If a casino is suddenly asking for ID, selfies or bank statements before it will pay you, you are not being singled out for doing something wrong. Identity and source-of-funds checks are required by law. What matters is whether the checks are reasonable, or whether they are being used to stall a withdrawal you are owed.
These checks are known as KYC, short for “Know Your Customer”. At a minimum, KYC means verifying who you are. Where the risk is higher, it can extend to assessing where your money came from and monitoring how you transact. It is a routine part of regulated gambling.
Why the checks exist
Two sets of rules drive this. The first is the Gambling Commission’s licence conditions. Under condition 17.1.1 of the LCCP, a UK-licensed operator must obtain and verify your identity, including your name, address and date of birth, before you are permitted to gamble. That rule was tightened on 7 May 2019. Before then, operators could let you play first and verify later. For UK-licensed remote operators, that window is gone: verification has to be done before you gamble.
The second is anti-money-laundering law. The Money Laundering Regulations 2017 require regulated casinos to carry out customer due diligence: identifying and verifying customers and, on a risk-sensitive basis, obtaining information about the source of funds, with enhanced checks in higher-risk situations. So when a casino asks where a large sum came from, it is often meeting a legal duty rather than simply being difficult.
What a reasonable request looks like
Reasonable verification is usually photo ID, proof of address, and sometimes proof of the payment method or, for larger sums, evidence of where the funds came from. The key word is proportionate. Under UK data-protection law, the data-minimisation principle means an organisation should collect only what it genuinely needs for the stated purpose. An operator should not need ten years of full bank statements to release a modest withdrawal. If a request feels open-ended or excessive for the amount involved, you can ask why that specific information is needed.
Larger withdrawals, heavy deposit activity, bonus or VIP play, and automated risk flags can all prompt deeper source-of-funds checks at cash-out. That fits the risk-based approach the regulations require. There is no single, publicly fixed pound figure that triggers it. Operators set their own thresholds.
The line between a check and a stall
One protection matters more than the rest. LCCP condition 17.1.1 says a request to withdraw funds must not result in a requirement for additional information as a condition of withdrawal, where the operator could reasonably have requested that information earlier. There is a narrow exception for information the operator is legally obliged to obtain at that point. Before you deposit, a UK-licensed operator should also tell you in advance what documents may be needed and when.
A UK-licensed operator should not accept your deposits for weeks, then spring brand-new verification demands at the moment you try to take your winnings out.
The Gambling Commission has said as much. Operators should not keep accepting deposits and then rely on their anti-money-laundering procedures to frustrate a withdrawal. Asking for verification or source-of-funds information only at cash-out, when it could have been sought earlier, is treated as a compliance failing. So the warning sign is not the existence of checks but their timing and pattern: verification that appears only when you try to withdraw, repeated requests for documents you have already supplied, several selfies for a small payout, or vague rejections with no clear reason. Players commonly report these experiences, and they sometimes occur alongside a frozen account or voided winnings.
A calm way to respond
If you are in the middle of this, a measured approach usually serves you best. Complete reasonable verification once and in full. Send clear, proportionate copies of what is genuinely needed. If a request seems excessive, ask in writing for the specific reason it is required. Keep your own record throughout: the dates, what was asked, and copies of what you sent. The payment trail is part of that record. It shows who you are and where funds moved, and it is useful documentation, not a separate route to chase.
If a UK-licensed operator keeps stalling beyond what is reasonable, put a formal complaint in writing. If it is unresolved after eight weeks, or you reach deadlock sooner, you can take the dispute to a Gambling-Commission-approved Alternative Dispute Resolution provider, free of charge. IBAS is one such provider for gambling disputes, and under its published terms its decisions are binding on a registered operator up to a total value of £10,000. This sits alongside our wider guidance on a casino that will not pay out.
Be clear about what these routes can and cannot do. The Gambling Commission regulates operators and can act on failings, but it does not recover money for individual players, and completing KYC does not guarantee a payout. It removes the main lawful reason to hold your money.
Offshore casinos are a different picture
The protections above apply to operators holding a UK Gambling Commission licence. A casino licensed elsewhere, for example under a Curaçao licence, is not bound by the UK LCCP. The “verify before play” rule, the bar on springing new checks at withdrawal, and the IBAS or ADR escalation route generally do not apply to it.
That gap matters. Offshore sites are often advertised as offering easy or instant withdrawals, but in practice payout, traceability and recovery can be harder, and your recourse is weaker because the UK routes are closed. If your losses are with an offshore operator, the focus shifts to your rights as someone who has been harmed. We cover that in our guidance on recovering gambling losses.
You are always free to use these routes yourself, without a claims company: complaining to the operator, escalating to ADR or IBAS, and contacting the Gambling Commission. Where a bank or payment provider is involved, the Financial Ombudsman may also be relevant. If you would rather have help, our case team can carry out a free eligibility check and tell you honestly whether there is a case worth pursuing. The initial eligibility check is free and confidential. Where a case proceeds, our regulated legal partners typically work on a no win, no fee basis, so you pay an agreed percentage only from funds that are actually recovered.
If gambling is affecting you, free and confidential help is available. You can call the National Gambling Helpline on 0808 8020 133 or chat to GamCare (gamcare.org.uk).
Sources
- Gambling Commission, LCCP condition 17.1.1, customer identity verification (gamblingcommission.gov.uk).
- Gambling Commission, new age and identity verification rules from 7 May 2019 (gamblingcommission.gov.uk).
- Gambling Commission, key issues and our expectations concerning account withdrawals (gamblingcommission.gov.uk).
- The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, regulation 28 (legislation.gov.uk).
- Information Commissioner’s Office, data minimisation guidance, UK GDPR Article 5(1)(c) (ico.org.uk).
- Independent Betting Adjudication Service, IBAS (ibas-uk.com).
General information, not legal advice. Clinton & Co Advisors is a trading name of Ramays TA/Clinton and Co Limited. We are not solicitors or a law firm. We connect clients with regulated legal partners.