SEPA instant payments and open banking: how money really moves into a casino

You press "Pay by bank link" on a casino's deposit page, pick your bank from the list, confirm with Smart-ID and the money is in your account. The whole thing takes two to three seconds.

At the end of the same evening you press "Withdraw" and are told the money will arrive within two hours or one business day.

That asymmetry confuses players more than anything else in casino payments. If the money went in within two seconds, why does it not come out just as fast? The answer is not "the casino is stalling" — although sometimes that too. The answer is that deposits and withdrawals travel through completely different pipes, and those pipes are run by different parties under different rules.

In this article we take the whole chain apart. Which three systems are involved in your payment, what the European payments directive actually changed, the difference between a standard and an instant transfer, where exactly Trustly sits in that chain, what information your bank shares, and why a withdrawal's technical route is inevitably longer.

If you play using a bank link, this explanation is practical rather than academic: it tells you what you can influence and what you cannot.

Three parties your payment touches

Every bank-link payment passes through three separate organisations. All of them are licensed, all of them are supervised, and each has a different role.

1. Your bank. It holds your money, verifies your identity and executes the payment. In the Estonian context these are LHV, Swedbank, SEB, Coop Pank, Luminor and others. The bank is the only party that actually reaches your money and the only one that can finally confirm or reject a payment.

2. The payment initiation service provider. This is Trustly, Zimpler, Brite or a similar company. They are not a bank and they do not hold your money. Their role is to be a technical intermediary: they open your bank's login window, pass on the payment instruction and tell the casino whether the payment succeeded.

This is where most misunderstandings arise. Trustly does not "hold" your payment and cannot speed it up. Trustly also does not see your passwords — the login happens inside your own bank's interface.

3. The casino and its payment service provider. A casino is usually not connected directly to a bank; it has a payment partner who gathers all methods into one interface. The casino receives a "payment succeeded" message and credits your gaming account.

Together those three determine what you finally experience. And it is important to notice that with a deposit they all do their work in real time, whereas a withdrawal adds the casino's internal decision process, which none of those three speeds up.

Who supervises whom is equally clear. Banks and payment institutions in Estonia are regulated by Eesti Pank together with the Financial Supervision Authority, the anti-money-laundering side by the Financial Intelligence Unit, and the gambling operator itself by the Tax and Customs Board under the Gambling Act. The common interests of Estonian banks are coordinated by the Estonian Banking Association.

What open banking actually changed

Until about ten years ago the situation was simple: only your bank could initiate a payment from your account. If a service wanted access to your account, it had to sign a separate agreement with the bank, and the bank could terminate it at any moment.

That was changed by the European Union's second Payment Services Directive, PSD2, which took effect in 2018. Its central idea is one sentence: your bank account data and payment capability belong to you, not to the bank.

In practice the directive created two new licence types:

• AISP (account information service provider) — may, with your consent, see your balance and transactions. Used by budgeting apps and lenders.
• PISP (payment initiation service provider) — may, with your consent, initiate a payment from your account. This is exactly what Trustly does in casino payments.

Two things to emphasise here.

First: the bank may not refuse. If a licensed PISP arrives with your valid consent, the bank must allow the payment to be initiated. That is the directive's most important part and it is why a bank link works at nearly every Estonian bank without the casino having to sign a separate agreement with each one. Which banks it works with in practice is covered in a separate article: which Estonian banks support Trustly payments.

Second: consent is given per payment. A PISP does not get standing access to your account. For every payment you authenticate again and confirm the exact amount and recipient. If you do not make a payment through Trustly, it has no connection to your account at all.

The broader concept of open banking — what it covers and where it is heading — is summarised in the Wikipedia article on open banking.

SEPA, instant payments and where the speed comes from

Once a payment is initiated, the money has to travel from one bank to another. For that the euro area has a single system — SEPA, the Single Euro Payments Area, covering more than 30 countries and making a cross-border euro payment technically identical to a domestic one.

Within SEPA there are two schemes, and the difference between them is the most practical thing in this whole article.

Standard SEPA credit transfer (SCT)

The classic bank transfer. Banks gather payments and send them in batches at fixed times. Works on banking days, usually until around 16:00–17:00.

Consequence: a standard transfer initiated on a Friday evening may arrive on Monday. That is why weekends are a topic of their own in casino withdrawals — analysed separately in the kiiredvaljamaksed.ee breakdown.

SEPA instant credit transfer (SCT Inst)

A scheme launched in 2017 that changed the picture. Three properties:

• The money arrives within ten seconds. The scheme's rule is a maximum of 10 seconds; in practice it is usually 2–5.
• It works 24/7/365. No banking days, no cut-off times, no public holidays.
• The upper limit is high. The scheme's cap is €100,000 per transaction, although individual banks set lower limits.

Estonian banks have been among Europe's leaders in adopting instant payments and most domestic transfers move on this scheme today. The scheme is managed by the European Payments Council and the euro-area infrastructure is developed by the European Central Bank. An overview of SEPA as a whole is on Wikipedia.

Why this matters to a player. If a casino withdrawal moves as an instant payment, the money arrives within minutes even at two in the morning on a Saturday. If it moves as a standard transfer, everything depends on the hour and the day of the week. The same casino may use both, depending on the amount and the partner — and that is often exactly why two withdrawals from the same house behave differently.

Where exactly Trustly sits

Trustly is the best-known name in this chain for an Estonian player, but its role is often misunderstood. Let us set it out precisely.

Trustly is a licensed payment institution, not a bank. It does not hold your money in an account and does not offer deposits. It has an operating licence permitting it to initiate and intermediate payments, and it is under financial supervision for that.

On a deposit, Trustly does three things. It opens your bank's authentication window, passes the payment instruction to the bank (amount, recipient, reference) and — this is the important part — immediately confirms to the casino that the payment has been initiated and covered. The casino credits your account on the basis of that confirmation, not on the basis of the money's actual arrival. The money itself moves in the background over the following minutes or hours.

This explains why a deposit feels faster than technically possible: you are not waiting for the money to move, only for the confirmation that the movement is guaranteed.

On a withdrawal the situation is reversed. Now there is no authentication of yours on which to build a confirmation. The casino has to make its decision, initiate the transfer, and only then does the money move through the real SEPA pipes. Nobody has a reason or a basis to confirm anything in advance.

What Trustly sees about you. To initiate a payment it accesses the account information needed to make it: the account holder's name, IBAN, balance (to check coverage) and transaction history. That is also used for fraud and money-laundering prevention, which is a statutory obligation for a licensed payment institution.

What it does not see: your banking password or PIN codes. Authentication happens inside your own bank's interface and Trustly receives the outcome, not the credentials. The company's own description of the service is at trustly.com, and how it looks from the casino's side is set out step by step on how Trustly works.

Alongside Trustly, Zimpler, Brite and several others operate in the same role. Technically they do the same thing; the difference is in the list of supported banks and in which casinos they have agreements with. A comparison with card payments is in a separate article: Trustly vs Visa and Mastercard, and the debit card comparison is in debit card vs Trustly.

Why a withdrawal cannot be equally fast

Now that the pipes are clear, the article's opening question can be answered precisely. The difference is not in speed but in the number of steps.

The deposit route (2–5 seconds):

1. You initiate the payment and authenticate.
2. The bank checks coverage and confirms.
3. Trustly tells the casino the payment is covered.
4. The casino credits the account.

That whole chain is automatic and triggered by you. No party has to decide anything — the bank either confirms or does not, and that decision is made in milliseconds.

The withdrawal route (2 hours to several days):

1. You submit a request.
2. The casino checks your account status — whether identity verification has been done, whether verification is valid, whether documents are current.
3. The casino checks bonuses — whether any wagering requirement is still outstanding, whether the terms and conditions have been followed.
4. The casino checks limits — whether the amount fits within the daily and monthly caps.
5. If necessary the request goes to manual review — for a larger sum, an unusual playing pattern or an anti-money-laundering rule.
6. Only then is the transfer initiated.
7. The money moves through SEPA — either as an instant payment (seconds) or a standard transfer (hours or a day).

Steps 2–5 are a business process, not technology. They take time because somebody has to decide, and some of those decisions are legally mandatory. No payment system in the world speeds them up.

What that means for a player in practice. Two useful conclusions:

One: you can do steps 2 and 3 in advance yourself. If identity verification is completed right after registration and you have no active bonus outstanding, a large part of the delay disappears. Most "slow withdrawals" are in fact first withdrawals where KYC only happened at the moment of the request.

Two: you can influence step 7 by choosing the method. If a casino offers both a bank link and a card refund, the first is almost always faster, because a card refund travels through the card network and typically takes 1–5 business days. The difference is measured thoroughly in the Trustly vs card payment comparison.

Trustly withdrawal times are covered in a separate article, and how to choose a casino with fast withdrawals is a guide of its own.

Pay N Play: when the account and the payment merge

The most interesting development of the bank link is Pay N Play, or account-free play. The logic is simple: if your bank has already verified your identity, and if the payment carries the account holder's name and IBAN with it, why ask you to fill in a separate registration form as well?

How it works technically. You make a deposit by bank link. During the payment the casino receives your bank-confirmed personal data. An account is created automatically in the background on that basis — there is no username or password at all. The withdrawal goes back to the same IBAN the money came from.

What changes for the player. Registration disappears, and the first withdrawal no longer contains a document check, because verification already happened at the moment of payment. It is that second part which is why Pay N Play casinos stand out in withdrawal speed rankings.

What does not change. Anti-money-laundering obligations, turnover requirements and the requirements of the Gambling Act apply in exactly the same way. For a larger sum, documents are requested at a Pay N Play casino too. The model does not remove the checks; it moves them earlier and makes most of them invisible.

What the trade-off is. A Pay N Play account is simpler and therefore often more limited: some houses offer a smaller range of limits and the playing history is not available as far back. Which model suits whom is taken apart in Pay N Play vs a regular account, and the market's direction is described in Pay N Play is growing in Estonia. The houses we have tested are gathered under Pay N Play casinos and the fastest-handling ones under instant casinos.

One practical detail worth knowing. Because a Pay N Play account is tied to the IBAN you paid from, you cannot withdraw to a different account. That is a security property, not a restriction — it makes account takeover practically useless. But it also means changing your bank account in the middle of a playing relationship raises additional questions.

Security: what protects your money and what does not

Thanks to PSD2 and Estonia's e-identity infrastructure, bank-link payments are among the most secure payment methods in existence. But it is worth knowing exactly what that protection covers.

What is very well protected.

Authentication. Smart-ID and Mobile-ID are state-recognised e-identity instruments requiring a physical device and a PIN. Even if someone knows all your personal data, they cannot initiate a payment in your name.

Payment integrity. You always confirm a specific amount and a specific recipient. They cannot be altered after confirmation — if the amount were different, the signature would be invalid.

Credential leakage. Because you log in inside your bank's own interface, your passwords never travel to a third party. That is a clear advantage over card payments: with a card you hand over a number that can be reused later, with a bank link you give a one-time consent.

What is not protected — and you need to know this.

A voluntary payment cannot be reversed. A card payment has chargeback: you can dispute a transaction and the bank may claw the money back. A bank-link payment has no such mechanism. You authenticated, confirmed the amount and the recipient — the payment is final. If the casino turns out to be a fraud, there is no route back through the bank.

That is the single most important practical reason why a licence matters. Holding a licence is the only thing that gives you a real place to turn in a dispute. The list of valid Estonian licences is public in the ETCB register and the houses we have checked are gathered under Estonian-licensed casinos. What an operating licence actually means is set out in the Estonian gambling licence.

Phishing. The only serious attack vector is a forged login page. The defence is simple and complete: always check that the Smart-ID verification code on screen and on your phone are the same number. If they differ, someone has tried to have something signed in your name — break off immediately.

A wrong IBAN. If you enter the wrong account number for a withdrawal, the money goes to someone else. The IBAN checksum catches typos, but a valid wrong number goes through. We will look at that type of failure and how to resolve it in more depth separately.

Fees, currency and the small details

Bank-link payments are usually free for an Estonian player, but "usually" is not "always" and it is worth knowing where cost comes from.

Who pays for what. The deposit fee is mostly paid by the casino — it is their customer acquisition cost. With withdrawals the picture is more varied: some houses offer a certain number of free withdrawals per month and charge for the ones after that. That condition is stated on the payments page.

Currency matters more than fees. The SEPA scheme is for euros. If your gaming account is in euros and your bank account is in euros, no conversion happens and no fee arises. If the casino holds your account in another currency, conversion happens twice — in and out — and each conversion includes an exchange margin, typically 1–3%. That is almost always a bigger cost than any direct fee.

The practical advice is simple: if you can choose, open your gaming account in euros.

Minimum amounts. Every house has a minimum deposit and usually a minimum withdrawal too. The second is the one that surprises people: if your balance falls below the withdrawal minimum, you cannot get it out until you play it up or contact support. Minimums are usually around €10–20.

Limits. Withdrawals carry daily, weekly and monthly caps that differ between houses by multiples. For an ordinary player that is not an issue; with a larger win it is the most important number on the whole payments page, because it determines whether a win arrives at once or in instalments over several months. Worked examples are in the withdrawal limits guide.

On one thing that is often asked. Taking a bonus affects a withdrawal more than any payment-technical detail: while wagering is outstanding, the money does not move at all. How to calculate it is in wagering requirements: how to work out a bonus's real value, and whether you can get a welcome bonus with a Trustly deposit is a question of its own. The interaction between bonuses and withdrawals is covered thoroughly here and current offers are gathered under Trustly bonuses.

Estonian banks: what distinguishes them in practice

All the larger Estonian banks support bank-link payments, but the experience is not quite identical. The differences do not come from the banks' whims but from their interfaces, their limits and how they handle instant payments.

What is worth knowing about your own bank.

Authentication method. Most Estonian banks support both Smart-ID and Mobile-ID. Smart-ID is usually smoother because it does not depend on a SIM card and works abroad without roaming. If you play while travelling, that is a practical difference.

Daily limits. Every bank has a daily limit on internet bank transfers and it applies to bank-link payments too. By default it is often around a few thousand euros. If a payment fails with an "insufficient funds" message although the money is in the account, it is almost always the daily limit, not the balance. The limit can be changed yourself in the internet bank.

A business account will not do. Casinos require the account to be in a private individual's name and to belong to the player. A payment from a business account may go through, but a withdrawal will not come back to it, and it triggers a review that drags the matter out for weeks.

A joint account. The same problem in another form: if there are two account holders, the name may not match the casino's account details exactly. This is checked during verification.

Which banks work with what. The list of supported banks depends on which intermediary the casino uses — Trustly, Zimpler and Brite do not cover exactly the same set. The list is always visible on the casino's deposit page before you confirm anything. Our continuously updated overview is in which Estonian banks support Trustly payments.

One common misunderstanding. If your bank is not on the list, it does not mean the bank blocks gambling payments. Almost always it simply means that intermediary has no technical connection to that bank. The same bank may work perfectly at another casino using a different intermediary. It is worth trying another house before blaming the bank.

Step by step: a first deposit and a first withdrawal

If you are doing this for the first time, a properly run process looks like this. The whole thing takes a couple of minutes and prevents almost every typical delay.

The deposit

Step 1 — check the licence before, not after. This is the only step that cannot be undone later. The ETCB register is public and a search takes ten seconds. Since a bank-link payment cannot be reversed, this is the foundation of all your security.

Step 2 — look at the minimum deposit and the currency. If you can choose, open the account in euros. Conversion costs more than any fee.

Step 3 — do not take a bonus if you have not read the terms. A bonus makes withdrawal impossible until the wagering requirement is met. That is by far the most frequent reason money "gets stuck". The terms and conditions say exactly what applies.

Step 4 — choose your bank and confirm. Check that the Smart-ID verification code on screen and on your phone are the same number. That is the only step protecting you from phishing, and it takes one second.

Step 5 — check that the amount and recipient are correct. After confirmation the payment is final.

The withdrawal — and one step to take immediately

Step 6 — complete identity verification right after registering. Do not wait until a withdrawal. In most houses documents can be uploaded in the account settings on day one. That single step usually cuts a whole day of waiting off the first withdrawal. What exactly is asked for is described in KYC and identity verification.

Step 7 — check three things before requesting. Is the bonus finished or cancelled? Is the amount above the withdrawal minimum and below the daily or monthly cap? Is the IBAN correct? Those three cover most rejections.

Step 8 — submit the request and do not cancel it. Some houses offer "reversal" — the option to cancel a request and bring the money back to the gaming account. That feature works against the player, not for them, and it is examined separately in the kiiredvaljamaksed.ee analysis.

Step 9 — measure the time. Note when you submitted and when the money arrived. The second withdrawal at the same house is almost always faster, and only the third tells you the house's true pace.

When a payment is left "pending"

The most uncomfortable state is not a failed payment. A failed payment is clear: the money stayed in your account and you try again. The uncomfortable one is pending — the sum has left your bank and is nowhere to be seen at the casino.

Why it happens. A transfer passes through three parties and the message can be lost between any of the links. The most common causes:

• You closed the window before the redirect finished. The payment left the bank, but the casino received no confirmation and is waiting.
• The session expired between authentication and confirmation.
• The message between the intermediary and the casino was delayed — rare, but it happens.

What to do, in the right order.

1. Do not pay again. This is the most important line in the whole chapter. A second payment does not fix the first — it creates a second payment. Most double deposits are born exactly that way.

2. Refresh the casino page and log out and back in. About half of pending payments appear by themselves within five minutes.

3. Check your bank statement. Has the sum actually gone, or is it "reserved"? A reserved sum may release itself.

4. Contact casino support and give them three things immediately: the exact amount, the exact time and the payment description or reference number from your bank statement. With a reference number support finds the payment in minutes; without it the search can take days.

5. Allow time until the end of the next banking day. If by then the money is neither at the casino nor back in your account, it is a case for support to resolve — and at a licensed house that procedure exists and is mandatory.

If support does not help, with an Estonian-licensed operator the next step is a complaint to the Tax and Customs Board, and on the payment institution side to the Financial Intelligence Unit or the Financial Supervision Authority. With an unlicensed operator that route does not exist — one more reason why the first step is always the licence check. You can reach us via the contact page.

Where all this is heading

Two developments will change this picture over the next couple of years.

Instant payments become mandatory. The European Union's instant payments regulation obliges euro-area payment service providers both to receive and to send instant payments, at the price of a standard transfer. The practical meaning for a player: "standard transfer, arrives next banking day" gradually disappears and with it a large part of the weekend problem. On the banks' side it is a major change; on the player's side it simply looks like withdrawals becoming uniformly fast.

Recipient verification becomes standard. The same regulation brings a requirement to check whether the recipient's name and IBAN match, and to warn the payer if they do not. That reduces two common problems at once: money sent to the wrong account, and invoice fraud.

What that means in casino payments. Three things:

1. The speed gap between houses narrows on the infrastructure side — which means the remaining gap comes ever more clearly from the casino's own process. In other words: withdrawal speed becomes an even cleaner indicator of operator quality.
2. The weekend-versus-weekday difference disappears gradually. That is already visible at houses which have moved fully to instant payments.
3. The choice of methods narrows. If a bank link is free, instantaneous and secure, neither a card nor an e-wallet has any remaining advantage to choose them for.

How we measure operators and on what basis we rank them is on the methodology page, general information about us under about and the editorial team on the team page. The crypto payments side — where the logic is entirely different, because there is no intermediary — is covered in the kryptokasiinod.ee payments overview.

Cards, e-wallets and crypto: where the difference comes from

If a bank link is free and instantaneous, why are other methods offered at all? Because they solve different problems and each has a place where it is better.

Card payments (Visa, Mastercard). The deposit is instant, but the withdrawal moves through the card network as a refund and typically takes 1–5 business days. A card's advantage is chargeback — a dispute option a bank link does not have. Its drawback is that you hand the casino a number that can be used repeatedly, and that many Estonian banks block gambling-category transactions by default. The full comparison is in Trustly vs Visa and Mastercard.

E-wallets (Skrill, Neteller and others). Fast in both directions, because the money moves inside the wallet rather than the banking network. Two drawbacks: moving from the wallet to a bank account is a separate step with its own timing, and an e-wallet deposit is excluded from bonuses at many houses. That last one is in the terms and it surprises people regularly.

Crypto payments. There is no intermediary at all — the transfer moves directly on the blockchain and the concept of a "banking day" does not exist. Speed depends on the network, not the hour. In exchange, the whole protective layer disappears too: there is no reversal, no intermediary to turn to, and Estonian-licensed houses generally do not offer the method. How that side works is covered in the kryptokasiinod.ee payments overview and the fastest houses are in that comparison.

A practical ranking for an Estonian player at a licensed house: bank link first, card when a bank link is not offered, e-wallet when you already have a balance and are not planning to take a bonus. A side-by-side of all methods is in online casino payment methods, and on the freespin.ee side there is a payment methods overview with a broader catalogue.

In summary

A bank-link payment looks like a single button press, but behind it sit three licensed parties, one European directive and two different SEPA schemes.

Three things follow from that in practice:

One: deposit speed does not predict withdrawal speed. They travel through different pipes, and a withdrawal has six decision points a deposit does not. A house that takes money in within two seconds may pay out in three days — and that is not a contradiction.

Two: the two biggest causes of delay are within your control. Complete identity verification right after registering, not when you want your money. And do not submit a withdrawal request while bonus wagering is still outstanding.

Three: bank-link security is very good, but there is no way back. Strong authentication protects you from outsiders almost completely. It does not protect you from a bad counterparty — only checking the licence before your first deposit does that.

The rest is infrastructure that will become uniformly fast over the coming years. Once instant payments are mandatory, the only gap left between casinos is the one they create with their own processes — and that is easier to measure than ever before.