Definition
KYC (Know Your Customer) is the set of identity and background checks a licensed gambling operator must run on its players — verifying who the player is, that they are of legal age, and, where risk requires it, where their money comes from. It is a licensing obligation first and a funnel variable second: every check protects the license, and every check adds friction that some share of players will not complete. Operators do not choose whether to run KYC; they choose how well-engineered the flow is.
What gets verified
The verification stack has four layers, each jurisdiction-specific in scope and timing:
- Identity and age. Name and date of birth checked against a government-issued document or an approved database source. Age verification is the one check no regime treats as optional.
- Address. Where the regime requires it — to confirm the player is inside the licensed territory and to complete the identity picture.
- Sanctions and PEP screening. The player is screened against sanctions lists and politically-exposed-person registers; a hit does not end the relationship automatically, but it escalates the risk level and the depth of checks.
- Source of funds and source of wealth. Triggered, not universal: when risk indicators fire, the operator must evidence that the money being played is legitimate. What counts as acceptable evidence is defined by the applicable regime.
When checks fire
Regimes differ most on timing. Some require full verification before any play; others allow deposit-first flows where verification gates the first withdrawal instead. The same operator running the same product in two markets can face two entirely different flows — which is why KYC design is a per-jurisdiction configuration, not a global setting. The full comparison lives in our guide to KYC and AML flows across licensing regimes.
| Stage | What is checked | Typical trigger |
|---|---|---|
| Registration | Identity, legal age, screening lists | Regimes that require verification before play |
| First deposit | Identity confirmation, payment-method ownership | Deposit-first regimes; payment risk rules |
| Withdrawal | Completed document verification; payout method matches the verified account holder | First cash-out under a deposit-first flow |
| Risk trigger | Enhanced due diligence: source of funds or wealth | Screening hit, unusual spend pattern, risk-score change |
KYC as funnel engineering
Every document request sits between a registered player and a paying one, and drop-off at the verification step lands directly on registration-to-deposit conversion. The obligation is fixed; the execution is not. The levers that separate a well-run flow from a leaky one: staged collection (ask only what the current stage legally requires), resumable uploads that survive an app switch, automatic retry with a fallback verification provider when the primary fails, and step-level completion measurement so the team knows exactly where players abandon. None of these reduce compliance — they reduce the price of it.
Risk-based approach
Mature regimes expect verification depth to scale with customer risk, not to be uniform. Low-risk players clear the baseline checks; elevated risk — from screening results, behavior, or spend inconsistent with the player profile — moves the account into enhanced due diligence. Verification is also not permanent: documents expire, risk scores change, and regimes require periodic review, so re-verification is a scheduled workflow, not an incident. Running enhanced checks on everyone is as much a failure of the risk-based approach as running them on no one — it burns funnel for no compliance gain.
KYC vs AML: where the line sits
KYC establishes who the customer is — at onboarding and at defined review points. AML watches what the money does — continuously, across deposits, play and withdrawals. The two share data and often a team, but they are different control planes: a player can pass every KYC check and still trip AML monitoring a month later. Platforms built for regulated markets treat both as native workflows — the Turbo Stars platform ships verification orchestration and monitoring hooks as part of the core stack rather than leaving each market launch to bolt them on.
Related terms: AML · Gambling License · Payment Approval Rate
In practice: KYC policy is part of the dossier a regulator reviews — see how to get a gambling licence.
Common questions
What does KYC stand for in iGaming?
Know Your Customer: the identity and background checks a licensed operator must run on players — confirming identity and legal age, screening against sanctions and PEP lists, and, on risk triggers, verifying where the money comes from. The exact scope and timing are set by each license.
When do casinos have to verify players?
It depends on the regime. Some licenses require verification before any play or deposit; others allow deposit-first play with mandatory verification before the first withdrawal. Risk triggers — unusual spend, a screening hit, a payment mismatch — can force checks at any point regardless of the default flow.
Can a player deposit before completing KYC?
In some jurisdictions yes: deposit-first regimes let players fund and play immediately, with full verification gating the first withdrawal. In verification-first regimes no play is allowed until identity checks pass. The applicable license — not operator preference — decides which flow is lawful.
What documents do players typically provide?
Commonly a government-issued photo ID for identity and age, sometimes a proof of address, and proof of payment-method ownership where required. Enhanced checks can add source-of-funds or source-of-wealth evidence. Requirements are jurisdiction-specific, so document lists should come from the applicable regime, not a generic checklist.
What is enhanced due diligence (EDD)?
A deeper level of verification applied to higher-risk customers — for example after a sanctions or PEP screening hit, unusual deposit behavior, or spend inconsistent with what is known about the player. EDD typically means source-of-funds or source-of-wealth evidence and closer ongoing monitoring.
Does KYC hurt conversion?
Verification friction is real: every document request loses some share of players. Well-run operators treat the KYC flow as funnel engineering — staged collection, resumable uploads, fallback verification providers, and step-level completion measurement — so the obligation is met at the lowest achievable drop-off, never by skipping checks.