Identity verification and account checks

Why account checks exist at all

Identity checking, usually shortened to KYC, is not a customer service decision. It is a legal obligation with two separate roots, and confusing them is why the process feels arbitrary.

The first root is gambling regulation: preventing children from gambling and knowing who holds an account. The second is anti-money laundering law, which applies to gambling businesses in the same way it applies to banks.

In Great Britain the gambling side is explicit. Licence condition 17.1.1 requires licensees to obtain and verify information in order to establish the identity of a customer before that customer is permitted to gamble, and that information must include, but is not restricted to, the customer's name, address and date of birth¹. The rule took its current shape on 7 May 2019, when the Commission required that where an operator has not yet verified those details, verification must be completed before the customer is allowed to gamble².

Age verification sits alongside it. Remote operators must have and put into effect policies and procedures designed to prevent underage gambling, and must verify a customer's age before that customer can deposit funds, access free-to-play games, or gamble with either their own money or a bonus³.

The anti-money laundering layer

The second layer explains the checks that arrive later, often at the point of a large deposit or a withdrawal.

Under European anti-money laundering law, providers of gambling services must apply customer due diligence on transactions amounting to EUR 2 000 or more, and the same threshold applies to the collection of winnings, the wagering of a stake, or both⁶. Customer due diligence means identifying the customer and verifying identity on the basis of documents, data or information obtained from a reliable and independent source⁶.

The Gambling Commission's guidance for casino operators sets out the same measures: identifying the customer unless their identity is already known and verified, verifying identity on the basis of documents or information obtained from a source that is reliable and independent of the person being identified, and keeping due diligence up to date as circumstances change⁴.

For remote casinos the threshold is applied to money movement. Identification and verification are required when a customer deposits funds to take part in remote gambling, or withdraws such funds or winnings, amounting to EUR 2 000 or more⁵. The threshold applies to single transactions or transactions that appear to be linked, and operators are expected to have systems that track and monitor customers across all the products and platforms they offer⁵.

That last point explains a common surprise: five deposits of a few hundred pounds can trigger the same check as one large one, because linked transactions are assessed together⁵.

What is typically requested, and why

Regulators describe the standard, not a shopping list. What they require is that identity is established from a reliable, independent source⁴⁶. In practice that is satisfied in one of two ways.

Electronic verification. Name, address and date of birth are matched against independent databases. Nothing is asked of the customer, and the account simply opens. This is the normal path, and the reason many people never see a document request at all.

Document verification. Where an electronic match fails or partially fails, the operator asks the customer to supply evidence. The categories are predictable because they map on to the three facts being established: who you are, where you live, and that the payment method is yours.

Where the anti-money laundering layer is engaged rather than the identity layer, the questions change character. Enhanced due diligence concerns the source of the money rather than the identity of the person, and it is applied on a risk basis rather than to everyone⁴.

That condition¹ is the single most useful sentence in the rulebook for anyone whose withdrawal has stalled behind a sudden document request. It does not prohibit checks at withdrawal; it prohibits saving up checks that should have happened at registration.

What a reader should expect

• Checks before play, not after. In Great Britain, identity must be verified before gambling is permitted, and age before any deposit or free-to-play access¹³.
• A second round at a threshold. Deposits or withdrawals reaching EUR 2 000, individually or as linked transactions, trigger due diligence for remote casinos⁵.
• Questions about funds, not just identity, in higher-risk cases. Enhanced measures follow the operator's risk assessment⁴.
• An account that cannot be used until checks complete. Verification is a precondition of gambling, not a formality that runs alongside it¹.
• Ongoing review. Due diligence is not a one-off: it is kept current as a customer's circumstances change⁴.

Operators also apply these requirements to the payment side, which is why a mismatch between the account name and the payment method causes delays. processing times sets out where each step in that chain sits and who controls it.

Data, and the limits of this page

Identity documents are personal data. How any particular business stores them is governed by its own privacy notice and by data protection law, not by gambling regulation, and it is worth reading that notice before uploading anything. privacy policy explains how this publication handles data; it says nothing about how an operator handles yours.

Two further cautions are worth stating plainly.

First, the specific documents requested vary between operators and jurisdictions. Regulators set the standard of proof, not a fixed list, so any page claiming to know exactly which documents a given site will ask for is guessing.

Second, an account verification process is not a safety rating. A site that verifies identity rigorously can still hold an unsuitable licence or none at all; our guide to checking a gambling licence covers the separate checks that matter there, and our licensing guide explains what a licence does and does not tell you.