Know-your-customer checks exist for anti-money-laundering law, age verification and fraud. What is checked, what documents pass, why the selfie, and what happens to the data afterwards.
Three laws meet at the verification screen. Anti-money-laundering rules require operators to know who is moving money through them, and to report suspicious patterns. Age rules require proof that the customer is an adult. And the operators’ own fraud rules require that the person betting is the person whose card is being used. Licensed operators are fined for failures on the first two, which is why the checks are thorough where the licence is strong.
Expired IDs. Photos with a corner cut off or glare across the data. Screenshots of bank apps without the bank’s name and your address. Bills older than three months. Documents in a name that differs from the account by a letter. Documents in someone else’s name, which are not a failure but a closure.
Before the first bet under the UK, Spanish and Italian licences. Before the first withdrawal, or at a deposit threshold, under Malta and Curaçao. Again, at any time, when a pattern triggers a review: a large win, a change of payment method, a login from a new country.
Under a European licence the documents are personal data under GDPR: the operator must state why it holds them, for how long, and must delete them on request once legal retention periods expire. Under Curaçao the protection is whatever the privacy policy says. In both cases, send documents only through the operator’s own upload page, never by email to an address that asked for them, and never to a site whose licence you have not checked; identity theft through fake verification requests is one of the scams in our next guide.
To match the address, and above a deposit threshold, to see where the money comes from.
You can; the operator can then refuse the withdrawal until identity is proven another way.
Under GDPR, for the legal retention period, typically five years after the account closes; ask the operator.