KSA Tells Dutch Operators Initials Are Not Enough to Verify a Player's Bank Account

The Dutch regulator says licensed operators must match a player's full first names and surname against the name on the bank account, after an investigation found minors depositing from their own accounts and from youth accounts. Players verified the old way must be checked again.

• The Kansspelautoriteit (KSA) published guidance on 8 October on verifying bank accounts and other payment methods, after finding licensed operators did not always check them adequately
• The KSA said it had signals that minors could in some cases deposit from their own bank account, that youth accounts (jongerenrekeningen) could be used, and that a minor's account could be linked to an adult player's account
• Operators must check, before or at the first deposit, that the full first names and surname on the player's identity document match the name on the bank account; initials alone are not enough, the KSA says
• Players not verified on all first names must be re-checked, business accounts refused, and credit cards and PayPal treated as a higher risk
• It comes 15 days after the regulator's account-closure guidance of 23 September, another written reading of existing player-account rules

The Regulator Found Operators Matching on Initials, and Minors Getting Through

The KSA said an investigation of the registration process showed operators did not always verify bank accounts adequately. It had received signals that minors, although not allowed to gamble, could in some cases deposit with their own bank account. The investigation found youth accounts could be used to gamble, or a minor's bank account linked to the account of an adult player.

According to the guidance document, the investigation covered 9 licensed operators and used data from 4 Dutch banks. The weakness also affects people registered in Cruks, the national exclusion register, and people under court-ordered financial administration, and lets players open a second account in another name for bonus fraud or to get around limits, the KSA says.

The legal basis is the Decree on remote games of chance (Bkoa) under the Wet op de kansspelen. Article 4.11 requires an adequate quality check on the player's names and birth details as shown on the identity document and on the holder name of the nominated account (the tegenrekening); article 4.25 allows only payment instruments traceable unambiguously to the player; article 4.10 allows only natural persons to register.

What the KSA Now Expects

Before or during the first deposit from a new or changed account, the operator must check that the full first names and surname on the identity document match the name on the account, the guidance says. Operators often relied on the holder name in transaction details, which usually shows only initials. The KSA says that is insufficient.

It points instead to a name-check mechanism used in other sectors and, since October 2025, mandatory under EU rules for payments between European banks. Variants are already used by two thirds of Dutch online operators, according to the guidance, but must be applied correctly; the check can also show whether an account is personal or business. A match can be accepted, a non-match cannot, and a partial match needs an additional, possibly manual, check; a small deviation such as "ij" for "y" can pass, a larger one demands more scrutiny. iDIN and transaction data may still be used alongside other sources, and the KSA recommends combining an identity document scan, iDIN, a liveness check and the player's own details.

Other payment methods should meet the same traceability test. Paysafe can supply verified full names and a date of birth. PayPal does not require a private account holder to upload an identity document at the outset, and a full-name check with credit card issuers is not yet possible, though the KSA understands a mechanism is being developed. It treats both as a higher risk that operators are expected to mitigate.

Business accounts, of a company or a sole trader, must be refused. Even a sole trader's account traceable to the player is "absolutely undesirable", the KSA says, citing larger sums, tax money held for months and money-laundering risk. Players whose account was not verified on all first names must be re-checked, by a bulk check or at their next login, deposit or withdrawal. The guidance sets no deadline.

The April Finding Was Reassuring. The Remedy Is Not Optional

On 13 April the KSA reported, from the same investigation, "virtually no serious abuses" at licensed operators: in a very limited number of cases players could use someone else's bank account or link their own to another player's, almost always where people shared exactly the same initials. Chairman Michel Groothuizen said then that where minors did gamble, it would be on the illegal market. Today's release, leading with youth accounts and minors depositing from their own accounts, is sharper. What has changed is the remedy. In April operators said they had no ready solution; the KSA now says one exists and two thirds of the market already uses a version of it. As a reading of the Bkoa rather than a new rule, it leaves licensees little room to say they were not told, from a regulator that weighed five years of breaches in its licence renewals.

The Back Book Is Where the Cost Sits

Changing the sign-up flow is the easy part. The harder work is re-checking every player verified on initials, the manual review that partial matches will create, and the foreign accounts and initials-only driving licences that do not fit an automated match. Where operators re-check at the next login, the KSA notes, long-inactive players may not be checked for a long time. Each added check is also friction in a market where, the KSA's chairman said in September, half of every euro goes to illegal operators, and where, its 2026 supervisory agenda says, illegal sites often lack adequate age checks entirely.

A Name Check Verifies the Account, Not the Person Using It

The guidance is candid about its limits. A minor with exactly the same first names as a parent will probably pass an automated check, the KSA concedes. Its 2026 supervisory agenda says minors on legal sites often play through the accounts of adult acquaintances, which no bank-name match will catch. That is why the document's closing best practices matter: liveness checks, an identity document noting the holder cannot sign, an email address carrying a different name or birth year, a bank statement marked "jongerenrekening", a child's voice on the phone. None is mandatory. The regulator has asked for powers to test operators with false identities, which would let it check those controls in practice.

The KSA has closed the gap its investigation found with a tool most operators already hold. Whether minors are kept out will depend as much on the checks it still leaves optional.