Casino KYC Explained: Why Online Casinos Ask for ID and When
KYC, short for know your customer, is the identity check a casino runs to confirm who you are and where your money comes from. Most crypto casinos let you sign up and deposit with only an email, so the request often arrives later, when you try to withdraw.
The timing comes from the law. Anti money laundering rules set a limit on your running total, and each license sets its own deadline for the check.
Knowing where those lines sit lets you get verified on your own terms, instead of finding out with a withdrawal on hold. This guide covers:
- What a KYC check includes, from photo ID to crypto wallet screening
- Why casinos ask for ID, and the legal thresholds that count your running total
- When the check happens under each license, and what gets an account flagged
- How to pass verification the first time, and how long it takes
- What happens if a withdrawal is held, and whether a casino can keep your money
- Whether it is safe to send your ID, and why some casinos skip KYC
Withdrawal already on hold? Go straight to what to do if your withdrawal is held for KYC.
What Is KYC at an Online Casino?
KYC is the process a casino uses to confirm a player’s identity, age and the source of the money they gamble with. Anti money laundering law treats casinos, online ones included, as businesses that must know their customers, much like banks.
The same checks also protect players. They stop underage accounts and let a casino enforce self exclusion, which only works if it knows who you are.
Casino KYC Levels: What a Check Can Include
Most casinos start with the lightest step and add more only when your play or the rules require it. Many crypto casinos label these steps as KYC levels, with Level 1 for basic details and higher levels for documents. The full set looks like this:
- 1Basic details. Your name, address and date of birth, screened against sanctions lists and lists of politically exposed persons, such as senior public officials.
- 2Photo ID. An unexpired passport, national ID card, residence permit or driver's license.
- 3Proof of address. A bank statement, utility bill or official letter, usually dated within the last six months.
- 4A selfie or liveness check. A live photo or short video that matches your face to your ID.
- 5Proof of payment. Evidence that the card, bank account or digital wallet you used is in your name.
- 6Source of funds. Payslips, bank statements or similar, when your deposits look large for your profile.
- 7Crypto wallet checks. Screening of the wallet you deposit from, and sometimes proof that the wallet is yours.
This is why two players at the same casino can face very different checks. The UK Gambling Commission, for example, says a casino may ask for a selfie if it suspects fraud on an account.
KYC vs AML: What Is the Difference?
AML, short for anti money laundering, is the full set of laws and controls a casino must follow. KYC is the part of it where the casino identifies you:
| KYC | AML | |
|---|---|---|
| What it covers | Who you are: identity, age and address | Every control against money laundering, KYC included |
| What it watches | You as a customer | Transactions, wallets and betting patterns |
| Do you notice it? | Yes, when the casino asks for documents | Rarely, as most checks run in the background |
| Example | Uploading your passport | Screening the wallet you deposit from |
A casino asks for documents only when a legal threshold or a risk signal requires them. The next section shows where those thresholds sit.
Why Casinos Ask for ID: The Law Counts Your Total
Outside the UK, casinos usually ask for documents once you pass a legal limit, and in the EU and Curaçao that limit is a running total.
In the EU, gambling operators must check anyone who stakes or collects €2,000 or more, “whether the transaction is carried out in a single operation or in several operations which appear to be linked.” The EU AML Regulation that applies from July 2027 keeps the same €2,000 line.
Curaçao, where many crypto casinos hold their license, counts every deposit and withdrawal since you opened the account. Its 2025 AML rules recalculate that total daily and require documents once it reaches 4,000 guilders, about $2,235, with bonus money left out.
When Each Regulator Requires KYC
The trigger and deadline depend on who licenses your casino:
| Who Sets the Rule | What Triggers KYC | Deadline |
|---|---|---|
| FATF (global standard) | Transactions of USD or EUR 3,000 or more | Left to national law |
| EU AML law | €2,000 or more staked or won, in one go or in linked transactions | Set by each member state |
| Malta (MGA) | €2,000 in deposits, counted from account opening or over a rolling 180 days | 30 days, with withdrawals blocked until you pass |
| Curaçao (CGA) | 4,000 guilders (about $2,235) in total deposits plus withdrawals | 30 days |
| Kahnawake | Opening an account and depositing | Before any payout, and no later than 30 days |
| UK Gambling Commission | Opening an account | Before you can gamble |
These are legal minimums. A casino can ask earlier, and casino terms reserve the right to request documents at any time, which is why a check can arrive below every figure in the table.
Why Splitting Deposits Does Not Avoid KYC
Some players believe that keeping every deposit small keeps them under the radar. Under the EU, Malta and Curaçao rules above, small deposits add up to the same total, so the check arrives anyway.
Splitting can also make an account look worse. The FATF, the global anti money laundering watchdog, named these patterns as red flags for casinos in its September 2026 report on gambling risks:
- Deposits broken into smaller amounts to stay under reporting thresholds.
- Winnings collected again and again slightly below an identification threshold.
In the US, splitting transactions on purpose to avoid a reporting rule is a federal crime under 31 U.S.C. 5324, even when the money is legitimate. That law covers US institutions, including casinos, but it shows how regulators treat the habit.
When the Check Happens: Before You Play or at Withdrawal
UK licensed casinos verify you before your first bet. Casinos licensed in Malta, Curaçao or Kahnawake can let you play first and check later, within the deadlines in the table above.
That is why many crypto casino players first meet KYC at a withdrawal. A cashout can push your running total over the line, and it is the last point at which the casino can check you before money leaves.
What You Can Do While Verification Is Pending
Malta and Curaçao both spell out what you can still do with your account during those 30 days:
- Curaçao, threshold reached by a deposit. You can keep playing with the balance already in your account, but you cannot deposit or withdraw until you pass.
- Curaçao, threshold reached by a withdrawal. The account is frozen completely, so you cannot play either.
- Malta. You can keep using the account, but no withdrawal of any amount goes through until the casino has your documents.
If the 30 days pass without documents, the casino must close the account. The section on held withdrawals below explains what happens to your balance.
What Gets an Account Flagged
A threshold is not the only trigger. Casinos also watch for patterns, and the FATF report on gambling risks lists warning signs such as these:
- Repeated VPN use, several devices or a location that does not match your stated country.
- More than one account under the same name, or one under a false name.
- A payment method in a different name from the account, or deposits from third parties.
- Deposits withdrawn with little or no play.
- Money that does not fit what the casino knows about you.
- Refusing a video call to confirm your identity.
The FATF adds that one indicator alone is not necessarily evidence of illicit activity, and that some point to problem gambling rather than money laundering. For most players, a flag ends in a document request.
Source of Funds and Source of Wealth Checks
These are the deepest checks, and they usually follow large deposits or a higher risk rating. Source of funds asks where the money you deposit came from, while source of wealth asks how you built your savings overall.
Curaçao’s rules tell casinos to establish a customer’s source of wealth and expected activity, and to request source of funds from time to time for higher risk players. Politically exposed persons face both checks. Typical evidence includes:
- Recent payslips or a tax return.
- Bank statements showing the money before it reached the casino.
- Paperwork for a property sale, an inheritance or a business payout.
- For crypto, exchange statements or wallet history showing where the coins came from.
If you buy crypto on an exchange, keep its transaction history, since it answers a source of funds request fastest. Players at high roller crypto casinos meet these checks most often, because large deposits cross every threshold quickly.
Crypto Casino KYC: How Your Wallet Is Checked
Crypto deposits face an extra layer that usually runs without asking you anything. Casinos screen wallet addresses with blockchain analytics tools that score coins for links to sanctions, mixers or stolen funds.
Curaçao issued its first crypto guideline for licensees in June 2026, and trade press reports that it requires:
- Wallet screening and transaction monitoring at both deposit and withdrawal.
- Refusing funds linked to sanctioned wallet addresses, mixers or tumblers.
- Withdrawals that normally return to the same wallet and coin you deposited from.
- A risk assessment for privacy coins such as Monero and Zcash, rather than an outright ban.
- Wallet ownership controls by December 2026 and withdrawal whitelisting by June 2027.
So a deposit from a flagged wallet can lead to questions, even at a casino that rarely asks for ID. Depositing straight from an exchange account or wallet in your own name gives the screening the least to question.
How to Pass Casino ID Verification the First Time
Most rejected checks fail on the paperwork. A blurry photo or an old bill sends you back to the upload screen, and your withdrawal waits while you try again.
Curaçao’s AML rules, which many crypto casinos follow, ask for documents that are “clear, legible and of good quality,” and the casino must check that they are genuine.
Casino KYC Documents: What Gets Accepted
Before you upload anything, run through this checklist:
- 1An unexpired photo ID. Show all four corners, with the photo, name and number readable and no glare.
- 2Proof of address under six months old. It must show your name and the address on your account. Curaçao's rules accept fixed line phone bills but not mobile ones.
- 3Matching details. Your name, date of birth and address must match your casino profile exactly, spelling included.
- 4Payment methods in your own name. A card, bank account or exchange account in someone else's name is one of the FATF red flags.
- 5Full, unedited files. Upload the whole page of a statement, and never crop out details or edit a PDF.
- 6A fast reply. Under Malta and Curaçao rules, the 30 days run from the day you reach the threshold, so answer the request as soon as it arrives.
If your ID, bank statement and casino profile show your name differently, such as a missing middle name, tell support when you upload. It saves a rejection and a second round.
Proving a Crypto Wallet Is Yours
A crypto casino may also ask you to prove that the wallet you deposit from belongs to you. Curaçao’s crypto guideline makes wallet ownership controls mandatory for its licensees by December 2026, and the usual methods are:
- A signed message. Your wallet signs a short text with its private key, which proves control without moving any coins.
- A small test transaction. You send a tiny amount from the wallet, often called a Satoshi test, and the casino matches it on chain.
- A screenshot. An image of your wallet or exchange account showing the address, which is the weakest proof but the easiest to produce.
Exchange accounts cannot sign messages, because the exchange holds the keys. If you deposit from one, a screenshot showing your name and the deposit address is usually the fastest route.
How Long Does Casino Verification Take?
It depends on whether software or a person reviews your file. Sumsub, the verification provider BC.Game uses, advertises an average verification time of 30 seconds for gaming customers.
Manual reviews take longer, because a compliance officer reads your documents. The UK Gambling Commission says it cannot give a timescale for ID checks, although electronic checks may be instant. These are the usual reasons a check slows down:
- A rejected document that has to be uploaded again.
- A source of funds request, which a person has to read.
- A large first withdrawal, which casinos often send to manual review.
- An upload at the weekend, at casinos that review files by hand.
If you plan to play for larger amounts, verify early from your account settings. The check is then done before you need the money.
What Happens if Your Withdrawal Is Held for KYC
A withdrawal held for KYC means the casino needs documents before money can leave. Once you send them and pass, the payout continues as normal.
If you never pass, the rules in Curaçao, Malta and the UK point the same way. The casino has to return your balance rather than keep it, unless it suspects money laundering.
Can a Casino Keep Your Money if You Fail KYC?
Each regulator sets out what happens once a check cannot be completed:
| License | If You Do Not Complete KYC | What Happens to Your Balance |
|---|---|---|
| Curaçao | Account closed after 30 days | Sent back to the bank account or wallet you deposited from |
| Malta | Relationship ended after 30 days | Returned to the same source, through the same channel |
| UK | No confiscation for failed ID checks | Repaid to the last payment method you used |
The exception in all three is a money laundering suspicion. The casino then reports to the authorities, and the funds can stay blocked while they decide.
When a Casino Can Void Your Winnings
When players lose winnings at the KYC stage, the cause is usually a breach of the casino’s terms that the check brought to light. The most common are:
- A second account, which many terms forbid per person, household or device.
- Playing from a country the casino excludes, or using a VPN where the terms ban it.
- Deposits from a card or wallet in someone else's name.
- Breaking bonus rules, such as betting above the maximum stake while wagering.
- Documents that are edited or belong to someone else.
Many of these rules sit in the bonus terms, so check the bonus rules that void winnings before you claim an offer.
Withdrawal Pending Verification: What to Do Next
If your cashout shows as pending verification, work through these steps:
- 1Read the request. Note which documents the casino wants and how long you have.
- 2Send everything at once. Follow the checklist above, so the file does not bounce back.
- 3Keep records. Screenshot the request, your upload and every support chat, with dates.
- 4Ask for reasons in writing. If a document is rejected, or the payout stays held after approval, ask support to explain why by email.
If that does not resolve it, file a written complaint through the casino’s official process and keep the ticket number. After that, the route depends on the license, and our guide to how each casino license handles complaints walks through every step.
Is It Safe to Send Your ID to a Casino?
Sending ID to a licensed casino is usually safe, but your documents do not stay in one place. They pass through the casino, its verification provider and the tools it uses to store and manage player data.
How Long Casinos Keep Your ID
AML law requires casinos to keep KYC records after you leave, so closing your account does not delete them:
| Rule | What It Means for Your Documents |
|---|---|
| Curaçao AML rules | Kept for at least 5 years after your account closes |
| EU AML rules | Kept for 5 years, which authorities can extend by up to 5 more |
| GDPR right to erasure | Cannot force early deletion while the law requires the records |
This means a breach years after you stop playing can still involve your documents.
What a Casino Data Breach Looks Like
Breaches can hit a casino’s suppliers as well as the casino itself. In October 2025, Shuffle confirmed that a breach at Fast Track, a CRM provider used across the gaming industry, exposed user data and likely affected the majority of its users.
Shuffle disclosed the incident publicly, warned users about phishing and said accounts and funds stayed secure. Some reports said uploaded ID documents were among the data, which Shuffle’s statement did not confirm.
How to Send Your ID Safely
A few habits keep your documents where they belong:
- 1Upload only inside the casino. Use its own site or app, or the verification screen it opens for you.
- 2Never send documents by message. Email, Telegram, Discord and direct messages are not safe channels, even when the sender claims to be support.
- 3Check the address bar. Phishing copies of casino sites exist, and they ask for ID too.
- 4Send only what is requested. On a card photo, cover the middle digits and never show the security code.
- 5Lock the account. Use a unique password and turn on two factor authentication.
- 6Expect phishing after a breach. Attackers reuse leaked names and emails to send convincing fake requests.
If anyone asks for documents outside the casino’s own platform, stop and contact support through the website first.
Why Some Casinos Skip KYC, and Where the Limits Are
Some crypto casinos let you deposit and withdraw for months without a document request. Licenses such as Curaçao’s tie full checks to thresholds and risk signals, so small, steady crypto play may never trigger one.
That suits players who value privacy, but it has a cost. A casino that does not know who you are cannot enforce self exclusion reliably, so set your own self exclusion and deposit limits where the casino offers them.
No KYC Does Not Mean Never
Every casino reserves the right to ask for documents in its terms, at any amount. In our own testing, withdrawals at Duel and Vave went through without a document request. That reflects our stakes and play, and either casino can still ask.
No casino can promise you 100% that it will never ask for KYC, because they all reserve that right in their terms. Some are much less likely to ask, though. Start with small amounts, increase slowly, play from the same IP and never open a second account.
João Mourato, Head of iGaming Product at VIP-Grinders
We track which crypto casinos ask, and at what point, on our list of no KYC crypto casinos we tested.
How to Lower the Risk of a Surprise Check
These habits will not get you around the law, but they keep a check from landing at the worst moment:
- 1Start small. Test the cashier with a deposit and a withdrawal before you send larger amounts.
- 2Withdraw as you go. Less money sits in the account if a check arrives.
- 3Play between deposits and withdrawals. Cashing out with little or no play is a warning sign casinos watch for.
- 4Keep one account. Play from the same devices and network, and never share the account.
- 5Follow the location rules. Play only from countries the casino accepts, and use a VPN only where its terms allow it.
- 6Read the terms first. Look for the KYC and withdrawal sections before your first deposit.
None of this avoids the legal thresholds above. It keeps your balance small and your account clean, so a check means a short delay instead of a frozen win.
Our page on how we test casino cashiers explains what we check at the cashier and where our testing stops.
Frequently Asked Questions
What does KYC mean at a casino?
KYC stands for know your customer. It is the identity check a casino runs to confirm who you are, how old you are and where your money comes from, as anti money laundering law requires.
Why is my casino asking for KYC after a win?
A withdrawal is often the point where your running total of deposits and withdrawals crosses the legal threshold, such as 4,000 guilders under Curaçao’s rules. Casinos also review large or profitable cashouts by hand before money leaves. A request after a win is routine, and the payout continues once you pass.
What documents do I need for casino KYC?
Usually an unexpired photo ID and a proof of address dated within the last six months, such as a bank statement or utility bill. Some casinos also ask for a selfie, proof that the payment method is yours, or source of funds documents for large deposits.
How long does casino KYC take?
Automated checks can take seconds, and Sumsub advertises an average of 30 seconds for gaming customers. Manual reviews and source of funds requests can take hours or days, and the UK Gambling Commission says it cannot give a fixed timescale.
Do crypto casinos require KYC?
Licensed crypto casinos must follow anti money laundering law, so every one of them can ask for KYC. Most only ask once you reach a legal threshold or trigger a risk signal, which is why small, steady crypto play often stays document free. Curaçao licensed casinos must also screen the wallets you deposit from and withdraw to, under the regulator’s 2026 crypto guideline.
Can I avoid KYC by making smaller deposits?
No. EU, Malta and Curaçao rules add small deposits together, so the check arrives once the total crosses the threshold. The FATF also lists deposits split to stay under thresholds as a money laundering red flag, so splitting can make an account look worse.
What happens to my balance if I never complete KYC?
Under Curaçao and Malta rules, the casino closes the account after 30 days and returns your balance to the account or wallet you paid from. UK casinos cannot confiscate your balance because you failed an ID check. The exceptions are a money laundering suspicion and winnings voided for breaking the casino’s terms.
Is it safe to upload my passport to a casino?
At a licensed casino it is usually safe, as long as you upload through the casino’s own site or the verification screen it opens. Never send ID by email, Telegram or direct message, and remember that casinos must keep your documents for five years or more after you leave.