How a 6-brand fantasy sports operator handled state-by-state compliance on one parent ledger

The operator runs 6 fantasy sports brands — daily fantasy football, daily fantasy basketball, daily fantasy golf, a peer-to-peer skill-bracket product, a fantasy racing brand, and a recently-launched fantasy esports brand. Each brand has its own state-legality matrix because fantasy sports regulation is state-by-state and varies by contest type (daily fantasy is legal in more states than season-long is legal in more states than peer-to-peer skill is legal).

Combined GGR (gross gaming revenue, the skill-gaming equivalent of GMV) runs about $8.2M/yr across the 6 brands, with daily fantasy football being the biggest contributor (~45% of revenue). Each brand operated on its own payment stack — its own merchant account on one of two gaming-approved acquirers, its own deposit flow, its own withdrawal processing, its own state-rules enforcement.

The structural problem: no single state has identical legality rules for all 6 brand types. Daily fantasy basketball might be legal in Texas, but peer-to-peer skill brackets aren't, and fantasy esports is in a gray zone. Each brand's checkout had to independently enforce its own state-rules. When the enforcement failed — which happened about 4 times a month, usually when a user traveled across state lines and tried to deposit from a newly-illegal state — the cleanup involved refunds, ban-the-account-from-that-state flags, and occasional legal notices from state regulators.

Withdrawals were the other mess. Users winning money on any of the 6 brands had to wait 3–5 business days for withdrawal ACH to clear. Because each brand used a separate acquirer merchant account, withdrawal reconciliation against the operator's business bank was a manual weekly process, about 14 hours of ops time per week.

In mid-2024 the Texas Attorney General's office opened an inquiry into the operator's peer-to-peer skill-bracket brand. Texas legality on peer-to-peer skill gaming is ambiguous and has been the subject of active regulatory attention. The inquiry focused on whether the brand had adequate controls preventing deposits from Texas users.

The operator's compliance counsel pulled the data. In the prior 18 months the peer-to-peer brand had accepted 47 deposits from Texas zip codes — each of which had been manually caught and refunded within 48 hours by the ops team, but the fact of the deposits having cleared in the first place was the regulatory issue. The enforcement was happening after the charge cleared, not before.

The AG inquiry resolved with a consent agreement requiring the operator to demonstrate automated pre-charge state-enforcement within 90 days. The Texas brand had to go offline pending the fix. The legal team told the operator: "This will come up in every state now that Texas did it. Build the fix platform-wide, not brand-by-brand."

The operator's fractional CFO had heard about multiflow from a crypto-gaming peer. Call booked the next day.

The acquirer conversation wasn't the challenge here. Both of the operator's existing gaming-approved acquirers were multiflow-compatible. The challenge was the state-rules engine — building one matrix that correctly handled 6 brands × 50 states × edge cases (military addresses, student-at-college addresses, traveling users with conflicting billing and IP locations).

Day 1–3: Compliance matrix build. multiflow's implementation engineer worked with the operator's compliance counsel to encode each brand's state-legality into a unified matrix. 6 brands × 50 states + DC + Puerto Rico = 312 cells, each either "legal", "illegal", or "ambiguous, manual review." Every cell got counsel sign-off.

Day 4: Geolocation enforcement. The rules engine needed 3 inputs per deposit: billing address state, IP-resolved state, and (for mobile) device GPS state if available. Conflicts between inputs (e.g., billing in Texas, IP in Colorado) triggered pre-charge review. multiflow's IP geolocation provider integrated with the operator's existing SaaS.

Day 5–6: Withdrawal consolidation. Previously each brand ran withdrawal ACH through its own merchant account. New setup: all 6 brands' withdrawals ran through the multiflow parent on same-day ACH where available (roughly 70% of US banks now support same-day) and next-day on the rest. Reconciliation now automatic against one consolidated bank feed.

Day 7: Per-brand descriptor standardization. Each brand kept its customer-facing descriptor for deposit and withdrawal. Statement experience for users didn't visibly change.

Day 8: Test transactions. 50 live test deposits across the 6 brands from a mix of legal and illegal state IP addresses (using VPN infrastructure for controlled testing). State-rules engine blocked 100% of illegal-state deposits at the pre-charge review stage. 12 withdrawal tests. 5 simulated disputes.

Day 9: Cutover. Webhook URLs and checkout flows switched across all 6 brands to the multiflow parent. The peer-to-peer Texas brand came back online (with Texas now correctly blocked at pre-charge) 6 days ahead of the AG consent-agreement deadline.

Day 10: First full day under the new system. 1,847 deposits processed, 214 blocked at pre-charge review (matching the historical blocked-rate percentage), 312 withdrawals paid out on same-day ACH. The ops team's weekly reconciliation work on the first post-cutover Friday took 2 hours instead of 14.

The Texas AG matter resolved in the operator's favor at the 90-day compliance checkpoint. Texas counsel accepted the automated pre-charge state-enforcement as meeting the consent-agreement requirements. No further action. The peer-to-peer brand stayed live in the 34 states where it was legal.

Cross-state violations dropped from ~4/month to under 1/month. The remaining handful are almost always edge cases where a user's billing address, IP, and GPS all disagree — and those now flag at pre-charge for manual review instead of clearing and requiring refund.

Withdrawal turnaround moved from 3–5 business days to same-day ACH for ~70% of users and next-day for the rest. This was the most visible user-facing improvement. The brand's app-store reviews that had complained about withdrawal lag effectively disappeared post-cutover. Winning-user retention (users who withdrew successfully and came back to deposit again) improved roughly 15% over the 6-month window post-cutover.

Reconciliation labor dropped from 14 hours/week to 2 hours/week. The operator redirected the 12 recovered hours per week to product-side work on the fantasy esports brand, which was under-resourced.

Compliance audit prep time dropped from 30 hours per quarter to 6 hours. State AG and state gaming commission audits became a matter of one dashboard export instead of 6 brand-specific pulls.

The operator's framing is specific to fantasy-sports and skill-gaming operators, but it generalizes to any multi-brand operator whose brands have different state/region/jurisdiction legality profiles. The checkout layer has to know the matrix, enforce it pre-charge, and log its enforcement decisions for regulatory review. Most payment platforms can't do any of this. multiflow does all three natively.

He's also clear that this isn't something he could have built himself in under 12 months. The state-rules engine alone would have been a 6-month engineering project with ongoing maintenance as state laws change. Outsourcing that to multiflow's infrastructure — which keeps the state matrix updated as regulations change — was the easier call.

The quote at the top is the one the operator wanted in the hero.