Online Gaming and Skill Games Payment Processing: MCC 7995 and the Coding Problem

The merchant account is approved. The acquirer spent six weeks on the file, read the legal opinion, checked the geolocation vendor, and boarded it. Then deposits go live and roughly a third of them fail. The cards are good and the players are real depositors who funded an account somewhere else last month. Nothing is broken on the merchant's side, and nothing the merchant can build will fully fix it. Getting approved is the easy half here, because the code your transactions carry tells every issuing bank in the country what you are before your name ever loads. This is a guide to how gaming gets coded, what the current legal map does to your options, and what a stack that survives a category shift looks like.

The category is defined by its code

Most high-risk verticals are risky by inference: an underwriter predicts the dispute pattern and prices it. Real-money gaming is different, because the card networks give the category its own merchant category codes and then let thousands of issuing banks set their own policy about those codes.

MCC 7995 is the general wagering code, covering betting, lottery ticket sales, casino chips, and off-track and track wagering. Visa also maintains narrower codes for licensed operators, including 7800 for government-owned lotteries, 7801 for government-licensed online casinos, and 7802 for government-licensed horse and dog racing. Which code you run under is not a preference you select. Your acquirer assigns it at boarding, registers you with the brands where required, and vouches for the licensing behind it.

The consequence of that code is not paid by your acquirer. It is paid by you, at authorization, by issuers who treat the code as a category to decline rather than a merchant to assess.

The decline that is structural, not fixable

Approval happens twice in this vertical, and merchants routinely count only the first one. Your acquirer approves the business, and then every player's issuing bank decides whether it wants to approve a gambling-coded transaction on that specific card. A meaningful slice of US issuers, particularly credit unions and smaller regional banks, decline the code categorically. Many also treat gaming deposits as cash advances rather than purchases, which brings different limits, fees, and decline logic.

The practical effect is that a fully licensed operator sees authorization rates well below what an ordinary ecommerce merchant would call a crisis, and checkout optimization does not move that number much. What does move it is routing.

Multiple MIDs across multiple acquirers, cascading a declined deposit onto a different acquirer under a different BIN relationship, recovers volume a single-MID setup simply loses. The mechanics of doing that safely, including how to avoid retry patterns that look like card testing, are in the MID load balancing guide. Read your declines properly while you build that logic, because a hard decline on a blocked code and a soft decline on a velocity rule call for opposite responses, and the decline code reference tells you which is which.

The gray zone, and why it keeps narrowing

The category's hardest question is not how to process wagering. It is whether your product is wagering at all.

Skill-based contests with entry fees, and dual-currency sweepstakes casinos handing out a promotional currency redeemable for prizes, were built to sit outside gambling law and outside gambling coding. For years that worked well enough that operators treated coding as an optimization: run as games or digital goods, dodge the 7995 decline tax, keep the legal opinion in a drawer.

That window has narrowed sharply. The sweepstakes model came under sustained legislative and attorney-general pressure through 2025 and into 2026, with statutory bans or explicit restrictions enacted in a growing list of states, including California, New York, New Jersey, Connecticut, Montana, and Nevada. That map is redrawn every legislative session, so treat any list, including this one, as a snapshot to confirm with counsel for the states you serve.

If the networks conclude your product is wagering and your volume is running under a benign code, that is transaction laundering, not a classification disagreement. Brand fines land on your acquirer, the account is terminated rather than remediated, and misrepresentation of the business at onboarding is the termination reason most likely to produce a MATCH listing that follows the principal for five years. The deferred underwriting pattern is at its most brutal here, because the review that catches you arrives long after the volume is real and the player base is large.

So settle the coding question in writing before you build. Get a legal opinion on whether your model is wagering in each state you take deposits from, present it to your acquirer, and run under the code they register you for. Paying the 7995 decline tax deliberately is survivable. Being recoded retroactively usually is not.

What underwriting actually asks for

Gaming underwriting is closer to a licensing review than a credit review, and the document pack is the heaviest of any vertical this site covers.

Expect to produce gaming licenses for every jurisdiction you serve, legal opinions for any you serve without one, and evidence of the controls the acquirer is on the hook for. That evidence is operational, not declarative. Geolocation blocking has to run at deposit and not only at signup, because that is where the money moves and the exposure attaches. The Unlawful Internet Gambling Enforcement Act obliges the payments system itself to block restricted transactions, which is why your processor audits your geofencing instead of trusting it.

Underwriters will also want age verification, self-exclusion controls that actually block a listed player, a KYC and AML program sized to your volume, and a picture of player balance liabilities. That last item drives the reserve, because player balances are money you owe and the acquirer prices for a failure while it is holding them. Rolling reserves here run higher and release slower than in most verticals.

Three tiers, and only one of them is real

	Aggregator	Registered gaming MID	Offshore acquiring
Boards real-money gaming	No, prohibited	Yes, with licensing and registration	Yes, specialist appetite
Underwriting focus	None at signup	Licenses, geolocation, KYC and AML	Varies, often lighter
Reserve	None, then a 90 to 180 day hold	Rolling, elevated, slow to release	Often higher
Under scrutiny	Freeze and terminate	Notice, remediation, new terms	Varies by acquirer
Realistic role	None	Primary processing	Non-US volume, redundancy

Stripe, PayPal, Square, and Shopify Payments all prohibit real-money gambling outright, which puts them further out of reach than in verticals where enforcement arrives late. Anyone running deposit volume through them is doing so under a business description that does not match the business, and the outcome is a frozen balance and a MATCH listing rather than a warning.

Offshore acquiring is a legitimate part of a mature gaming stack rather than a last resort, since specialist acquirers have served licensed operators for decades. The honest trade is higher pricing, larger reserves, foreign-currency settlement, and cross-border interchange that shaves approval rates further.

The disputes come from your players

Gaming's signature chargeback is not a stolen card. It is a player who deposited deliberately, lost, and decided the transaction was unauthorized. Family-member use is the second cluster, most often a minor depositing on a parent's card. The third is the withdrawal dispute, where a player who cannot cash out quickly charges back the deposits instead, which makes payout speed a chargeback control whether you think of it that way or not.

What wins these is account-level evidence rather than transaction-level evidence. KYC records, device fingerprints, IP and geolocation logs, session and gameplay history, prior withdrawals, and the bonus terms the player accepted beat an unauthorized-use claim from someone who played on the account for weeks. Run prevention alerts through Ethoca and Verifi with player-account correlation, so a dispute freezes the balance before the funds are withdrawn and you lose twice on one deposit. Measure your real ratios with the chargeback ratio explainer, and keep the chargeback reason code reference beside your evidence templates.

Architecture for a category that gets exited

Plan for the failure this vertical actually produces: not termination for your numbers, but a notice period because a state changed the law or a sponsor bank left the category.

Run a primary and a backup MID at separate acquiring banks, split live deposits across both, and keep the backup warm rather than theoretical. Keep player card credentials in a processor-neutral vault, as described in the token vault explainer, because gaming operators change acquirers often and a depositor base you cannot re-point is one you mostly lose. Keep the compliance record portable too, so the next underwriter is satisfied in days rather than months.

Practical takeaway

Online gaming and skill games are not hard to bank because of dispute volume. They are hard to bank because your network code hands thousands of issuers a standing decision about your transactions, because the legality map under your model is redrawn every legislative session, because your processor carries regulatory exposure for your geofencing, and because your losing players are your largest source of chargebacks. The operator who lasts settles the coding question in writing before building, boards through an acquirer that already runs a licensed gaming portfolio, enforces geolocation at deposit, cascades across multiple MIDs to claw back structural declines, and keeps a second bank and a neutral vault behind all of it. The operator who fails codes wagering as digital goods and learns the price when the balance freezes and the MATCH listing lands. For a walkthrough of what a durable online gaming and skill games payment stack looks like at your volume, apply for an architecture review.