KYC and AML Checks in Online Gambling

Every licensed online gambling operator asks its customers who they are, and a growing number ask where their money comes from. The requests are the visible end of two overlapping obligations: know your customer (KYC), the identity and age verification every regulated market requires, and anti-money laundering (AML), the duty to prevent the business being used to launder the proceeds of crime. This guide explains what each requires, why, what the customer sees, what the operator does behind it, and what happens when a check is failed or refused.

It is written for both sides: for the customer wondering why a withdrawal has been held pending a bank statement, and for the professional building or running the function.

Why gambling is a money-laundering risk

Gambling converts money into chips, bets or balances and back again, at scale, quickly, with a plausible reason for a large cash movement in either direction. A criminal who deposits £50,000, wagers a little and withdraws £48,000 has funds that now come from a licensed gambling operator, with a transaction history to show for it. Regulators have treated casinos as high-risk for laundering since the international standards were written, and online casinos are covered by the same standards in every regulated market. Betting is treated as lower risk in some regimes and identically in others.

The controls that follow are the international ones, set by the Financial Action Task Force and implemented in national law: identify the customer, understand their business with you, monitor it, report what is suspicious, and keep records. In gambling, the customer's "business" is the money they gamble with, which is why the enquiries reach into bank statements and payslips.

Know your customer

Identity and age. Before a customer can gamble (in Britain and most European markets) or before they can withdraw (in some others), the operator must verify who they are and that they are of age. Verification is usually done electronically, by matching the name, date of birth and address the customer supplies against credit-reference, electoral and identity databases; where the match fails, the operator asks for documents: a passport or driving licence, and a proof of address such as a utility bill or bank statement. Selfie-and-document matching, in which the customer photographs themselves and their ID and software compares them, is now standard.

Where the customer is. Regulated operators verify location, because their licence covers a territory. Address data, IP address, device signals and, in the American states, GPS geolocation establish that the customer is where they say and where the operator may serve them.

Who the customer is, beyond the name. Screening against sanctions lists, politically exposed person lists and adverse-media databases at onboarding and periodically. A match does not mean refusal; it means enhanced due diligence.

Ongoing. Verification is not a one-off. Operators re-verify when details change, when documents expire, when a risk trigger fires or on a schedule. A customer who has been verified for years can be asked again.

Anti-money laundering

AML builds on KYC and goes further. The operator must assess the money-laundering risk of its business as a whole, assess each customer against that risk, and apply due diligence in proportion.

Customer due diligence is the standard level: identity, the purpose of the relationship (gambling), and monitoring of the account's activity for anything inconsistent with what the operator knows about the customer.

Enhanced due diligence applies to higher-risk customers: politically exposed persons, customers from high-risk jurisdictions, customers whose activity is unusual for their profile, and customers whose deposits or losses cross the operator's thresholds. Enhanced due diligence is where source of funds and source of wealth enquiries come in.

Source of funds asks where the money being gambled came from: salary, savings, a business, an inheritance, a property sale. The evidence is bank statements showing the deposits' origin, payslips, tax returns, sale documents. Source of wealth asks how the customer came to have their overall assets, and is asked of the highest-value customers. The distinction matters: a customer can show that this month's deposits came from a salary (funds) without explaining how they own a portfolio of properties (wealth).

Transaction monitoring watches the account for the patterns that suggest laundering rather than gambling: deposits followed by minimal play and withdrawal, deposits from many payment sources, mismatches between the payment method's name and the account's, transfers between customers where the product allows them, structuring below thresholds, and velocity that does not fit the customer's profile. The AML and Financial Crime course covers monitoring design.

Reporting. When the operator suspects laundering it must report to the national financial intelligence unit (in Britain, a suspicious activity report to the National Crime Agency) and must not tell the customer it has done so. It may also need consent before proceeding with a transaction.

Records. Everything, for years, available to the regulator.

What triggers a check

Customers ask why they were checked when a friend was not. The triggers are a mixture of rules and risk models.

Registration and first withdrawal. Identity and age, always.

Thresholds. Cumulative deposits, losses or withdrawals crossing a level set by the operator's risk assessment, often with a regulatory floor. The levels are not published, are different at every operator and change.

Payment behaviour. A new card or wallet, a payment in a different name, a method associated with fraud, a chargeback, a withdrawal to a destination that is not the deposit source.

Profile mismatches. Deposits inconsistent with the customer's stated occupation or with the operator's estimate of their affordability; a young customer with very large deposits; a rapid escalation.

Screening hits. A sanctions, PEP or adverse-media match.

Play patterns. Minimal-risk wagering, immediate withdrawal after deposit, large transfers in peer-to-peer games.

Random and periodic review. Some checks are simply scheduled.

What the customer sees

A request for documents, usually in the account area, with a withdrawal held until they are supplied. Operators are required to be clear about what they need and why in general terms, and are required not to reveal that a suspicious activity report has been made. The tension is real: a customer told "we need a bank statement before releasing your withdrawal" is being asked for a source-of-funds check, and the operator cannot always say whether the trigger was routine or a suspicion.

Regulators in most markets require that verification be completed before the customer's funds are held hostage for long, and complaints about withdrawal delays are among the commonest gambling complaints. Britain's rules require that operators verify identity before play, precisely so that the check does not arrive at the moment a customer wants their money. Source-of-funds requests at withdrawal remain the largest source of friction.

What happens when a check fails

Documents rejected. Usually because they are unreadable, expired, do not match the account, or are not the type requested. The operator asks again.

Identity not established. The account is closed and funds returned to the payment source, since the operator cannot pay a person it cannot identify.

Source of funds not established. The operator may restrict the account, refuse further deposits, close it, and in some cases withhold funds pending a suspicious activity report and the authorities' response. This is the outcome customers find most alarming, and it is the one the rules are designed to produce when a customer cannot or will not explain their money.

Suspicion confirmed. A report is filed; the operator may be required to hold funds; the customer may be contacted by the authorities. The operator will not explain.

Screening match. Enhanced due diligence, and possibly refusal, depending on the nature of the match.

Customers who believe a check was wrong can complain to the operator, then to the dispute-resolution body the operator's licence names, and to the regulator. Regulators do intervene in cases of unreasonable withholding, and they have fined operators for both failing to check and for checking so badly that customers were harmed.

KYC and responsible gambling

The same identity data serves player protection. A customer who is verified can be self-excluded and stay excluded, can be matched against national exclusion schemes, can have their age enforced, and can be affordability-assessed against public data. The affordability checks being introduced in Britain and considered elsewhere are, in effect, KYC extended to the customer's finances, and they are run through the same data providers. Operators that have invested in verification find that the AML and the responsible gambling functions share most of their infrastructure. The Responsible Gambling course covers the protection side.

Unlicensed operators

Offshore, sweepstakes and crypto casinos generally verify less, later or not at all, and it is part of their appeal to some customers. The consequence is that they are useful for laundering, are excluded from the payment and banking systems that regulated operators use, and cannot deliver the protections that depend on identity. A customer who values the absence of checks should understand what else is absent. The Crypto Casinos and Sweepstakes and Social Casino courses cover both segments.

For the professional

The function is built from: a risk assessment that justifies every threshold; a verification stack (electronic checks, document capture, biometrics, screening) with a defined fallback; monitoring rules and, increasingly, models; a case-management system with an audit trail; trained staff who can read a bank statement; a reporting process with a named officer; and a testing and review cycle. Regulators inspect all of it and fine for gaps in any of it. The AML and Financial Crime course is the full treatment; the iGaming Compliance Checklist guide places it among the other obligations.

Frequently asked questions

Why does a casino need my bank statement? Because its AML obligations require it to establish where the money you gamble with comes from, usually after your deposits or losses cross a threshold or a risk trigger fires.

Can an operator keep my money? It can hold a withdrawal while verification is completed, and can withhold funds where it suspects laundering and reports it. It cannot keep verified funds without cause, and the regulator and dispute bodies exist for that.

Is KYC the same as AML? KYC is identity and age verification; AML is the wider framework that uses it, including due diligence, monitoring and reporting.

What is source of funds? Evidence of where the money being gambled came from: salary, savings, a sale. Source of wealth is how the customer came to have their assets overall.

Why was I checked and my friend was not? Thresholds, payment behaviour, profile, screening and play patterns differ by customer and by operator, and some checks are random.

Related on iGaming Times

AML and Financial Crime for Gambling is the full course. Fraud and Risk Management covers identity and payment fraud, which share the same tools. The glossary defines KYC, CDD, EDD, PEP, SAR and the rest.

---

Regulation, tax and market figures move quickly, sometimes mid-year. Where this guide gives a number, treat it as a starting point and confirm the current position with the named primary source before you rely on it.