Every regulated online casino in Europe, Australia and the UK is legally required to verify who you are before releasing winnings, and often before you can raise a deposit limit or place a large bet. The rules sit under the umbrella term KYC, know your customer, and they exist because gambling money is a favoured route for laundering and, increasingly, for fraud recovery. Understanding what they will ask for turns the whole process from a five-day headache into an afternoon.
The three documents every licensed operator will request
Three files clear the standard KYC bar at almost any regulated casino in 2026: a photo ID, a proof of address and a payment-method image. Get all three ready before you sign up, upload them within an hour of opening the account, and the vast majority of operators will verify you before you have finished your first session.
| Document | What they check | Common pitfall |
|---|---|---|
| Government photo ID | Face matches, name matches account, ID not expired, MRZ readable | Blurry corners; four corners of the card must be visible on the same shot |
| Proof of address | Utility, bank statement or council letter dated within 90 days, same name as account, address matches registration | Mobile-phone bills are often rejected; a bank statement PDF from your bank app works fine |
| Payment method image | Card front with middle 8 digits masked, or an e-wallet screenshot showing your account holder name | Never send the CVV or unmasked digits; if they ask, the request is not compliant |
The document they might also want
For larger deposits, or if your play pattern flags an anti-money-laundering rule, operators will ask for source of funds. That means a recent payslip, a tax return, a pension statement or, for self-employed players, a set of invoices. This is where verification switches from automatic to human-reviewed, and where the timeline stretches. Preparing a source-of-funds document in advance is optional; most players will never be asked, but every player above a couple of thousand a month will be. Having it saved as a clean PDF costs nothing and shaves days off a big cash-out later.
The line they should never cross
A licensed operator will never request an unmasked full card number, the CVV on the back, a bank account password or a copy of a family member's ID. Any of these means the request has been intercepted, the operator is unlicensed, or a support agent is running a scam. Close the chat, contact the licensed operator through the details on the regulator's register, and report the interaction. In three years on the desk we have logged five such attempts; every one turned out to be a spoof of a legitimate site.
Timing the verification so it never blocks a withdrawal
The best time to submit KYC is the first hour after signing up, before you have played a single spin. Two reasons. First, the operator has no incentive to stall, because there is no money on the table yet. Second, if there is a problem with a document, you find out at leisure rather than after you have hit a good win and want the cash out today.
Watch the confirmation email. A proper KYC platform, Jumio, Onfido, iDenfy, ComplyAdvantage, will bounce back a receipt within minutes. If no confirmation arrives after 24 hours, resubmit through live chat with a screenshot of the original submission time; that record is your leverage if a dispute follows.
Why documents get rejected, and how to fix them without escalation
The three most common rejections in our own testing are all cosmetic and all fixable in a phone camera. Glare on the ID from a ceiling light. A corner of the ID card cropped out of frame. A proof-of-address dated more than 90 days ago because the last utility bill was the summer statement. Reshoot on a dark surface, in daylight, with all four corners visible, and use the bank statement PDF from your app for a fresh date. This resolves around 80 percent of the KYC delays we log.
What happens to the documents afterwards
Under GDPR in Europe and the UK, KYC records must be retained for five years after account closure and then deleted. You have the right to see what has been stored and, once the retention period ends, to demand deletion. Regulated operators publish a data-protection contact; unlicensed sites, as a rule, do not, which is one more reason the licence check comes first.
KYC is boring and, once, or twice a year, it saves someone from losing their winnings to a paperwork snag. If you can bear the fifteen minutes of admin at the start, it is easily the highest-return chore on the account-setup list. Every operator on our top-rated shortlist is graded on how quickly and cleanly this stage runs.
FAQ
Can I play before KYC is complete?
Yes, at most sites, up to certain deposit and play thresholds. Withdrawals, however, will not clear until verification is done. Uploading documents on day one keeps that from becoming a problem later.
What if I moved recently and my ID address is not current?
Use a current proof of address, dated within 90 days, in your name at the address on your account. The ID does not need to match the address; that is why the two documents are separate.
Do crypto casinos still run KYC?
Regulated ones do. The 2024 European MiCA rules and the 2026 AMLA framework close most of the "no-KYC crypto" loopholes for anyone holding a European licence. Outside those jurisdictions the picture varies, and unregulated crypto sites carry the corresponding risk in disputes.
