Payments Are the New Choke Point: How India and Indonesia Are Hunting Grey-Market Operators

For years, India and Indonesia have been blocking websites of offshore casinos and sportsbooks, only to find that mirror sites pop up faster than regulators can shut them down. In 2026, both countries shifted their main pressure onto the money: mule accounts, UPI and QRIS, and payment intermediaries and merchants. We will examine which of these measures work and estimate how much money is already frozen. We will also discuss what this means for operators, affiliates, PSPs, and providers.

Key Takeaways

• Website blocking has reached its limit. In India, 8,376 URLs related to betting and gambling had been blocked by March 2026, while in Indonesia, approximately 3.6 million websites and IP addresses had been blocked since October 20, 2024. However, the illegal market has not disappeared;
• A new front is the payment layer. An Indian law passed in 2025 explicitly prohibits banks and payment systems from processing payments for real-money online games. In Indonesia, the financial intelligence agency PPATK froze 5,762 accounts totaling Rp1.07 trillion in the first half of 2026, and Bank Indonesia and the payment association ASPI pledged in October to revoke QRIS access from merchants;
• The entire chain is exposed, not just the operator. In the 1xBet and Parimatch cases, Indian investigators uncovered thousands of mule accounts and payment companies that had been denied licenses by the RBI. In Indonesia, police froze funds held by five payment providers in a single case.

Why Blocking Websites Is No Longer Enough

In India, the number of blocked sites runs into the thousands. According to data from MeitY, which the ministry provided in a response to the Lok Sabha on April 1, 2026, as of March 28, 8,376 URLs related to betting and gambling had been blocked, of which more than 4,800 were blocked after the passing of the online gaming law in August 2025. In March 2026 alone, approximately 300 more websites and apps were blocked.

In Indonesia, the scale is three orders of magnitude greater. On October 6, 2026, Minister of Communications and Digital Affairs Meutya Hafid reported that 4.1 million pieces of content containing gambling material had been processed, of which 3.6 million were websites and IP addresses that could be blocked. According to data from Komdigi, which the ministry presented jointly with Bareskrim on September 3, access to more than 8.8 million websites has been blocked in the country since 2017.

The numbers are rising, but the market isn’t going away: a blocked address is quickly replaced by a mirror site. That’s why, in July at the OJK banking forum, Hafid clearly articulated a new goal. The objective is to “break the neck of the online gambling ecosystem – that is, the collection accounts.” A mirror site costs next to nothing. A new bank account, a QRIS merchant account, or a payment gateway costs more and is easier to track.

India: A Law Addressed to Banks

Parliament passed the Promotion and Regulation of Online Gaming Act in August 2025; MeitY published the regulations for the Act on April 22, 2026, and they have been in effect since May 1, 2026. The Act prohibits all online games for money – whether based on chance, skill, or a combination of both. A separate Section 7 prohibits banks, financial institutions, and payment systems from processing payments related to such games. According to PIB, the government estimates that 45 crore people (450 million) have been affected by online gambling, with their losses totaling more than ₹200 billion.

The penalties are the same for both those who offer the game and those who process the payment: up to three years in prison and/or a fine of up to ₹10 million. For repeat offenses, the prison term ranges from three to five years, and the fine ranges from ₹10 million to ₹20 million. Advertising such games is punishable by up to two years in prison and a fine of up to ₹5 million. Cases may be investigated by state police cybercrime units, down to the level of individual precincts.

The new regulator is the Online Gaming Authority of India (OGAI), a body under the Ministry of Electronics and Information Technology (MeitY) that includes representatives from the Ministry of Finance, the Ministry of Home Affairs, and the Ministry of Law and Justice. Its mandate explicitly includes coordination with financial institutions. The OGAI took its first major step on July 29, 2026. The regulator issued an advisory to banks, app stores, cloud providers, telecom operators, OTT platforms, and advertising agencies. 

The document, signed by OGAI Secretary T. Santosh, requires recipients to stop authorizing payments, disable the apps, and remove the ads. It also states that all recipients “shall build and implement automated or manual internal compliance systems.” In parallel, banks are being equipped to detect mule accounts. In May 2026, the Ministry of Finance required banks to deploy MuleHunter.AI, a model developed by the Reserve Bank Innovation Hub. On May 12, 2026, the RBIH and I4C signed an agreement whereby I4C, the national cybercrime centre, feeds identifiers of suspects from its registry into the system. As of May 2026, the model was in use at more than 26 banks. 

The legal picture is not settled, however. On August 5, 2026, the Supreme Court agreed to hear the challenges to the Act on their merits and asked the parties to complete their pleadings. The Act has not been stayed, so it remains fully in force for the market.

India: Mule Accounts, Payment Gateways, and the Enforcement Directorate

The most detailed picture of how offshore operators accepted money from Indian players comes from cases investigated by the Enforcement Directorate (ED) under the Prevention of Money Laundering Act (PMLA). In the 1xBet case, according to ED data as of November 2025, deposits were collected through more than 6,000 mule accounts. The money then passed through several payment gateways, where merchants were onboarded without proper KYC verification. The ED raided four payment gateways, froze more than 60 bank accounts, and estimated the money trail at more than ₹10 billion.

The Parimatch case reveals who stood between the player and the operator. In August 2025, the ED froze approximately ₹1.1 billion in mule accounts and seized more than 1,200 mule credit cards. According to investigators, Parimatch worked with payment companies that had been denied payment aggregator licenses by the RBI. These companies were registered as technology service providers and provided agents with APIs to link accounts. Deposits collected via UPI were disguised as refunds, chargebacks, and payments to suppliers. On September 3, 2026, the ED reported a new development: more than ₹9 billion had been transferred abroad, including through fictitious foreign direct investments, imports of services, and travel agencies. According to the ED, part of the cash was converted into USDT via hawala. In total, approximately ₹1.5 billion has been frozen and seized in connection with the case.

The tax authority is investigating the same accounts. Back in March 2025, the DGGI reported that it had blocked 357 websites belonging to offshore operators, and approximately 700 companies were under investigation. About 2,000 accounts used to receive players’ funds were frozen, and a further 392 UPI-linked accounts were subject to a withdrawal ban, with ₹1.22 billion provisionally frozen.

The pressure isn’t limited to offshore operators. In November 2025, the ED froze approximately ₹5.23 billion held by the Indian companies WinZO and Gameskraft in a case involving player balances that had not been returned. This is a warning to anyone holding players’ money: once a ban is in place, it’s the investigator who will be asking, “Where did the deposits go?”

Indonesia: What Financial Intelligence Sees

Gambling is prohibited by criminal law in Indonesia, and the government measures the illegal online market by tracking money flows. According to PPATK data, online gambling turnover in 2025 totaled Rp286.84 trillion across 422.1 million transactions, a 20% decrease from the previous year (Rp359.81 trillion). Deposits fell from Rp51.3 trillion to Rp36.01 trillion, with 12.3 million people making at least one deposit.

In the first half of 2026, turnover totaled Rp86.82 trillion, down 12.9% from a year earlier. Meanwhile, the number of transactions rose by more than 167% to 467.32 million, and deposits totaled Rp22.05 trillion. PPATK head Ivan Yustiavandana says the rise in transaction numbers does not reflect market growth: “The increase in transaction frequency also shows that our ability to detect them has improved.” The key figure is QRIS: Rp12.36 trillion in deposits (about 56% of the total volume) were processed through the national QR standard.

Freezes occur in waves. In the first half of the year, the PPATK temporarily suspended transactions on 5,762 accounts holding Rp1.07 trillion. In early August, following the FIFA World Cup, it suspended transactions on an additional 2,815 accounts with a combined balance of Rp325.43 billion. From mid-June through July, the PPATK estimated tournament-related deposits at Rp1.02 trillion across 6 million transactions. Based on 51 PPATK analytical reports on transactions from 132 websites, the police opened 27 cases.

Indonesia: Banks, QRIS, and Payment Providers

The banking regulator is responsible for freezing accounts. On October 5, 2026, OJK Chief Executive of Banking Supervision Dian Ediana Rae announced that the regulator had required banks to conduct enhanced due diligence (EDD) or freeze approximately 38,796 accounts, according to Komdigi. Banks are also required to identify and close other accounts held by the same owners based on their national identification number (NIK). By comparison, there were about 8,500 such accounts in all of 2024. According to Komdigi data as of July, of the 38,000 accounts referred to the OJK, about 32,500 have been closed, and citizens have reported another 156,000 suspicious accounts through the cekrekening.id service.

The next target is merchants. On October 15, Bank Indonesia announced via its official account that every payment service provider (PJP) involved in gambling must cease using QRIS for such activities, and that all PJPs are required to apply the “Know Your Merchant” principle. The day before, ASPI Chairman Santoso Liem promised a harsh response to proven violations: “We will revoke QRIS and disable the payment tool,” and the merchant’s account will be blocked. The scale of the task: according to BI data as of August 2026, 47.11 million merchants – mostly small businesses – are connected to QRIS.

The police have already turned their attention to payment companies. On September 3, Bareskrim announced three cases. In the first case, which involved the 1xBet website, among others, approximately Rp1.03 trillion passed through PT Ultra Payment Terpercaya, and Rp51.99 billion was frozen at five payment providers. Two other cases involved promoters who advertised casinos via spam in the comments sections of popular social media accounts. The police blocked 42 accounts and estimated the monthly turnover of these schemes at Rp7.5 billion. In total for 2026, according to Polri data as of September, 55 cases have been filed against 123 suspects – fewer than in 2025 (665 cases and 744 suspects). The number of cases is decreasing, but payment companies are now involved in the largest ones.

Two Models in One Table

Table 1. India and Indonesia: How pressure is applied to the illegal market. Sources: 1–21.

Table 2. Pressure tactics and their targets. Sources: 1–3, 6–11, 13–21.

What Does That Mean?

To operators. India and Indonesia are not grey but closed markets for real-money gaming; in India, the ban explicitly extends to games of skill as well. Accepting payments from there through intermediaries is now not just a risk of being blocked, but grounds for a money laundering case, in which funds throughout the entire chain will be frozen. For a group with licenses in other jurisdictions, such a case could become an issue during a due diligence review. The practical takeaway is to implement geo-restrictions based on IP addresses, KYC, and payment data for IN/ID, and to conduct regular audits of your payment stack: who your PSPs are, what licenses they hold, and where deposits are sent.

To affiliates. Indian law penalizes the advertising of gambling under a separate section, and the OGAI advisory is also directed at advertising agencies. In Indonesia, the police have already opened cases against promoters, and their accounts have been frozen along with those of the operators. Payments from these GEOs go through the same payment infrastructure that is currently being cleaned up, so funds under such contracts may end up in a frozen account. The safest approach is to remove IN and ID from targeting for real-money games and to stipulate this in contracts with operators.

To PSPs and aggregators. This is the main risk group for 2026. Cases in India show that investigators are specifically targeting companies that operated without an aggregator license under the guise of technology providers and onboarding merchants without KYC. Indonesia’s BI has explicitly placed responsibility for merchants on PJP. At a minimum, this requires KYM with verification of the merchant’s actual business activities, monitoring for discrepancies between the declared business and actual cash flows, and a rapid response to requests from regulators.

To game and platform providers. The OGAI advisory lists cloud providers and hosting services among those that can “facilitate” real-money games. For B2B suppliers, this is a reason to verify where operator clients are based and to include in contracts a prohibition on launching content in IN and ID for real-money games. In India, social games and esports remain permitted, but the status of a game is determined by OGAI, not the supplier.

Methodology

As of October 22, 2026. Amounts are listed in local currencies without conversion to dollars: ₹ – Indian rupees (1 crore = 10 million), Rp – Indonesian rupiah. Blocking figures are calculated differently in the two countries: in India, these are URLs, while in Indonesia, they include websites, IP addresses, and social media content; therefore, they cannot be directly compared. PPATK data on asset freezes for different periods overlap and are not aggregated. The charges brought by the ED and Bareskrim represent the investigative authorities’ position; the court proceedings in these cases have not concluded. Quotes in Indonesian have been translated by the editorial staff.

Sources

1. PIB / MeitY, “A New Era of Online Gaming Governance: Enabling safe and responsible gaming under the Online Gaming Rules, 2026,” April 30, 2026 — dates of the law’s adoption and the rules’ entry into force; payment prohibition; penalties; composition of OGAI; 450 million affected individuals and ₹20,000 crore (₹200 billion) in losses. https://static.pib.gov.in/WriteReadData/specificdocs/documents/2026/apr/doc2026430859401.pdf
2. ThePrint, “Exclusive: 1st big push under online gaming law — govt tells app stores, OTTs to stop enabling money games,” August 4, 2026 — OGAI advisory dated July 29, 2026; signed by T. Santosh; recipients; penalties under Sections 5–7. https://theprint.in/india/governance/exclusive-1st-big-push-under-online-gaming-law-govt-tells-app-stores-otts-to-stop-enabling-money-games/3004996/
3. iGamingToday, “India Bans 8,376 Websites Associated with Online Betting and Gambling as Offshore Access Persists,” April 5, 2026 — MeitY’s response in the Lok Sabha on April 1, 2026: 8,376 URLs as of March 28, 2026, including more than 4,800 blocked after the law was enacted. https://www.igamingtoday.com/india-bans-8376-websites-associated-with-online-betting-and-gambling-as-offshore-access-persists/