KYC verification at a casino — what is asked for, and which rule asks

Every regulated betting account eventually asks you to prove who you are. This is called KYC — know your customer — and it is not the operator being difficult. It is a legal obligation with a written text behind it, and knowing that text tells you which requests are normal and which are not.

The rule underneath it

In the European Union, the anti-money-laundering directive names gambling operators directly. They must carry out customer due diligence:

upon the collection of winnings, the wagering of a stake, or both, when carrying out transactions amounting to EUR 2 000 or more

— Directive (EU) 2015/849, Article 11

The directive then says what “due diligence” means. Article 13(1) requires:

identifying the customer and verifying the customer’s identity on the basis of documents, data or information obtained from a reliable and independent source

plus identifying beneficial owners, understanding the purpose of the relationship, and conducting ongoing monitoring of it.

Two things follow from that wording, and they explain most of what happens to you in practice.

“A reliable and independent source” is why a selfie is not enough. The operator cannot take your word for your identity; it has to check it against something issued by somebody else. That is the whole reason for the passport, the driving licence, the utility bill.

“Ongoing monitoring” is why verification is not a one-off. An account verified two years ago can legitimately be asked for documents again. That is the directive working as written, not the operator moving the goalposts.

Regimes outside the EU set their own thresholds and their own rules, and none of the brands reviewed on this site is licensed in the EU. The EUR 2 000 figure is not a worldwide number. The shape of the obligation — identify, verify against an independent source, monitor continuously — is close to universal, because it comes from the same international standard that those regimes implement.

What you will be asked for

In rough order of how often it is requested:

• Identity. Passport, national ID card or driving licence. Full page, all four corners in frame, nothing cropped, not expired.
• Address. A utility bill, bank statement or government letter, usually dated within the last three months, showing the same name and address as the account.
• Payment method ownership. A card photographed with the middle digits covered and the CVV covered, or a bank statement showing the deposit leaving your account. This proves the money was yours — which is the actual point of the exercise.
• Source of funds. Payslips, bank statements, a sale contract. Requested for large or unusual amounts. This is the most intrusive request and also the most clearly mandated by the directive’s “purpose and intended nature of the business relationship”.
• A selfie, sometimes holding the document or a dated note. Increasingly a short video instead.

The two mistakes that cost people weeks

Registering under a name that is not exactly the one on your ID. Verification compares strings. A missing middle name, a transliterated spelling, a married name on one document and a maiden name on another — each of those is a manual review, and manual reviews are slow. Register with the name printed on the document you will verify with, character for character.

Depositing from an account that is not yours. A partner’s card, a friend’s wallet, a shared family account. Third-party payments are prohibited under essentially every licence, because they are the exact mechanism the directive exists to stop. Money deposited this way is frequently frozen rather than returned, and the account is usually closed. There is no appeal that works, because the operator would be breaking its own licence conditions to give it back to you.

Verify before you win, not after

Nothing in the rules stops you from uploading documents on the day you open the account.

Doing it then costs you nothing. Doing it when a withdrawal is pending costs you the wait, and it is the point at which the process is least pleasant — you are waiting on money, and every request for one more document reads as a delaying tactic.

Which brings us to the case where it actually is one.

When the request is not legitimate

The obligation is to verify identity. It is not a licence to invent requirements. Treat these as warning signs:

• Documents requested one at a time, each new request arriving only after the previous one is satisfied. A compliance team knows its own checklist and can send it in one message.
• A demand for a document that proves nothing about identity or fund ownership — a photograph of you holding the device, a video of you saying a sentence they compose, your passwords.
• Verification demanded only after a large win, on an account that deposited and played for months without a single question.
• A deposit accepted instantly from a method the operator later says it cannot verify.

The asymmetry is the tell. An operator that could take your money without checking anything, and then cannot pay it out without checking everything, has told you which of the two it was actually in a hurry about.

What this has to do with the App Store

Apple requires that an app offering real money gaming has

necessary licensing and permissions in the locations where the app is used, must be geo-restricted to those locations, and must be free on the App Store

— App Review Guidelines 5.3.4

and separately, that apps in highly regulated fields — gambling is named — are submitted by

a legal entity that provides the services, and not by an individual developer

— App Review Guidelines 5.1.1(ix)

So the publisher name on an App Store listing is a company that told Apple it holds a licence for that country. That is not proof the licence is valid, and we have found the claim worth checking: see how we verify for what the registers actually said in each case. But it does mean the account you are opening sits inside a regulatory regime, and the KYC request you get is that regime working — not an operator improvising.

An unlicensed site reached through a sideloaded file has none of that structure. It will also ask for your passport.