KYC and verification: what is legitimate and what is not

British accounts: age and identity checks are required before gambling; later checks must not be used to demand information that could reasonably have been requested earlier. UKGC guidance.

Verification is not the enemy

Know Your Customer — KYC — is the process by which a regulated business establishes who you are, where you live, and where your money came from. Every licensed gambling operator is required to do it. It is not a courtesy, not a preference, and not something an operator can waive because you asked nicely.

It exists for reasons that are, on inspection, mostly good ones:

• Anti-money-laundering law. Gambling accounts are attractive vehicles for laundering. Regulators require operators to know who holds an account and to be able to explain unusual money movements.
• Age verification. Nobody under the legal age in your jurisdiction should hold an account. Checking this is the only way to enforce it.
• Fraud and account takeover. Verification stops someone else withdrawing from your account with stolen card details.
• Self-exclusion integrity. A self-exclusion scheme is only as good as the identity behind it. Unverified accounts are how exclusions get circumvented, sometimes by the very person who set them. See self-exclusion and getting help.

So the goal of this guide is not to teach you to resist verification. It is to teach you to tell the difference between verification and something that is wearing verification's clothes.

What is legitimate to ask for

A standard, well-run verification asks for three categories of document, and it is usually finished within a couple of days.

Identity. A government-issued photo ID: passport, national ID card, driving licence. Sometimes a selfie holding it, or a short liveness video.

Address. A utility bill, bank statement or council/tax document, typically dated within the last three months, showing your name and the address on the account.

Payment method ownership. Proof that the instrument is yours: a card image with the middle digits obscured, a bank statement header, a wallet screenshot. This one is genuinely for your protection — it is what stops a stranger cashing out to their own account after taking over yours.

Source of funds, sometimes. On large withdrawals or unusual patterns, an operator may ask how you came by the money you deposited: payslips, a bank statement, a document showing a sale or an inheritance. This feels intrusive because it is. It is also, above certain thresholds, a legal obligation on the operator rather than a choice.

All of that is normal. None of it is a red flag on its own.

What is not legitimate

Here is the line, and it is a bright one. A legitimate verification has a defined list and a defined end. An abusive one has neither, and the absence is the entire mechanism.

Repeated requests for documents already supplied. You sent the passport. Three weeks later, they want the passport. Then they want it "in a clearer photo". Then the address document has "expired during the review" and must be re-sent, restarting the clock. Each individual request looks reasonable in isolation. That is the design. The sequence is the abuse, and the sequence is what you must document.

Verification demanded only after a win. You deposited for six months. You played for six months. Nobody asked for anything. You won, and suddenly your identity is an urgent matter. Verification that was not necessary to take your money but is necessary to release it is not a compliance process. Well-run operators verify at registration or at first deposit, and it costs them nothing to do so.

Documents no legitimate operator needs. Full unredacted card images including the CVV. Your account password. Remote access to your device. A selfie holding a handwritten note containing your card number in full. Refuse these, and treat the request as a serious finding about the operator.

A hold with no stated end. "Your account is under review." How long? "We cannot say." Under what clause? "Our terms." What will end it? Silence. A process with no defined completion cannot be complied with, and therefore cannot be appealed — which is the point of building it that way.

Unexplained requests. The withdrawal amount alone does not determine whether a source-of-funds review is justified. Risk can depend on account activity and other information. Ask what is outstanding and retain the chronology; do not infer the reason from a single amount.

Open-ended KYC as an unfair term

Look at the actual clause. It usually reads something like:

Three open-ended discretions in one sentence. Nothing you can do satisfies it, because it does not specify what satisfaction looks like. That is why open-ended KYC is one of the five clauses in our register, why it carries a substantial penalty against an operator's TrustAudit Index, and why an operator we have recorded enforcing it takes a much heavier penalty than one that merely has it on the books.

It is also one of the clauses that can, on its own, meet our published blacklisting criteria where we record an operator enforcing it.

A fair version of the same clause exists, and some operators write it: a defined list of documents, a stated target turnaround, a named contact, and a right of escalation. It is not difficult. The operators that have not written it that way have chosen not to.

Protect yourself: verify before you have anything to protect

The single most effective thing in this guide, and it takes twenty minutes.

Complete verification when you open the account. Not when you win. Before you deposit, or immediately after. Upload the ID, upload the address document, upload the payment proof, and get written confirmation that the account is fully verified.

The reason this works is structural. Verification while you have no balance is a routine administrative task with nothing riding on it, and it is processed as one. Verification while the operator is holding a five-figure withdrawal is a process with a strong incentive attached to its own slowness. Same documents, entirely different queue.

Then:

• Keep the confirmation. Screenshot the "account verified" status, with the date visible. If they later claim you were never verified, you have the answer.
• Log every document you send: what, when, to which address, in what format. A chronology of six sends and four re-requests is the single most damning exhibit a case can carry.
• Never deposit with an instrument you cannot withdraw to. Depositing with one method and withdrawing to another triggers review at every serious operator, and refusal at most. Use one instrument, in your own name, throughout.
• Redact sensibly. Cover the middle digits of a card and the CVV. Leave your name, the last four digits, and the expiry visible. Redact transaction lines from a bank statement that have nothing to do with the account; leave the header and the relevant lines.
• Send documents through the operator's own upload tool, not email, wherever the option exists.

Your data, once you have sent it

You have just handed a company your passport and a proof of address. That is worth thinking about for a moment.

A licensed operator is a regulated data controller. It must hold those documents securely, use them only for the stated purpose, retain them only as long as it is required to, and — in most jurisdictions — give you a right to obtain a copy of your data and to have the account deleted.

On our own side: complaint attachments are private by default. Evidence uploaded to a case is not public. Signed, expiring URLs; encryption at rest; nothing about your gambling activity is exposed or logged for anyone's convenience. A player's dispute should not cost them their privacy as the price of being heard. Our full position is on the transparency page.

If verification has become the problem

1. 01Send one message that closes every gap at once. List every document already supplied, with the date sent. Attach them again, in one batch. Ask, in writing, for two specific things: the complete list of anything still outstanding, and the date the review will conclude.
2. 02Record an unclear response. A missing or changing document list is a communication problem to document. It does not, by itself, prove that no review is taking place.
3. 03Escalate to the operator's formal complaints function, and put the same two questions in writing.
4. 04Then the regulator's ADR route, where the licence provides one.
5. 05You may also submit to the Tribunal, with the chronology. Publication and a non-response finding depend on screening and a verified right of reply.

Read how to file a complaint that wins before you write it, and how fast should a withdrawal be to see where verification sits in the wider pattern of payout delay.

Verification is a legal obligation an operator owes to the state. Its conclusion is an obligation it owes to you. An operator that treats the first as mandatory and the second as optional has told you what it is.