer, or KYC, is the identity-verification step that sits between a person and a betting account. Under UKGC social-responsibility rules and the Money Laundering Regulations 2017, a UK-licensed operator has to collect enough information at onboarding to satisfy customer due diligence, and to escalate to enhanced due diligence where risk factors warrant it. In practice that usually means a passport or driving licence, a proof of address, and a source-of-funds enquiry if deposits climb above a certain threshold. It is unglamorous, it is sometimes clumsy, and it is exactly the kind of sludge that consumer research says people resent whilst benefiting from. The behavioural point is that the friction is priced in early, when the customer is calm and not yet in the game.

Offshore operators run KYC on a different logic. Some ask for very little at onboarding because the priority is getting the deposit through the door, and some defer the paperwork until the customer tries to withdraw a meaningful amount. A household that reads the light sign-up as a courtesy is reading the incentive backwards. Deferred KYC concentrates the friction at the withdrawal, which is the moment when the household is most emotionally exposed, when the money feels closest to its own again, and when a delay or refusal cuts most deeply. This is the pattern the industry-facing literature calls back-loaded verification, and it is the mirror image of the front-loaded pattern the UK regulator forces onto its licensees.

A closer look

There is a further behavioural asymmetry. The psychological weight of uploading a passport and a utility bill to a UK-licensed operator is buffered by the knowledge that the operator sits inside UKGC supervision, and that the Information Commissioner's Office can act if that data is later misused. Uploading the same documents to an operator based abroad attaches a durable identity record to a bilateral private transaction whose subject-access, deletion and remedy channels sit under a foreign legal system. A reader might discount that gap in the moment because the upload takes a couple of minutes and the reward is right there. The gap does not go away, it just sits invisible until the moment it matters. A useful household rule of thumb is to treat every document upload as if it were being pinned to a public notice board in a town the household will never visit. The record persists, the household does not, and the only way to influence what happens next is to choose carefully what to upload in the first place.

Bank blocks and card gambling switches in 2026

All five of the largest UK current-account providers now offer a voluntary card gambling switch inside their mobile app. HSBC, Monzo, Starling, Lloyds and Barclays each provide the toggle, and several apply a further reactivation friction, usually 24 to 48 hours, before the block can be turned off. Behavioural economists have a name for this shape of intervention, the commitment device, meaning a friction the reflective self installs today so the craving self cannot easily reverse it later. The literature on commitment devices, from Thaler and Benartzi's work on retirement saving through to Ashraf, Karlan and Yin on commitment savings accounts, is unusually consistent, and consistent in a helpful direction. Small, well-designed frictions materially change downstream behaviour, and the effect survives naturalistic settings, not just laboratory conditions.

The reason to lead with the switches on a payments page, rather than treat them as a footnote, is that they are the single most household-friendly consumer protection currently available for gambling spend in the UK. They cost the account holder nothing, they cover every merchant flagged with the gambling merchant-category code, and they attach the friction to the payment rail rather than to any one operator. Because the merchant-category code is enforced at the card scheme rather than the operator, they cover offshore card acceptance as well as UK-licensed acceptance. The one caveat worth stating cleanly is that if a household turns the switch off during a stressful evening, the block ceases to function, so the value of the tool depends on the delay to reactivation the bank has chosen to attach to it.

Behaviourally, the presence of a reactivation delay is what separates a useful commitment device from a decorative one. A block that can be turned off in the same tap that turned it on has almost no effect on outcomes, because the intention to spend arrives whole, and the block is undone before the intention has dissipated. A block that requires a 48-hour wait between the request and the switch-off has a very different profile, because the request has to survive a night's sleep before it becomes an action. The household choosing between two banks on this specific feature is not choosing between similar products, it is choosing between two rather different consumer-protection tools that happen to sit under the same interface.

Visa, Mastercard and the UKGC 2025 taskforce

Card schemes coordinate with regulators, and in 2025 the UK Gambling Commission convened a taskforce with Visa and Mastercard to tighten enforcement of merchant-category coding across gambling transactions. The point of the taskforce is to reduce the ability of an unregulated operator to be miscategorised at the card terminal, so that a customer who has turned on their bank gambling switch is not silently exposed to a merchant that has been coded as something innocuous. In behavioural terms this is a system-level friction, one that fixes the leaky-pipe problem that individual bank switches on their own could not solve. It is quiet infrastructure, invisible to the customer until it is the thing that stops a payment going through.

For the reader, the useful takeaway is not a table of enforcement statistics, it is a shift in how to read a declined card. A card decline at an offshore operator in 2026 is more likely to reflect scheme-level enforcement than a bank glitch, and it is more likely to survive a retry on another card. The behavioural literature on payment friction and self-control, including work summarised in the Money and Pensions Service evidence on consumer credit, suggests that a decline, treated as information, functions as a natural pause in the transaction cycle. The household that reads the decline as a nudge to close the browser tab and put the kettle on tends to fare better than the household that reads it as a technical problem to be routed around.

Crypto rails and why they still hit KYC eventually

The idea that crypto lets a household route around UK gambling checks is one of the most durable folk beliefs in the space, and it is largely wrong. Every large UK-accessible exchange applies identity checks under the Money Laundering Regulations 2017, and the on-chain record of an outbound transfer is more, not less, traceable than a card payment once the exchange link has been made. A stablecoin deposit into an offshore casino wallet is legible on a public ledger to anyone with a block explorer, and any subsequent large withdrawal from that operator back into a UK bank account will typically trigger the receiving bank's own AML monitoring. The behavioural error is treating novelty as opacity. The system is younger, not blinder.

There is a further household consideration on the way in. Buying crypto to fund an offshore account converts a familiar unit of account, sterling, into a volatile one, so the household is now carrying both the operator's negative expected value and the exchange-rate variance of the intermediate token. Mental accounting hides this double cost because the household ledger tends to treat the crypto balance as a separate pocket, but on a rigorous accounting the loss is compounded. A sober write-up of a Friday night session ought to include the fiat-to-crypto slippage, the exchange fee, the on-chain fee and any operator withdrawal fee, alongside the game outcome. When the ledger is honest, the case for crypto as a workaround thins out very quickly.

A closer look

The narrower question is where the KYC event lands on a crypto path. In the common configuration it lands twice, once at the exchange when fiat is bought or sold, and once at the operator if a withdrawal exceeds internal thresholds. A household expecting anonymity as the reward for the extra steps is usually disappointed, because the exchange retains records and the operator retains its own logs. The upshot for the behavioural read is that the extra steps do add friction, which is helpful, but they add it in an unstructured way that is easy to underestimate at the start and painful to accept at the end.

When your bank flags a suspicious deposit

Banks in the UK look at their customers' transaction patterns continuously, not because they enjoy paperwork, but because Regulation 21 of the Money Laundering Regulations 2017 obliges them to. When a deposit or withdrawal looks unusual for that customer's own pattern, the bank has options ranging from a soft touchpoint, such as a chat within the app, through to a hold on the transaction, through to a Suspicious Activity Report to the National Crime Agency. This is not the bank taking sides against gambling, it is a legal-compliance function that would look the same shape if the transaction were an unusual property deposit or an unexpected inbound transfer from abroad.

Behaviourally, a flag from a bank is one of the highest-quality signals a household will ever receive on this topic. The bank has more information about the household's income, outgoings and past behaviour than any single operator, and it applies that information at exactly the moment the household is least equipped to weigh it. The literature on hot-cold empathy gaps, most cleanly stated in Loewenstein's early-2000s papers, tells us that decisions made in a hot state are systematically different from decisions the same person makes in a cold state. A bank flag is a piece of cold-state information delivered into a hot-state moment. Treated as information rather than obstruction, it functions as a naturally occurring version of the pause we would want to build.

What a Suspicious Activity Report actually is

A Suspicious Activity Report, or SAR, is a formal document that a regulated firm submits to the UK Financial Intelligence Unit, which sits inside the National Crime Agency. It records a transaction or pattern the firm believes may be linked to money laundering, terrorist financing or other economic crime. The firm has no discretion to weigh whether a specific customer would be inconvenienced, it has a statutory duty under the Proceeds of Crime Act 2002 and the Money Laundering Regulations 2017 to submit the report when the threshold is met. For a household, the practical effect is usually invisible. Most SARs do not lead to any further action against the account holder, and the customer is not routinely told the report has been made.

The reason to describe SARs on a consumer page is that the folk version of the story tends to leap from bank pause to a criminal investigation, and that is not how the system runs. A SAR is a routine intelligence document, submitted in very large volumes across UK finance every year, and the follow-up depends on what other information the National Crime Agency already holds. The behavioural point for the household is simply that the presence of this reporting layer is a further reason to treat bank friction as information rather than pursuit. A household that reads the friction as a signal it is glad the system produced, rather than an insult, is a household that has re-anchored the frame in a helpful way.

Practical steps to reduce personal risk

A short household plan does more for outcomes than any long article. First, turn on the gambling card switch inside the mobile-banking app, and set the reactivation delay to the longest option the bank offers. Second, ring-fence a separate current-account pocket for any spend the household considers acceptable in this category, and fund it once a week rather than continuously. Third, keep a written note of the running weekly figure and share it inside the household. Fourth, review the arrangement on a fixed monthly date, not on a night when the topic is emotionally loaded. Each of these steps is a small commitment device, and the value comes from stacking them rather than picking a favourite.

The last step is the most important and the least often taken. Programme the National Gambling Helpline number, 0808 8020 133, into the mobile phone before it is needed. Behavioural research on emergency-help take-up is clear that pre-programmed contact routes are used at much higher rates than routes that require a lookup in the moment. A phone contact card labelled plainly and reachable in two taps is the household equivalent of a smoke alarm in the hallway. It costs nothing to set up in a calm moment, and the value only ever appears in the moment when the household needs it most.

One final household observation is worth stating. Payment friction, read as information, is easier to accept when the household has already agreed on what the money in question is meant to be doing. If the weekly household plan already lists what discretionary spend is available and what it is set aside for, a bank flag on an outgoing deposit is a small event, easily discussed and easily resolved. If the household has no such plan, the same flag can arrive as a shock and provoke a defensive reaction that does not help anyone. The most efficient payments-side consumer protection a household can install is not a bank switch or a written journal, it is a shared, agreed sentence about what the money is for. Everything else in this page is a scaffolding around that sentence, and the sentence is where the actual work is done.

Read next

• GamStop explained, the scheme, the periods, the checks
• The legal position for UK players outside GamStop
• The risks, explained without the marketing
• Coming off GamStop, the official route
• Getting support, helplines, clinics, family, money

Frequently asked questions