Compliance without a regulator
A licensed operator's compliance function exists because a regulator requires it and audits it. A sweepstakes operator has no regulator, and the temptation is to conclude that it has no compliance obligations. It has several, they are enforced by different people, and the operators that have survived the last two years are the ones that treated them as real before they were forced to.
This lesson takes the obligations in the order they bite: identity and age, geography, money laundering, responsible gambling, payments, advertising and affiliates, and data.
Identity and age
The model's age floor is contractual, 18 in most terms, and its enforcement is whatever the operator verifies. Where an operator verifies only at first redemption, a player can register, play and purchase with an email address and a card, and is asked for identity documents only when they first ask for a cash prize. That practice is an easy target for critics and one the public understands: unverified play means play by people the operator cannot say are adults. Florida's attorney general has accused the platforms of preying on Floridians, including minors.
The industry code moved toward verification at purchase: the code of conduct the Social and Promotional Gaming Association introduced in December 2024 calls for regulation-grade suppliers and technology to ensure age verification that limits purchases to users 18 and older, alongside identity checks, location verification and AML policies (the association has since merged into the Social Gaming Leadership Alliance). The better operators now verify identity and age before the first purchase, using the same document-and-database providers the licensed industry uses. That is more expensive, reduces conversion and is the right answer. An operator that still verifies only at redemption should expect that fact to appear in a complaint, a lawsuit or a legislative hearing.
Verification also protects the operator. A prize sent to a stolen identity, a minor or a self-excluded player is a loss and a liability; a prize sent to a verified adult in a permitted state is a fulfilled promotion.
Geography
Operators maintain a list of excluded states, and the list is the operator's legal position made concrete. It has three sources: states with explicit prohibitions, states where the operator has received enforcement correspondence, and states the operator's counsel considers too risky. The lists differ between operators, which tells a professional something about each operator's appetite.
Exclusion is enforced by geolocation at registration and, in better implementations, at purchase and redemption, using address, IP, device signals and, for the most careful operators, the same geofencing providers licensed operators use. A state that has banned the model will look at whether the ban was honoured, and an operator that excluded a state on paper while continuing to accept purchases from it has converted a regulatory question into a fraud one.
The practical difficulty is that a state can change status in a week. Compliance functions in the segment now track legislation and enforcement state by state, with a defined process for adding a state to the exclusion list, notifying its players, ceasing purchases and fulfilling outstanding redemptions. The last step matters: a ban that leaves players unable to redeem is a consumer-protection story that follows the operator into every other state.
Money laundering
On the model's own terms the only redeemable value is sweeps coins given away free, which would make it a poor laundering vehicle. In practice players purchase packages of gold coins that come bundled with sweeps coins, which can be redeemed after minimal play-through, and at scale the pattern is a gambling pattern: purchases by card, play, cash prizes to bank accounts. A purchaser who buys packages with stolen cards, plays minimally and redeems is laundering card fraud through the operator, and the operator is left holding chargebacks and, in some states, an obligation.
Licensed operators are subject to anti-money laundering rules as financial institutions: under the Bank Secrecy Act a state-licensed casino with more than $1 million in gross annual gaming revenue is a financial institution. Sweepstakes operators are, in the main, not, but the payment processors and banks they use are, and those institutions have imposed the controls the operators lacked: transaction monitoring, source-of-funds enquiries on large purchasers, and reporting of suspicious activity through the processor's own obligations. The AML and Financial Crime course's framework applies in full, and where operators have adopted it, the pressure has usually come from their banks and processors.
Responsible gambling
The model's defenders argue that it is a promotion, not gambling, and therefore that gambling harm is not its concern. That argument has no purchase with the public, the press or the legislators who have seen the testimony of players who spent large sums on a product they experienced as a casino. The industry's trade bodies adopted the standard toolkit voluntarily, with members committing to monitor behaviour, train staff and offer players tools to manage their play: purchase limits, session limits, self-exclusion, links to helplines. Adoption is uneven, and the absence of an auditor means that a claim to have the tools is not the same as having them.
The operators that intend to survive a licensing regime have built the function properly, with the behavioural detection, customer interaction and governance that the Responsible Gambling course sets out, because a state considering whether to license the model will ask to see it. The operators that intend to exit have not. A professional can tell which is which from the responsible gambling page and from the answers to three questions: who owns the function, what does it report, and to whom.
Payments
The purchase of gold coins is, on the model's own terms, a card transaction for a bona fide consumer good, not a gambling transaction. For years that was the model's quiet advantage: a purchase flow that looked closer to e-commerce than to gaming. That advantage is ending.
The payment chain is now a target in its own right. The federal Unlawful Internet Gambling Enforcement Act requires designated payment systems to have policies and procedures to identify and block restricted transactions, and a bet counts as unlawful internet gambling when it is unlawful under the law of the state where it is made, so a state ban changes the processor's position. California's ban, enacted in October 2025, makes it unlawful for a financial institution, payment processor or geolocation provider to knowingly and willfully support an online sweepstakes game in the state, and in August 2026 Florida's attorney general sued Stake, VGW and the payment processors that enable them. An operator that loses a primary processor moves to secondary and offshore processors at higher cost and lower acceptance, and cryptocurrency and alternative payment methods are the next rung for keeping the purchase flow open. Each step down the processor ladder raises cost, raises fraud and, in the eyes of a regulator, looks more like the offshore gambling the operators say they are not.
Redemption payments are the other side. Cash prizes sent by bank transfer, gift card, instant payment or, on some platforms, cryptocurrency are subject to the payment provider's own rules, and a provider that concludes it is paying gambling winnings will stop. A redemption channel can close at short notice, which produces the unfulfilled-redemption problem described above.
Advertising and affiliates
The segment's growth was bought with advertising on a scale that licensed online casinos, confined to the few states that license them, cannot match: national campaigns, celebrity and influencer campaigns promoting large wins, sponsorships and affiliate programmes reaching every state the operator serves. The content of that advertising has become evidence in the legal fight. Adverts that sell cash winnings, that omit the no-purchase route, or that describe the product as a casino support the argument that the purchase is consideration for the promotion. Federal law makes sweepstakes mailings that do not state that no purchase is necessary to enter nonmailable, and state game-promotion laws such as Florida's forbid requiring payment as a condition of entry and require the rules to be published in advertising; an advert that leaves out the free route is evidence against the operator.
Affiliates are the exposure. An affiliate promoting a sweepstakes casino to residents of a state where it is banned is promoting illegal gambling in that state, and states have begun to say so in legislation: California's ban extends to any media affiliate that knowingly and willfully supports the promotion of an online sweepstakes game, a misdemeanour carrying a fine of $1,000 to $25,000, up to a year in county jail, or both. The Marketing Compliance course's framework, contract, approve, monitor, terminate, applies, with one addition: an affiliate programme in this segment needs a state-by-state permission list that is updated as fast as the exclusion list, and many have not had one.
Data
A sweepstakes operator holds identity documents, payment data and behavioural data on large numbers of Americans, without the data-security obligations that a gaming licence would impose and with a customer base that plaintiffs' lawyers have sought to represent as classes, as in a class action filed against VGW in federal court in Minnesota in June 2026. State privacy laws apply as they apply to any consumer business. The operational point is that a data breach in this segment is a breach at a business whose customers were told they were not gambling, and the disclosure obligations will describe what they were doing.
Building the function
An operator in the segment that wants to be around in three years needs a compliance function that would pass a licensed regulator's inspection, because that is the standard by which it will be judged when a state decides whether to license or ban. The components are the ones every other course in this hub describes: identity and age verification at purchase, geolocation at every money movement, transaction monitoring and source-of-funds enquiries, a responsible gambling function with behavioural detection and governance, advertising review against sweepstakes disclosure law, an affiliate programme with state permissions, and a data-protection regime. None of it is required by a regulator today. All of it is required by the banks, the processors, the courts and the legislators who have replaced one.
What to take from this lesson
The segment has no regulator, so its compliance obligations are enforced by banks, processors, attorneys general, plaintiffs' lawyers and legislators, and each of them has moved. Age and identity verification at purchase, honest geofencing, AML controls imposed by the payment chain, a real responsible gambling function, sweepstakes-compliant advertising and a state-aware affiliate programme are the minimum for an operator intending to survive. The processor ladder is the tell: each step down it is a step toward the offshore product the operators say they are not.