- Minimum age
- 21+
- KYC timing
- Identity and age are verified when the account is established, and the exact-match checks must be completed before any deposit, withdrawal or wager (24 NCAC 06A .0702(d), (e)). Identity must be re-verified on reasonable suspicion of compromise.
- AML regime
- Operators must comply with the federal Bank Secrecy Act, keep currency transaction and suspicious activity reports and supporting records for five years, give them to the Commission on request and notify it of any IRS compliance review (24 NCAC 06A .0416). Internal controls must include an anti-money laundering programme with a responsible officer, staff training, automated monitoring and periodic independent testing (.0417). Operators must detect suspicious or illegal wagering and report integrity concerns to the Commission and the sports governing body (G.S. 18C-910(a)(7), 18C-914(g)).
- AML supervisor
- Federal Bank Secrecy Act regime (IRS compliance reviews), with the Commission entitled to the records
- Deposit limits
- Operators must offer daily, weekly and monthly deposit limits; decreases take effect immediately and increases only after the current limit period ends (24 NCAC 06A .0713(a), (b)).
- Session limits
- No rule-mandated time limit was found. Players must be able to block themselves from an operator for any period from 72 hours to permanently (24 NCAC 06A .0713(c)); the Commission reports that operators also offer time limits, cooling-off periods and reality checks.
- Data localisation
- All servers needed to place or resolve a wager, other than back-up servers, must be physically located in North Carolina; cloud hosting and out-of-state back-up servers are allowed (G.S. 18C-910(g)).
- KYC requirements
- Accounts only for natural persons, one per operator. The operator collects full legal name, date of birth, residential address (not a PO box) and Social Security number or its last four digits (or a passport or taxpayer number for a non-citizen), verifies them by database checks or government photo ID with a contemporaneous photograph, and must match last name, date of birth and ID number exactly. It must also confirm the person owns the identity, by knowledge-based questions, phone and email match, ID, device and location history or multi-factor authentication, and screen out ineligible persons (24 NCAC 06A .0701 to .0703; G.S. 18C-912).
- Stake limits
- Operators must offer daily, weekly and monthly wager limits (24 NCAC 06A .0713(a)(2)). The Commission may not set a maximum or minimum payout or hold percentage (G.S. 18C-902(h)).
- Mandatory player messaging
- Advertising must state that players must be 21 or older and include a link to and phone number for the North Carolina Problem Gambling Helpline in Commission-provided language (24 NCAC 06A .0902, .0905). Operator websites and social profiles with wagering content must carry a 21+ message. Each operator must have a Commission-approved responsible gaming plan, updated annually and independently reviewed at least every five years (.0601).
- Reporting obligations
- A daily summary of all wagering activity to the Commission (G.S. 18C-910(h)); wager-level records kept for three years after the event (G.S. 18C-910(b)); prompt reports of abnormal betting and integrity concerns (G.S. 18C-914(g)); monthly tax returns to the Department of Revenue (G.S. 105-113.126(c)); a monthly reserve attestation (24 NCAC 06A .0413(e)); and annual attestations of compliance where required (G.S. 18C-908(e)). The Commission publishes monthly aggregate revenue reports.
- Game content restrictions
- Wagers only on events in the Commission's sports wagering catalog. The statute bars wagering on youth sports and on injuries, penalties, disciplinary proceedings and replay reviews (G.S. 18C-902(d)), and the Commission also lists political contests and award shows as not approved. Players may not use VPNs or other location-masking technology (G.S. 18C-912(c)(5)).