Casino KYC Verification Explained

What casino identity checks involve, why they exist, how long they take and how to avoid a rejected upload.

By the Gambling Hero editorial team · Checked October 24, 2026

Short answer

Casinos verify identity to keep minors out and to meet anti-money laundering law. Expect to confirm name, address and date of birth, sometimes with ID, proof of address or bank statements. In Great Britain and Ontario this must happen before you can gamble, and UK operators may not demand avoidable new documents only when you withdraw.

KYC stands for “know your customer”. For an online casino it means confirming who you are, that you are old enough to gamble, and in some cases where your money comes from. The checks are a legal duty, not a casino preference, and they are one of the most common causes of delayed payouts. This guide explains why they exist, what is usually requested, how timing rules differ by country and what rights you have over the data.

Why casinos verify your identity

Anti-money laundering law

In the European Union, the Fourth Anti-Money Laundering Directive (Directive (EU) 2015/849) names “providers of gambling services” as obliged entities. Article 11(d) requires customer due diligence “upon the collection of winnings, the wagering of a stake, or both” when transactions amount to EUR 2,000 or more. Due diligence under Article 13 includes verifying identity from reliable, independent sources and “ongoing monitoring” of the relationship, including source of funds where necessary. National rules can go further than this baseline.

Sweden is an example: Spelinspektionen says licensed operators “are required to know their customers”, must tailor procedures to money laundering risk and must report suspicious transactions to the Swedish Financial Intelligence Unit. See our glossary entry on AML for the wider background.

Age and self-exclusion

Verification also keeps minors out and enforces self-exclusion. The UK Gambling Commission (UKGC) says online businesses check your age, your identity and “whether you have self-excluded”. Minimum ages differ: Sweden sets 18, while Ontario sets 19 for most products.

When verification has to happen

Timing is where the rules differ most between licences.

Regulator	Timing rule
UKGC (Great Britain)	Name, address and date of birth must be verified “before that customer is permitted to gamble”, including with a free bet or bonus. Customers must be told before depositing which documents may be needed. A withdrawal must not trigger a demand for information the operator “could have reasonably requested” earlier, unless another legal obligation applies (LCCP 17.1.1).
AGCO (Ontario)	Player information must be “complete, accurate and validated before a player account is created” (Standard 3.04), and players must be authenticated before they can gamble (3.12).
MGA (Malta)	Operators may take the time “reasonably necessary” to verify identity before remitting funds (Player Protection Directive, Art. 29(3)(a)). No fixed verification window is set.
EU AML baseline	Due diligence at the latest when transactions reach EUR 2,000, whether on stakes, winnings or both (Directive 2015/849, Art. 11(d)).

The practical result: on UK and Ontario sites you should expect checks at sign-up. On sites where verification happens later, it often surfaces at the first withdrawal, which is why we recommend completing it before you deposit significant amounts. Our guide to a pending withdrawal covers what to do if checks are holding up a payout.

Documents casinos typically request

Many checks are done electronically first. The UKGC explains that operators may match your details against databases such as credit reference agencies and the electoral roll. If that is not enough, documents follow.

Purpose	Typical documents
Identity and age	Passport, driving licence or national ID card
Address	Recent utility bill, bank statement or official letter
Payment method ownership	Card photo with middle digits hidden, e-wallet account screenshot
Source of funds	Payslips, bank statements, evidence such as a property sale
Fraud prevention	Selfie, sometimes holding your ID

The UKGC names passports, driving licences and household bills as examples but does not specify which types operators must request. It says operators may ask for a selfie if they suspect fraud such as identity theft, but should not ask for one at withdrawal if they could have asked sooner. For financial checks, it notes that operators may request bank statements to confirm source of funds and for anti-money laundering purposes.

Source of funds and affordability

Source of funds questions are about where your deposits come from; affordability checks are about whether the spending is sustainable. The UKGC expects source of funds information to be obtained “where necessary and proportionate” and says these checks should happen during the customer relationship rather than being triggered by a withdrawal.

How long verification takes

No regulator we reviewed sets a fixed number of hours or days for the player-facing check. The UKGC says electronic verification may be instant while document checks take longer, that customers cannot bet until verified and that operators should verify as quickly as possible.

Two further points matter if a casino sets its own deadline:

The UKGC states that operators cannot confiscate funds because a customer did not verify their identity within a certain timeframe.
When the UKGC and the Competition and Markets Authority reviewed online gambling terms, “potentially arbitrary short deadlines on the time customers have to verify their identity” were among the concerns raised.

A smooth verification, step by step

Register with your legal details. Use your full name as it appears on your ID, your current address and your correct date of birth. Electronic checks compare these against external records, so small differences can cause a manual review.
Read the verification section of the terms. UK operators must tell you before you deposit which identity documents may be needed. Elsewhere, look for the same information in the terms or help pages.
Prepare documents in advance. A valid photo ID, a recent proof of address and, if you use a card or e-wallet, proof that it belongs to you.
Upload through the official channel and note the date and time of each upload.
Wait for confirmation before larger deposits. A verified account is far less likely to see its first withdrawal held.
Answer follow-up questions promptly. If the casino asks about source of funds, ask what exactly it needs and by when.

Common rejection reasons and how to avoid them

Blurred, cropped or glared images. Photograph the whole document on a flat surface in even light, with all four corners visible.
Expired documents. Check the expiry date before uploading.
Proof of address too old or not in your name. Use a recent document addressed to you at the address on your account.
Details do not match the account. Name spelling, date of birth and address must match exactly. Ask support to correct typos in your profile first.
Payment method in someone else’s name. Deposit only with methods you own.
Edited files. Do not alter documents. If you want to hide unrelated details, such as other transactions on a bank statement, ask the casino first whether that is acceptable.
Wrong upload channel. Use the account’s verification page. Avoid sending documents by ordinary email if a secure upload exists.

Never use another person’s documents, and do not look for ways to avoid verification. That breaches the terms, can void winnings and defeats protections such as age checks and self-exclusion.

Your privacy and data protection rights

Verification involves sensitive personal data, so data protection law applies alongside gambling law. In the EU and UK this is the GDPR and the UK GDPR.

Right of access. You can ask the operator what data it holds about you and for a copy. Under GDPR Article 12, the response is due “within one month of receipt of the request” and is, as a rule, “free of charge”. The UK Information Commissioner’s Office calls this a subject access request.
Retention. Deletion requests have limits. The EU AML Directive (Art. 40) requires due diligence records to be kept “for a period of five years after the end of the business relationship”.
Purpose. Ask what each requested document is for. The UKGC suggests contacting the company directly if you are unhappy with a request.
Licence matters. A licensed operator answers to both a gambling regulator and a data protection authority. With unlicensed sites, you have little visibility over where your documents end up.

Our rating method includes how clearly an operator explains its verification process.

When verification becomes a dispute

If a casino keeps rejecting valid documents, asks for the same items repeatedly or uses verification to stall a payout, put the issue in writing and use the formal complaints process. In Great Britain, the UKGC treats delays caused by insufficient ID checks as a potential breach of licence condition 17. Our guide on what to do if a casino won’t pay out explains complaints and ADR.

Verification is also linked to player protection. If you have self-excluded, checks are designed to stop you opening new accounts. If you want to take a break, see our responsible gambling page.

FAQ

Can I play at a casino without KYC?

Not on a UK or Ontario licensed site, where verification is required before you gamble. Sites that skip checks entirely may not be licensed, which also removes complaint and ADR routes. We do not recommend trying to avoid verification.

Why is the casino asking for bank statements?

Usually for source of funds or affordability checks under anti-money laundering and player protection rules. Ask what period and which account are needed, and whether unrelated details may be hidden.

Can a UK casino ask for ID only when I withdraw?

Not for information it could reasonably have requested earlier. LCCP condition 17.1.1 forbids making extra information a condition of withdrawal in that case, unless another legal obligation requires it at that point.

How long does casino verification take?

Electronic checks can be instant; document reviews take longer. Regulators we reviewed do not set a fixed player-facing deadline, but the UKGC expects verification as quickly as possible.

Can I ask the casino to delete my documents?

You can ask, but AML law requires due diligence records to be kept for five years after the relationship ends in the EU. You can still request a copy of your data under the GDPR right of access.

Sources

Last updated October 24, 2026 by the Gambling Hero editorial team.