Crypto deposits and cash-outs for iGaming — with a file that survives a licence review.
A player funds in USDT, plays for twenty minutes, and asks to cash out to a different address. Your obligation begins at the deposit and is judged at the withdrawal.
Why gambling is the hardest crypto funding case there is
The pattern that AML training uses as the textbook example of layering — money in, minimal genuine activity, money out somewhere else — is also, on a casino, an entirely ordinary evening. A player who deposits 2,000 USDT, plays a few hands and withdraws 1,700 has done nothing wrong, and looks exactly like someone who has. No address-level risk score resolves that, because the question is not about the address.
Volume makes it worse. A broker sees a handful of funding events per customer per year; an operator can see thousands of deposits an hour, most of them small, from addresses that have never appeared before. Anything that requires a human to look at every one is not a control, it is a queue that grows until someone turns it off.
What the rules actually say, and from when
Under the EU's anti-money-laundering regulation, providers of gambling services are obliged entities, and due diligence is triggered at EUR 2 000 or more on the wagering of a stake or the collection of winnings — counted per customer, not per session, so a player who deposits EUR 400 five times has crossed it. That regime applies from 10 July 2027. Most operators reading this are licensed outside the EU and serving players inside it, which does not remove the exposure; it changes who asks about it first.
Sanctions are the layer that already binds you, today, everywhere, with no threshold at all: paying out to a designated person is prohibited regardless of amount, licence or jurisdiction. And unlike a card chargeback, a stablecoin payout is permanent and public — the transaction stays on-chain, with your hot wallet on one side of it, for as long as the chain exists.
How KYTGate fits an iGaming stack
One API call at deposit and one before each cash-out. KYTGate verifies the transaction on-chain, screens the paying or receiving address against OFAC, UK and EU sanctions data and live USDT and USDC freeze status, applies your written policy, and returns ALLOW, REVIEW, BLOCK_PENDING_MLRO or TECHNICAL_HOLD with a signed Decision Receipt. Anything that is not ALLOW opens a case; blocks need a second pair of eyes to close, so one operator cannot release a held payout alone.
Deliberately not in scope: KYTGate holds no player names or documents, and does not detect bonus abuse, chip dumping or multi-accounting — those are your platform's job and need your gameplay data, not a chain. What it covers is the funding leg, and it covers it with something you can hand to a regulator rather than describe to one.
Three situations, handled
Cash-out to an address that never deposited
The deposit decision and the withdrawal request are linked screenings on the same player reference, so the mismatch is visible in one case rather than reconstructed from two systems afterwards.
Tether freezes the player's address mid-session
Freeze status is read live from the issuer's contract at decision time, not from a cached list. A frozen destination is blocked, and the receipt proves the freeze existed on the day you declined — even if it is lifted later.
A player crosses the threshold in small deposits
The occasional-transaction signal fires on the cumulative amount against your configured threshold and lands on the case as information, not as an automatic block — the decision stays yours and stays recorded.
Best fit: licensed online casinos and sportsbooks taking stablecoin deposits at volume, where the compliance team needs the funding leg evidenced without a human in every loop.
Still working out which obligations apply to you? Who must screen crypto payments sets out the two layers — sanctions, which bind every EU business today, and due diligence, which binds a defined list of sectors from 2027 — with the source next to each row.
Decision-support software, not legal advice. Which obligations apply to you depends on your licence and structure — confirm with counsel.