SEPA Instant Payments: What iGaming Operators Can't Afford to Miss

As of 9 April 2026, every payment service provider operating in the eurozone was required to submit its first annual compliance report under the EU's Instant Payments Regulation — detailing charge parity, transaction volumes, and rejected payments under sanctions screening.

Two-thirds of PSPs weren't ready.

That is not a minor administrative gap. For iGaming operators, whose entire deposit and withdrawal infrastructure runs through these same payment rails, a non-compliant PSP is a compliance risk that sits squarely on the operator's balance sheet.

Why This Matters More for iGaming Than Any Other Vertical

The Instant Payments Regulation is sector-neutral on paper. In practice, iGaming is one of the most exposed verticals in Europe.

The regulation requires all eurozone payment service providers to process SEPA credit transfers within 10 seconds, around the clock, 365 days a year, without charging a premium over standard SEPA transfers. Providers must verify the match between payee name and IBAN before execution, screen all customers against EU sanctions lists on a daily basis, and — from April 2026 — file annual reports covering all of the above.

For a retail company, this is a backend infrastructure challenge. For an iGaming operator processing thousands of withdrawals per day — across multiple currencies, multiple acquiring relationships, and under heightened AML scrutiny — this is an operational overhaul.

Withdrawal speed is no longer a UX metric. It is a compliance variable. Operators who lack the right payment infrastructure cannot deliver what regulators now mandate.

What Operators Are Running Into

The infrastructure gap is real. Legacy payment stacks were not built for 10-second settlement. Many operators route through two or three layers — PSP, acquirer, local payment method provider — and a compliance failure at any layer creates exposure at the operator level.

Sanctions screening is the other pressure point. The regulation prohibits real-time sanctions checks from delaying transactions but requires daily screening of all customers. Getting this architecture right — screening comprehensively without triggering payment delays or GDPR complications — requires more than a software update. It requires a coordinated compliance architecture built across the entire payment stack.

Verification of Payee (VoP) adds another layer. Where an account holder's name does not match the IBAN, the PSP must warn the sending customer and flag the transaction. In iGaming, where player accounts are verified through KYC but withdrawals sometimes go to accounts held in a different name, the edge cases multiply quickly.

The Acquiring Relationship Question

Most iGaming operators delegate this compliance burden to their PSPs and acquiring banks. That is a reasonable commercial arrangement — until the acquiring bank fails its own compliance obligations and takes the operator down with it.

George Kakouras has observed this dynamic from both sides of the table — as an operator and through direct involvement in payment infrastructure built to serve the iGaming vertical. The lesson is consistent: operators who treat payment compliance as their acquirer's problem are the ones caught without documentation when a regulator asks for it.

The right question is not "is our PSP compliant?" It is "can we evidence compliance across our entire payment stack, end to end, with documentation the operator controls?"

That distinction matters in an enforcement context. Regulators ask the operator.

What the November 2026 Deadline Adds

April's reporting obligation is not the final pressure point. By November 2026, all SEPA payment messages must use ISO 20022 structured address fields — a technical migration that affects how transaction data is formatted at the message level across the entire chain.

For operators with fragmented acquiring stacks — multiple PSPs across multiple markets — this is a complex technical migration running in parallel with reporting obligations that should already be underway.

The ISO 20022 deadline is the kind of infrastructure project that takes longer than expected and is impossible to rush at the end. Planning should be happening now.

What a Compliant Operator Looks Like

Compliant operators have already addressed four things.

First, they have confirmed that every PSP in their payment stack has achieved SEPA Instant Payments certification — not promised it, but evidenced it contractually and technically.

Second, they have mapped their sanctions screening architecture to confirm that daily screening is happening at the right layer of the stack, with documentation that can be produced on request.

Third, they have stress-tested their withdrawal SLA against the 10-second requirement under peak load conditions, not under ideal ones.

Fourth, they have started ISO 20022 migration planning with their acquiring partners, not waiting for November to become a crisis.

Operators who cannot check those four boxes are carrying regulatory risk they may not have fully priced.

The Competitive Dimension

There is a positive case here that often gets buried in the compliance conversation. Instant withdrawals are one of the highest-correlated variables with player retention in the European market. The regulator has, in this instance, aligned its requirements with what players have demanded for years.

Operators who invest in compliant, high-performance instant payment infrastructure are not just satisfying a regulatory requirement. They are building a structural competitive advantage over operators who treat payment infrastructure as a cost centre to be managed rather than a capability to be built.

That gap will widen across 2026. The compliance cost is broadly the same for everyone operating in the eurozone. The return on that investment is not.

The next wave of European payment regulation — MiCA stablecoin integration and its implications for iGaming withdrawals — is already visible on the horizon. It merits a dedicated examination.