KYC and customer due diligence in gambling payments

Gambling operators must know who their customers are before money moves. In Great Britain, identity and age must be verified before a customer can deposit or gamble. Anti-money laundering law adds transaction thresholds: £2,000 for casinos in the UK since June 2026, €2,000 for gambling in the EU, and 3,000 in the FATF standards.

By Clera Dukuk · Published 24 October 2026

Coverage

Great Britain, EU, Ontario, FATF standards

Sources checked

24 October 2026

Next review

24 January 2027

KYC and CDD: two related duties

"Know your customer" in gambling usually means two separate obligations. Gambling regulators require identity and age checks to keep minors out and to make accounts traceable. Anti-money laundering law requires customer due diligence (CDD): identifying the customer, verifying identity, understanding the relationship and monitoring transactions, with deeper checks for higher risk. They overlap but have different triggers.

Great Britain

• Identity before gambling. Licence condition 17.1.1 requires remote licensees to "obtain and verify information in order to establish the identity of a customer" before the customer can gamble, covering at least name, address and date of birth, and to keep it accurate. It took effect on 7 May 2019.
• Age before depositing. Social responsibility code 3.2.11 requires age verification before the customer can deposit funds or gamble, including with free bets or bonuses.
• Casino CDD threshold. Regulation 27(5) of the Money Laundering Regulations 2017 requires casinos to apply CDD to transactions of £2,000 or more, single or linked. Deposits for remote gambling and withdrawals of winnings both count. The figure was €2,000 until 30 June 2026.
• Funds stay put. The Commission's identity verification guide says operators "should not remove funds in a deposit balance if a player is unable to verify their identity."

European Union

Article 11(d) of the AML Directive 2015/849 requires gambling providers to apply CDD on collecting winnings, wagering a stake, or both, for transactions of €2,000 or more. The AML Regulation (EU) 2024/1624 keeps the €2,000 threshold in article 19 and applies from 10 July 2027. Member states may exempt proven low-risk gambling services, but not casinos, and not most providers whose main business is online gambling.

The FATF standard

The FATF Recommendations (updated October 2025) require casinos to apply CDD when customers engage in financial transactions at or above a designated threshold, set at USD/EUR 3,000 in the interpretive note to Recommendation 22. Casinos must also be able to link CDD information for a customer to the transactions that customer makes. National rules can be stricter, as the UK and EU figures show. In September 2026 the FATF published a report on the risks of gaming and gambling, its first detailed look at online and illegal gambling, including payment systems such as e-wallets and virtual assets.

Ontario

AGCO standard 3.04 requires operators to collect the information required by the federal Proceeds of Crime (Money Laundering) and Terrorist Financing Act at registration. Standards 6.02 and 6.03 require AML policies, including when to verify source of funds. Deposits and withdrawals both require verification and authorisation (5.69 and 5.70).

How verification connects to payments

• Name matching. Matching the name on the payment method to the verified account holder catches third-party funding. Spain requires at-risk players to use payment methods in their own name.
• Withdrawal destination. Ontario requires withdrawals to an account the player legally holds; New Jersey requires card deposits to be refunded to the card first.
• Threshold tracking. Linked transactions count toward the £2,000 and €2,000 thresholds, so systems need to aggregate deposits and withdrawals per customer.
• Do it early. Verifying at registration avoids the withdrawal delays regulators criticise; see our withdrawals guide.

Questions about KYC in gambling