Gift Card Arbitrage — Legal vs Grey vs ToS Violation in 2026
If you run a digital-codes business — whether a Telegram top-up bot, a Shopify gift-card store, or a fintech with a recharge feature — compliance is the difference between a scalable business and one that gets shut down at $200k/mo when a payment processor decides you're too risky. This guide is a practical 2026 map: what's legal, what's grey, and how to structure your reseller business so banks, processors and platforms treat you as legitimate.
The three categories of regional arbitrage
The first thing to get clear: not all "arbitrage" is the same regulatory thing. There are three distinct tiers.
| Category | Example | Legality | Operator risk |
|---|---|---|---|
| Legal | US merchant sells US-region gift cards to international buyer with valid email | Legal in nearly all jurisdictions | Low — clean compliance |
| ToS-grey | Reselling TR-region PSN codes to RU customers, codes purchased from authorized TR distributors | Legal as commerce; ToS violation by end user | Medium — platform may invalidate codes if upstream is fraud-tainted |
| ToS-violation | Operating fake-region accounts on behalf of customers, or sourcing codes from card-cashout operations | Legal exposure varies; civil and sometimes criminal | High — chargebacks, account terminations, processor bans |
Most legitimate reseller businesses operate in tier 1 and tier 2 simultaneously. The line you don't want to cross is tier 3 — running region-faking infrastructure or knowingly buying from fraud sources.
VAT and sales tax — the operational reality
For B2C digital goods, you collect tax at the customer's location, not yours. Practical thresholds in major markets:
- EU: OSS scheme, charge VAT at buyer's country rate above €10k cross-border. Below threshold, your home-country rate.
- UK: Register at £85k annual turnover; 20% VAT on most digital goods.
- US: Marketplace facilitator laws in 45+ states. Economic nexus typically $100k or 200 transactions per state.
- Russia: 20% VAT via OECD digital-services regime, applies to foreign sellers above ₽2M annual to Russian consumers.
B2B sales (your wholesale buyers) usually qualify for reverse-charge in EU/UK, but you must collect and validate the buyer's VAT ID and store it in your records for 7-10 years.
Marketplace facilitator nuances
If you run a multi-vendor marketplace (other sellers list on your platform), you are typically considered the "marketplace facilitator" in US states with these laws — meaning you collect and remit sales tax on transactions, not the underlying seller. This is significant because it changes your tax exposure: a $5M-GMV marketplace with 100 sellers has the same compliance burden as a $5M direct seller.
How to structure the business for legitimacy
Three practical moves separate a clean reseller from one that gets de-platformed:
- Position the product correctly. Sell "digital codes" or "regional licenses" with explicit disclosure of the region. Do not market as "works globally" or "any region". The wording on your store page matters when processors review your account.
- Document sourcing. Every SKU should be traceable to a B2B invoice from an authorized distributor. FoxReload provides this — every order has a documented upstream chain you can show to a bank or processor.
- Maintain refund-rate hygiene. Keep refund rate below 2%. Above that, processors flag you. Above 3-4%, you'll get a termination letter. Sourcing from authorized supply is the single biggest lever.
The defensible position is "B2B digital code marketplace operating under documented commercial terms" — not "gift card laundromat". The product is the same; the framing, paperwork and sourcing chain determine which one you actually are.
If you're building a compliant reseller business, FoxReload's documented B2B supply, invoiced procurement and validated VAT-ID flow make you defensible by default. Start at foxreload.com.