3628 Excalibur hotel and casino

Introduction

• What it is: This MCC is designated for establishments that provide hotel and casino services.
• Risk level: Medium — The combination of hospitality and gaming often attracts a higher risk profile.
• Acceptance difficulty: Medium — Banks may scrutinize these transactions more closely due to potential gaming-related fraud.
• Typical business models: hotels with casinos; entertainment complexes; resorts offering gambling; gaming destination facilities.
• For merchants: Expect moderate MDR; potential for increased reserves due to higher risk; thorough approval process needed.
• What PSPs expect: Verification of gaming licenses; detailed business model description; compliance documentation specific to gaming regulations.

Payment Insights & Benchmarks

Merchants in this MCC should plan for payment processes that may vary significantly due to the unique nature of the gaming and hospitality industry. Understanding payment dynamics is crucial to minimize friction and optimize acceptance rates.

Payment methods

Cards: often the primary method, but subjected to stricter scrutiny; expect lower approval rates.

• E-wallets: popular for quick transactions, but acceptance may depend on specific gaming regulations.
• A2A payments: gaining traction, particularly for deposits and withdrawals; regulatory awareness is key.
• Prepaid cards: frequently used for customer privacy, yet can have limitations on use in gaming.

Authentication & security

Strong customer authentication (SCA) is usually required; 3DS may be applied selectively based on risk profiles.

• High levels of fraud scrutiny apply, necessitating robust monitoring strategies.
• Casinos may face higher rates of friendly fraud, demanding nuanced fraud detection approaches.

Benchmarks (indicative, not guaranteed)

MDR: typically higher than standard e-commerce due to associated risks.

• Rolling reserves: may be significant, often in double digits, related to regulatory oversight.
• Settlement cycles: generally extended, often exceeding 7 days due to transaction review processes.
• Chargeback ratios: usually elevated; merchants should prepare for higher dispute volumes.
• Approval rates: card transactions may see lower rates, while e-wallets could enhance acceptance.

Key metrics to monitor

Authorization rates stratified by payment method and timing.

• Decline reasons directly related to fraud or compliance issues.
• Chargeback reasons categorized by friendly fraud versus legitimate disputes.
• Transaction velocity and average ticket sizes for patterns indicative of risk.

Risk & Compliance

Merchants operating under the MCC 3628, which encompasses establishments like the Excalibur Hotel and Casino, face significant scrutiny due to the high financial risks and potential for fraudulent activities. PSPs and acquirers closely monitor these businesses, demanding comprehensive measures to handle chargebacks, fraud, and compliance with AML/KYC regulations.

Chargebacks & fraud

Common instances of friendly fraud, in which customers claim they didn't authorize transactions, and bonus abuse are prevalent in this sector.

• Fraud patterns may include multi-accounting, where a user creates several accounts to exploit promotions or bonuses.
• Effective mitigation tools include behavioral analytics, velocity checks to monitor rapid betting or transaction activities, and device fingerprinting to detect anomalies in user behavior.

AML/KYC expectations

Strong customer identity verification (IDV) is mandatory, often incorporating sanctions and Politically Exposed Persons (PEP) checks to ensure compliance.

• Source-of-funds verification is essential, especially when transactions exceed established thresholds or display unusual patterns typical of money laundering.
• Manual review triggers often include situations like large or frequent deposits, irregular payment methods, or connections from known VPN/proxy services.

Operational red flags

Lack of transparency regarding ownership and operational structures can raise alarms, especially in white-label setups without clear accountability.

• Sources directing traffic from restricted regions or unverified affiliates should be scrutinized to mitigate potential risks.
• Inadequate responsible gaming measures, such as missing self-exclusion options, betting limits, or cooling-off periods, can signal compliance deficiencies.
• Unclear or hidden refund and return policies can lead to disputes and increased chargeback rates.

Onboarding Checklist

Merchants under this MCC should prepare a complete onboarding package before approaching PSPs or acquirers. A well-structured submission improves approval chances and shortens review times.

Legal & corporate documents

company registration and incorporation documents

• disclosure of beneficial owners (UBO) and corporate structure
• valid licenses for the relevant business activities
• policies: Terms of Service, Privacy, AML/KYC, Refund Policy, Responsible Gaming (if applicable)

Financials & risk management

recent financial statements and cashflow forecasts

• liquidity or reserve model for payouts
• description of antifraud setup and monitoring tools

Product & marketing

demo access or screenshots of the live platform

• marketing plan and traffic source overview (affiliates, SEO, PPC)
• geographic targeting information
• KYC flow details, including IDV providers and thresholds

Technical integration & security

payment architecture overview with supported methods/providers

• description of SCA/3DS flows, retry logic, and tokenization
• PCI DSS compliance status and data storage policy

Operations

customer support coverage (languages, 24/7 if available)

• SLA for dispute handling and chargeback response
• deposit, bet, and payout limits; self-exclusion mechanisms
• internal process for chargeback investigation and documentation

Regulation & Licensing

Licensing and certification are critical for merchants in this MCC, as PSPs and acquirers will require proof of compliance before onboarding. Recognition of licenses depends heavily on the merchant’s jurisdiction and the markets they target.

Operator licenses

UK Gambling Commission (UKGC) — highly recognized, required for UK-facing operators.

• Nevada Gaming Control Board (NGCB) — essential for any gambling entity operating in Nevada, including casinos.
• Malta Gaming Authority (MGA) — widely accepted within the EU and beneficial for online gaming operations.
• Isle of Man and Gibraltar licenses — respected for international online gaming operators.
• Some markets require separate licenses for different forms of gambling, such as casino and sports betting.

Geo-restrictions

Countries with strict gambling regulations → often prevent transactions or block access to gambling sites.

• In the United States, gaming regulations are state-based, and operations must comply with local laws.
• Many PSPs will refuse transactions from jurisdictions deemed high-risk or where gambling is illegal.

Certifications & audits

PCI DSS compliance for effective handling of payment card data and to ensure data security.

• RNG (Random Number Generator) audits to certify the fairness of gaming systems.
• Annual AML/KYC compliance reports and reviews are essential to prevent fraud and money laundering.
• Responsible Gaming policy audits, ensuring adherence to regulations promoting safe gambling practices.

Official Definitions & Network Comparisons

This section shows how major card networks define this MCC and highlights practical differences that affect merchant onboarding.

Explanation:

While the term "casino" is consistently used across networks, variations in phrases like "gaming facilities" versus "gaming-related services" can influence acceptance criteria. Some networks might require distinct merchant IDs for different types of gambling activities or jurisdictions. Reasons for rejection often include inadequate licensing, elevated risk locations, and ambiguous business models.

Alternative MCC Codes

Merchants often confuse this MCC with other categories. The table below shows which codes are related, why they are confused, and what risks misclassification brings.

Rule of thumb for merchants:

If your business includes gambling activities or anything involving cash wagers, it should be classified under MCC 3628. Misclassifying your business can result in compliance issues and potential closure of your merchant account. Always ensure the correct representation of your operations.

Best Practices for Merchants

Merchants operating within the "EXCALIBUR HOTEL AND CASINO" MCC must adopt best practices that prioritize transparency, operational integrity, and proactive risk management. Following these recommendations can enhance payment acceptance and mitigate potential disputes.

Classification & transparency

always use the correct MCC; inaccurate classifications can lead to account issues or closure

• clearly display gaming licenses, geographic restrictions, and responsible gambling policies on your website
• maintain transparency in business models, including clear descriptors for all transactions

Fraud & chargeback reduction

implement 3DS or step-up authentication for transactions that exhibit high-risk signals (e.g., large amounts or unusual locations)

• ensure clear billing descriptors to avoid confusion and provide instant confirmations via SMS or email
• log all transaction and gaming events to support evidence gathering for potential chargeback disputes

Payment acceptance optimization

support multiple payment methods (credit/debit cards, e-wallets, self-service kiosks) to reduce reliance on a single channel

• route transactions by customer geography or payment processor performance to optimize approval rates
• consider using separate merchant IDs (MIDs) for different parts of the business to streamline transaction management

Operational discipline

establish KPIs such as authorization rates, chargeback ratios, and recovery times to monitor payment performance

• conduct regular compliance audits and internal reviews to ensure adherence to policies and procedures
• designate a dedicated team or individual responsible for managing disputes and responding to customer inquiries

Payouts & liquidity

maintain adequate liquidity buffers to accommodate rolling reserves and avoid cash flow disruptions

• implement automated Anti-Money Laundering (AML) checks for high-value withdrawals to safeguard against illicit activity
• keep a close watch on payout frequencies and patterns to detect any suspicious withdrawal behaviors

Business Scope & Examples

This MCC covers businesses primarily involved in the operation of hotels that feature casino gaming facilities. Merchants classified under this category typically provide accommodations alongside gambling activities, making a combined experience for customers who wish to engage in gaming entertainment while staying at the hotel.

Models

hotel casinos with slot machines and table games

• integrated resorts that combine luxury accommodations with gaming floors
• entertainment venues offering live shows and events along with gaming services
• destination resorts that include casinos as part of a larger hospitality experience

Borderline cases

Resort hotels without gaming — traditional hotels that offer luxury but do not include any gambling facilities; these should not be classified under this MCC.

• Gaming establishments outside of hotel properties — standalone casinos or gaming halls that do not offer accommodations; they fall under a different MCC.

Signals for correct classification

hotel amenities include dedicated gaming areas for customers

• guests can access gaming facilities directly from their accommodation
• business model promotes both lodging services and in-house gambling activities