Restricted Traffic Sources: What Closes an Account, and What Does Not

Traffic sources sort into three tiers: generally accepted, needs written permission per brand, and never. Almost every account loss happens in the middle tier, where somebody read silence as a yes. Brand bidding and incentivized traffic are the two that catch people who genuinely believed they were clean.

Almost nobody who loses a deal set out to cheat. They are usually working hard, convinced they did nothing wrong, and right in a narrow sense that helps them not at all. They ran a source the brand does not accept, it found out, and the conversions came off the statement.

The rules that catch people are rarely the ones they braced for. Nobody is surprised that bot traffic ends an account. Plenty are surprised that buying search ads on the brand's own name does.

Three tiers, and the middle one is where the damage happens

Every operator publishes an allowed-sources list somewhere in its terms. Read enough of them and the same three-tier shape shows up, whatever vocabulary the brand dresses it in.

Tier one, generally accepted. Open by default at almost every brand:

• Organic search and your own content, on a domain you own. Nobody argues about it, which is part of why it is worth the eighteen months it takes to build.
• Paid social, where the brand permits paid media at all, and plenty do not. Where it is open, the brand's creative rules and the platform's gambling policy apply at once: Meta certification for a market does not mean the operator will accept your ad copy.
• Streaming, short video and community channels where the platform permits gambling promotion. Twitch, YouTube and Telegram each hold their own position, and each has moved it.
• Display on sites you own.

Tier one still has rules. It just means the source is not in question, so any argument will be about the creative.

Tier two, permission per brand. The grey stripe down the middle of every terms page. Brand bidding, email, push, bought display and pop inventory, incentivized placements, and anything where you pay a third party per user. These end accounts routinely, nearly always because the affiliate read the absence of a "no" as a "yes".

Tier three, effectively never. Bots and scripts. Self-clicks and self-registrations. Forced or hidden clicks, including clicks fired under a video player. Toolbars that inject a click nobody made. Impersonating the operator's support, trademark abuse in ad copy, adult inventory, anything sitting next to malware.

Tier three is short and obvious. Nearly all the real trouble comes out of tier two.

Brand bidding: why it gets refused, not just banned

Say the brand is Casino X. It already buys the search term "casino x" every day, because if it stops, somebody else sits above its own organic result. A player typing that name into Google has already decided. Now you bid on it too, win the auction, and the player deposits through your link.

Look at what that bought. The player was arriving anyway. The operator's own paid search now costs more, because you are in the auction pushing the price up. And it has paid an acquisition fee for a player it already had. Same person, twice the cost, no new revenue. The objection is arithmetic, not morality.

Which is why brand bidding is the most common way to lose a good deal while feeling entirely innocent. Cheap clicks, a cost per FTD of maybe $12 against the $60 your other campaigns run at, because you are buying people who were already sold. Every metric you judge a campaign by says this is your best one. To the operator it reads as an invoice for nothing.

Some brands do allow it under conditions: a negative keyword list, no brand name in the headline or display URL, or an exclusive arrangement with one partner paid to defend the term. Specific, written down, per brand.

What is never enough: the terms do not mention brand bidding, so you assumed it was fine. Absence of a prohibition is not permission. Silence defaults to no, because the operator wrote down what it wanted to buy. Reading an offer properly is mostly the skill of noticing what a document does not say.

Incentivized traffic, and the NGR that arrives three months late

"Sign up through my link and get 5 EUR" produces beautiful numbers for about a fortnight.

Registrations climb. FTDs land. Your cost per acquisition looks like something to scale on Monday. Then open the same cohort in month three: redeposits near zero, NGR near zero, accounts nobody opened again once the reward cleared.

The mechanism is working as designed. You paid people to perform the action that triggers your commission, so you selected for people motivated by your payment rather than the product.

Which consequence bites depends on your model. Under CPA the operator absorbs it, which is why CPA deals carry the tightest incentivized-traffic clauses, the longest holds before money clears, and survival rules that need the player still active at day 30. Under RevShare you absorb it, because bonus money comes off inside NGR, and a batch of reward-seekers can hold your revenue share near zero for a month while the FTD count looks healthy.

Either way the evidence arrives late. The FTD looked fine in week one. The NGR curve tells the truth in month three, by which point you have scaled the source and spent the budget. Operators watch that curve, and for longer than you do.

Some brands do run approved incentivized campaigns, at a reduced CPA that prices the retention profile in from the start. A €90 rate agreed up front beats a €250 rate reversed in March.

Where each source sits

What actually happens when you run something restricted

There is a ladder here, and two things decide the rung: whether you did it deliberately, and how much of it there was.

The mildest is a conversation. A manager asks what a source is, you explain, you stop. That happens more often than the forums suggest.

One rung up, the specific conversions are reversed, with a line item naming the conversion and the reason. Money still pending never clears, and depending on the program money that already cleared can be clawed back too. Read the pending, available and held states before you need them, because a reversal behaves differently depending on where the money was sitting.

Put a number on it. Twenty qualifying deposits reversed at a $180 CPA is $3,600 off the statement, plus the roughly $240 of clicks that bought them at that suspiciously good $12 per FTD. That is four days of brand bidding; four months across six brands is the same arithmetic with a different exponent.

Above that, earnings are held while a review runs. A hold is not a refusal, it means nobody has decided yet, and a review still open on the 15th pushes your clearing date past it.

Above that, the deal is removed. You keep the account and every other brand on it, and that one is gone, usually permanently, because nobody in that team has a reason to revisit it. Do not assume the damage stops there: plenty of casino brands sit inside a group with one shared affiliate department, and a removal at one can cost you its siblings.

At the top, the account is closed. That is where confirmed fraud lands: bot traffic, self-dealing, injected clicks, tier three run knowingly and at scale. Traffic quality is checked continuously, and confirmed fraud means reversal and closure. Nobody reaches this rung for one mistake they stopped when asked.

How to get permission properly

The procedure is dull and takes about ten minutes.

1. Ask before you run it, never after the first conversion lands. "Can I do X" costs nothing. "I have been doing X" costs the campaign.
2. "Email marketing" is not a description. "My own opt-in list, 12,000 subscribers in PL, collected on my own site, sending twice a month" is. Vague requests get vague answers.
3. Get it in writing. In the deal, in a support ticket, in an email. Not on a call, and not in a chat from a manager who leaves in April.
4. That reply is your entire defence when the question comes back, so it belongs somewhere you will still find it in a year, with the date and brand in the filename.
5. Anything changes, ask again. Permission for four whitelisted placements is not permission for a fifth, and permission in IT is not permission in ES.

Then check the plumbing, because a permitted source on a broken link earns nothing and proves nothing. Test the tracking link end to end before you spend a cent, a habit that belongs in your first week.

The rules that are not the brand's

One overlay, because it catches people who assumed asking the operator covered them. A licence can restrict how gambling may be advertised, on which channels, at what hours and to whom, and those conditions reach the operator's marketing partners too. Italy (IT) sits at the strict end, with a general advertising and sponsorship ban in force since 2018. Spain (ES) restricts how welcome bonuses may be put in front of a freshly registered account. Several markets, Germany (DE) among them, require set responsible-gambling wording on promotional material.

So a brand can honestly say yes to a source and still be unable to say yes in one country. A channel open in one GEO may be shut in the next, with no change to the deal.

None of this is legal advice. Before running a channel in a market, read the regulator's own page and the brand's terms for that GEO, then treat the stricter as the rule.

Where AFFILIFY sits in this

Ours has the same three-tier shape, with the caveats published next to it.

Each brand on AFFILIFY sets its own accepted-source list, and it sits in that brand's deal alongside the model, the GEO grid, the baseline and the hold, before you send a single click. A source list you can only discover by breaking it is not a source list.

Two limits, stated plainly. The first: permission belongs to the brand. We can put your question in front of the right person and write the answer into the deal. We cannot approve brand bidding on somebody else's trademark, and an advertiser's no on your email list is the end of it there.

The second: a yes does not travel. Approval is per brand, so email cleared with one advertiser is not email cleared with the other four on your account, even where the tier rate and GEO grid look identical. Your level is platform-wide. Your source permissions are not, and the people caught by this roll a working channel across the whole account in an afternoon.

Traffic quality is checked continuously on our side, and we do not publish the checklist. What that means for your wallet is the pipeline you already know: held deposits clear when the review closes, not when the calendar says.

The short version

Affiliates who never have this conversation share one habit. They ask first.

Everything in the middle tier has an approved version, available to anybody who sends an email before the traffic runs, and the difference between a good year and a closed account is usually a question that took four minutes to type.