Online Gambling Regulations
Lexicon

Know Your Customer (KYC)

Identity-verification duties an operator must complete before or shortly after allowing play or payout.

Know Your Customer is the identity-verification layer of gambling compliance: confirming who the customer is, that they are of age, and that they are not excluded or sanctioned. Licensed regimes require verification before play or before withdrawal — Britain moved it to before play in 2019, ending the era of "verify at cashout".

KYC failures are among the most fined compliance breaches in gambling, because they gate everything else: age limits, self-exclusion checks and AML monitoring all assume the operator knows who is playing. The friction it adds at signup is, from the regulator's side, the system working.

KYC is where regulation becomes a product feature: the document upload, the address check, the name-match against a sanctions list. Licensed markets differ mainly in when it bites — registration, first deposit or first withdrawal — and in how much friction the regulator tolerates before play begins. Germany's LUGAS file and the Dutch Cruks check are KYC's logical extensions: identity verified not just once, but against cross-operator records on every session.

The unlicensed market's sales pitch is the absence of all this — "no-KYC casinos" advertise the gap openly. That is precisely why regulators treat KYC depth as a channelling variable: every added document is security against fraud and underage play, and also one more reason a marginal player drifts offshore. The balance each regime strikes shows up in its enforcement priorities.

Within this atlas, KYC depth is one of the quiet variables distinguishing regimes that look similar in a status table: 'regulated' in Germany and 'regulated' in Curaçao describe very different verification realities. The country profiles note the register-checking obligations where they exist, because they mark the strict end of the spectrum — and because the schemes involved (LUGAS, Cruks, OASIS) are licence conditions, not options.

Frequently asked questions

What does KYC actually require?
At minimum: verified identity (name, date of birth), age and usually address, checked against documents or databases before meaningful play. Licensed regimes layer sanctions screening, politically-exposed-person checks and — increasingly — affordability or source-of-funds questions on top.
When must a licensed operator complete KYC?
It varies by regime: some require full verification before any play, others before deposit or withdrawal. The strict end (Germany, the Netherlands) verifies identity at registration and re-checks against national registers on every login.
Why do "no-KYC" casinos exist?
They operate under point-of-supply licences — typically Curaçao or Anjouan — that impose lighter identity requirements than any point-of-consumption regime. The absence of KYC is a reliable signal that no local regulator stands behind the site in the player's own market.
How does KYC relate to AML?
KYC is the identity layer inside the broader anti-money-laundering programme: you cannot monitor transactions you cannot attribute. Source-of-funds checks, the next escalation, ask not who the player is but where the money came from.
Does stricter KYC actually reduce harm?
It verifiably blocks underage accounts and supports every downstream protection — exclusion registers and deposit limits only work against verified identities. Its cost is friction, and the channelling debate is precisely about how much friction the licensed market can carry before play leaks to sites that ask nothing.
Related terms

Anti-Money Laundering · Source of Funds

← Full glossary