KYC at a UK-Licensed Casino: The Standard Check in Five Steps, With the Rule Behind Each

Hannah BirchEditorUpdated: 17 October 2026Checked by: Rob Sutton

At a casino licensed by the Gambling Commission the identity check is not a hurdle at the end; it is the first thing that happens. Age before a deposit or a demo, name and address and date of birth before a bet, a public-record check at £150 of net deposits, customer due diligence at £2,000, and a rule that stops the operator asking at payout for anything it should have asked at the start.

No KYC verified: deposit and withdrawal tested.

Step one: age, ahead of any deposit or demo

A licensee must verify that you are 18 or over before you can deposit any funds, before you can open a free-to-play version of a gambling game, and before you can gamble with your own money or with a bonus. The condition also requires the operator to warn prospective customers that underage gambling is an offence. Gambling by a 16- or 17-year-old is an offence under the Act, and inviting or allowing anyone under 18 to gamble is an offence for the operator.

The demo lock is the part players notice. A site that lets you spin a slot "for fun" without any check is, by that fact alone, not operating under a Gambling Commission licence.

Step two: identity, before a bet

Before you can gamble, a licensee must verify at least your name, your address and your date of birth. The Commission's page for players puts it without qualification: every online gambling business must ask you to prove your age and identity before you gamble, and a customer cannot place a bet until verified. The method is the operator's, documents or electronic checks, but the point in time is the licence's.

The same condition carries the rule that does most of the work on this site. The operator must take reasonable steps to keep the information it holds accurate, and it must not demand at the point of withdrawal information, such as identity documents, that it could reasonably have requested earlier. The Commission describes a withdrawal delayed for identity reasons as a possible breach of that condition.

Age, 18 or over — When: Before deposit, demo or play · Rule: LCCP SR 3.2.11
Name, address, date of birth — When: Before a bet · Rule: LCCP 17.1.1
Accuracy of that information — When: Ongoing, reasonable steps · Rule: LCCP 17.1.1

Step three: the £150 public-record check

Once your net deposits, deposits minus withdrawals, exceed £150 in a rolling 30-day period, a licensee must run a financial vulnerability check: at minimum a customer-specific search of public records for significant indicators of financial difficulty, such as bankruptcy, a county court judgment, an individual voluntary arrangement or a debt relief order. The check is run by the operator against records. It is not a request for documents from you, it does not cap your deposits, and the threshold was £500 until it was lowered.

Two things follow. The figure is low enough that most regular players cross it in their first month, so the check is part of ordinary play rather than a flag. And because it counts net deposits across every payment method, it cannot be avoided by spreading deposits over cards, transfers and wallets.

Step four: customer due diligence at £2,000

A casino is a relevant person under the money-laundering regulations, and for remote gambling the regulations require customer due diligence where a customer deposits, withdraws or wagers £2,000 or more, in one transaction or in several that appear to be linked. The threshold is set in pounds since the most recent amendment. Separately, a licensee must assess its money-laundering and terrorist-financing risks, including the risks of new payment methods, at least once a year.

Due diligence at that level is where a source-of-funds question can arise. The Commission's guide to players names bank statements as the document used to check that your source of funds is legitimate, and names income information as something an operator may ask for to assess affordability; the threshold at which a licensee must make the request is not published, so the request is proportionate to the operator's own risk assessment rather than fixed at a sum.

£150 net deposits in 30 days — What it triggers: Public-record vulnerability check · Who it binds: Gambling Commission licensees
£2,000 deposited, withdrawn or wagered — What it triggers: Customer due diligence · Who it binds: Casinos under UK money-laundering regulations
No published figure — What it triggers: Source-of-funds request, bank statements · Who it binds: Licensees, by risk assessment

Step five: what a payout may still wait for

A verified player's withdrawal at a licensee can still be reviewed, and the review has three legitimate contents: bonus conditions, where wagering may not have been set above 10 times; a duplicate-account check; and a source-of-funds question where the operator's risk assessment calls for one.

What the review may not contain is a demand for identity documents the operator could have collected before you played. That distinction, between a question about the money and a question about you that is being asked late, is the test to apply to any hold.

Behind the review sit two protections that exist at a licensee only. A complaint the operator has not resolved within eight weeks can go to an alternative dispute resolution body, free to you. And the operator must have told you in its terms whether your funds are protected if it becomes insolvent, and at what level; the duty is disclosure, not a guarantee, but it means the answer is written down before you deposit.

The sequence as a timeline

Registration. Name, address, date of birth and contact details entered; the operator runs its checks. No deposit, demo or bet until age and identity are verified.
First deposit. Accepted on a verified account. The credit card ban applies: no credit card, directly or through an e-wallet.
Play. The slot stake cap applies, £5 per spin for players aged 25 and over, £2 for players aged 18 to 24; a deposit limit you set applies from the first payment.
£150 net deposits in 30 days. Public-record check, run by the operator.
£2,000 in deposits, withdrawals or wagering. Customer due diligence under the money-laundering regulations.
Withdrawal. Review of bonus, duplicates and, where the risk assessment calls for it, source of funds. No late identity demands.
Dispute. Operator's procedure, then free ADR after eight weeks.

Every item on that list is something a no KYC operator either defers to the withdrawal or does not do. The money-laundering rules that make the list what it is are set out on the main page under the money-laundering rules behind every check. What the no KYC label promises against that baseline is under what the no KYC label actually promises, and the moment the deferred version of this check arrives is under when a deferred check finally arrives.

Why the sequence exists

The sequence is not there to slow you down. Each step is attached to a stated purpose in the licence conditions: the age check to keep gambling away from children, the identity check so that the person gambling is the person the operator knows and the person it will pay, the vulnerability check so that someone in financial difficulty is noticed at £150 rather than at £15,000, due diligence so that gambling is not a laundering route.

The Commission's description of unlicensed sites is the same list read backwards: no age verification, no responsible gambling tools, no secure payments, no dispute resolution, and withheld payouts.

The cost of the sequence to a player is a few minutes at registration and, occasionally, a bank statement. The cost of its absence is borne at the withdrawal, by the player, with no body to appeal to.

Responsible gambling

Two of the five steps exist for your protection rather than the operator's: the age check and the £150 vulnerability check. Alongside them a licensee must participate in GamStop, which closes every Gambling Commission licensee at once for the period you choose and cannot be lifted early. You must be 18 or over to gamble in Great Britain. If gambling is causing you harm, the National Gambling Helpline is free on BeGambleAware at any hour, and GamCare and BeGambleAware offer help online.

Frequently asked questions

If I send no documents, what does a licensed casino verify me against?

The licence condition requires the operator to verify your name, address and date of birth before you gamble; how it does so is its choice. Many use electronic data checks first and ask for documents only when those fail. Either way, you cannot place a bet until the operator has verified you.

Can I try the demo games before the check?

No. A licensee must verify your age before you can deposit, before you can access a free-to-play version of a gambling game and before you can gamble with your own money or a bonus. The demo lock is a licence condition, not a marketing choice.

What happens if the check fails at sign-up?

The account stays unable to deposit or gamble until the operator has verified you by another route, usually documents. Nothing has been lost at that point, which is the difference between a check at the start and one at the payout.

Does the standard check ever repeat?

The operator must take reasonable steps to keep the information it holds accurate, and the money-laundering regulations require due diligence at £2,000 of deposits, withdrawals or wagering. A repeat request for the same passport at withdrawal is not that; it is a late demand the licence forbids.

Is the £150 check a document request?

No. It is a check the operator runs against public records for indicators of financial difficulty, such as bankruptcy or a county court judgment, once your deposits minus withdrawals exceed £150 in a rolling 30 days. You may notice nothing; you should not be asked for payslips.

I am fully verified. Can a withdrawal still be held?

Yes, for reasons that are not identity: bonus conditions unmet, a duplicate account, or a source-of-funds question where the operator's risk assessment calls for one. A hold for a document the operator could have asked for earlier is the one the licence rules out.

What can I do if a licensed casino breaks these rules?

Complain through the operator's procedure in writing; if it is unresolved after eight weeks, take it to the free alternative dispute resolution body the operator must offer. The Commission does not settle individual disputes but does act on licence breaches it learns of.