KYC and Verification: What Online Gamblers Should Expect

This guide is for information only. It is not legal advice. Rules change by country and over time. Please gamble responsibly.

A quick story to set the scene

Sam hit his biggest win on a Friday night. He clicked “Withdraw.” Then a banner showed: “We need to verify you.” He felt lost. What did they need? How long would it take? Would the win be paid? He opened support chat. They asked for an ID, a proof of address, and a selfie. On Monday he got an email: “Please also send proof of how you got the funds you used to play.” He had never heard of SoF (Source of Funds). He learned fast: better photos, clear docs, and a calm plan can speed things up. Let’s make that plan now.

TL;DR — what to expect

You will have to prove who you are. ID, address, sometimes a selfie, and how you pay.
Checks can be fast or slow. Many pass in minutes. Manual reviews can take 24–72 hours.
Triggers are clear. First cashout, large wins, new payment method, or risk flags.
Good prep helps. Clean photos, docs in date, same name as on the account, same owner as the card.
If you refuse, you likely won’t be paid. Accounts can be locked and may be closed.

Why casinos ask for KYC — five myths, fixed

Myth 1: “KYC is there to stall your withdrawal.”
Truth: KYC is a legal duty to fight fraud and money laundering. If an operator fails, it can lose its license.
What it means for you: With full, clear docs, good sites pay fast.

Myth 2: “All players face the same checks.”
Truth: Casinos use a risk‑based approach. Low risk = lighter checks; higher risk = deeper checks.
What it means for you: Your history, payments, and win size can change the depth of review.

Myth 3: “Age checks are only at withdrawal.”
Truth: Some places (like the UK) require age/ID checks before you deposit. See the UK rules on age and identity.
What it means for you: Expect earlier checks in stricter regions.

Myth 4: “Selfies and live checks are pointless.”
Truth: Face match and liveness stop ID theft and bot abuse.
What it means for you: A 30‑second live check can unlock instant payouts later.

Myth 5: “A bill from last year is fine.”
Truth: Address proof must be recent (often within 3 months).
What it means for you: Keep a fresh bill or bank statement ready.

What documents you will actually need

You will almost always need:

Photo ID: a passport, national ID, or driver’s license.
Proof of address: a utility bill or bank statement with your name and address, not older than 3 months.
Payment proof: a photo of your card (mask middle digits), or a screenshot of your e‑wallet or bank showing your name.
Selfie or live face check: to match you to your ID.

Good sites follow clear identity proof rules. For a deep dive into how identity proofing works, see NIST SP 800‑63A (it is technical, but it shows why photos must be clear and edges must show).

What gets rejected often:

Blurry photos, glare, cut edges, or covered data.
Bills without your name or address.
Screenshots that hide the URL or account name.
Docs in a different name than your account.

A fast global snapshot

Rules vary by region. The table below shows common asks, timing, and re‑check triggers. This is a short view, not a full law book.

UK (UK Gambling Commission)	Full ID and age before or at deposit; address; payment checks	Often instant to 24h; no withdrawals until KYC is complete	New payment method; cumulative spend/wins; AML reviews	UKGC age/ID changes
EU / Malta (MGA)	ID, address; risk‑based SoF for higher tiers	Minutes to 48h	Large wins; thresholds; risk score	MGA AML/CFT guidance
Ontario (AGCO/iGO)	ID, age, address; payment verification	24–72h if manual	Risk‑based reviews, ongoing	AGCO Registrar’s Standards
New Jersey (NJ DGE)	ID and age; sometimes last 4 of SSN; geolocation	Often instant; manual 24–48h	Regulatory checks; thresholds	NJ DGE regulations
Australia (AUSTRAC)	Photo ID; address; strong AML focus	Same day to 72h	Ongoing customer due diligence	AUSTRAC KYC guide
Curaçao (GCB)	ID, address; AML/CFT rules now stricter	Varies; often 24–72h	Risk‑based triggers; large wins	GCB AML/CFT

Behind the glass: how verification really works

When you upload your ID, a tool reads the data (OCR). It checks fonts and security signs. It looks for edits. Then it runs a face match with your selfie. A live test (turn your head, blink) proves you are a real person now, not a photo of someone else. In the background, your name may be checked against PEP (politically exposed person) and sanctions lists. If the match score is low (bad light, glare, mask, cap), the tool asks for a new photo. If something does not add up (name on bank ≠ name on account), a human takes over.

When KYC happens (and why it repeats)

At sign‑up or first deposit: UK and some others.
Before the first withdrawal: very common worldwide.
At set spend or win levels: once you pass a limit, deeper checks start.
On new payment methods: each new card or wallet may need proof of ownership.
Periodic reviews: some sites re‑verify every 1–3 years, or sooner if risk rises.

How long it takes — and how to make it painless

Speed depends on your region, your docs, and the queue. Auto checks can pass in minutes. If a person must review, expect 24–72 hours on business days. Holidays can add time. Here is how to cut delay:

Use bright, even light. No glare. Place the ID on a dark, flat surface.
Show all edges. Do not crop. Do not cover any data.
Turn off “live photo” if it makes blur. Use normal photo mode.
Proof of address must show your full name and address and be less than 3 months old.
Make sure your name on the account matches your ID and bank.
For cards, cover the middle digits. Show only first 6 and last 4 on the front, and cover CVV on the back.
Payment must be yours. Do not use a friend’s card or wallet.
Upload PDFs or images at high quality. If you send a bank screenshot, include the URL bar and your name.

If you want less stress, pick sites with clear KYC rules and a track record of fast pays. In reviews, look for real timing notes like “ID in 30 min, SoF in 1 day,” not vague claims.

Source of Funds (SoF) vs. Source of Wealth (SoW)

Source of Funds (SoF) means: where did the money used for play come from. Think recent salary, a recent bank transfer, a card top‑up, or a sale. Proof may be 3–6 recent payslips, bank statements for 3 months, or a bill of sale.

Source of Wealth (SoW) means: how did you build your money over time. Think long‑term savings, business income, or past asset sales. Proof may be tax returns, audited accounts, or notarized sale docs. Not all players will be asked for SoW. If you bet or win large, or if you are a higher risk, expect deeper asks. The idea of SoF/SoW comes from AML rules. For the logic behind it, see the FATF guidance noted above.

Your privacy and data: what stays, what you can ask to delete

Casinos must keep some data for a set time due to AML rules. In the EU and UK, data use must follow the “storage limitation” rule in the GDPR (see Article 5(1)(e)). In short: keep only what is needed, and not forever.

You have rights to see your data, ask to fix errors, and in some cases ask to delete it. In the UK, this is called a Subject Access Request. The ICO explains your right of access. Note: a casino may refuse a delete request if law says it must keep the data for AML, fraud, or tax.

What happens if you refuse KYC

If you refuse, expect account limits or a lock. You may not be able to deposit or withdraw. Some sites may return only your deposits, not wins, if rules allow it. Many will close your account. If you think a request is wrong, ask support to explain what law or rule requires it. Stay calm and keep records.

Stuck? Escalation paths that actually work

First, write to support and ask for a clear list of needed docs. Ask for a time frame. If nothing moves, ask for a manager. Save all chat logs and emails. If you are in the UK and a dispute stays unresolved, you can use ADR (Alternative Dispute Resolution) such as IBAS. In other regions, check who your regulator is and how to file a complaint. Share only what is needed. Be factual. List dates, sums, and what you sent.

Pick a casino that won’t make KYC a nightmare

If you want less guesswork, choose brands with clear terms, fair KYC steps, and public proof they pay on time. Read real player feedback about KYC times and support. It also helps to see current casino offers from sites that track service quality, not just promos. Look for reviews that note exact docs asked, re‑check cycles, and real SLA (service level) on withdrawals. One good sign is a visible KYC policy page and a help center with photo tips and timelines.

FAQ

Can I withdraw before KYC?
In most places, no. Many sites block cashout until KYC is done.

Why was my utility bill rejected?
It may be too old, blurry, or missing your full name and address. Send a clearer, newer bill or a bank statement.

Do VPNs affect KYC?
Yes. A VPN can trigger risk checks. Use your real location. Geo rules apply in many regions.

How often will I be re‑verified?
It varies. Some do it every 1–3 years or when risk changes, or when you add a new payment method.

What is PEP and sanctions screening?
Your name is checked against public lists of high‑risk roles (PEP) and sanctions. A match triggers extra checks.

My face check fails. What can I do?
Stand near a window or use soft light. Remove hats and glasses. Hold the phone steady. Try again.

Glossary

KYC: Know Your Customer — ID and address checks.
AML/CTF: Anti‑Money Laundering / Counter‑Terrorist Financing.
PEP: Politically Exposed Person.
Sanctions screening: checks against banned lists.
SoF: Source of Funds — where the money for play came from.
SoW: Source of Wealth — how you built your money over time.
ADR: Alternative Dispute Resolution, like IBAS in the UK.

Sources and update note

FATF — Risk‑Based Approach for Casinos: guidance
UKGC — Age and Identity: rules
MGA — AML/CFT for Remote Gaming: guidance
AGCO — Registrar’s Standards: standards
NJ DGE — Internet Gaming Regulations: PDF
AUSTRAC — Customer Identification: guide
Curaçao GCB — AML/CFT: overview
GDPR — Text (Art. 5(1)(e)): EUR‑Lex
ICO (UK) — Right of Access: guide
FinCEN — CDD Final Rule (US): overview
Support — Responsible play: BeGambleAware

Updated: 28 June 2026

Author

About the author: Alex Reed is a compliance writer with 6+ years in iGaming and fintech. He has worked with operators on KYC/AML flows and payout QA. Alex tests sign‑up and withdrawal paths and explains the rules in plain words.

Disclaimer

This article is for information only and does not give legal advice. KYC/AML duties vary by country and can change. If you need legal advice, talk to a qualified lawyer in your area.