Payments and checks, banks, cards, crypto, KYC

UK Money Laundering Regulations 2017 in a paragraph

The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, as amended by the 2019, 2022 and later statutory instruments, sit under the fourth, fifth and sixth EU AML directives and remain in force in the UK after the transition period. The regulations require banks, e-money firms, crypto-asset businesses, and gambling operators licensed by the UKGC to identify their customers, verify the source of funds where the risk warrants, and file a Suspicious Activity Report with the National Crime Agency when a transaction fits a defined pattern. An offshore gambling site does not have to follow these rules in the UK sense, but the payment rail beneath it very often does, and that is why deposits made from a UK bank to a non-UKGC operator now travel through more scrutiny, not less, than they did five years ago.

For a carer, the paragraph above is worth reading twice because it explains why the bank is now often the first place a problem is seen. When your loved one opens a new payment channel, whether a card, an e-wallet, or a crypto exchange, the bank behind that channel is running an identity check and a transaction-pattern check. The check may not stop the payment. It may however produce a phone call from the bank's fraud team, a delay on a specific transaction, or a soft flag that appears when the household later applies for a mortgage or a credit product. Understanding this quietly changes what you should say to the bank when you ring, and it is one of the reasons carers who take the time to read the underlying rules tend to get further with a difficult conversation than carers who arrive apologising.

How offshore KYC differs from UKGC-licensed KYC

UKGC-licensed operators run a know-your-customer check that is designed to satisfy the Commission and the wider UK AML framework. The check typically includes name, date of birth, address, a document upload, and a check against sanctions and PEP lists, and it is repeated when the customer's activity crosses certain thresholds. Failure to complete the check to the operator's satisfaction locks the account. Offshore operators outside UKGC remit run a check that is designed to satisfy the licensor in their home jurisdiction, which is often less prescriptive on documentation and much less prescriptive on ongoing monitoring, and the check may be waived up to a deposit or withdrawal threshold that is unrecognisable from a UK point of view.

What this means in practice is that a loved one can sometimes deposit for a considerable period without producing a passport or a bill, and then find at the point of a large withdrawal that a full document set is suddenly required, with the operator holding the funds until the pack is complete. Families reach us at that moment with a very specific worry, which is that the money is now beyond both the household and the ordinary UK complaint channels. It is a real risk, and it is worth being honest about with your loved one before it happens rather than after. There is no version of this conversation that is easy, but the sequence is easier if you have read the mechanics first, and it is easier still if the household has already thought about who else they might want in the room.

A closer look

UKGC-licensed sites also run affordability checks under the White Paper reforms; offshore sites do not. That absence is not a feature to the customer, because the same absence removes the operator's obligation to intervene when the pattern of play suggests harm. A carer reading the two frameworks side by side is often struck by how much of what looked like consumer inconvenience on the UK side is in fact a safety net designed for exactly the person they are worrying about, and how much of what looked like offshore freedom is in fact the absence of that net.

Bank blocks and card gambling switches in 2026

Every major UK high-street and app-based bank now offers a voluntary gambling block on debit cards. HSBC, Monzo, Starling, Lloyds and Barclays each publish a switch that the account holder can activate inside a mobile banking app or by calling the bank, and each block runs a cool-off delay of between 24 and 72 hours before the customer can turn it off again once it is on. The delay is deliberate, because the switch is designed to hold at the moment of temptation. From a carer's point of view the switch is one of the most useful pieces of household infrastructure to know about, but it is worth being clear that only the account holder can turn it on, and no bank will accept a switch instruction from a spouse or a parent without a registered lasting power of attorney.

What you can do, and what many families do, is sit next to your loved one while they navigate to the switch and turn it on themselves. You can then ring the bank's vulnerable customer team together and ask about the other tools the bank holds, which sometimes include a spending category freeze, a merchant lookup, and a case owner who follows the account for a short period. You cannot make the choice for your loved one, but you can create the conditions in which the choice is easier to make, and you can hold the phone while they navigate a call that would be harder to make alone. If your loved one refuses the switch, that is their right; do not push, and do not turn the moment into an argument the household then has to recover from.

Visa, Mastercard and the UKGC 2025 taskforce

In 2025 Visa and Mastercard joined a UKGC-led taskforce on merchant category code enforcement, and the result has been a steady tightening of what happens when a UK card is presented to an offshore gambling merchant. A merchant category code is the four-digit number the card scheme uses to classify a transaction, and the code most commonly associated with online gambling is now checked at the acquirer level with a much lower tolerance for miscoded transactions than in previous years. This has produced a growing pattern in which offshore deposits are flagged, delayed or refused at the payment processor before they ever reach the operator, and it is one of the reasons families sometimes see an unexpected pattern of small failed transactions on a card statement.

The taskforce activity has practical consequences for the household. A failed transaction can trigger the bank's fraud alerts, which arrive as a text or an app notification, and that notification is sometimes the first outside signal a carer receives that gambling has resumed. It is not helpful to treat the notification as a gotcha moment; it is helpful to treat it as a data point in a longer conversation. The taskforce has also produced clearer routes for a customer to challenge a miscoded transaction, and if you and your loved one are both willing, a short call to the bank's disputes team is now more likely to lead somewhere than it was even two years ago.

Crypto rails and why they still hit KYC eventually

Crypto is often described in offshore marketing as a way to keep gambling private from a bank, and the framing is misleading. In the UK a person cannot convert pounds to crypto through a legitimate exchange without passing a full identity check under the Money Laundering Regulations 2017 as amended, and the exchange must retain those records for at least five years. The check happens at the exchange, not the operator, and it produces exactly the same paper trail a card deposit would produce, sometimes more. Families who arrive worried that their loved one has moved onto crypto to make things invisible are often surprised, and slightly relieved, to hear that the trail is in fact plainer than the one produced by an e-wallet.

The other side of the crypto question is volatility. A person depositing in crypto is exposed to a price movement between the moment they buy the coin and the moment they place a wager, and again between the moment they cash out a win and the moment they return the coin to pounds. In practice this compounds the risk rather than reducing it, and it multiplies the number of transactions the household eventually has to unpick if debt has begun to build. Nothing about the rail is safer than a card, nothing about it is more private in a legal sense, and nothing about it removes the ordinary consumer protection that is already missing from an offshore operator.

A closer look

Some carers ask us whether stablecoins solve the volatility half of the problem. They reduce it, but they do not remove it, because the exchange still charges a spread, and the operator's own conversion rate at the point of wager is often noticeably worse than the market rate. Reading through a stablecoin deposit and withdrawal cycle typically reveals a friction cost of several per cent even before any play has taken place, and that friction accrues silently across a period of weeks.

When your bank flags a suspicious deposit

A bank will flag a transaction that fits a pre-defined pattern under its internal AML framework, and offshore gambling deposits are one of the patterns most commonly monitored. What the flag actually triggers depends on the size of the transaction, the customer's history, and the bank's tolerance for risk on that specific product. Sometimes it produces nothing more than an entry in a monitoring log. Sometimes it produces a call from the fraud team, or a hold placed on the account for a short period whilst the bank asks about the purpose of the transaction. Sometimes it produces a Suspicious Activity Report to the National Crime Agency, which the customer will typically not be told about at the time.

From a carer's point of view the flag is not a threat, and the household should not treat it as one. It is a signal, and the signal can be met with a factual response. The bank does not need to hear the household's private business; it needs to hear enough to satisfy the framework it is working within. If a call comes and your loved one is not comfortable taking it alone, ask their permission to sit next to them while they speak, and take notes of the call reference numbers so the conversation can be resumed later. Do not speak on their behalf without their consent, because the bank will refuse to continue the call.

What a Suspicious Activity Report actually is

A Suspicious Activity Report, or SAR, is a document sent by a regulated firm to the National Crime Agency when the firm sees a transaction that fits a defined risk pattern. It is not an accusation of a criminal offence, and it does not automatically produce a police investigation. It is a form of intelligence-sharing, and most SARs are read, catalogued, and used to inform later analysis without ever producing an action visible to the customer. The rules on SARs are set out in the Proceeds of Crime Act 2002 and refined by Financial Action Task Force guidance, and the firm cannot tell the customer that a report has been made; doing so is a criminal offence called tipping-off.

Families sometimes hear about SARs after the fact, either through a mortgage broker mentioning that an application has been declined, or through a bank asking a series of questions that seem to come from a specific concern rather than a routine review. The best response is neither panic nor confrontation. It is to speak honestly to the person asking the questions, to keep a record of the answers given, and to seek advice from Citizens Advice or a solicitor if the questions are producing decisions the household does not understand. The SAR itself is not the problem, and treating it as one tends to make the conversation worse rather than better.

A carer can also ask a solicitor for a brief written opinion on a specific concern for a modest fixed fee, and this is worth doing before making significant financial decisions in response to a suspected SAR. Legal aid does not generally cover this territory, but Law Centres and some Citizens Advice offices maintain lists of solicitors who offer a first half-hour at a reduced rate, and a short paid opinion is often the cheapest way to settle a household's anxiety. If nothing else, it will confirm whether a decision the household has been offered by a bank is one it has to accept, and what the options are if it does not.

Practical steps to reduce personal risk

The first practical step for any carer is to protect their own financial position, because a household that has one solvent adult is a household with options a household without one does not. If your salary lands into a joint account, consider opening a personal account in your sole name and directing your salary and household direct debits there. This is not a hostile move and it is not a step towards leaving; it is a step towards making sure the rent, the food shop and the children's school costs continue to be paid regardless of what happens on the gambling side of the ledger. Speak to StepChange on 0800 138 1111, Citizens Advice, or National Debtline on 0808 808 4000 for a free walkthrough of the sequence.

The second practical step is to make sure your own credit file is clean and readable. If your loved one has been using credit in your name, or in a joint name, obtain a copy of your credit file from one of the UK credit reference agencies and read it line by line. If entries appear that you do not recognise, dispute them in writing and keep a copy of the dispute. If children live in the home and are old enough to notice, look up Family Lives on 0808 800 2222 and Young Minds; both offer free confidential support, and both are used to speaking with families where an adult in the home is struggling. Nothing on this page is a substitute for advice tailored to your own situation, but the steps above will hold in most households in most circumstances, and they will make the harder conversations that follow easier to have.

The third practical step, and the one most often left until last, is to look after your own mental and physical health. Sleep, food, walking, and a small number of people in your life who know what is happening are not indulgences; they are the resources your ability to help your loved one draws from. If any of them has started to slip, treat that as the first place to invest rather than the last. Speak to your GP if worry is affecting your sleep or appetite for more than a fortnight. Speak to Samaritans on 116 123 if the noise in your head has become too much to sit with alone. Nothing about caring for yourself in this way reduces your usefulness to the person you love; it is the specific act that keeps you useful over the months and years the household may still need to travel.

Read next

• GamStop explained, the scheme, the periods, the checks
• The legal position for UK players outside GamStop
• The risks, explained without the marketing
• Coming off GamStop, the official route
• Getting support, helplines, clinics, family, money

Frequently asked questions