Compliance without a regulator
A licensed operator's compliance function exists because a regulator requires it and audits it. A sweepstakes operator has no regulator, and the temptation is to conclude that it has no compliance obligations. It has several, they are enforced by different people, and the operators that have survived the last two years are the ones that treated them as real before they were forced to.
This lesson takes the obligations in the order they bite: identity and age, geography, money laundering, responsible gambling, payments, advertising and affiliates, and data.
Identity and age
The model's age floor is contractual, 18 in most terms, and its enforcement is whatever the operator verifies. The prevailing practice has been verification at first redemption: a player can register, play and purchase with an email address and a card, and is asked for identity documents when they first ask for a cash prize. That practice is the licensed industry's strongest criticism and the one the public understands: unverified play means play by people the operator cannot say are adults.
The industry code moved toward verification at purchase, and the better operators now verify identity and age before the first purchase, using the same document-and-database providers the licensed industry uses. That is more expensive, reduces conversion and is the right answer. An operator that still verifies only at redemption should expect that fact to appear in a complaint, a lawsuit or a legislative hearing.
Verification also protects the operator. A prize sent to a stolen identity, a minor or a self-excluded player is a loss and a liability; a prize sent to a verified adult in a permitted state is a fulfilled promotion.
Geography
Every operator maintains a list of excluded states, and the list is the operator's legal position made concrete. It has three sources: states with explicit prohibitions, states where the operator has received enforcement correspondence, and states the operator's counsel considers too risky. The lists differ between operators, which tells a professional something about each operator's appetite.
Exclusion is enforced by geolocation at registration and, in better implementations, at purchase and redemption, using address, IP, device signals and, for the most careful operators, the same geofencing providers licensed operators use. A state that has banned the model will look at whether the ban was honoured, and an operator that excluded a state on paper while continuing to accept purchases from it has converted a regulatory question into a fraud one.
The practical difficulty is that a state can change status in a week. Compliance functions in the segment now track legislation and enforcement state by state, with a defined process for adding a state to the exclusion list, notifying its players, ceasing purchases and fulfilling outstanding redemptions. The last step matters: a ban that leaves players unable to redeem is a consumer-protection story that follows the operator into every other state.
Money laundering
The sweepstakes model is an unusually poor laundering vehicle in its basic form, because the value that comes out is capped by the sweeps coins that went in free, and the free coins are small. But at scale the pattern is a gambling pattern: purchases by card, play, cash prizes to bank accounts. A purchaser who buys packages with stolen cards, plays minimally and redeems is laundering card fraud through the operator, and the operator is left holding chargebacks and, in some states, an obligation.
Licensed operators are subject to anti-money laundering rules as financial institutions; sweepstakes operators are, in the main, not, but the payment processors and banks they use are, and those institutions have imposed the controls the operators lacked: transaction monitoring, source-of-funds enquiries on large purchasers, and reporting of suspicious activity through the processor's own obligations. The AML and Financial Crime course's framework applies in full, and the operators that have adopted it have done so because their banks required it.
Responsible gambling
The model's defenders argue that it is a promotion, not gambling, and therefore that gambling harm is not its concern. That argument has no purchase with the public, the press or the legislators who have seen the testimony of players who spent large sums on a product they experienced as a casino. The industry code adopted the standard toolkit voluntarily: purchase limits, session limits, self-exclusion, links to helplines, staff training. Adoption is uneven, and the absence of an auditor means that a claim to have the tools is not the same as having them.
The operators that intend to survive a licensing regime have built the function properly, with the behavioural detection, customer interaction and governance that the Responsible Gambling course sets out, because a state considering whether to license the model will ask to see it. The operators that intend to exit have not. A professional can tell which is which from the responsible gambling page and from the answers to three questions: who owns the function, what does it report, and to whom.
Payments
The purchase of gold coins is a card transaction for a digital good, processed under a merchant category that is not gambling. For years that was the model's quiet advantage: acceptance rates and processing fees closer to e-commerce than to gaming. It has ended.
Card schemes and acquirers have tightened their view of the segment, prompted by chargeback rates, by state prohibitions and by the federal obligation on payment systems to block unlawful internet gambling transactions once a state has declared the model unlawful. Primary processors have withdrawn, operators have moved to secondary and offshore processors at higher cost and lower acceptance, and some have added cryptocurrency and alternative payment methods to keep the purchase flow open. Each step down the processor ladder raises cost, raises fraud and, in the eyes of a regulator, looks more like the offshore gambling the operators say they are not.
Redemption payments are the other side. Cash prizes sent by bank transfer, gift card or instant payment are subject to the payment provider's own rules, and a provider that concludes it is paying gambling winnings will stop. Operators have had redemption channels closed at short notice, which produces the unfulfilled-redemption problem described above.
Advertising and affiliates
The segment's growth was bought with advertising that licensed operators cannot run: national television, influencer campaigns, sponsorships and affiliate programmes reaching every state. The content of that advertising has become evidence in the legal fight. Adverts that sell cash winnings, that omit the no-purchase route, or that describe the product as a casino support the argument that the purchase is consideration for the promotion. Federal and state disclosure rules for sweepstakes require that the no-purchase route be stated; a surprising number of adverts did not.
Affiliates are the exposure. An affiliate promoting a sweepstakes casino to residents of a state where it is banned is promoting illegal gambling in that state, and states with affiliate licensing have said so. The Marketing Compliance course's framework, contract, approve, monitor, terminate, applies, with one addition: an affiliate programme in this segment needs a state-by-state permission list that is updated as fast as the exclusion list, and most did not have one.
Data
A sweepstakes operator holds identity documents, payment data and behavioural data on millions of Americans, without the data-security obligations that a gaming licence would impose and with a customer base that has, in litigation, been assembled into classes. State privacy laws apply as they apply to any consumer business. The operational point is that a data breach in this segment is a breach at a business whose customers were told they were not gambling, and the disclosure obligations will describe what they were doing.
Building the function
An operator in the segment that wants to be around in three years needs a compliance function that would pass a licensed regulator's inspection, because that is the standard by which it will be judged when a state decides whether to license or ban. The components are the ones every other course in this hub describes: identity and age verification at purchase, geolocation at every money movement, transaction monitoring and source-of-funds enquiries, a responsible gambling function with behavioural detection and governance, advertising review against sweepstakes disclosure law, an affiliate programme with state permissions, and a data-protection regime. None of it is required by a regulator today. All of it is required by the banks, the processors, the courts and the legislators who have replaced one.
What to take from this lesson
The segment has no regulator, so its compliance obligations are enforced by banks, processors, attorneys general, plaintiffs' lawyers and legislators, and each of them has moved. Age and identity verification at purchase, honest geofencing, AML controls imposed by the payment chain, a real responsible gambling function, sweepstakes-compliant advertising and a state-aware affiliate programme are the minimum for an operator intending to survive. The processor ladder is the tell: each step down it is a step toward the offshore product the operators say they are not.