Payments and checks, banks, cards, crypto, KYC

UK Money Laundering Regulations 2017 in a paragraph

The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 are the domestic instrument through which the United Kingdom implements the anti-money-laundering directives that came out of Brussels between 2015 and 2018. They apply to banks, to payment institutions, to electronic money issuers, to authorised gambling operators and to a growing list of crypto-asset businesses. They set out the customer-due-diligence work that a regulated firm has to complete on an ordinary customer, the enhanced due diligence that it has to complete on a customer whose profile carries higher risk, and the ongoing monitoring that runs across the life of a business relationship. The Regulations are the mechanism that put identity verification at the deposit step for UK-licensed operators, and the mechanism that keeps banks watching transactions long after an account has been opened.

None of that machinery reaches an offshore operator that has no permission to solicit UK customers. The Regulations do reach the two ends of the payment chain where a UK-regulated firm sits, which is the issuing bank on your side and the acquiring bank at the operator's end. That is why the phrase no KYC can be printed truthfully on an offshore home page and remain misleading. The operator is telling you what it will not do. It is not telling you what your bank is required to do, what the acquirer is required to do or what an exchange in the middle of a crypto route is required to do. The reader is left with an impression that the transaction sits outside any check, and the impression is not accurate.

How offshore KYC differs from UKGC-licensed KYC

On a UK-licensed operator the identity check happens early. The Gambling Commission's licence conditions require verification of name, address and date of birth before the customer is allowed to gamble, and further verification before the customer is allowed to withdraw. The check is intrusive, and it is criticised as such by customers who compare it to the offshore experience. The offshore experience feels quicker because the operator has moved the intrusive step to a later point in the relationship, being the point at which the customer wants to take money out. The result is a home page that reads no KYC, a registration form that asks for very little, and a first deposit that clears without friction.

What the offshore experience does not tell you is that the terms and conditions preserve the operator's right to request identification, source-of-funds documentation and further evidence at any point before releasing a withdrawal. The right is often expressed in a paragraph that runs to several hundred words, in a font size smaller than the marketing headline, and it usually reserves the right to void the winnings if the documentation is not provided within a set number of days. From the position of an editor reading advertising copy for a living, that combination reads as a classic bait and switch. From the position of the customer, it reads as a gate that appears at the moment the customer stands to gain something.

A closer look

The specific patterns to watch for are these. First, the withdrawal-only KYC provision, which places the identity check at the least convenient point. Second, the source-of-funds provision, which allows the operator to demand payslips, bank statements or tax returns before a large withdrawal is released. Third, the maximum win from a bonus provision, which caps the amount that can be withdrawn from a promotional balance even if the customer's balance shows more. Together those three clauses turn an advertised instant withdrawal into a documented review, and the reader who reached the site through the home page has no way of knowing they exist until the moment they matter.

Bank blocks and card gambling switches in 2026

Every one of the five largest UK retail banks now offers a gambling block on their consumer cards. The switch lives inside the mobile application. On HSBC it is under card controls. On Monzo it is under gambling block within the account settings. On Starling, on Lloyds and on Barclays it sits in a comparable location. When the switch is on, the bank declines any transaction assigned the merchant category code that identifies gambling, whether the merchant is a UK-licensed operator or an offshore one. The block cannot distinguish between the two. If the transaction is coded as gambling, and the switch is on, the transaction fails.

The switch also carries a cool-off period that runs after the customer turns it off. On Monzo and Starling that period sits in the region of forty-eight hours to seventy-two hours. On the larger high-street banks it can run longer. The cool-off is the reason the block does its protective work in the situations that most matter, which are the moments of pressure in which the customer would otherwise reverse a decision made in a calmer moment. From an advertising-standards perspective, the availability of these blocks changes what an offshore operator can honestly say about the ease of depositing from the United Kingdom. The claim that any UK card will work is no longer accurate. The claim that a deposit will always clear was never accurate. The gap between the two claims and the reality is now large enough to be visible without a magnifying glass.

Visa, Mastercard and the UKGC 2025 taskforce

In the spring of 2025 the Gambling Commission announced a joint taskforce with Visa and Mastercard aimed at the acquiring end of the payment chain, being the end at which the merchant's bank presents a transaction to the card network for authorisation. The taskforce sits alongside the Gambling Commission's broader enforcement work, which produced more than seven hundred and seventy cease-and-desist notices in the 2024 to 2025 reporting year and led to around sixty-four thousand URL removals through Google and two hundred and sixty-four domain removals. The card networks bring a different lever. They can decline to route transactions from acquirers that are known to process unlicensed gambling for UK customers, and they can act on those decisions much faster than a domestic regulator can pursue a case against an offshore incorporation.

The practical consequence is a growing category of offshore operators that have quietly stopped accepting UK cards altogether, and a smaller category that continues to accept them at the price of a heightened rate of declines and chargebacks. That reality does not appear on the operator's home page. What appears on the home page is a Visa logo, a Mastercard logo, and a statement to the effect that most UK cards work. The statement is not a lie. The statement is written in the present tense about a set of arrangements that were true last month and may not be true next week. Reading it as a promise of reliable service is a mistake the copy is designed to permit.

Crypto rails and why they still hit KYC eventually

An offshore operator that will not take a UK card will often take a cryptocurrency deposit instead. The mechanics are simple. The customer buys the token on a UK exchange, sends it to a wallet at the operator's end, and plays with the credited balance. On the operator's marketing page that route is presented as a way to sidestep the bank block, the merchant category code, and the identity check. On the exchange, the route sits inside the same regime that governs a bank transfer. The Financial Conduct Authority now supervises UK-based cryptoasset businesses for anti-money-laundering purposes, and every mainstream exchange completes full customer-due-diligence on account opening. The idea that a crypto route is invisible to the UK authorities does not survive contact with the exchange's onboarding process.

The invisibility problem is worse on the way back. A withdrawal from an offshore operator, converted from token to sterling on a UK exchange, and paid into a UK current account, arrives on the banking system as an incoming credit from a cryptoasset business. That is not a hidden transaction. It is a well-signposted one. The bank's transaction-monitoring software reads it as a crypto-related receipt and processes it accordingly. Frequent large receipts of that kind will trigger the same questions that a series of returning bank transfers from a gambling merchant would trigger. The route was never invisible. The marketing that suggested otherwise was reading a technical property of the token layer and describing it as if it also applied to the payment layer.

A closer look

The specific point at which the identity check meets a crypto route is at the exchange, and specifically at the account-opening step. Once you have completed customer-due-diligence at a UK exchange, the exchange holds a record of every token movement into and out of the account tied to that identity. If, later, an offshore operator sends a large token payment back to that same wallet, the exchange has both the source and the destination in a form that a request for information from a UK regulator can retrieve. That is not a feature the offshore operator will explain in its cashier documentation, and it is a feature that the customer typically discovers only when a question is asked.

When your bank flags a suspicious deposit

UK retail banks operate transaction-monitoring rules that read incoming and outgoing transactions against a set of patterns held by the bank as a matter of internal policy. The rules are not published. They are calibrated to the customer's ordinary use of the account, to the merchant categories the customer normally transacts with and to the ratios between disposable income and out-payments that the account has shown over the preceding months. A deposit that sits outside the normal pattern triggers a review. The review is invisible to the customer in most cases. In a smaller number of cases the customer will notice, because the account has been paused, a card has been declined at a point of sale, or a message has arrived asking for a call to the bank.

What tends to appear in the customer's inbox is a plain-language request to confirm the transaction, followed by a request to explain the source of the funds. The bank is not accusing the customer of anything. It is running the risk process the Money Laundering Regulations 2017 require, and it is documenting its enquiries so that its own regulatory position is protected. On an offshore-gambling pattern the review will typically ask about the frequency of deposits, the identity of the merchant, and the pattern of withdrawals. A customer who cannot answer those questions clearly, or who has no records of the merchant relationship because the merchant has offered no reliable statements, is a customer whose review may end in the closure of the account.

The tone of the bank's enquiry is worth reading carefully. It is nearly always a routine risk-management letter, drafted by a compliance officer whose job is to document the bank's own position rather than to challenge the customer's conduct. Answering promptly, factually and without embellishment is the correct response. Where the customer has records to hand, providing them tends to close the review at that stage. Where the customer has none, the safe reply is to say so plainly. Bank compliance officers are more comfortable with an honest account they can note on the file than with a defensive account that does not sit against the transactions the account has shown.

What a Suspicious Activity Report actually is

A Suspicious Activity Report is a formal notice sent by a regulated firm to the National Crime Agency in accordance with Part 7 of the Proceeds of Crime Act 2002 and the Money Laundering Regulations 2017. It is not a public document, it is not shared with the customer whose account is the subject of the report, and it does not by itself trigger a criminal investigation. It is the mechanism through which the state builds a picture of financial activity that may sit in scope of the money-laundering offences. Ordinary gambling deposits do not produce a SAR. What produces a SAR is a pattern of transactions that the regulated firm cannot reconcile with the customer's disclosed income or with the customer's answers to routine due-diligence questions.

The advertising claim that a route is anonymous is a claim that the SAR regime does not exist for that route. The claim is not accurate for any route that touches the UK banking system, the UK crypto exchange sector, or a UK payment institution. Where it approaches accuracy is on the small subset of routes that stay entirely inside the offshore layer, and those routes present their own set of risks that outweigh the advertised benefit. From the position of an ex-ASA officer reading the copy, the claim of anonymity would not survive a substantive complaint under the CAP Code if the CAP Code applied. Because the operator sits outside the code, the claim continues to appear without correction.

Practical steps to reduce personal risk

If you have arrived on this page because you are already exposed, there are steps that are worth taking today. Turn on the gambling block inside your banking application and leave it on. Ask your bank for a written record of the cool-off period that applies when the switch is turned off, so that you know what the delay will be if you attempt to reverse the decision. If you use a crypto exchange, review the settings that govern outgoing transfers to unlisted wallets and consider tightening them. If you have shared card details with an offshore operator, request the card to be replaced by your bank, which will invalidate the details held by the operator and require any future transactions to use a fresh card that you have not shared.

Documentation is the second theme. Keep records of every deposit, every withdrawal, every promotional balance, and every message from the operator, and hold them in a place that survives your loss of interest in the topic. If a review by your bank arrives in six months, you will need the records. If a withdrawal is withheld and you decide to challenge it, you will need the records. If you eventually seek help from a debt-advice charity, they will need the records. The offshore operator will not provide them on request, and they are considerably harder to reconstruct after the account has been closed than they are to save in real time.

Read next

• GamStop explained, the scheme, the periods, the checks
• The legal position for UK players outside GamStop
• The risks, explained without the marketing
• Coming off GamStop, the official route
• Getting support, helplines, clinics, family, money

Frequently asked questions