ADM sets payment rules for gaming-shop top-ups amid fraud risks

Italy's ADM set requirements for the payment methods used to top up gaming accounts at retail outlets in determination 675265 of 22 October, the regulator's latest step in a framework governing top-ups at points of sale. The determination followed observations from the MEF, UIF and Guardia di Finanza, according to the source. It does not address retailers' access to the top-up portal, the source said.

Under the determination, top-ups made at retail outlets must be recorded in the concessionaire's accounts, including to check the weekly limit. Withdrawals must go only to an instrument held in the name of the account holder, with the concessionaire responsible for the check. The source said the rules protect the player and traceability rather than the retailer against fraud.

The retail top-up framework derives from article 13 of legislative decree 41 of 2024, the reorganisation of remote gambling, which requires the retailer to identify the account holder requesting a top-up and to use traceable payment instruments already indicated to the concessionaire and validated by it. ADM established the register of retailers with a determination of 25 October 2024.

A €100 weekly cap on cash top-ups was upheld before the Sixth Section of the Council of State in judgment 7220, published on 30 September 2026, together with the ban on withdrawing from the account at the point of sale.

The source described frauds in which a caller posing as the concessionaire's technical support persuades a retailer to open a remote-assistance programme, then uses the outlet portal to change the password, load top-ups onto gaming accounts and withdraw to cards. A simpler variant uses an SMS that appears to come from the bank or concessionaire and asks the recipient to confirm access to their profile.

The source said the weekly cap stops a player who tops up too much in cash but not someone who has taken control of the till and distributes top-ups across several accounts, and that the withdrawal restriction helps investigators follow the money once it has left. How access to the terminal from which top-ups start is protected is left to each concessionaire, the source said.

The source contrasted the retail rules with the EU's PSD2, which made strong customer authentication mandatory for payment accounts and sets who bears the loss for unauthorised operations. It said the retail top-up rules contain no comparable strong-authentication obligation and no rule on allocating the damage, which depends on how each concessionaire has built its system and on its contract with the retailer.

The source said the retailer currently bears the loss, that a report starts an investigation but does not by itself return the money, and that insurance covering the risk is not guaranteed. It argued responsibility should be divided across three levels, with the concessionaire controlling the technology, and proposed two-factor authentication on the portal at three points: access, password change and top-ups outside the outlet's usual pattern, alongside alerts and blocks on anomalous top-ups and a verifiable support channel.

The source said ADM has already set rules on who may be a point of sale and on how much can be topped up, and that a natural next step would be a minimum security requirement for terminals and portals, as applies to certified gaming systems. It said access security is already a contractual and certification requirement on the online B2B side, while on retail it is left to each concessionaire.