MawarSlotResmiLicensing & player protection

Compliance

KYC and identity verification

Why licensed operators ask for documents, what is normal, and the point at which a stalled withdrawal stops being verification and becomes a complaint.

Last reviewed: 18 September 2026MawarSlotResmi Editorial Desk

In short

Licensed operators are required to verify who you are. In Great Britain a remote licensee must obtain and verify your name, address and date of birth before you are permitted to gamble — and the regulator’s position is that information should not be sought at withdrawal where the operator should have sought it earlier. So a first-time identity request appearing only when you try to cash out is not normal, and is the basis of a complaint. A request for additional information triggered by your activity can legitimately arise later, and the operator may be legally barred from telling you why.

Two different regimes, routinely conflated

“KYC” is used as one word for two sets of rules with different triggers, different scopes and different rights attached to them. Telling them apart is what lets you work out whether what is happening to your account is normal.

Identity and age verification (the gambling-licensing strand)
Driven by age limits, self-exclusion and consumer fairness. In Great Britain this is licence condition 17.1.1 together with a social responsibility code provision, and it applies to remote licensees generally — every online operator, not only casinos. It is supposed to happen before you gamble.
Customer due diligence (the anti-money-laundering strand)
Driven by the Money Laundering Regulations. Within gambling in Great Britain these apply to casinos; betting, bingo, lotteries and arcades are not on the list of "relevant persons" for those regulations, though they remain bound by proceeds-of-crime legislation and by a separate licence condition requiring a money-laundering risk assessment. This strand is risk-triggered and can legitimately arise at any time.

What you are asked for, and why

Common verification requests and what each is for
RequestedTypical purposeWhen it is normal
Name, date of birth, addressConfirming identity and that you are old enoughBefore you gamble — this is the baseline
Photo identity documentConfirming the identity given is yoursAt registration, or when electronic checks cannot confirm you
Proof of addressConfirming where you live, which can determine whether the operator may serve you at allAt registration or shortly after
Proof of payment-method ownershipConfirming the card or account is yours, and preventing third-party fundingBefore a withdrawal, commonly the first one
Source of fundsEstablishing where the money you deposited came fromRisk-triggered — not routine
Source of wealthEstablishing how your overall wealth was accumulatedEnhanced due diligence only — a higher tier again

The first four are ordinary. The last two sit in the enhanced tier and are triggered by risk factors rather than applied universally — politically exposed persons, links to high-risk jurisdictions, identification documents that appear false, and transactions that are unusually complex or unusually large.

When verification should happen

This is the part most consumer-facing writing gets wrong, and it is the part that gives you leverage.

  1. Before you gamble — the baseline

    A remote licensee in Great Britain must obtain and verify name, address and date of birth before permitting you to gamble. Not before you withdraw. Before you play.

    The age-verification code provision is specific about what “before you gamble” covers: age verification must happen before the customer may deposit funds, before they may access free-to-play versions of games, and before they may gamble with the licensee using either their own money or any free bet or bonus. That last limb matters — playing only with bonus funds does not put you outside the requirement.

  2. Not sought late if it should have been sought earlier

    The regulator’s position is that an operator should not be seeking information at the point of withdrawal where it should have sought that information earlier if needed. An operator that let you deposit and play for months and asks for basic identity documents only when you try to take money out has not simply been slow — it is in the territory the rule is aimed at.

  3. Additional checks can legitimately come later

    Risk-driven requests are different. If your activity changes, or a pattern triggers a review, an operator can properly ask for more. This is not the same as never having verified you at all.

  4. Risk profiling should not begin at a threshold

    The Gambling Commission has criticised operators for beginning risk profiling only once a financial threshold is reached. If everything was fine until your balance grew, that pattern is itself something to describe in a complaint.

First ID request at withdrawal Checks only after a big win Verified before first deposit Extra checks after unusual activity

Source of funds and source of wealth

These are the requests people find most intrusive, and they are worth understanding separately because they sit in the enhanced tier and are not routine.

  • Source of funds asks where the specific money you deposited came from — a salary, a property sale, a transfer.
  • Source of wealth is broader: how your overall wealth was built. This is a higher bar and a larger ask.

They are triggered by risk factors rather than applied to everyone. Being asked is not an accusation, and it is also not something an operator should do casually — the enhanced tier exists for defined circumstances.

Why an operator may be unable to explain the delay

This is the single most useful thing to know when a delay is unexplained, and almost nobody tells consumers about it.

That cuts both ways, and it is why this page does not tell you to treat silence as proof of anything:

  • It explains why a well-run operator might give you a frustratingly vague answer.
  • It does not excuse an operator that never verified you in the first place, that keeps changing what it wants, or that ignores its own stated timeframes.
  • It is not a reason to stop escalating. You still make the complaint; you simply understand that “we cannot discuss the reason” may be a true statement rather than an evasion.

When a delay becomes a complaint

Verification is not a complaint. These are.

  • Basic identity documents requested for the first time at withdrawal, after a period of depositing and playing.
  • Documents supplied and nothing moving past the operator’s own stated timeframe, with no explanation of what is outstanding.
  • Requests that keep changing — a new document each time the last one is supplied, without a stated reason.
  • Documents rejected without saying why, or without saying what would be acceptable.
  • Checks beginning only once your balance grew, where everything was frictionless before.
  • Any demand for payment to complete verification.

  1. Give them exactly what was asked, and log it

    In the format requested. Record the date you sent each item and keep copies. This both removes the ordinary explanation and builds your evidence.

  2. Ask two specific questions in writing

    What, precisely, is still outstanding? And what is the expected timeframe? A written answer — or a refusal to give one — is what an external body will look at.

  3. Use the formal complaints procedure

    Not live chat. The published procedure, in writing, with your evidence attached and a reference number requested. See complaints and dispute resolution.

  4. Escalate to the dispute-resolution route

    In Great Britain the complaint becomes eligible for an approved ADR provider after eight weeks, or earlier if the operator issues a deadlock letter. What exists elsewhere depends on the licence — see the escalation ladder.

If verification genuinely cannot be completed

There is an outcome here that consumer writing tends to avoid, and it is better stated plainly.

Where customer due diligence cannot be completed, the Money Laundering Regulations do not merely permit an operator to walk away — they require it to refuse the transaction and terminate the business relationship. An operator in that position closing your account is following the regulations, not mistreating you.

That does not resolve what happens to a balance, which depends on the operator’s terms and the circumstances, and it is a legitimate subject for a complaint and for dispute resolution. But it does mean “they closed my account after asking for documents I could not provide” is not automatically evidence of wrongdoing.

Common questions

Is it normal to be asked for ID before a withdrawal?

Proof that a payment method belongs to you, yes — that is commonly checked at a first withdrawal. Basic identity documents for the first time at withdrawal is a different matter: in Great Britain that is what a remote licensee is supposed to have done before you were allowed to gamble at all.

They will not tell me why my account is under review. Is that allowed?

It can be. Where a suspicious activity report has been made, the operator commits an offence by telling you. That makes a vague answer potentially lawful rather than evasive — but it does not excuse missed timeframes, shifting requests, or a failure to verify you earlier.

Do I have to send identity documents to a live chat agent?

Use the operator’s documented secure upload route where one exists. Sending identity documents through an unsecured channel is worth resisting, and an operator that offers no proper route for them is worth asking about in writing.

Does every gambling operator have to do anti-money-laundering checks?

Not the same ones. In Great Britain the Money Laundering Regulations’ due-diligence machinery applies within gambling to casinos; betting, bingo, lotteries and arcades are not on that list. They remain subject to proceeds-of-crime law and to a licence condition requiring a money-laundering risk assessment, and where they operate remotely they are subject to the identity and age verification requirement regardless.

Can I refuse and just close my account?

You can ask to close it, but that does not oblige an operator to release a balance it has not been able to verify, and where due diligence cannot be completed the regulations require it to end the relationship. If you believe a balance is being withheld unfairly, that is a complaint and then a dispute-resolution matter.

Primary sources

Each link below goes to the issuing authority’s own website. Where a page could not be retrieved by our automated checks, that is stated rather than hidden.