KYC and AML

KYC Rules for Online Gambling by Market

When identity, age and address must be verified in Great Britain, Ontario, Malta, Sweden, Germany, Brazil, Mexico and US states, which self-exclusion registers must be checked, and the anti-money laundering thresholds on top.

12 min readPart of kyc and aml

On this page
  1. What does KYC mean in online gambling?
  2. How does a typical KYC flow work?
  3. What are the KYC rules in each market?
  4. How do AML rules add to KYC?
  5. How do operators run KYC across several markets?
  6. How do operators handle KYC queries in support at scale?
  7. Who owns KYC inside an operator?
  8. How should operators measure KYC performance?
  9. How should support explain verification requests?
  10. How does identity verification work technically?
  11. When should operators re-verify customers?
  12. How does a multi-market KYC engine decide what to check, step by step?
  13. Which regulator sets KYC rules in each market?
  14. What does a good KYC operation look like?
  15. Worked example 2: a spoofed selfie
  16. Worked example: one player, three markets
  17. What mistakes do operators commonly make?
  18. Checklist
  19. Frequently asked questions
  20. Sources
  21. More guides

In most regulated online gambling markets, identity and age must be verified before a player can gamble, not at first withdrawal. Great Britain, Ontario, Sweden, Germany, Brazil and US states all require verification up front, while Malta lets remote operators complete full customer due diligence by a €2,000 deposit threshold. Self-exclusion registers (GAMSTOP, Spelpaus, OASIS, BetGuard and others) and anti-money laundering rules add further checks.

Key takeaways

  • Verify before play is the norm: Great Britain since 2019, plus Ontario, Sweden, Germany, Brazil and US states.
  • Minimum ages differ: 18 in most of Europe, Brazil and Mexico; 19 in Ontario; 21 for US online casinos.
  • National self-exclusion registers must be checked at registration and often at login.
  • AML rules sit on top: customer due diligence, PEP and sanctions screening, and reporting thresholds that differ by market.
  • Electronic verification (BankID, CPF and facial checks, credit reference data) clears most players without documents.
8markets compared
€2,000Malta CDD threshold
325 UMAMexico identification threshold
19 / 21Ontario / US iCasino minimum age

What does KYC mean in online gambling?

KYC stands for “know your customer”. In gambling it covers three things: confirming a player is old enough, confirming they are who they say they are, and collecting enough information to meet anti-money laundering (AML) rules, including customer due diligence, screening and ongoing monitoring. This page compares the rules in eight markets; each has a detailed page linked from the table below.

How does a typical KYC flow work?

Typical KYC flow1RegistrationPlayer enters name, date of birth, address anda national identifier where required.2Electronic checkData is matched against databases or abank-based eID such as BankID.3Register checksSelf-exclusion and exclusion registers, PEPand sanctions lists.4Document fallbackIf electronic checks fail: ID document, selfiewith liveness, proof of address.5Ongoing monitoringRisk scoring, source of funds triggers andperiodic re-verification.
A typical online gambling KYC flow.

Most drop-off happens at the document fallback; player drop-off after registration covers how to measure it and keep players informed while they wait. The igaming.cx guide on cutting KYC drop-off without weakening compliance covers fixes that keep controls intact.

What are the KYC rules in each market?

Each market below has its own detailed page.

KYC rules by market
Market Regulator Min age When identity is verified Registers Source
Great Britain Gambling Commission 18 Before deposit or gambling, including free-to-play GAMSTOP [1] [2]
Ontario AGCO; iGaming Ontario 19 Before play; player geolocated in Ontario BetGuard and operator lists [3] [4]
Malta MGA; FIAU for AML 18 Age before play; full CDD by €2,000 in deposits Operator self-exclusion [5] [6]
Sweden Spelinspektionen 18 Registration and identification before gambling Spelpaus [7]
Germany GGL 18 Full identification before play; preliminary ID allowed under GwG OASIS, LUGAS [8]
Brazil SPA 18 At registration: CPF validation and facial recognition National self-exclusion platform [9] [10]
Mexico SEGOB; SAT and UIF for AML 18 At registration; AML identification from 325 UMA Operator lists; UIF lists [11]
New Jersey Division of Gaming Enforcement 21 At registration, with multi-source authentication State self-exclusion and exclusion lists [12]

How do AML rules add to KYC?

AML duties that sit on top of KYC
Market AML law and supervisor Key thresholds or duties Source
Great Britain Money Laundering Regulations 2017; Gambling Commission CDD and ongoing monitoring; PEP rules under regulation 35 [13] [14]
Ontario PCMLTFA; FINTRAC Reports at CA$10,000 (large cash, virtual currency, casino disbursements); PEP determination at $100,000 transactions [15] [16]
Malta PMLFTR; FIAU CDD at €2,000 in deposits [6]
Germany GwG section 16 Own-name payment accounts; no EUR threshold for CDD [8]
Brazil Ordinance 1,143/2024; Coaf AML programme and suspicious transaction reports [17]
Mexico LFPIORPI; SAT and UIF Identification at 325 UMA; notice at 645 UMA; records ten years [11]
US states Bank Secrecy Act; FinCEN Currency transaction and suspicious activity reports [18]

See source of funds checks, PEP and sanctions screening and EDD triggers.

How do operators run KYC across several markets?

  1. Build to the strictest ruleVerifying before play everywhere is simpler than running different flows per market.
  2. Use electronic verification firstBankID in Sweden, CPF and facial checks in Brazil, credit reference and database checks in the UK and US.
  3. Design the document fallbackClear instructions, mobile capture and fast review reduce drop-off.
  4. Check registers every time they matterAt registration and, where required, at login.
  5. Tie KYC to paymentsOwn-name payment rules in Germany and Brazil make the payment account part of identity.

How do operators handle KYC queries in support at scale?

“Why do you need my ID?” and “my document was rejected” are among the most common player contacts. At scale, operators answer from the live verification status, give market-specific instructions and route suspected fraud or enhanced due diligence to compliance. igamingsupportai.com covers this in its KYC support guide, and Cevro describes how to automate KYC for online casinos.

Who owns KYC inside an operator?

KYC ownership
Team Responsibility
Compliance and MLRO Policy, risk assessment, EDD decisions, reporting
KYC operations Document review, manual checks, re-verification
Product Registration flow, document capture UX
Payments Own-name payment checks, closed loop
Support Explaining requests, helping players finish verification
Data and engineering Provider integrations, register checks, audit logs

How should operators measure KYC performance?

KYC metrics
Metric Why it matters
Electronic pass rate Share verified without documents; higher means less friction
Document review time Long reviews delay play and payouts
Registration drop-off at KYC Lost players at the verification step
Re-verification backlog Expired documents and risk-driven checks
Register check failures Self-exclusion and sanctions hits handled correctly
KYC-related contacts Confusing requests drive support volume

How should support explain verification requests?

Plain verification explanations
Request Plain explanation
ID document “The law requires us to confirm your identity and age before you play. A photo of your passport or driving licence is enough.”
Proof of address “We could not match your address electronically. A recent bank statement or utility bill showing your name and address will do.”
Selfie “This confirms you are the person on the document. It takes a few seconds.”
Re-verification “Your document has expired, so we need an updated one to keep your account active.”

How does identity verification work technically?

Verification methods
Method How it works Strengths Weaknesses
Database checks Match name, address and date of birth against credit, electoral or government data Fast, no documents Coverage gaps for young people and recent movers
Bank-based eID Player logs in with a bank ID such as BankID Strong identity assurance Only in markets with eID schemes
Document capture Photo of passport, ID card or driving licence, checked for security features Works almost everywhere Friction; fraud with fake documents
NFC chip reading Phone reads the chip in a passport or ID card Very strong Needs compatible phone and document
Liveness and face match Selfie video compared with the document photo Stops many impersonation attacks Accessibility and false rejections

When should operators re-verify customers?

Re-verification triggers
Trigger Example action
Document expiry Request an updated document
Change of name or address Verify the new details
Risk increase EDD and source of funds
Suspicious login or account takeover signs Re-verify identity before payouts
Sanctions or PEP list update Rescreen and review

See EDD triggers and account takeover.

How does a multi-market KYC engine decide what to check, step by step?

  1. Identify the licenceThe registration flow knows which licence the player falls under from their location and the brand. That decides the rulebook.
  2. Select the required checksEach market has a list: identity, age, national self-exclusion register, PEP and sanctions screening, and any market-specific items such as CPF in Brazil or geolocation in New Jersey.
  3. Run frictionless checks firstDatabase checks or bank-based eID run before any document request.
  4. Fall back to documentsOnly if frictionless checks fail does the player upload a document, with liveness where the risk needs it.
  5. Combine the resultsA rules engine decides: open the account, open with limits, ask for more, or refuse.
  6. Set the risk ratingThe outcome feeds the customer risk rating, which drives monitoring and EDD triggers.
  7. Record everythingWhich checks ran, their results and the decision are logged for audit.
  8. Re-verify on triggersDocument expiry, risk changes or suspicious account activity restart the relevant checks.

Which regulator sets KYC rules in each market?

KYC regulators by market
Market Regulator What it covers for this topic Official source
Great Britain Gambling Commission Verify identity and age before gambling; customer due diligence under the Money Laundering Regulations [1] [13] AML and CTF guidance, MLR 2017 regulation 35
Ontario AGCO and FINTRAC Registrar’s Standards on player verification; FINTRAC identification and PEP duties [3] [15] [16] Registrar’s Standards, FINTRAC casino guidance, FINTRAC PEP and HIO guidance
Malta MGA and FIAU Player Protection Directive; customer due diligence by the €2,000 threshold [5] [6] Player Protection Directive, FIAU Implementing Procedures
Sweden Spelinspektionen Identification before play and the Spelpaus check [7] Spelinspektionen
Germany GGL Identification, OASIS and LUGAS checks; own-name payment accounts [8] GGL, GwG section 16
Netherlands Kansspelautoriteit Identification and the Cruks register check Kansspelautoriteit
Brazil SPA CPF-based identity, age and facial checks, self-exclusion platform [9] [10] Secretaria de Prêmios e Apostas, Centralized self-exclusion platform
Mexico SEGOB Permit regime; identification under the LFPIORPI thresholds [11] SEGOB
New Jersey Division of Gaming Enforcement Registration data, multi-source authentication, age 21, exclusion lists [12] N.J.A.C. 13:69O-1.3, New Jersey DGE
Pennsylvania PGCB Age 21, identity verification and geolocation Pennsylvania Gaming Control Board
United States FinCEN Bank Secrecy Act duties for casinos [18] 31 CFR Part 1021

What does a good KYC operation look like?

KYC playbook
Area What good looks like
Pass rate Most players verified without documents in markets with good data coverage
Speed Document reviews completed within a published target, often the same day
Clarity Every request explains why, what is needed and how long it takes
Consistency One decision engine with market rules, not separate manual processes
Audit Every check and decision logged and retrievable by account
Support Agents and AI see verification status and the exact missing item

igaming.cx covers cutting KYC drop-off without weakening compliance, and Cevro describes how to automate KYC for online casinos.

Worked example 2: a spoofed selfie

  1. A new player in a document-based market uploads a passport photo and a selfie.
  2. The liveness check fails: the selfie appears to be a photo of a screen.
  3. The player is asked to retry with live video; the second attempt also fails.
  4. The case goes to manual review. The device is linked to two other recent registrations with different names.
  5. The account is refused and the device and document data are added to fraud rules. No deposit was taken.

Worked example: one player, three markets

An illustrative comparison of what the same 24-year-old player experiences when signing up at a licensed operator in three markets.

Step Sweden Brazil New Jersey
Sign-up BankID login; identity confirmed instantly CPF entered and validated; selfie with liveness Name, date of birth, address, SSN (or last four) entered
Register checks Spelpaus checked National self-exclusion and prohibited bettor rules State self-exclusion and exclusion lists
Location Not required for licensing Not geolocation based Geolocated inside New Jersey
First deposit Bank method in own name Pix from own-name account Card, ACH or other approved method
Time to play About a minute A few minutes A few minutes; documents if databases fail

What mistakes do operators commonly make?

Verifying only at withdrawal

In most markets identity must be verified before play.

One flow for all markets

Ignores minimum ages, registers and own-name payment rules.

Treating KYC as one-off

Ongoing monitoring and re-verification are required.

Skipping register checks at login

Some registers must be checked repeatedly.

No support playbook

Unanswered verification questions cause drop-off and complaints.

Unclear document requests

Players upload the wrong thing and churn.

No re-verification process

Expired documents and changed risk go unchecked.

Treating registers as optional

Self-exclusion and sanctions checks are legal duties.

Checklist

  • Minimum age per market enforced.
  • Identity verified before play where required.
  • Self-exclusion registers checked at the right moments.
  • PEP and sanctions screening at onboarding and ongoing.
  • AML thresholds per market configured.
  • Document fallback tested on mobile.
  • Support macros for verification questions.
  • Records kept for the required period.
  • Electronic pass rate tracked.
  • Re-verification process for expiry and risk changes.
  • Plain explanations for every request type.
  • KYC contacts tagged and reviewed.
  • Verification method mix chosen per market.
  • Re-verification triggers documented.

Frequently asked questions

When must an online casino verify my identity?

In Great Britain, Ontario, Sweden, Germany, Brazil and US states, before you can gamble. Malta-licensed operators must complete full due diligence by €2,000 in deposits.

What is the minimum gambling age by market?

18 in Great Britain, Malta, Sweden, Germany, Brazil and Mexico; 19 in Ontario; 21 for online casinos in US states.

Which self-exclusion registers must operators check?

GAMSTOP (Great Britain), Spelpaus (Sweden), OASIS (Germany), BetGuard (Ontario), Brazil’s national platform and state lists in the US, among others.

How does Brazil verify bettors?

CPF validation and facial recognition with liveness at registration under Ordinance 722/2024.

What is LUGAS?

Germany’s central file that tracks activity and enforces the €1,000 monthly cross-operator deposit limit.

What AML thresholds apply in Mexico?

Identification from 325 UMA and SAT notice from 645 UMA under the LFPIORPI.

Do US online casinos fall under federal AML rules?

Yes. Licensed casinos are financial institutions under the Bank Secrecy Act.

Why do I need to upload documents if I already gave my details?

Electronic checks sometimes cannot confirm identity, so operators fall back to documents.

How often is KYC repeated?

Operators re-verify when risk changes, documents expire or suspicion arises.

Is KYC the same as AML?

KYC is part of AML. AML also covers risk assessment, monitoring, screening and reporting.

What is electronic verification?

Checking identity data against databases or bank-based identity schemes instead of documents.

Why was my document rejected?

Usually because it was blurred, cropped, expired, or the name or address did not match.

What is NFC verification?

Reading the electronic chip in a passport or ID card with a phone to confirm the document is genuine.

Why might a young player fail database checks?

They may have little credit or electoral history, so documents are more likely to be needed.

Which market has the strictest KYC?

It depends on the measure. Germany and Brazil combine identity checks with national registers and own-name payment rules; Great Britain requires verification before any gambling.

Sources

  1. Gambling Commission: AML and CTF guidance
  2. GAMSTOP
  3. AGCO: Registrar’s Standards for Internet Gaming
  4. AGCO: centralized self-exclusion standards in effect
  5. MGA: Player Protection Directive
  6. FIAU: Implementing Procedures
  7. Spelinspektionen (English)
  8. Geldwäschegesetz section 16
  9. Shufti: Brazil bets KYC playbook
  10. gov.br: centralized self-exclusion platform for betting
  11. KYC Systems: LFPIORPI for games and raffles
  12. N.J.A.C. 13:69O-1.3 (Justia)
  13. Money Laundering Regulations 2017, regulation 35 (legislation.gov.uk)
  14. Gambling Commission: notice on politically exposed persons (May 2024)
  15. FINTRAC: casinos
  16. FINTRAC: PEP and HIO guidance for account-based sectors
  17. Mattos Filho: Brazil AML ordinance for betting operators
  18. eCFR: 31 CFR Part 1021

Source of funds and source of wealth

When SoF and SoW checks are triggered, what evidence counts, and what regulators penalised.

PEP and sanctions screening

Screening players against PEP and sanctions lists: when, which lists, and how to handle matches.

Enhanced due diligence triggers

How to set and wire EDD triggers so reviews happen before large losses or wins.

Self-exclusion schemes

GAMSTOP, Spelpaus, OASIS, Cruks, BetGuard, Brazil’s platform and US state lists compared.

AI support for withdrawal and KYC queries

What AI agents can resolve in payment and verification conversations, and what stays with people.

Further reading elsewhere