KYC and AML

KYC Requirements for Online Gambling in the UK

What Gambling Commission licensees must verify before a customer can gamble, which registers they must check, and the AML and financial vulnerability checks that follow.

5 min readPart of kyc and aml

On this page
  1. What must be verified before a UK customer can gamble?
  2. What AML due diligence applies?
  3. What financial checks apply after onboarding?
  4. What does a UK verification process look like step by step?
  5. How should UK operators handle failed electronic verification?
  6. How does UK KYC compare with Ontario and Malta?
  7. Worked example: a UK sign-up
  8. What mistakes do operators commonly make?
  9. Checklist
  10. Frequently asked questions
  11. Sources
  12. More guides

In Great Britain, remote operators must verify a customer’s name, address and date of birth before the customer can deposit or gamble, including on free-to-play versions. They must check GAMSTOP, apply customer due diligence and ongoing monitoring under the Money Laundering Regulations 2017, screen for PEPs and sanctions, and run light-touch financial vulnerability checks when net deposits reach £150 in 30 days.

Key takeaways

  • Age and identity verification before deposit or play has applied since May 2019.
  • GAMSTOP participation is mandatory for remote licensees in scope (LCCP 3.5.5), widened from 1 April 2024 to more telephone and messaging channels [1].
  • Casinos fall under the Money Laundering Regulations 2017; PEPs need EDD under regulation 35 [2] [3].
  • Financial vulnerability checks are triggered at £150 net deposits in 30 days [4].
  • Direct marketing needs opt-in consent by product and channel under SR code 5.1.12 [5].
18minimum age
May 2019verify before play
£150FVC trigger in 30 days
LCCP 3.5.5GAMSTOP participation

What must be verified before a UK customer can gamble?

UK verification before play
Item Requirement When
Name, address, date of birth Verified Before deposit or gambling, including free-to-play
Age (18+) Verified Before gambling
GAMSTOP status Checked At registration and per scheme rules
PEP and sanctions Screened Onboarding and ongoing

What AML due diligence applies?

Remote casino operators are subject to the Money Laundering Regulations 2017. The Gambling Commission’s guidance requires a risk-based approach: customer due diligence, ongoing monitoring, enhanced due diligence for higher-risk customers, and policies that are applied effectively under licence condition 12.1.1 [2]. For PEPs, regulation 35 requires senior management approval, source of funds and wealth checks and closer monitoring, with domestic PEPs a lower risk starting point since 2024 [3].

What financial checks apply after onboarding?

UK financial checks
Check Trigger Data Source
Financial vulnerability check £150 net deposits in 30 days Public records: bankruptcies, CCJs, IVAs, DROs [4]
Financial risk assessment (staged) Stage one: net deposits over £5,000 in 24 hours (£2,500 under 25) Credit reference data [8]

See affordability checks and UK financial risk assessments.

What does a UK verification process look like step by step?

  1. Collect detailsName, address, date of birth and email at registration.
  2. Verify electronicallyCheck identity and age against electronic data; ask for documents only if this fails.
  3. Check GAMSTOPMulti-operator self-exclusion check before the account opens [1].
  4. Screen PEPs and sanctionsAt onboarding and on list updates [3].
  5. Set risk levelAssign a customer risk rating that drives monitoring and EDD triggers [2].
  6. MonitorFinancial vulnerability checks at £150 net deposits in 30 days [4], and further checks as spending grows.

How should UK operators handle failed electronic verification?

Failed verification routes
Failure Next step
Name or address mismatch Ask for a recent bank statement or utility bill
Age not confirmed Ask for passport or driving licence; no play until verified
Possible duplicate account Review before opening
Sanctions potential match Hold and review; do not tip off

How does UK KYC compare with Ontario and Malta?

UK compared
Topic Great Britain Ontario Malta Source
Verify before play Yes Yes Age yes; CDD by €2,000 [2] [9] [10]
Minimum age 18 19 18 [9]
Central self-exclusion GAMSTOP BetGuard Operator level [1] [11]

Worked example: a UK sign-up

  1. Customer enters name, address and date of birth.
  2. Electronic verification matches credit and electoral data; age confirmed.
  3. GAMSTOP check: not registered. PEP and sanctions screening: no match.
  4. Marketing preferences collected by product and channel.
  5. Account open for deposit.

What mistakes do operators commonly make?

Letting customers play before verification

Prohibited since 2019.

Skipping GAMSTOP on new channels

Scope widened in April 2024 [1].

One-off KYC

Ongoing monitoring is required [2].

Marketing without channel consent

SR code 5.1.12 requires opt-in by product and channel [5].

Checklist

  • Name, address, DOB verified before deposit.
  • GAMSTOP checked.
  • PEP and sanctions screening.
  • CDD and EDD policy applied.
  • FVC at £150 in 30 days.
  • Marketing consent by product and channel.
  • Electronic verification first.
  • Failed verification routes documented.

Frequently asked questions

Do UK casinos have to verify my age before I play?

Yes, before you can deposit or gamble, including free-to-play games.

What is GAMSTOP?

The national online self-exclusion scheme that UK remote operators must participate in.

Will a UK casino check my credit file?

Financial vulnerability checks use public records; staged financial risk assessments will use credit reference data with no credit score impact, according to the Commission.

Can I play before uploading documents?

Only if electronic verification has already confirmed your identity and age.

Are PEPs allowed to gamble in the UK?

Yes, with enhanced due diligence and senior approval.

What is the minimum age?

18.

Why do I have to choose marketing preferences?

Operators need your opt-in consent by product and channel.

Who enforces KYC rules?

The Gambling Commission.

Can I gamble in the UK before verification?

No. Identity and age must be verified before a customer can deposit or gamble.

Are financial vulnerability checks credit checks?

They use public data and must not affect credit scores.

Sources

  1. Gambling Commission: LCCP 3.5.5 remote multi-operator self-exclusion
  2. Gambling Commission: AML and CTF guidance
  3. Gambling Commission: notice on politically exposed persons
  4. Gambling Commission: financial vulnerability checks (May 2026)
  5. CMS: update to direct marketing requirements (SR code 5.1.12)
  6. Gambling Commission: QuinnBet public statement
  7. Gambling Commission: Grosvenor public statement
  8. Gambling Commission: financial risk assessments in a staged approach
  9. AGCO: Registrar’s Standards for Internet Gaming
  10. FIAU: Implementing Procedures
  11. AGCO: centralized self-exclusion in effect

KYC rules by market

When identity and age must be verified in eight regulated markets, and which registers apply.

Casino withdrawals in the UK

LCCP withdrawal rules, the reverse withdrawal ban, closed loop, ADR and Gambling Commission cases.

United Kingdom

Payments, KYC, responsible gambling and marketing rules in United Kingdom.

Affordability checks

UK financial vulnerability checks, Dutch thresholds, German limits and Sweden’s duty of care.

PEP and sanctions screening

Screening players against PEP and sanctions lists: when, which lists, and how to handle matches.

Further reading elsewhere