KYC at a Crypto Casino: Every Check Rated by When It Comes and What It Costs You

Timing: a licensee checks before play, an overseas operator at payout

A Gambling Commission licensee must verify your name, address and date of birth before you are allowed to gamble, must verify your age before you can deposit or open a demo game, and may not demand at withdrawal documents it could reasonably have requested earlier. The method of payment does not appear in any of those conditions, so a licensee that accepted crypto would check you at the same point as one taking a debit card.

An operator licensed under Curaçao, Anjouan or Tobique rules is bound by none of those conditions and sets its own timing. The pattern across the operators in our list is a sign-up with an email and a password, deposits accepted at once, and the document request arriving with the first withdrawal or at an amount the terms do not disclose.

The Commission's position is that such an operator may not serve consumers in Great Britain at all; the timing of its check is a feature of a business that is outside the rules rather than a lighter version of them.

The risk in the timing is simple to state. Before play, a failed check costs you nothing but the account. At withdrawal, a failed or stalled check holds a balance you already won, and the party deciding whether the documents are good enough is the party that owes you the money.

The triggers at an overseas operator

Four events bring the deferred check forward. None has a published threshold in the sources we rely on, so the amounts are the operator's and change without notice.

• First withdrawal — What it usually produces: Photo ID, proof of address, sometimes a selfie · Risk to you: Balance held until accepted
• A cumulative amount — What it usually produces: Same, plus source of funds · Risk to you: Threshold unknown in advance
• A flag — What it usually produces: Account review, extra documents · Risk to you: Open-ended; no external clock
• Residence — What it usually produces: Proof of address against the jurisdiction clause · Risk to you: Account closure if the UK is excluded The fourth trigger is specific to UK players and is the one the operators' own terms create: several brands that appear in UK search results list the United Kingdom among excluded jurisdictions in their terms, and a proof of address showing a UK postcode at withdrawal is then grounds under those terms to close the account. The jurisdiction clause is covered on the main page; the point here is that the identity check is the moment it bites.

The £2,000 line: money-laundering rules and who they bind

A casino is a relevant person under the UK money-laundering regulations, and for remote gambling the regulations require customer due diligence where a deposit, a withdrawal or wagering reaches £2,000, in a single transaction or several that appear linked. The figure is in pounds since the most recent amendment. It binds casinos operating under UK law; it does not reach an operator abroad, which is why "no KYC" sites can exist and why the Commission classes them as it does.

For a licensee the Commission adds a crypto-specific layer. An operator that wants to accept cryptoassets must notify the Commission, revisit its money-laundering risk assessment and reduce the risks to the level it would expect of any other payment method; the risks the Commission names are source of funds, fluctuations against fiat values, challenges around customer identification and the security of funds. The sources do not identify a licensee that has done so, and this site does not claim one.

• Identity before play — Licensee: Required · Overseas operator: Not required
• Customer due diligence from £2,000 — Licensee: Required · Overseas operator: Not bound
• Crypto risk assessment and notification — Licensee: Required · Overseas operator: Not bound
• Financial vulnerability check at £150 net deposits — Licensee: Required · Overseas operator: Not bound The £150 figure in the last row is the one UK players most often meet without knowing it: once net deposits pass it in a rolling 30 days, a licensee must check public records for indicators of financial difficulty. It is run against records, not against you, and it counts deposits by every method.

Source of funds: the question crypto does not answer

The Gambling Commission's guide to players names bank statements as the document used to help check that your source of funds is legitimate. Crypto changes how the money arrived, not where it came from, so a source-of-funds question put to a crypto player is answered by the bank statement showing the fiat that bought the coins, often alongside the exchange's record of the purchase. A wallet history alone shows movement, not origin.

The risk rating differs by licence. At a licensee the request must fit the operator's risk assessment and cannot be a cover for identity documents it should already hold; a request that looks like the latter is a licence matter, and the complaints route runs to a free dispute body after eight weeks.

At an overseas operator the request is bounded only by the terms, there is no clock, and the Commission's own research places withheld payouts among the common outcomes at such sites. The records that make the question answerable, and that a later tax question will also want, are set out under the records a later tax question will want.

A bonus brings the question forward. A withdrawal requested after a bonus is the point at which many operators run their first full review, which is why a document request and a bonus hold tend to arrive in the same message; the mechanics are under why a bonus and a document request arrive together.

Your data: the check as a risk in itself

Passing an identity check means handing over a passport scan, a utility bill and often a photograph of yourself holding them. At a licensee that data sits with a company subject to UK data protection law and to a regulator that holds the operator responsible for the third parties it uses. At an unlicensed site, the Commission's own writing lists the risk of personal data theft among the harms, next to missing age verification, missing responsible gambling tools and missing dispute resolution.

Three habits reduce the exposure without reducing the check.

1. Upload through the operator's own account tool, never by email or chat attachment, and never to a link sent to you.
2. Send the document the request names and nothing broader; a request for a full year of statements when the question is one deposit is a request to query in writing.
3. Keep your own copy of what you sent and when, because at an overseas operator the only record of the exchange is the one you keep.

Every check in one risk table

Check	When it comes, and the risk
Age	Licensee: before deposit, low risk. Overseas: often never, which is itself the risk the Commission names
Identity	Licensee: before play. Overseas: at withdrawal, balance held meanwhile
Customer due diligence	Licensee: from £2,000. Overseas: not bound; own threshold, undisclosed
Financial vulnerability	Licensee: at £150 net deposits, public records. Overseas: none
Source of funds	Licensee: proportionate, with a complaints route. Overseas: open-ended
Data handling	Licensee: UK data law, regulator oversight. Overseas: no UK recourse

Read down the right-hand column and the pattern is the same in every row: the licensee's check comes earlier and costs less when it fails; the overseas operator's check comes later and holds your money while it runs. That is the compliance risk on the main page's map, and the questions that expose it before a deposit are under the questions that expose each risk before a deposit.

Responsible gambling

The age check and the vulnerability check exist to keep gambling away from people it harms, and a site that skips them has removed your protections, not your inconvenience. GamStop closes every Gambling Commission licensee at once for the period you choose and cannot be lifted early; it does not reach sites licensed elsewhere, and Gamban and BetBlocker, free to UK residents, do.

You must be 18 or over to gamble in Great Britain. If gambling is causing you harm, the National Gambling Helpline is free on BeGambleAware at any hour, and GamCare and BeGambleAware offer help online.

Frequently asked questions

Can a casino verify me from my wallet address alone?

No. An address is not an identity, and no regulator treats it as one. A licensee verifies name, address and date of birth from documents or data checks before you gamble; an overseas operator asks for the same documents when it chooses to, usually at withdrawal.

What is customer due diligence and where does £2,000 come from?

Customer due diligence is the identity and risk check required under the UK money-laundering regulations, under which a casino is a relevant person. For remote gambling it is required for transactions of £2,000 or more, in one go or linked. It binds UK casinos; an overseas operator is outside the regulations.

Can I decline a source-of-funds request?

You can, and the operator can decline to pay until it is answered. At a licensee the request has to be proportionate to the operator's risk assessment and cannot be used to demand identity documents it should have collected earlier; at an overseas operator the request is bounded only by its terms.

Is it safe to upload my passport to an overseas crypto casino?

The Gambling Commission's writing on unlicensed sites lists the risk of personal data theft among the harms, alongside missing age checks and dispute routes. There is no UK regulator to complain to about how such a site stores a document. Weigh that before the first deposit, because the request will come at the withdrawal.

What does a casino mean by levels of KYC?

An operator's own tiering: a basic level at sign-up, a document level at a withdrawal threshold, an enhanced level for larger sums. The tiers are the operator's policy, the thresholds are rarely published, and none of it corresponds to a UK rule, which requires verification before play regardless of amount.

I paid in crypto. Why is the casino asking for bank statements?

Because the question is about where the money came from, not how it travelled. The Commission's guide to players names bank statements as the document used to check source of funds, and its crypto guidance names source of funds as a risk a crypto-accepting operator must manage. The exchange record of the purchase may be asked for too.

Does a crypto deposit avoid the £150 financial vulnerability check?

At a licensee, no. The check runs once net deposits exceed £150 in a rolling 30 days across every method, and it is a public-record check run by the operator rather than a document request to you. An overseas operator does not run it at all.

Sources

• Gambling Commission, LCCP 17.1.1 customer identity verification
• Gambling Commission, LCCP SR 3.2.11
• Gambling Commission, LCCP SR 3.4.4 financial vulnerability check
• Gambling Commission, LCCP SR 6.1.1 complaints and disputes
• Gambling Commission, LCCP SR 1.1.2 responsibility for third parties
• Gambling Commission, blockchain technology and crypto assets
• Gambling Commission, age and ID verification
• Gambling Commission, how we tackle illegal gambling
• Gambling Commission, confronting the threat of illegal gambling
• Gambling Commission, Illegal online gambling, phase 1
• Gambling Commission, organisations that can help
• Money Laundering Regulations 2017, regulation 27
• Gambling Act 2005
• GamStop