Player Funds Segregation: Requirements Across Jurisdictions

Rules on the segregation of player funds differ more sharply than most operators expect, and the gap between holding balances in a separate account and shielding them from creditors is where the risk sits. Malta, Great Britain, the Netherlands, Denmark and Sweden each answer that question differently, and the difference becomes material only at the point of insolvency or licence suspension, when the account structure decides who gets paid.

What Player Funds Segregation Guarantees, and What It Does Not

Segregation of player funds means one thing in every regime: money owed to players sits in an account that is not the operating account. What differs is whether that separation survives contact with an insolvency practitioner. The Gambling Commission states plainly that operators in Great Britain are under no legal duty to protect customer money if the business fails, although many choose to do so. Segregating player accounts from operating capital, on its own, changes nothing about who ranks where among creditors.

The regimes that do protect balances achieve it through ownership rather than book-keeping. Malta treats player money as the separate and distinct patrimony of players rather than as assets of the licensee, and requires the licensee to make the institution holding that money understand that the licensee’s creditors have no claim against it. Denmark reaches a similar result by defining the balance as entrusted funds held in an account not subject to set-off. Both approaches place the question inside the licence itself, which is why fund protection belongs with licensing and legal status requirements rather than with payments operations.

How the UKGC Rates Customer Funds Protection in Insolvency

Licence condition 4.1.1 obliges remote licensees who hold customer money to keep it in a separate client bank account, and defines those balances as deposits placed for future gambling, winnings left on account and crystallised but unpaid bonuses. Licence condition 4.2.1 then forces the operator to state, in its terms and conditions and again at the point of deposit, which of four categories applies. The UKGC rating system for customer funds protection is applied by the operator itself, and operators must not imply that the Commission has approved the level chosen.

Rating	Who it applies to	Account structure	Position on insolvency
Not protected, no segregation	Non-remote and ancillary remote licensees only	No separation from business accounts	No protection
Not protected, segregation of customer funds	Minimum for all remote licensees holding customer money	Separate bank, investment or other accounts	Balances form part of the assets of the business
Medium protection	Any licensee holding customer money	Quistclose accounts, insurance arrangements or equivalent	Distribution arrangements exist, with no absolute guarantee
High protection	Any licensee holding customer money	Formal trust account verified by an independent trustee or external auditor	Legally and in practice separate from the affairs of the company

Since 31 October 2025, a licensee on a not protected rating must remind each customer every six months that the balance is unprotected, state the amount held for that customer, and obtain an acknowledgement before the customer gambles further. Wording that uses the language of protection where only segregation exists is a recurring finding in Commission compliance work, alongside missing or broken links to the ratings page. Anyone drafting that wording should read it against UKGC licence conditions rather than against a competitor’s terms.

What the MGA Requires of a Player Funds Account

Malta sets out the requirements the MGA attaches to a player funds account in the Player Protection Directive (Directive 2 of 2018). Where Great Britain is disclosure-led, Malta is prescriptive about the structure and the balance behind it.

• Player money may be held with a licensed credit, financial or payment institution, but the setup must be presented to the Authority for approval, and the Authority may impose further safeguards on a risk basis, including trusts, bank guarantees and reserve accounts.
• Institutions must be licensed in Malta, elsewhere in the EU or EEA, or in another approved jurisdiction, and the licensee must ensure the Authority retains viewing rights over the account.
• The player funds account balance must at all times be at least equal to the aggregate standing to the credit of players, with at least 90% of that requirement held in the account itself and the remainder covered by funds in transit.
• If the balance falls below that aggregate, the licensee must make good the shortfall from its own funds forthwith.
• Funds standing to the credit of an account must be remitted at the player’s request within five working days where practicable, and any monthly withdrawal limit imposed on a player may never be lower than EUR 250.
• Licensees may not offer credit or knowingly facilitate the giving of credit in connection with gaming, so no balance should ever represent money the operator has advanced.

Reporting closes the loop. Under the Gaming Authorisations and Compliance Directive (Directive 3 of 2018), remote B2C licensees submit an agreed-upon procedures report prepared in accordance with ISRS 4400 (Revised) covering player funds, jackpot funds and the portion of the player funds account balance falling under the Maltese licence. Operators comparing structures across MGA licence types should assume that the aggregate balance will be tested on selected dates rather than at year end alone.

Ring-Fencing Rules in the Netherlands, Denmark and Sweden

Requirements for player funds by jurisdiction diverge most in what an operator has to build before the licence is granted. The Dutch regime asks for a separate legal vehicle, the Danish one for an account with a specific legal characteristic, and the Swedish one for separation without prescribing the instrument.

Jurisdiction	Instrument	Mechanism required	Balance test
Netherlands	Wet Koa, with the BRVKOA 2026 policy rules applying from 1 January 2026	Provision evidenced through a Dutch stichting derdengelden (third-party funds foundation) or another accepted provision, with statutes, register extract, the agreement with the foundation and conduct declarations for its directors	Applicant must show that payout of player balances is secured, including in bankruptcy; the KSA cannot be named as beneficiary
Denmark	Executive order made under the Gambling Act	Balances treated as entrusted funds in an account not subject to set-off, kept separate from the licence holder’s own funds, payable only to the player and safeguarded in insolvency	The account must at all times at least equal the total amount on players’ accounts
Sweden	Gambling Act (2018:1138), Chapter 13	Funds in a player account kept separate from the licence holder’s own funds, with financial transactions registered and made available to the player in the account	No prescribed reserve ratio; separation plus a transaction record the player can audit

The Dutch change matters for anyone renewing. Earlier KSA guidance described four routes to demonstrating the provision, including a bank guarantee and a third-party account; the application module for filings from 1 January 2026 documents the foundation route and an other provision route, and the exit plan showing how balances would be paid out in the event of discontinuity remains part of the file. Read the requirement together with the rest of KSA licensing under KOA, because the control database and CRUKS obligations sit in the same submission.

Ontario, Curaçao and the Gap Between Registered and Offshore Regimes

Ontario approaches the same problem from the account side. The Registrar’s Standards for Internet Gaming require that a player can recover the balance owing when an account becomes dormant or is deactivated, that operators keep a mechanism to return unused funds to a person on the Centralized Self-Exclusion Registry, and that compliance records are retained for at least three years. Operators remain accountable for third parties carrying out any part of the business, which reaches platform and payment providers holding balances. What the Standards do not publish is an insolvency ratings scale of the British kind, so the operating agreement with iGaming Ontario, rather than a public rulebook, carries much of the commercial detail.

The offshore picture moved in June 2026, when the Curaçao Gaming Authority issued a crypto guideline for B2C licensees. Player, operational and treasury wallets must be kept separate, and personal or owner-linked wallets are banned. The timetable is staged: a compliant crypto policy filed through the CGA portal within three months, then risk assessments, due diligence on any third-party virtual asset service providers, wallet ownership controls and staff training within six months, then full technical compliance by June 2027, including wallet segregation, blockchain analytics, transaction reconciliation, withdrawal whitelisting and audit-ready records. Sanctioned wallets and mixing services were prohibited immediately. Anyone assessing Curaçao licensing after the LOK should treat those dates as the practical test of whether segregation is real on chain.

Where Segregated Balances Went After a Licence Suspension

The clearest illustration of how little segregation settles on its own is BetIndex Limited, which operated Football Index. The Gambling Commission suspended its operating licence on 11 March 2021 under section 118(2) of the Gambling Act 2005, and the company appointed administrators within days. Press reports put potential customer losses above £90m. A trust account existed, and the Commission said the money in it would not be distributed to creditors other than customers, but distribution required directions from the court, and the return of funds was a matter for the administrators and the court rather than the regulator. The independent review published in September 2021 found that the operator had failed to notify the Commission properly of the nature of its product at the licence application stage, and of later changes to it.

The sequence repeats, whichever market it happens in.

1. A licence is suspended, which the Commission itself acknowledges can hasten financial decline and put balances at risk.
2. Payments out of the account stop while entitlements are calculated.
3. The account structure decides whether players rank as beneficiaries of a trust or as unsecured creditors.
4. A court, not the regulator, directs distribution.
5. Players wait, whatever the terms and conditions promised.

A disclosure failure sitting alongside a funds failure is a familiar combination in recent enforcement actions, which is why the two are assessed together rather than in separate workstreams.

Evidence GICNT-LS and GICNT-DS Auditors Expect on Fund Protection

GICNT-LS covers licensing and legal status, and fund protection sits inside it because the account structure is a licence condition in every regime above. GICNT-DS approaches the same subject from the ledger side: the record of what each player is owed has to be accurate, access-controlled and reconstructable after an incident. Certification does not replace a licence and does not alter what a national authority requires. What it does is ask the operator to evidence the following.

• The account structure in writing, naming the institution, the jurisdiction, the legal characterisation of the balance and the regulatory approval where approval is required.
• A reconciliation between the player liability ledger and the account balance, run at a defined frequency, with the working papers retained.
• Disclosure wording that matches the structure, using the language of protection only where protection actually exists.
• A documented rule for making good a shortfall, naming who authorises the transfer and the period within which it must happen.
• Access controls over the balance ledger and the payout process, including who can adjust a player balance and how that adjustment is logged.
• An incident and continuity plan covering loss of access to the funds account, with the notification path documented. GICNT-DS sets a 72-hour notification standard, which is stricter than several national breach rules and is presented as a certification requirement, not as a legal baseline.
• Independent testing of the arrangement, whether through an ISRS 4400 engagement, an external audit or an equivalent.

Most of this belongs in the same file as the pre-launch compliance checklist, because retrofitting an account structure after the first deposit has been taken is considerably harder than choosing one before it.