Crypto Payments in iGaming: Rules, Risks and Controls

Where can licensed operators accept crypto?

Rules change; check the regulator’s current position.

How does crypto affect source of funds checks?

Crypto makes it harder to see where money came from. The Gambling Commission’s statement on Grosvenor is the clearest recent example: the operator accepted crypto as a source of funds once converted through a bank account, without looking at how it was obtained, and a student with crypto as a declared source of funds was not moved to a higher risk level ^[2]. Evidence for crypto-derived funds should reach back to purchase: exchange statements showing purchases with traceable fiat, wallet histories linking to those purchases, and records of sales of long-held crypto. See source of funds checks.

What controls does an operator need to accept crypto?

1. Screen walletsBlockchain analytics score incoming wallets for links to sanctioned addresses, mixers, darknet markets and scams.
2. Apply the travel ruleUnder FATF Recommendation 16, and in the EU Regulation 2023/1113, originator and beneficiary information travels with transfers between service providers ^{[4] [8]}.
3. Use authorised counterpartiesIn the EU, crypto-asset service providers need authorisation under MiCA ^[9].
4. Pay out to the same walletApply closed loop to crypto, after screening.
5. Set volatility rulesState whether balances are held in crypto or converted, and which rate applies.
6. Explain networks clearlyShow which network each coin uses to avoid wrong-network deposits.

What are the red flags for crypto deposits?

• Funds routed through mixers, privacy coins or newly created wallets
• Deposits from several wallets into one account, or one wallet into several accounts
• Deposit followed by withdrawal to a different wallet with little play
• A declared source of funds relying on crypto with no history

See AML red flags for the general list.

Who should approve crypto acceptance?

Accepting crypto is a board-level risk decision, not a payments feature. It touches licence conditions, AML risk assessment, sanctions exposure, treasury (volatility and custody), accounting and customer support. Operators that accept crypto document the decision in their business-wide risk assessment, explain which controls mitigate each risk, and review it when regulators publish new guidance or enforcement.

How should support handle crypto questions?

What is the crypto travel rule?

Most gambling operators are not crypto-asset service providers themselves. They usually accept crypto through a payment provider or exchange that is. The travel rule still matters because the provider will collect information on transfers, including transfers involving self-hosted wallets, and may ask the operator or player for more. Operators should understand what their provider collects and how it shares risk signals.

How should blockchain analytics be used?

1. Screen incoming addressesCheck deposits against analytics for links to sanctioned entities, mixers, darknet markets or scams.
2. Score exposureRate the share of funds with direct or indirect exposure to high-risk sources.
3. Set actions by scoreAccept, accept with enhanced monitoring, hold for review, or reject and report.
4. Screen payout addressesCheck where winnings are being sent, not only where deposits came from.
5. Record decisionsKeep the analytics result and the decision for audit.

How do crypto rules differ under MiCA?

The EU Markets in Crypto-Assets Regulation (MiCA) ^[9] regulates crypto-asset issuers and service providers. It does not license gambling, but it shapes the providers operators use: authorised crypto-asset service providers must meet conduct and safeguarding requirements. For operators, the practical effect is to prefer authorised providers and to check that the provider’s licence covers the services used.

Why do regulators treat crypto as higher risk?

Crypto transfers are fast, cross-border and hard to reverse, and the origin of funds can be obscured through mixers, multiple wallets and chains. Those features make crypto attractive to some legitimate players and to people moving criminal money. That is why regulators that permit crypto-derived funds still expect operators to trace them to a legitimate source, as the Grosvenor case shows ^[2].

For operators, the question is not only whether crypto is allowed in a market, but whether they can evidence where the money came from. Exchange statements, wallet history and the original source of funds used to buy the crypto are the usual starting points.

How does a crypto deposit work, step by step?

1. Check the market allows itCrypto is accepted only where the licence permits it. It is not a permitted method for licensed betting in Brazil ^[1].
2. Generate a deposit addressThe operator’s crypto payment provider issues a deposit address or invoice, often valid for a limited time.
3. Wait for confirmationsThe provider waits for a set number of blockchain confirmations before treating the deposit as final.
4. Screen the sourceBlockchain analytics score the sending address for exposure to sanctioned entities, mixers or illicit markets.
5. Convert and creditMany providers convert to fiat at a quoted rate and credit the player’s balance in fiat. Others credit in crypto.
6. Apply source of funds rulesLarger or higher-risk deposits trigger questions about where the crypto came from ^[2].
7. Pay out to a checked addressWithdrawals go to an address the player controls, screened in the same way as deposits.

Which regulators set crypto rules for gambling operators?

What does a good crypto acceptance programme look like?

Grosvenor’s settlement shows the cost of accepting crypto as a source of funds without tracing it ^[2].

Worked example 2: a deposit with mixer exposure

1. 10:00
   A player at an operator that accepts crypto sends a deposit worth about €4,000.
2. 10:20
   After confirmations, analytics show a significant share of the funds passed through a mixing service.
3. 10:21
   Policy says deposits above a set exposure level are held. The balance is not credited for play.
4. 11:00
   An analyst reviews the case and asks the player for exchange records showing how the crypto was bought.
5. Day 3
   No credible evidence is provided. The MLRO decides whether to report, and the funds are handled under the operator’s policy and local law.
6. Day 4
   The player is told the deposit could not be accepted, without being told about any report.

How do markets compare on crypto and AML reporting?

Worked example: crypto-derived fiat at a UK operator

What mistakes do operators commonly make?

Checklist

• Market position on crypto documented per licence.
• Wallet screening on deposits and payouts.
• Travel rule data collected where required.
• Same-wallet payouts enforced.
• Crypto-derived funds traced to acquisition.
• Network and rate rules shown in the cashier.
• Board-level risk decision documented.
• Custody and treasury controls defined.
• Support answers for crypto issues ready.
• Blockchain analytics on deposits and payouts.
• Provider’s MiCA or local authorisation checked.

Frequently asked questions

Sources

More guides