Online Gaming and Skill Games Payment Processing: MCC 7995 and the Coding Problem

The merchant account is approved. The acquirer spent six weeks on the file, read the legal opinion, checked the geolocation vendor, and boarded it. Then deposits go live and roughly a third of them fail, on good cards held by players who funded an account somewhere else last month. Nothing the merchant can build will fully fix it. Getting approved is the easy half, because the code your transactions carry tells every issuing bank what you are before your name loads. This is a guide to how gaming gets coded, what the legal map does to your options, and what a stack that survives a category shift looks like.

The category is defined by its code

Most high-risk verticals are risky by inference: an underwriter predicts the dispute pattern and prices it. Real-money gaming is different, because the networks give the category its own merchant category codes and let thousands of issuing banks set policy about them.

MCC 7995 is the general wagering code, covering betting, lottery ticket sales, casino chips, and off-track and track wagering. Visa also maintains narrower codes for licensed operators, including 7800 for government lotteries, 7801 for licensed online casinos, and 7802 for licensed racing. Which code you run under is not a preference you select: your acquirer assigns it at boarding, registers you with the brands where required, and vouches for the licensing.

The consequence of that code is not paid by your acquirer. It is paid by you, at authorization, by issuers who treat the code as a category to decline rather than a merchant to assess.

The decline that is structural, not fixable

Approval happens twice here, and merchants count only the first one. Your acquirer approves the business, then every player's issuing bank decides whether it will approve a gambling-coded transaction on that card. A meaningful slice of US issuers, particularly credit unions and smaller regional banks, decline the code categorically. Many also treat gaming deposits as cash advances rather than purchases, which brings different limits, decline logic, and a fee the player never expected.

A licensed operator therefore runs authorization rates an ordinary merchant would call a crisis, and checkout optimization does not move them much. What moves them is measuring correctly, then routing around the fixed part.

Break declines down by issuing BIN rather than by response code alone. A categorical block shows up as near-total failure on a handful of BINs while the rest of the book performs normally, which an aggregate approval rate hides. A BIN that declines everything is not a conversion problem to tune, it is a population to route differently or serve on another rail. The authorization rate guide covers how to tell fixed issuer policy from the soft declines you can recover.

Multiple MIDs across multiple acquirers, cascading a declined deposit onto a different acquirer under a different BIN relationship, recovers volume a single-MID setup simply loses. Build the cascade with retry limits and back-off, because an aggressive retry pattern looks like card testing to networks already watching your code. Keeping that maintainable instead of a pile of conditional logic is what the payment orchestration explainer covers.

The rails that are not cards

Cards are the rail this category is most penalized on, which is why mature operators do not lean on them alone. Bank-based deposits, ACH and pay-by-bank in the US and open banking elsewhere, carry no MCC for an issuer to block, settle cheaper, and are harder to reverse as an unauthorized-use claim. The honest trade is a slower, less familiar deposit experience, a return window that is not a chargeback but still claws money back, and a KYC burden of its own. Treat a bank rail as a second primary rather than a fallback, because offering it to the BINs you know decline you converts players a cascade never reaches.

The gray zone, and why it keeps narrowing

The hardest question here is not how to process wagering. It is whether your product is wagering at all.

Skill-based contests with entry fees, and dual-currency sweepstakes casinos handing out a promotional currency redeemable for prizes, were built to sit outside gambling law and gambling coding. For years that worked well enough that operators treated coding as an optimization: run as games or digital goods, dodge the 7995 decline tax, keep the legal opinion in a drawer.

That window has narrowed sharply. The sweepstakes model came under sustained legislative and attorney-general pressure through 2025 and into 2026, with statutory bans or restrictions enacted in a growing list of states, including California, New York, New Jersey, and Nevada. That map is redrawn every legislative session, so treat any list, including this one, as a snapshot to confirm with counsel.

If the networks conclude your product is wagering while your volume runs under a benign code, that is transaction laundering, not a classification disagreement. Brand fines land on your acquirer, the account is terminated rather than remediated, and misrepresentation at onboarding is the reason most likely to put the principal on the MATCH list for five years. The review that catches you arrives long after the player base is large.

So settle the coding question in writing before you build: get a legal opinion on whether your model is wagering in each state you take deposits from, and run under the code your acquirer registers you for. Paying the 7995 decline tax deliberately is survivable. Being recoded retroactively usually is not.

What underwriting actually asks for

Gaming underwriting is closer to a licensing review than a credit review, and the document pack is the heaviest of any high-risk vertical.

Expect gaming licenses for every jurisdiction you serve, legal opinions for any you serve without one, and evidence of the controls the acquirer is on the hook for. That evidence is operational, not declarative. Geolocation blocking has to run at deposit, not only at signup, because that is where the money moves and the exposure attaches. The Unlawful Internet Gambling Enforcement Act obliges the payments system itself to block restricted transactions, which is why your processor audits your geofencing instead of trusting it.

Underwriters will also want age verification, self-exclusion controls that actually block a listed player, a KYC and AML program sized to your volume, and player balance liabilities. That last item drives the reserve, because player balances are money you owe while the acquirer holds them, so rolling reserves here run higher and release slower than most.

Three tiers, and only one of them is real

	Aggregator	Registered gaming MID	Offshore acquiring
Boards real-money gaming	No, prohibited	Yes, with licensing and registration	Yes, specialist appetite
Underwriting focus	None at signup	Licenses, geolocation, KYC and AML	Varies, often lighter
Reserve	None, then a 90 to 180 day hold	Rolling, elevated, slow to release	Often higher
Under scrutiny	Freeze and terminate	Notice, remediation, new terms	Varies by acquirer
Realistic role	None	Primary processing	Non-US volume, redundancy

Stripe, PayPal, Square, and Shopify Payments all prohibit real-money gambling outright, so deposit volume running through them sits under a business description that does not match the business, and the outcome is a frozen balance and a MATCH listing, not a warning. Offshore acquiring, by contrast, is legitimate in a mature stack rather than a last resort, traded against higher pricing, larger reserves, foreign-currency settlement, and cross-border interchange that shaves approval rates further.

The disputes come from your players

Gaming's signature chargeback is not a stolen card. It is a player who deposited deliberately, lost, and decided the transaction was unauthorized. Family-member use is the second cluster, most often a minor depositing on a parent's card. The third is the withdrawal dispute, where a player who cannot cash out quickly charges back the deposits instead, which makes payout speed a chargeback control whether you treat it as one or not.

What wins these is account-level evidence rather than transaction-level evidence. KYC records, device fingerprints, IP and geolocation logs, session history, prior withdrawals, and the bonus terms the player accepted beat an unauthorized-use claim from someone who played for weeks. Run prevention alerts through Ethoca and Verifi with player-account correlation, so a dispute freezes the balance before the funds are withdrawn. Measure your ratios the way the networks count them, because the VAMP and VDMP thresholds use their own denominators and monthly windows.

Architecture for a category that gets exited

Plan for the failure this vertical actually produces: not termination for your numbers, but a notice period because a state changed the law or a sponsor bank left the category. That means the backup MID already carrying live volume, a compliance record portable enough to satisfy the next underwriter in days, and player card credentials in a processor-neutral vault rather than one acquirer's gateway, because a depositor base you cannot re-point is one you mostly lose.

Practical takeaway

Online gaming and skill games are not hard to bank because of dispute volume. They are hard to bank because your network code hands thousands of issuers a standing decision about your transactions, because the legality map is redrawn every session, and because your losing players are your largest source of chargebacks. The operator who lasts settles the coding question in writing before building, boards through an acquirer with a licensed gaming portfolio, enforces geolocation at deposit, reads declines by BIN, and keeps a bank rail and a second acquirer behind the cards. The operator who fails codes wagering as digital goods and learns the price when the balance freezes and the MATCH listing lands. For a walkthrough of what a durable payment stack looks like at your volume, apply for an architecture review.