How to Set Up Payments for Online Gambling in Cyprus (2026): Banks, Psps, AML & Merchant Accounts

Online gambling payments Cyprus is one of the most operationally demanding aspects of launching or maintaining a regulated betting business in the jurisdiction, and 2026 has raised the bar again. Heightened enforcement of the Betting Law of 2019 (Law 37(I)/2019), combined with intensified anti-money-laundering (AML) supervision, has pushed Cypriot banks and payment service providers (PSPs) to apply markedly stricter due diligence to gambling merchants. This guide sets out, step by step, how licensed operators, applicants, PSPs and in-house counsel can open merchant accounts, select payment partners, and build the know-your-customer (KYC) and AML controls that acquirers now expect.

It is written as a practical compliance checklist, not legal advice, and not tax advice, and every legal obligation is anchored to primary sources listed at the end.

Overview: what this guide on online gambling payments Cyprus covers

This guide addresses the acceptance and processing of payments for online gambling activity aimed at Cyprus-facing or Cyprus-licensed operations. It applies to three broad groups: licensed operators already trading, applicants preparing to launch, and the PSPs, acquirers and banks that must decide whether to onboard a gambling merchant. The scope covers deposits from players, payouts (withdrawals), the corporate and beneficial-ownership documentation banks demand, and the AML controls that underpin the whole arrangement.

The primary statutory framework is the Betting Law of 2019 (Law 37(I)/2019), which governs betting activity in Cyprus, alongside the consolidated Prevention and Suppression of Money Laundering Activities Law, which imposes ultimate beneficial owner (UBO) identification and suspicious-activity reporting duties. Payment processing itself is shaped by the Central Bank of Cyprus, which supervises payment institutions and has responsibility for the framework transposing the EU Second Payment Services Directive (PSD2). This guide does not cover licensing procedure in depth, gaming-tax treatment, or the specifics of casino (land-based) supervision. Throughout, sample policy language and clause references are flagged as templates that require legal review before use.

Eligibility, who can process online gambling payments Cyprus operators rely on

Eligibility to process online gambling payments Cyprus operators depend on turns on two questions: is the operator lawfully licensed to offer betting to Cyprus players, and is the payment partner itself authorised to provide payment services? Under the Betting Law of 2019, the National Betting Authority (Εθνική Αρχή Στοιχημάτων) is the competent authority responsible for licensing and supervising betting activity in Cyprus. The Cyprus Gaming and Casino Supervision Commission (CGC) separately supervises the integrated casino resort and land-based casino operations. A bank or PSP that knowingly processes for an unlicensed operator exposes itself to regulatory and reputational risk, and most reputable acquirers will refuse the relationship outright.

Payment partners must themselves be authorised. Under the PSD2 framework, as supervised in Cyprus by the Central Bank of Cyprus, entities providing payment services in the EU must hold the appropriate authorisation as a payment institution, electronic money institution, or credit institution. Operators should verify a prospective PSP’s authorisation status before signing.

Local presence versus cross-border operations

An operator licensed and established in Cyprus generally finds domestic banking relationships more accessible, because the bank can verify local corporate substance, directors and UBOs directly. Operators established elsewhere but targeting Cyprus players, or those with non-EU beneficial owners, face longer and more searching due diligence. Cross-border passporting under the PSD2 framework allows an EU-authorised PSP to serve a Cyprus-facing operator, but the operator’s own licensing position under the Betting Law of 2019 remains decisive. Where UBOs sit outside the EU, expect enhanced due diligence, source-of-wealth enquiries, and a higher likelihood of reserves.

Step-by-step: how to set up online gambling payments Cyprus

The following nine steps form the core operational sequence. Each identifies the responsible party, the key actions, and the principal risks. Treat the ordering as broadly sequential, though several strands (policy drafting and PSP selection, for example) can run in parallel.

1. Prepare corporate and UBO documentation, Operator.

   Assemble the complete corporate pack: certificate of incorporation, articles, the shareholder register and a clear UBO map identifying every beneficial owner holding a relevant interest. Under the Cyprus AML law, UBO identification is mandatory, so gaps here stall every subsequent step.

   • Prepare certified copies and, where owners are foreign, apostilled documents.
   • Draw the ownership chain to ultimate natural persons, nominee or layered structures invite additional scrutiny.
2. Draft a payments policy and AML/KYC policy, MLCO / Operator.

   Your Money Laundering Compliance Officer (MLCO) should produce a payments policy that defines accepted methods, deposit and withdrawal rules, and transaction thresholds, alongside a standalone AML/KYC policy setting out customer identification, monitoring and reporting lines. Acquirers routinely ask to read these before onboarding.

   • State thresholds for enhanced due diligence and source-of-funds requests.
   • Define politically exposed person (PEP) handling and the suspicious-activity reporting (SAR) escalation path. (Template, seek legal review.)
3. Decide the payment acceptance model, Payments lead.

   Choose between a sponsored merchant arrangement, a PSP aggregator, direct acquiring, or e-wallet integrations, or a blend. The model drives onboarding friction, cost, and control. High-volume card-centric businesses often favour direct acquiring; operators wanting fast multi-method acceptance lean towards a PSP aggregator.

   • Map expected volume, currencies, and player geography to the model.
   • Plan redundancy from the outset, a single point of failure in payments is a commercial and compliance liability.
4. Select PSPs and acquirers, Commercial / Payments.

   Run a structured request-for-proposal (RFP) with a due-diligence checklist. Confirm each candidate’s authorisation status with reference to Central Bank of Cyprus / PSD2 requirements, its appetite for gambling merchants, its supported methods, settlement terms and reserve policy.

   • Ask directly whether the PSP accepts gambling merchant category codes.
   • Request references from comparable operators and confirm reporting obligations.
5. Negotiate merchant and acquiring agreements, Legal.

   Key clauses to scrutinise include permitted activities (gambling must be expressly permitted), chargeback allocation, reserves and rolling reserves, settlement timing, and AML-related termination rights. Silence on permitted gambling activity is a frequent cause of later account closure.

   • Cap or clearly define rolling reserve percentages and release schedules.
   • Negotiate notice periods and remediation rights before any suspension. (Template clauses require legal review.)
6. Technical integration and dispute flows, Tech / Payments.

   Integrate the gateway with 3D Secure (3DS) authentication, robust decline handling, and clear settlement reconciliation. Map dispute and chargeback flows so that representment evidence is captured automatically.

   • Implement 3DS to shift liability and reduce fraud exposure on card payments.
   • Log every transaction with the data your AML monitoring will later need.
7. Onboard with bank/PSP: KYC package submission, Compliance.

   Submit the full KYC package (see Required documents below) and prepare a remediation plan for any gaps the acquirer flags. Responsiveness here materially shortens onboarding.

   • Nominate a single point of contact to manage acquirer queries.
   • Prepare source-of-funds and source-of-wealth narratives for UBOs in advance.
8. Implement monitoring, MLCO / Compliance.

   Deploy transaction monitoring, velocity checks and SAR workflows aligned to a risk-based approach. FATF guidance on the risk-based approach for gambling and virtual assets informs the design of thresholds and enhanced due diligence triggers.

   • Set velocity and value rules that flag structuring and rapid deposit-withdrawal cycling.
   • Document escalation to the MLCO and onward reporting where required by law.
9. Test go-live and contingency, Operations.

   Run a soft launch with live but limited traffic, reconcile settlement statements, and confirm fallback PSPs are ready. Verify payout flows to player accounts before full go-live.

   • Reconcile the first settlement cycles line by line.
   • Keep at least one backup PSP integrated and tested for continuity.

Comparing banks, PSPs and e-wallets for online gambling payments Cyprus

The table below summarises the practical trade-offs across the three main routes to gambling payment processing Cyprus operators consider. Use it as a decision aid rather than a definitive rule, individual providers vary considerably in risk appetite.

For guidance on the underlying licensing prerequisites that precede any payment onboarding, consider taking specialist advice on how to obtain a betting licence in Cyprus, and address contract-level detail, such as PSP and merchant agreements for gambling operators, with qualified Cyprus counsel.

Required documents for gambling merchant onboarding

Banks and PSPs work from broadly the same evidentiary base, though the depth of scrutiny rises where owners are non-domestic, where the corporate structure is layered, or where UBOs sit outside the EU. Domestic operators with local directors and transparent ownership typically clear document review faster. The table below indicates what payment partners commonly request when onboarding a gambling merchant. Assemble it in full before you approach any acquirer, partial submissions are among the most common causes of onboarding delay.

Note that the Money Laundering Compliance Officer (MLCO) contact must be a named, contactable individual, acquirers verify that a real reporting line exists. Where directors have gambling or financial-services experience, foreground it in the CVs, as it materially eases due diligence.

Timeline and deadlines

Durations vary widely, and the single biggest source of variability is AML remediation. Where an acquirer requests further UBO evidence, source-of-funds narratives, or policy revisions, timelines extend accordingly. The figures below are realistic planning estimates for 2026; treat them as indicative and build in contingency. Non-EU ownership, layered structures, and incomplete document packs all push timelines towards the upper end.

Where phases run in parallel, for instance, drafting policies while shortlisting PSPs, the aggregate calendar compresses, but the onboarding and remediation phases sit on the critical path and rarely accelerate under external pressure.

Costs and fees

Budgeting for online gambling payments Cyprus requires accounting for both recurring processing costs and one-off compliance investment. Gambling is treated as a higher-risk category, so setup fees, reserve percentages and chargeback fees tend to sit above those charged to ordinary e-commerce merchants. The ranges below are indicative for 2026 and will vary with volume, method mix, and the operator’s risk profile. Beyond these commercial fees, operators should factor in the potential cost of regulatory non-compliance, which can include penalties imposed by the competent authority and account termination.

The reserve line deserves particular attention: a rolling reserve of 5–20% held for a settlement period can materially affect working capital, so model its cash-flow impact before signing. PCI DSS scope depends on how much cardholder data your integration touches, using a hosted or tokenised gateway reduces both scope and cost.

What changes in 2026, regulatory updates and practical effects

The defining trend of 2026 is convergence: enforcement under the Betting Law of 2019 has tightened in parallel with intensified AML supervision, and the two now reinforce each other at the point of payment onboarding. Cypriot banks have become materially more cautious about gambling merchants, applying deeper UBO checks and demanding fuller source-of-funds and source-of-wealth evidence than in prior years. PSPs, obliged under the PSD2 framework and supervised in payment matters by the Central Bank of Cyprus, are expected to demonstrate robust monitoring and reporting for gambling flows.

The FATF’s risk-based-approach guidance continues to shape supervisory expectations, and the EU AML framework, as implemented through Cyprus’s Prevention and Suppression of Money Laundering Activities Law, keeps obliged entities under pressure to identify beneficial owners and monitor transactions rigorously. The practical effects for operators are concrete. Industry observers expect onboarding to run longer, with UBO scrutiny more searching and reserves more commonly imposed, particularly where ownership includes non-EU nationals. Early indications suggest banks will increasingly steer player-facing payouts through PSPs and e-wallets rather than handle them directly, and that documentary expectations around transaction monitoring rules will keep rising.

The actionable implications are straightforward: prepare a complete, apostilled corporate and UBO pack in advance; assume enhanced due diligence rather than hoping to avoid it; budget for reserves; and maintain at least one backup payment relationship so that a single acquirer’s risk reassessment does not halt trading. For the underlying controls, robust AML and KYC policies aligned to the current Cyprus AML framework set out the policy architecture supervisors now expect.

Common pitfalls and practical tips

Most payment-onboarding failures in the gambling sector are avoidable and stem from a handful of recurring mistakes. The list below sets out the errors that most often derail applications, together with mitigations.

• Insufficient AML policies. Generic or off-the-shelf policies that do not reflect the operator’s actual product and player base are quickly spotted. Draft policies that map to your real deposit/withdrawal flows and thresholds, and have your MLCO own them.
• Failing to disclose gambling as the business activity. Attempting to onboard without clearly stating gambling activity almost always ends in later termination and blacklisting. Be transparent from the first contact and confirm the acquirer expressly permits gambling.
• Weak KYC at player level. Thin customer verification exposes the operator to fraud and regulatory breach. Implement identity verification, UBO-equivalent checks for high-value players, and source-of-funds requests above defined thresholds.
• Not segregating player funds. Commingling player balances with operating funds is a serious control weakness. Maintain segregation and be able to evidence it to the acquirer.
• Poor chargeback handling. Gambling carries elevated chargeback risk; without automated representment evidence and 3DS, ratios climb and acquirers withdraw. Capture transaction and authentication data by default.
• Single point of failure. Relying on one PSP leaves the business exposed if that relationship is suspended. Integrate and test at least one fallback provider.

Practical mitigations worth adopting early include a pre-onboarding internal audit that stress-tests your document pack against the required-documents table above; robust, tiered player verification calibrated to a risk-based approach; and clear terms and conditions covering bonuses, refunds and payout verification, so that disputes do not escalate into chargebacks. Where clause-level protection matters, reserves, termination and permitted-activity language, treat any template as a starting point for legal review rather than a finished contract.

Conclusion

Setting up online gambling payments Cyprus operators can rely on is now a compliance exercise as much as a commercial one. The route to stable processing runs through complete corporate and UBO documentation, credible AML/KYC policies owned by your MLCO, transparent engagement with acquirers, and carefully negotiated merchant agreements that expressly permit gambling and fairly allocate reserves and chargebacks. In 2026, with enforcement under the Betting Law of 2019 and AML supervision converging, the operators who prepare their document packs thoroughly, budget for reserves and remediation, and maintain a backup provider will onboard fastest and stay live.

Treat every template and sample clause in this guide as a starting point for professional legal review, and anchor your controls to the primary sources below.

Sources

1. National Betting Authority (Εθνική Αρχή Στοιχημάτων)
2. Cyprus Gaming and Casino Supervision Commission (CGC)
3. CYLAW, Cyprus legislation, including the Betting Law of 2019 (Law 37(I)/2019)
4. Prevention and Suppression of Money Laundering Activities Law (consolidated), CYLAW
5. Central Bank of Cyprus, payment services & PSD2 supervision
6. EUR-Lex, Directive (EU) 2015/2366 (PSD2)
7. FATF, guidance on the risk-based approach
8. Cyprus Bar Association, professional ethics & legal practice guidance