UK-licensed casinos must verify your identity before you can withdraw — it is a licence condition. Offshore operators have no equivalent obligation, so verification is risk-based rather than automatic.
What usually triggers a request
- A withdrawal above the operator's internal threshold, commonly £1,000–£2,000.
- Any card or e-wallet withdrawal — the payment processor requires it, not the casino.
- A mismatch between registration country and login location.
- Bonus abuse flags, such as multiple accounts on one device.
What they ask for
Typically a photo ID, a proof of address dated within three months, and — for card deposits — a photo of the card with the middle digits covered. Turnaround is usually 24–72 hours.
Why crypto avoids it
There is no card scheme and no banking intermediary in a crypto withdrawal, so the processor-driven requirement disappears. That is why crypto routes are the ones where players genuinely go unverified.
Be realistic
No offshore casino guarantees permanent anonymity, and any site claiming it does is overselling. Treat low-KYC as convenience, not as a shield — and never as a reason to skip the withdrawal terms.
What KYC is for
Know Your Customer checks exist for anti-money-laundering law, not for the casino's amusement. Regulated operators must establish that you are who you claim, that you are old enough, and that funds are not being laundered through wagering.
In the UK this is a licence condition and it must happen before your first withdrawal — often before you can deposit at all. Offshore, the obligation is lighter, so operators apply it based on risk rather than by default. That is the entire difference, and it is a difference of process rather than of principle.
What documents are actually requested
| Document | Purpose | Usually accepted |
|---|---|---|
| Photo ID | Identity and age | Passport, driving licence, national ID |
| Proof of address | Residence | Utility bill or bank statement, dated within 3 months |
| Payment proof | Ownership of the method | Card photo with middle digits covered, or a statement |
| Source of funds | Large or unusual activity | Payslips, bank statements, sale documents |
| Selfie with ID | Liveness | Photo holding the document |
The first two are routine. Source of funds is the one worth understanding: it is not requested casually, and it is the check that stalls large withdrawals for weeks when it does arrive. It is triggered by amount, by rapid deposit-and-withdraw patterns, and by mismatches between stated income and turnover.
What actually triggers a request
- Withdrawal size. Thresholds vary but £1,000 to £2,000 is a common first trigger.
- Cumulative activity. Many operators verify once total deposits pass a set figure, regardless of individual amounts.
- The payment rail. Card and e-wallet withdrawals frequently trigger checks that crypto withdrawals do not, because the processor requires it rather than the casino.
- Geography mismatches. Registering in one country and logging in from another, or VPN use where the terms prohibit it.
- Bonus abuse flags. Multiple accounts on one device or IP, or patterns matching known advantage play.
- Random sampling. Some operators verify a percentage of accounts regardless of behaviour, precisely so that verification is not itself a signal.
Why crypto avoids it — and where that stops being true
A crypto withdrawal has no card scheme and no banking intermediary. The processor-driven requirement that forces verification on fiat rails simply is not present, so the operator's own risk rules are the only thing left.
That is why crypto-first sites can genuinely operate with no documents at modest amounts. It is not a loophole they are exploiting; there is no third party demanding the check.
It stops being true at scale. Large crypto withdrawals still trigger internal AML rules, and an operator that never verified anyone at any amount would not keep a licence for long. Treat "no KYC" as accurate at small amounts and optimistic at large ones.
How to make verification painless
- Verify at registration, not at withdrawal. This is the whole article in one line. Documents already on file turn a three-day delay into no delay at all.
- Use the same name everywhere. The account name, the ID and the payment method must match exactly. A middle name on one and not the other causes rejections.
- Photograph documents flat, in daylight, with all four corners visible. The most common rejection reason is a cropped edge or glare, not fraud.
- Use a document dated within three months for proof of address. Older ones are refused as a matter of policy.
- Do not use a VPN if the terms prohibit it. Location masking is grounds to void winnings at most operators, and it is trivially detected.
The pattern to avoid. Deposit, win, request a large withdrawal, then be asked for documents you do not have to hand. That sequence is where almost every "the casino would not pay me" story begins — and in most of them the operator was applying its terms rather than breaking them.
What to do if verification stalls
Ask in writing which specific document failed and why. Vague requests to "re-submit" usually mean an automated check rejected an image rather than a human rejecting you.
Keep everything in one written thread rather than live chat, because live chat transcripts are harder to retrieve later. If a delay passes fourteen days with no clear reason, escalate to the operator's alternative dispute resolution provider, whose details must be published on their site.
On an offshore site that route is weaker than the UK equivalent, which is one of the trade-offs covered on our how we test page.
How long verification actually takes
| Stage | Typical time | What slows it |
|---|---|---|
| Automated ID check | Minutes to 2 hours | Blurred images, cropped edges, glare |
| Manual review | 24–72 hours | Weekend submissions, name mismatches |
| Proof of address | 24–48 hours | Documents older than three months |
| Source of funds | 3–14 days | Incomplete bank statements, unexplained deposits |
| Payment method proof | Minutes to 24 hours | Card photo missing the covered digits |
Source of funds is the outlier and the one that generates almost every long-running complaint. It is not a routine check — it is triggered by amount or by pattern, and satisfying it means producing documents most people do not have to hand. That is why verifying early matters: routine checks completed at registration mean only the exceptional one can ever delay you.
What the UK requires by comparison
UKGC-licensed operators must verify identity and age before allowing a deposit, and must complete full verification before any withdrawal. There is no risk-based discretion — it is a licence condition, and operators that skip it are fined.
That is the trade in one sentence: the UK guarantees you will be verified and guarantees a complaints route if something goes wrong. Offshore, verification is often skipped and the complaints route is weaker. Those two facts are the same fact viewed from different sides.
Data protection — the part worth thinking about
Sending a passport scan to an offshore operator means placing an identity document with a company outside UK jurisdiction, where UK GDPR does not apply and enforcement is limited.
- Upload through the site's own verification portal rather than emailing documents where you can.
- Cover the document number where the operator permits it — many accept partially redacted proofs.
- Never send documents to a support agent over live chat or a messaging app, whatever the reason given.
- Check the site uses HTTPS on the upload page, and be suspicious of any request arriving by email rather than appearing in your account.
This is a genuine cost of offshore play and it is rarely mentioned. It is not a reason not to verify — it is a reason to verify through the right channel.
If you joined GamStop because gambling was becoming a problem, this page is not for you. GamStop exists because it works. Free, confidential help is available from GamCare on 0808 8020 133, and from BeGambleAware.