Open banking casino deposits: how a direct bank transfer is authorised

What a payment initiation service provider actually does

The firm sitting between a bank account and a gambling cashier is called a payment initiation service provider, or PISP, a defined category under the Payment Services Regulations 2017. A PISP does not hold a player's money at any point and does not receive card details, because there are none to receive. It is given permission, for a single transaction, to instruct the player's own bank to move a stated amount to a stated recipient.

That permission is not casual. Regulations 68 and 69 of the PSRs require the player's own bank, called the account servicing payment service provider, to give the PISP access on request and to treat an instruction coming through it the same way it would treat one from the account holder directly, provided the PISP is properly authorised and the player has consented.

Consent itself has to clear a specific bar. Regulation 100 of the PSRs, alongside the regulatory technical standards on strong customer authentication, requires the bank to confirm the payment using at least two independent factors, typically something the player has and something only the player knows. A single click inside a casino cashier is not what authorises the payment; the player's own bank, in its own app or its own second factor, is what actually does.

Why this needs full authorisation rather than a lighter registration

The PSRs recognise more than one kind of open banking firm, and they are not held to the same bar. An account information service provider, or AISP, only reads account data and can operate under a lighter registration route. A PISP moves money on a person's instruction, which the regulations treat as materially riskier, and it requires full authorisation rather than mere registration before it can operate at all.

The FCA's own register of firms holding payment services permissions lists both categories separately, and a firm's entry states which permissions it actually holds rather than leaving the distinction to be inferred from its name. That register is the place to check standing for a named firm, in the same way the e-money register is the place to check standing for a wallet provider on the PayPal page.

Open Banking Limited sits alongside that regime rather than inside it. It was established under the Competition and Markets Authority's 2017 retail banking market investigation order to run common technical standards and a shared directory that banks and third parties both connect to. It does not authorise firms and it is not the FCA; it is the body that made a single technical standard possible across banks that would otherwise each have built their own.

Open banking casino deposit limits, and why there is no fixed figure

Nothing in the PSRs sets a value ceiling on a payment initiated this way, which puts open banking in a different position from the phone-bill route, where a £40-and-£240 statutory pair exists precisely because that route relies on an exclusion rather than a permission of its own. A PISP is authorised to move money, not capped in how much, so any ceiling a player meets comes from elsewhere.

In practice that means two other limits do the work a statutory one might otherwise do: the gambling site's own cashier minimum and maximum, and whatever limit the player's own bank places on payments authorised this way, which varies by bank and by account type and is not something a PISP or a gambling site controls.

A player who wants to know the actual ceiling on a given deposit is, in effect, asking two different institutions two different questions, and neither answer is published anywhere a page like this one could quote as a general figure.

Who holds the permission, and who only writes the standard

Two different bodies get spoken about as though they were one. Open Banking Limited was created to implement a Competition and Markets Authority order, and what it produces is a technical standard: how a bank exposes an account, how consent is expressed, what a request has to look like. It authorises nobody. It appears on no register as the party handling a payment, because it never handles one.

The permission sits with the provider that initiates the payment, and it is the Financial Conduct Authority that grants it. That distinction has a practical edge for anyone checking a deposit route. A cashier offering to move money straight from a bank account is naming a method, and a method is not a permission. The name worth checking against a register is the initiating provider's, which a cashier does not always put in front of the player.

There is a structural consequence as well. A payment initiation service instructs the player's own bank to make the transfer, and the authentication happens at that bank rather than at the provider. The provider does not take the money in and pass it on afterwards, which is what separates this route from one running through a wallet that holds a balance. Whether that difference changes what a player can recover when a disputed deposit goes wrong is not settled by the authorisation alone, and no general answer is offered here.

What appears on the bank account before and after the transfer

The payment leaves the player's bank as an account-to-account transfer. The PISP initiates it but never becomes the place where the balance sits, so the transaction record belongs primarily to the bank account rather than to a separate wallet ledger. The cashier receives confirmation that the instruction was authorised and can then credit the gambling account.

Strong customer authentication explains the hand-off a player sees. The casino starts the request, the provider passes it to the bank, and the bank asks for its own approval factors. A redirect or app switch is not the provider collecting bank credentials. It is the bank keeping the authentication step inside the environment it controls.

A failed instruction can occur at several points. The cashier can reject the amount, the bank can refuse it under account limits or fraud controls, and an authentication session can expire. None of those outcomes, by itself, says the PISP lacked authorisation. The register answers the firm's standing; the transaction record answers what happened to one payment.

When money leaves the gambling account, it generally comes back as a normal bank transfer. The casino already has an identified account from the deposit route, but the withdrawal is not the PISP reversing its earlier instruction. It is a new payment in the other direction, with its own processing and verification steps.