Casino ID verification: what they ask for, and why withdrawals stall

What the law actually requires

A UK-licensed operator must verify a customer's identity, age and address before allowing them to gamble. That is a licence condition, not a house rule, and it applies before your first spin rather than before your first withdrawal.

Separately, operators must run anti-money-laundering checks and — under affordability rules — may ask about the source of funds when deposits reach certain levels. These are different obligations and they generate different requests, which is why a perfectly ordinary account can be asked for documents twice.

Most of the first check now happens invisibly, through electronic database lookups against your name, date of birth and address. You only see a request for documents when the electronic check fails to match, or when a later trigger fires.

The documents you should expect

• Photo identity: passport, driving licence or national ID card. A photo of the document, not a photocopy of a photocopy.
• Address: a utility bill, bank statement or council tax letter, normally dated within the last three months, with the address matching your account exactly.
• Payment method ownership: a card image with the middle digits obscured, or a wallet screenshot showing your name.
• Source of funds, on larger accounts: payslips, bank statements or a tax return. This is the request people find most intrusive, and it is also the one most tightly required by law.

The timing test — the part that separates good operators from bad

A well-run casino asks for everything it needs before or at the moment you first deposit, publishes the list, and does not come back for more unless something genuinely changes. A badly-run one lets you deposit and play for months without a question, then produces a document list the moment you request a withdrawal — and sometimes a second list after you satisfy the first.

Both operators are technically fulfilling the same obligation. Only one of them is using it as friction. This is why our own testing protocol records the date of every document request against the date of the withdrawal request: the gap between those two dates is the finding, and it is a number no operator publishes about itself.

The verification criterion in our rating rubric awards full marks only when documents are requested once, up front, from a list published in advance. Documents that appear for the first time after a win is requested score zero.

How to make it painless

• Register with your exact legal name and current address, matching your bank records. Most failed electronic checks are a middle name or a flat number.
• Complete verification on the day you open the account, before depositing, if the site allows it.
• Photograph documents in daylight, whole page in frame, all four corners visible, no glare across the number.
• Use one payment method for deposits and withdrawals, in your own name. Third-party payments are refused everywhere and can freeze an account.
• Keep the submission confirmation. If a request is repeated, you want a timestamp showing what was sent and when.

When verification becomes a stalled withdrawal

If documents were accepted, the account is verified and a withdrawal is still sitting unpaid, ask support for two things in writing: the specific reason for the hold, and the date by which it will be resolved. A licensed operator has an eight-week window to give you a final response to a formal complaint, after which you can take it to the approved ADR body named in its terms — free of charge to you.

Keep your own record: the withdrawal timestamp, every document sent, every reply received. Complaints that succeed are almost always the ones with dates attached.

Three different checks that people call one thing

Almost every complaint about verification is really a complaint about one of three separate processes being confused with another. Separating them makes the whole thing predictable.

The first is age and identity verification. A British-licensed operator must confirm that you are over 18 and that you are who you say you are before you gamble at all — not before you withdraw, before you play. In practice this is usually an electronic check against public databases, invisible and instant, and it only escalates to documents when the electronic check fails to find you.

The second is address verification. This confirms where you live and typically fires when the electronic check is inconclusive or when something changes — a new device, a new payment method, a different address on the card. A utility bill or bank statement, usually dated within three months, settles it.

The third is source of funds, and it is the one that produces the arguments. This is an anti-money-laundering and affordability check, and it is not about who you are but about where the money came from. It fires on cumulative deposits, on a large single deposit, or on a pattern the operator's system flags. Payslips, bank statements and occasionally tax documents are what it asks for. Our separate guide on financial checks covers this one in detail.

If you know which of the three you are in, you know what will satisfy it. Sending a passport to answer a source-of-funds request does not move the queue at all.

Documents that get rejected, and the reasons that repeat

• A photograph of a screen. Statements downloaded as PDFs and then photographed on a monitor are refused almost everywhere. Send the original file, or a flat scan.
• Cropped edges. Verification teams need the whole document including the corners; a cropped image is treated as an altered one.
• A statement with the transactions blacked out. Redacting the amounts defeats the purpose of a source-of-funds check, and an operator will ask again. Redacting an account number is normally acceptable; redacting the balance is not.
• An address that does not match the account. If you have moved, update the account first and then send the document. A mismatch is the single most common cause of a second round.
• A document older than three months. Utility bills and bank statements are usually required to be recent; a council tax bill is often accepted for a full year, but only some operators say so.
• A payment method in someone else's name. British operators are required to refuse third-party payments, and a card in a partner's name will stop both the deposit and any withdrawal it funded.
• A selfie without the document in frame, when the operator asked for both. Read the instruction rather than the general idea of it.

Return to source, and why your first deposit method matters

Most British operators pay withdrawals back to the method that funded the account, up to the amount deposited. It is an anti-money-laundering practice rather than an arbitrary rule, and it has one practical consequence worth planning around: your first deposit method decides how your first withdrawal behaves.

Deposit by card and the payout returns to that card, subject to your issuer's clearing time on top of the operator's processing — often one to three working days once released. Deposit by e-wallet and the payout usually lands within minutes of release. Deposit by open banking and it typically returns to the same account, quickly.

The awkward case is a closed card or an expired one. If the method that funded the account no longer exists, the operator has to verify an alternative destination, and that is an extra round of documents at exactly the moment you want the money. Keeping one working method attached to the account avoids the whole situation.

Where a withdrawal exceeds total deposits, the excess normally goes to a bank account, which usually requires a statement showing the name, sort code and account number matching the account holder.

How long it should take, and what to do at each stage

A straightforward identity check that requires documents is normally resolved within one working day at a well-run operator, and within three at most. Source-of-funds reviews take longer — three to five working days is common, and longer if the operator asks a follow-up question.

At 48 hours with no response, ask for a status update in writing through the account's message system rather than live chat, so there is a record. Ask two specific questions: which document is outstanding, and which team is reviewing it.

At five working days, raise a formal complaint. The phrase that matters is "I would like to raise a formal complaint and receive a final response". That wording starts the operator's regulated complaints process, which has to conclude within eight weeks, and it is the step that unlocks alternative dispute resolution.

At eight weeks, or as soon as you have a final response you disagree with, go to the operator's ADR provider. It is free, it is independent, and it can order the operator to pay. The regulator does not adjudicate individual disputes, though reporting to it does feed the compliance picture that produces the enforcement cases we mirror.

Throughout, keep every document you send and the date you sent it. Verification disputes are almost always won on the record rather than on the argument.

Age verification, and why it happens before you play

Britain is unusual in requiring age and identity verification before a customer can deposit or gamble, rather than at the point of withdrawal. The rule closed a gap that used to let under-18s play for weeks and only be discovered when they tried to take money out — at which point the operator kept the stakes and the family found out at the worst possible moment.

For an adult with an ordinary credit footprint, the check is invisible: an electronic lookup against public records, done in seconds during registration. It escalates to documents when the lookup cannot find you, which happens most often to people who have recently moved, recently returned to the UK, or are not on the electoral roll.

That is worth knowing because it explains an otherwise baffling experience: two people sign up at the same casino on the same day, one plays immediately and one is asked for a passport. Nothing has gone wrong in the second case, and there is no appeal to make — the operator is required to resolve it before allowing play.

What happens if verification fails

The outcome depends on which check failed and why, and the difference is worth knowing before it happens.

If age verification fails because you are under 18, the operator must return stakes and must not pay winnings. That is not a penalty clause; it is the statutory position, and no operator can waive it.

If identity verification fails because the documents do not match — a different name, an address the operator cannot confirm — the account is normally suspended until it is resolved. Deposits are generally returnable; winnings usually are not paid until the account is verified, and an operator that pays out to an unverified account is the one taking the regulatory risk.

If a source-of-funds review is not satisfied, the operator may close the account. In that case your own funds should be returned to source. Winnings are the contested case, and the answer depends on the specific terms and on whether the operator can justify its decision to an adjudicator. This is the scenario where an ADR complaint is most often worth making, and where a complete record of what you sent and when decides the outcome.

One thing to avoid entirely: opening a second account to get around a stalled first one. Duplicate accounts breach the terms at every British operator, and they convert a delay you would probably have won into a closure you will not.

What they keep, and for how long

Verification hands a gambling company your identity documents, your address and, in a source-of-funds review, your bank statements. It is reasonable to ask what happens to them afterwards.

British operators hold customer records under anti-money-laundering rules and the Gambling Commission's licence conditions, and the retention periods are measured in years rather than months — typically at least five years after the relationship ends for AML records. Data-protection law gives you the right to ask what is held and to have inaccurate data corrected; it does not give you the right to have AML records deleted on request, because the operator has a legal obligation to keep them.

The practical implications are small but real. Send documents through the operator's own upload form rather than by e-mail, because e-mail leaves copies in more places than you control. Redact an account number if the operator does not need it, but never redact the figures on a source-of-funds statement — that is the part being checked. And check the privacy policy for whether documents are handled in-house or by a third-party verification supplier, which most operators use and few advertise.

None of this is a reason to avoid verification. It is a reason to do it deliberately, once, at a moment of your choosing, rather than in a hurry with a withdrawal pending.

What we check, and what we found

Our rating method scores verification on two things: whether the operator publishes which documents it will ask for, and whether it publishes when it will ask. Both are disclosures the operator controls entirely, and both are cheap to make.

Across the catalogue, publication is patchy. A minority name the documents in advance — passport or driving licence for identity, utility bill or bank statement for address. Almost none publish the timing, which is the half that decides whether a withdrawal stalls.

That gap is the reason this guide exists in the form it does. If operators published the trigger points, none of the advice above would be necessary; because they mostly do not, the useful thing is to verify before you need to, at the point where nothing is at stake.

Where we have read an operator's verification page, the documents it names are printed on its review with the date we read them.

Questions

Read next