Payment Flows at MGA-Regulated Shark77: A Closer Look at Onboarding, Deposits, and AML Thresholds

Overview

Over recent years, the Scam-Or Project has monitored investment/trading outfits alongside the payment processors that keep B2C platforms running. Payments are the operational backbone: customers must be able to put money in and take money out. Across many cases, we’ve seen gaps in regulatory compliance and AML/CFT execution. In this review, we extend that lens to online gambling—starting with Shark77 Limited, an MGA-authorized operator.

Key Facts at a Glance

Short Narrative

Shark77 Limited—licensed by the Malta Gaming Authority (MGA)—publicly operates three sites: 18Bet.com, sportempire.com, and CasinoWinBig.com. There are claims that RichKing Casino is also connected to the Shark77 ecosystem, though we have not definitively verified that relationship.

The brands appear to target multiple geographies. Notably, audiences include countries such as the UK, Norway, Germany, Austria, and Hungary, even though Shark77 does not hold domestic licenses in those markets. As of September (Similarweb snapshots referenced for 18Bet.com and CasinoWinBig.com), a significant share of visitors came from Hungary, Finland, Sweden, and Austria. Operating locally in these jurisdictions typically requires a national license and may trigger additional restrictions.

New users across the networked sites are offered welcome bonuses up to 100% of their first deposits. Registration funnels commonly route newcomers straight to the deposit page before KYC, where they can fund balances—reportedly up to €10,000—via cards or wallets such as Skrill, Neteller, MuchBetter, Rapid, Revolut, Volt, and others listed above. For Norway, we observed flykk as a facilitating PSP.

AML/CFT Framework: What the MGA Expects

The MGA is the competent authority for the Prevention of Money Laundering and Funding of Terrorism Regulations as applied to gaming.

• Scope: MGA-licensed B2C operators of Type 1, 2, and 3 games must adopt a risk-based AML/CFT program—covering measures, controls, and procedures.

• Trigger Threshold: Most enhanced obligations kick in once a customer reaches €2,000 in cumulative deposits across the relationship or over a rolling 180-day window.

• Identity Verification: Funds-handling procedures are expected to require player identity verification once total deposits equal or exceed €2,000.

Implication: A B2C licensee like Shark77 Limited (with 18Bet as one of its trading names) should not allow deposits beyond €2,000 prior to KYC completion under the prevailing AML/CFT rules and MGA guidance.

Onboarding & Deposit Flow Observations

• Date of check: October 26, 2022

• Finding: Prior to identity approval, the deposit interface indicated that pre-KYC deposits up to €10,000 would be accepted.

From a control-design standpoint, preventing non-verified users from depositing more than €2,000 is a straightforward technical limit and aligns with the MGA’s risk-based expectations. Where pre-KYC deposits are permitted at all, applying a hard cap at the regulatory trigger threshold reduces exposure and simplifies downstream remediation (e.g., refunds, enhanced due diligence, source-of-funds requests).

Practical AML Considerations for B2C Gambling Operators

1. Pre-KYC Deposit Caps

• Enforce €2,000 cumulative limit pre-KYC (or lower, depending on the operator’s risk appetite).

2. Rolling-Window Monitoring

• Track deposits on a 180-day rolling basis to auto-trigger identity and funding checks.

3. PSP-Level Controls

• Align caps and velocity limits with each payment method (cards, e-money, bank transfer, APMs like flykk).

4. Geo-Licensing Guardrails

• Filter or restrict onboarding from non-licensed markets; adapt payment options and bonus eligibility accordingly.

5. UX-Integrated Compliance

• Communicate thresholds transparently at registration and deposit screens; fail-safe over permissive behavior.

Bottom Line

The payment journey is a critical risk point for gambling platforms. For MGA B2C licensees like Shark77 Limited, allowing deposits that exceed €2,000 before KYC conflicts with the AML/CFT guardrails implied by MGA rules. Technically, enforcing pre-KYC deposit ceilings and jurisdiction-specific restrictions is not complex—and it should be standard practice to keep payment compliance aligned with regulation and risk appetite.