Every licensed online casino will ask you to prove who you are. That part is not negotiable and it is not the casino being difficult, it is the law it operates under. What is worth knowing is that the process has three separate stages, that they fire at different moments depending on which licence the casino holds, and that at least one regulator puts a hard deadline on how long your money can sit still while it happens.
Casino Account Verification and KYC Explained
The short answer: Verification, usually called KYC after “know your customer”, is the casino confirming three things: that you are a real person of legal age, that you live where you say you live, and that the payment method belongs to you. A fourth check, source of funds, is separate and only some players ever see it.
What Casino Account Verification Actually Checks
Affiliate pages tend to describe verification as one event, a single upload of a passport photo. In practice it is a stack of separate checks that can be triggered independently, which is why players are often verified once and then asked for something else months later.
| The check | What proves it | What triggers it |
|---|---|---|
| Identity | Passport, national ID card or driving licence | Registration, or before the first withdrawal |
| Address | Utility bill or bank statement, usually under three months old | Registration, or a mismatch between your stated address and your IP |
| Payment method | Photo of the card with the middle digits covered, or an e-wallet screenshot | First withdrawal, and again if you add a new method |
| Source of funds | Payslips, bank statements, sale documents, tax returns | Unusual deposit size or velocity, and risk based triggers set by the operator |
The first three are routine and almost every player goes through them. The fourth is not routine, and confusing the two is where most of the anxiety around this subject comes from. Being asked for a utility bill is administration. Being asked for six months of bank statements is a risk review, and it means something specific has flagged.
When Verification Happens Depends on the Licence, Not the Casino
This is the part nobody explains, and it is the reason two players can have completely different experiences at what looks like the same brand.
Under the EU anti money laundering directive, the legal floor is set by a transaction threshold. Article 11 of Directive (EU) 2015/849 requires due diligence “upon the collection of winnings, the wagering of a stake, or both, when carrying out transactions amounting to EUR 2 000 or more”. That is a floor, not a schedule. It permits a casino to let you deposit, play and lose smaller amounts before it has confirmed anything about you.
The UK went considerably further. Since 7 May 2019, a British licensee has to have verified your name, address and date of birth before it lets you gamble at all, not before it lets you withdraw. That change introduced a new licence condition and rewrote the social responsibility code, and it is why a UK facing casino asks for documents at the door while a Malta facing one may not.
Casinos under the Curacao framework sit somewhere in between, with due diligence obligations that escalate for higher risk profiles, and crypto deposits are explicitly treated as one of those escalations. If you want the difference between these regimes in full, the guide on which casino licence is best sets them side by side, and there are dedicated pages on Malta and Curacao.
Where this catches people out: A casino that let you deposit and play for weeks without asking for anything has not decided you are trustworthy. It has simply not hit its trigger yet. The trigger is usually your first withdrawal request, which is exactly the moment the delay is least welcome.
The Five Working Day Rule
Verification is not open ended at every casino, and this is the part worth more than everything above it. The Malta Gaming Authority’s Player Protection Directive allows an operator to hold back a withdrawal while it verifies a player, but it caps that hold: the funds may be delayed “by no later than five (5) working days”.
That is a published limit in a regulator’s own directive, not a promise in a casino’s terms. It gives a player waiting on a verified payout something concrete to point at, and it gives you a date at which “we are still reviewing your documents” stops being a process and starts being a complaint.
The single most useful thing on this page: At an MGA licensed casino, five working days is the ceiling on holding your withdrawal for identity verification. Count from the day you supplied what was asked for, not from the day you requested the withdrawal, and keep the timestamps.
Two honest caveats. The cap is written for identity verification, so a genuine anti money laundering investigation is a different animal and is not the same clock. And it is a Malta rule. No equivalent five day figure was found in the Curacao or UK texts, so do not carry the number across to a casino licensed elsewhere and expect it to hold.
Source of Funds Is Not the Same as Proof of Address
Source of funds means evidence of where the specific money you deposited came from. Source of wealth is broader and means evidence of your overall financial position: savings, a property sale, an inheritance, a business. Casinos ask for the first far more often than the second.
There is no single legal figure that triggers it. Regulators require a risk based approach and leave each operator to set its own thresholds, which means a request that arrives at €3,000 at one casino may not arrive until €20,000 at another. Anyone quoting you a universal number is guessing.
What does reliably trigger it: deposits that grow quickly, deposits that do not match the profile you gave at registration, a lot of small deposits in a short window, and any use of a payment route the operator treats as higher risk. Crypto is one of those routes almost everywhere, which is why the crypto casinos that hold a real licence still run full checks despite the marketing around anonymity.
Why Verification Gets Blamed for Delays It Did Not Cause
A withdrawal can sit still for several reasons at once, and support tends to name only the last one. Verification is the visible reason. It is often not the whole reason.
The other common causes are a pending period the casino applies to every payout before it is even sent, an unfinished wagering requirement quietly holding the balance, and the payment rail’s own transit time after the casino has released the money. Those are separate clocks and they run in sequence, so the useful question is which clock you are actually waiting on. If the money is being refused rather than delayed, that is a different problem again and the page on why you cannot withdraw your winnings is the right starting point.
How to Get Verified Once Instead of Three Times
Most rejections are avoidable and almost all of them come from the same handful of mistakes.
- Register with the name exactly as it appears on your ID, including middle names and accents. A mismatch of one character is the single most common rejection
- Photograph the whole document, all four corners visible, no fingers over the edges and no glare across the machine readable strip
- Use an address document under three months old. Mobile phone bills are rejected more often than utility bills or bank statements
- For a card, cover the middle eight digits and the CVV, leave the first six, the last four, your name and the expiry visible
- Upload everything in one go. Documents supplied one at a time restart the review each time
- Verify before you have a withdrawal waiting. Nothing about the process is faster when you are in a hurry
A test worth running: Ask a casino to verify you the week you sign up, before you have any balance to worry about. A licensed operator will do it. One that stalls, asks for documents nobody else asks for, or has no visible complaints route is telling you something useful while it still costs you nothing to walk away.
What to Do Before Your First Withdrawal
Verification is the least popular part of playing online and it is also the part that most clearly separates a licensed casino from a bad one. A casino that never asks for anything is not being generous. It is either unlicensed, or it is going to ask at the worst possible moment. An operator that only discovers you exist when you try to take money out fits a pattern, and the rest of that pattern is worth recognising early.
Treat it as a one time cost, pay it early, and keep copies of what you sent with the date you sent it. Then know the deadline your licence actually gives you, because five working days at an MGA operator and no published limit elsewhere are very different positions to argue from. That deadline is a property of the licence rather than the brand, so browsing casinos by the regulator behind them tells you what your verification will look like while you still have nothing at stake.
Frequently Asked Questions
Because the law it is licensed under requires it. EU licensed operators owe customer due diligence under the anti money laundering directives, and UK licensees must confirm your name, address and date of birth before you are allowed to gamble at all. It is not the casino choosing to check, it is a licence condition.
At an MGA licensed casino, the regulator caps the delay to your withdrawal at five working days for identity verification. In practice a clean set of documents is usually approved within 24 to 72 hours. A source of funds review is a separate process and takes longer, because a human reads the statements.
Three things in most cases: photo ID such as a passport or driving licence, a proof of address under three months old such as a utility bill or bank statement, and proof that the payment method is yours. Some players are also asked for source of funds evidence, which is a risk based check rather than a standard one.
Evidence of where the money you deposited came from, such as payslips, bank statements or a sale document. It is different from source of wealth, which is evidence of your overall financial position. There is no universal amount that triggers it, because regulators require a risk based approach and each operator sets its own thresholds.
It depends on the licence. At a UK licensed casino, yes, since May 2019 you must be verified before you can gamble at all. Elsewhere the anti money laundering floor only bites at €2,000 in stakes or winnings, so many casinos let you deposit and play first and verify at your first withdrawal.
Almost always because the withdrawal is the trigger. If the casino did not need to verify you to take deposits, the first payout request is the point at which it must. Supply everything at once rather than one document at a time, since each new upload can restart the review.
It can refuse to accept specific documents, and it can close an account if it cannot satisfy its legal obligations. What it cannot do at a licensed operator is hold your money indefinitely without a reason. If a verified account is still being held past the regulator’s limit, that is a complaint, not a delay.
Licensed ones do. Under the Curacao framework crypto deposits are explicitly treated as a higher risk category that calls for enhanced due diligence, including checks on where the funds came from. Casinos advertising no verification at all are generally operating outside a licensing regime, which is a different risk category entirely.
Yes, and this is where the clocks get confused. Verification is one hold. A casino’s own pending period, an unfinished wagering requirement and the payment method’s transit time are three others, and they run one after another. Being verified only clears the first of them.
Usually because it is too old, the name or address does not match your account exactly, or it is a mobile phone bill, which many operators do not accept. Use a utility bill or bank statement dated within the last three months and make sure the name matches your ID character for character.
You can redact individual transaction lines if you are only proving your address, but leave your name, your address, the document date and the bank’s name visible. If the statement is being used as source of funds evidence rather than proof of address, redacting the transactions defeats the point and it will be rejected.
Not routinely, but it can be revisited. Adding a new payment method triggers a fresh check on that method, an expired ID document has to be replaced, and a change in your deposit pattern can trigger a risk review at any time, even years into an account.
At a licensed operator handling documents under data protection law, yes, and refusing means you will not be paid. At an unlicensed one you are handing identity documents to a business with no regulator, which is a real risk. The licence is the thing that makes the answer different, so check it before you upload anything.
At most casinos yes, and it is the best time to do it. You find out how the operator behaves while you still have nothing at stake, and you remove the single most common cause of a slow first withdrawal.
