KYC Documents at Online Casinos (2026)

Every licensed online casino has to establish who you are before it will pay you. The process is called KYC — know your customer — and it normally asks for three things: a government-issued photo ID, a document proving your current address, and either evidence of the payment method you are using or a selfie for a biometric match.

Getting those three right at registration, rather than at the moment you request a withdrawal, removes most of the friction people complain about. This guide covers what each document proves, how they are actually checked, when an operator will go further and ask where your money came from, and what the rules require in Canada, Ireland and Norway specifically.

Key takeaways

Upload your documents on the day you open the account. Verification that happens before you deposit almost never delays a payout; verification that starts when you request one almost always does.

Point	Details
Three document categories	Photo ID, proof of address, and payment or biometric evidence. Most operators want one of each.
Names must match exactly	The name on your casino account, your ID and your payment method must be the same, including middle names. Mismatches are the most common rejection reason.
Source of funds is a separate check	KYC asks who you are; source-of-funds asks where the money came from. Large or unusual deposits can trigger it, and payouts are held while it is open.
“No KYC” is a deferral, not an exemption	Sites advertising no verification typically hold a light-touch offshore licence and run the checks anyway at cashout, when you have the least leverage.
Your market sets the rules	Ontario operators work to AGCO standards; Irish licensees must keep a register of account holders under the Gambling Regulation Act 2024; in Norway only Norsk Tipping is licensed at all.

What KYC is, and why the operator has no choice
The documents to have ready before you register
How your documents are actually checked
When a casino asks where the money came from
What the rules require in your market
What happens to your documents afterwards
What a “no KYC” casino is really offering
If your documents are rejected
An editorial note on how we present this guidance
Check the operator before you upload anything
Sources

What KYC is, and why the operator has no choice

KYC is the process by which a licensed operator confirms your identity before you play or withdraw. The term comes from financial services regulation, and it covers three overlapping checks that serve different legal purposes:

Identity — confirming your name, date of birth and address match official records, and that the account matches the payment method funding it.
Age — confirming you are over the legal minimum before any gambling activity begins.
Anti-money-laundering screening — checking you against sanctions lists, politically exposed person registers and adverse-media databases.

The obligation is not something the casino invented to inconvenience you. Gambling operators are treated as reporting entities under anti-money-laundering law in all three of our markets: the Proceeds of Crime (Money Laundering) and Terrorist Financing Act in Canada, supervised by FINTRAC; the Criminal Justice (Money Laundering and Terrorist Financing) Act 2010 in Ireland; and the Anti-Money Laundering Act in Norway.

There is a practical upside for you in this. An operator that has already confirmed who you are cannot later use “we need to verify you” as a reason to sit on a withdrawal, and it is far less likely to pay your winnings into somebody else’s account.

The documents to have ready before you register

Requirements vary by operator, but the accepted document types are broadly standard. Have one from each category scanned or photographed before you sign up.

Category	Documents usually accepted	What it proves	Usual condition
Photo identity	Passport, photo driving licence, national identity card	Who you are, your date of birth	Must be in date; expired documents are rejected automatically
Proof of address	Utility bill, bank statement, tenancy agreement, mortgage statement, local tax or government correspondence	Where you currently live	Usually issued within the last three months
Payment evidence	Photo of the card with the CVV covered, bank statement showing the funding account, e-wallet account screenshot	That the payment method is yours	Name must match the account exactly
Biometric	Selfie, or a short liveness video	That you are the person on the ID	Good lighting; face unobscured

The conditions that cause most rejections are mundane rather than technical. All four corners of the document must be visible. The text must be legible, with no glare, blur or cropping. And the name on the document has to match the name on the casino account exactly — if you registered as “Dave” and your passport says “David”, that will fail.

Pro tip: Photograph documents flat on a plain, non-reflective surface in even daylight, away from direct sun — hard shadows and glare cause more rejections than poor cameras do. On a card image, cover only the CVV, the three-digit code on the reverse. Never obscure the card number, expiry date or your name, because those are the fields being checked.

Two practical points on file handling: save as JPEG or PDF, since many operators reject other formats outright, and check the upload size limit before you start, as full-resolution phone photos sometimes exceed it.

How your documents are actually checked

Verification at an established operator is mostly automated, with a human involved only when something does not line up. The sequence is broadly consistent across the identity-verification providers the industry uses:

Optical character recognition. Software reads the document and extracts your name, date of birth, document number and expiry date.
Database cross-reference. Those fields are checked against electoral, credit-reference and government records, plus sanctions and politically exposed person lists.
Biometric match. Your selfie is compared with the photograph on the ID, and liveness detection confirms a real person is present rather than a photograph of a photograph.
Pass or flag. If everything reconciles, verification can complete in minutes. Any mismatch routes the case to manual review.
Manual review. A compliance officer inspects the images for editing, inconsistent fonts or missing security features.

Where your details are already well represented in electronic records, verification is often instant. Manual review takes longer — operators typically quote hours rather than minutes, and longer again where documents arrive one at a time. Submitting everything in a single batch is the fastest route through.

When a casino asks where the money came from

Source-of-funds is a distinct, more intrusive check, and it catches people out because the trigger threshold is often lower than expected. Standard KYC establishes identity; source-of-funds asks you to evidence where the money you are gambling with originated.

It is generally triggered by large single deposits, a rapid increase in deposit volume, activity that looks inconsistent with the profile the operator holds, or an automated flag during ongoing transaction monitoring. The evidence usually accepted includes:

Recent payslips, typically covering the last two or three months
Bank statements showing salary or regular income credits
A tax return or annual statement of earnings
Completion documents where the funds came from a property sale
Dividend certificates or audited accounts for company owners
Pension or investment account statements

The important operational detail: an operator cannot release winnings while a source-of-funds review is open. If you are planning to deposit a significant sum, assembling this paperwork in advance is worth the half hour it takes. Our casino banking guide covers how different payment methods interact with these checks across our markets.

What the rules require in your market

The documents are similar everywhere. What differs is who supervises the operator, and therefore what recourse you have when verification goes wrong.

Canada

In Ontario, operators must be registered with the AGCO and listed by iGaming Ontario. The registrar’s standards for internet gaming require identity verification and that payment methods be held in the player’s own name. Casinos are also reporting entities to FINTRAC, which sets client-identification and record-keeping obligations independently of the gambling regulator. Outside Ontario, provincial lottery corporations run their own sites and offshore operators sit in a grey area — check the licence yourself before uploading anything.

Ireland

The Gambling Regulatory Authority of Ireland began licensing in February 2026 under the Gambling Regulation Act 2024. GRAI states that a gambling website licensee must maintain a register of account holders recording each holder’s name, address and date of birth — which is precisely why the ID and proof-of-address pair is requested. The same rules require an account to be closed on request or after 13 months of inactivity, with any remaining balance returned. Note the timing: these obligations bind operators as they are licensed, on a phased basis, so an offshore site accepting Irish players may not yet be applying them. Anti-money-laundering duties come separately, under the Criminal Justice (Money Laundering and Terrorist Financing) Act 2010.

Norway

Norway is different in kind. According to Lotteritilsynet, the only company that can legally offer online casino games and betting is Norsk Tipping, with Norsk Rikstoto covering horse racing. Verification there runs through the national electronic ID rather than document uploads, so the process described above largely does not arise.

For any other site, there is no Norwegian regulator to escalate to, because no other site can hold a Norwegian licence. Payment blocking has applied since 2010 to stop transfers between foreign gambling operators and individuals in Norway, and DNS blocking of illegal gambling sites was added in 2025. Check our searchable copy of the blocklist before considering any operator. We do not publish ways around either measure.

Checking a licence anywhere

Before you hand over a passport scan, confirm the licence is real. The MGA licensee register, the Anjouan Gaming Authority register and the Curaçao Gaming Control Board all publish searchable records. Check the licence history rather than just the current entry — an operator that has stepped down to a more permissive regulator is signalling how it intends to handle disputes. Our licence comparison sets out what each framework actually gives you.

If you are worried about your own or someone else’s gambling, ConnexOntario (Canada), Problem Gambling Ireland and Hjelpelinjen (Norway) offer free, confidential support, and BetBlocker blocks gambling sites across your devices at no cost.

What happens to your documents afterwards

You are handing over a passport image and a bank statement, so it is reasonable to ask what happens next. Two bodies of law apply at once, and they pull in opposite directions: anti-money-laundering rules require the operator to keep your identity records for years after the relationship ends, while data protection law gives you rights over them.

In Ireland and Norway that means the GDPR, overseen by the Data Protection Commission and Datatilsynet respectively. In Canada, private-sector processing falls under PIPEDA. In practice you should expect:

An encrypted upload channel — never send identity documents by ordinary email, whatever support suggests
Retention of your records for a defined period after the account closes, driven by AML law rather than the operator’s preference
A right of access and rectification, but a limited right to erasure while retention duties still apply
Possible disclosure to law enforcement under a suspicious activity report, without prior notice to you
No use of your documents for marketing, and no sharing with third parties for that purpose

If you want to know exactly what an operator holds on you, make a data subject access request to its data protection officer. A licensed operator has to answer.

What a “no KYC” casino is really offering

Sites advertising instant, verification-free play are selling a deferral and describing it as an exemption. The checks are not gone; they are moved to the point at which you try to take money out.

The pattern is consistent enough to be worth naming. Deposits and small withdrawals clear without friction. A larger withdrawal triggers a manual review that the operator is not resourced to complete quickly, and the documents get requested then — at the exact moment your balance is locked and your negotiating position is weakest. Because these operators typically hold a light-touch offshore licence or none at all, there is often no meaningful dispute route when that review stalls.

The quality of an operator’s verification process is one of the better available predictors of how it behaves generally:

Sound practice	Warning sign
Identity confirmed at registration, before money is at stake	No checks until a withdrawal is requested
Document requirements published in the terms or help centre	Requirements revealed only when documents are demanded
A stated review timeframe, and updates while it runs	Open-ended “security review” with no timeframe given
Rejections explained by naming the field that failed	Repeated rejection with no reason stated

Our casino blacklist records operators with a history of payout and verification complaints.

If your documents are rejected

Most rejections come down to image quality, an expired document, a proof of address outside the date window, or a name mismatch — all fixable. Rephotograph rather than resubmitting the same file, use a different document type if the date window is the problem, and supply a linking document such as a marriage certificate where the name is.

If verification is refused outright or your funds are frozen, ask for the reason in writing, note the case reference, and take it to the operator’s compliance team rather than live chat. Our companion guide on why casino verification fails and how to fix it covers that escalation path, the timeframes to expect and the signs an operator is stalling deliberately.

An editorial note on how we present this guidance

This article describes what operators ask for and what the law requires of them. It is built from operator verification and terms pages read line by line, the regulators’ own published rules and registers, the statutory material linked throughout, and player-reported experiences in complaints and forum threads.

Newcasino has completed exactly one first-hand deposit-and-withdrawal test to date — MyStake, in 2026 — and it is written up on our editor test log. We have not run verification ourselves at the other operators we write about, and no timing in this article is a figure we have measured. Where a claim about payout or verification behaviour appears anywhere on this site, it is sourced to that log, to operator terms, or to player reports, and labelled accordingly. Our review methodology sets out the whole process.

My view: KYC gets treated as the annoying part of signing up, when it is actually the cheapest diligence you will ever do on an operator. A casino that asks for clear documents upfront, processes them quickly and tells you plainly what failed has shown you how it handles an awkward situation before any of your money is involved. That is worth more than a bonus.

Check the operator before you upload anything

Verifying the casino should come before verifying yourself. Find the licence number in the footer, confirm it on the regulator’s register, read the verification policy in the terms, and check whether the operator appears on our blacklist or in the licence tracker. It takes five minutes.

Our licence-checked casino reviews set out verification terms, payment options and the evidence behind each rating, and responsible gambling tools and support resources are collected in one place.

This article is general information about identity verification at online casinos. It is not legal, financial or data protection advice, and it is not a substitute for the operator’s own terms. Confirm current requirements with the operator and the relevant regulator before you register.

KYC Documents at Online Casinos — What to Prepare and Why It Is Asked