iGaming KYC Requirements by Jurisdiction (2026): What Each Regulator Demands

iGaming KYC requirements are not one global standard. Each regulator decides three things for you: what player data you collect, how you verify it, and when verification has to be finished. The UK, Sweden, New Jersey and (with a small exception) Germany make you verify identity and age before a player can gamble at all. Malta and the coming EU rules tie full due diligence to a €2,000 deposit or stake threshold. Canada’s federal AML rules, which apply in Ontario, require identity verification before you pay anything out.

If you’re an operator planning a multi-market launch, or an affiliate deciding which licensed brands to promote, that timing question shapes your onboarding flow, your conversion rate and your enforcement risk. Most pages ranking for “iGaming KYC” are written by verification vendors and talk about KYC in general terms without naming a single regulator’s rule. This guide maps what each major regulator actually demands, cites the rule, and flags what changed in 2026. If you already know the rules and need to pick a vendor, go to our comparison of KYC providers for iGaming instead.

iGaming KYC requirements by jurisdiction (October 2026)

Read the table as a starting point. Each regulator layers technical standards, guidance and enforcement decisions on top of the core rule, and those details decide whether your flow passes an audit.

What is KYC in iGaming, and how is it different from AML?

KYC (know your customer) in iGaming is the set of checks an operator runs to confirm a player is who they say they are, is old enough, is allowed to gamble in that market and isn’t self-excluded, and to understand where their money comes from. It sits inside your anti-money laundering (AML) programme: KYC is the identity and risk work on each player, while AML is the wider system of monitoring, reporting and controls it feeds. In gambling, KYC does more work than in banking because it also enforces age limits, self-exclusion and affordability rules.

The building blocks are the same ones banks use:

• Customer identification: collecting name, date of birth, address and, in some markets, a tax or social security number.
• Customer due diligence (CDD): verifying that data against documents or reliable databases and rating the player’s risk.
• Enhanced due diligence (EDD): deeper checks, including source of funds or wealth, for high spenders, politically exposed persons (PEPs), players from high-risk countries and, in several regimes, crypto depositors.
• Ongoing monitoring: watching transactions and behaviour, refreshing data and reporting suspicious activity to the financial intelligence unit.

The gambling-specific layers are age verification, the national self-exclusion register check, residence or geolocation (you can only serve players in the licensed territory), and, in a growing number of markets, financial risk or affordability checks.

What are the requirements for KYC at an online casino?

KYC is mandatory in every licensed market covered here; what varies is the timing and depth. Across these markets, a licensed operator generally has to:

1. Collect core identity data at registration: full legal name, date of birth and residential address. Germany adds birth name and place of birth; Malta expects place of birth once CDD applies; New Jersey asks for the SSN (full or last four) where the player provides it.
2. Verify it with a reliable method: electronic checks against credit, population or tax databases, national e-ID such as Sweden’s BankID, or document plus selfie with liveness detection when the database route fails.
3. Confirm age against the local minimum: 18 in most of Europe, 19 in Ontario, 21 in New Jersey and most US iGaming states.
4. Check the self-exclusion register before play: GAMSTOP, OASIS, Spelpaus, CRUKS or the state list.
5. Screen against sanctions and PEP lists and adverse media, then risk-rate the player.
6. Escalate to source of funds or wealth when deposit thresholds or risk triggers are hit.
7. Keep records for the period your AML law sets (five years under the US Bank Secrecy Act and the EU framework).

What documents are needed for iGaming KYC?

Most regulators set the data you must hold and the standard of verification, not a fixed list of documents. In practice, operators ask for documents only when electronic checks fail or a risk trigger is hit:

A self-declaration on its own rarely satisfies a regulator for source of funds. Ask for evidence proportionate to the risk and keep it on file.

Verify before play: the UK, Sweden, New Jersey and Germany

Great Britain: Gambling Commission

Since 7 May 2019, remote operators must verify a customer’s name, address and date of birth before that customer can gamble, under licence condition 17 and social responsibility code 3.2.11 for age. The Commission’s announcement of the rule change also made clear you can’t confiscate a customer’s funds just because they didn’t send ID in time. Casino licensees additionally fall under the Money Laundering Regulations 2017, while all licensees are covered by the Proceeds of Crime Act reporting duties. For the wider licensing picture, see our UKGC licence guide.

Affordability now sits alongside KYC. Light-touch financial vulnerability checks have applied since 30 August 2024 at £500 in net deposits over a rolling 30 days, and since 28 February 2025 at £150. These use publicly available data such as county court judgments and bankruptcies, not documents from the player.

The 2026 change is financial risk assessments. On 7 July 2026 the Commission confirmed a staged rollout. Stage One applies to customers with net deposits above £5,000 in a rolling 24 hours (£2,500 for higher-risk groups such as under-25s). The final stage drops to £1,000 in 24 hours or £3,000 over 90 days (£750 and £2,000 for higher-risk groups). The Stage One start date had not been confirmed when this guide was updated, and the Commission said it won’t take enforcement action for failing to act after an assessment during early implementation.

Sweden: Spelinspektionen

The Gambling Act (Spellagen) only lets you register people who live or habitually stay in Sweden (chapter 12, section 1), and you must establish identity reliably, in practice with BankID or another e-ID (chapter 12, section 2). Play can’t start until identity is established and you’ve checked the player isn’t on Spelpaus (chapter 12, section 4). A temporary account is allowed, but identity has to be established by the first payout, and a temporary account can never be opened for someone on Spelpaus. You also have to identify the player each time they log in (chapter 13, section 2).

Proving residence is where operators get caught: in 2021 the regulator ordered Bayton to fix its KYC because household bills and account statements were not sufficient proof that a player lived in Sweden.

New Jersey: Division of Gaming Enforcement

A patron must open an internet gaming account before playing. Under N.J.A.C. 13:69O-1.3 the file must hold the verified legal name, date of birth, residential address (no PO box) and the full or last four digits of the SSN if the player provides them. You must use multi-source authentication as the primary verification method and confirm the player is 21 or over and not self-excluded or on the exclusion list.

Other US iGaming states follow a similar model, and enforcement is real: in March 2026 the Pennsylvania Gaming Control Board fined BetMGM $100,000 after inadequate KYC controls let fraud rings open accounts with stolen identities, one ring alone opening 1,567 accounts.

Germany: GGL

Under §6a of the GlüStV 2021, registration requires first name, surname, birth name, date and place of birth and residence, checked with suitable and reliable procedures. No play or payout is allowed before the data is confirmed, with one exception: for 72 hours after registration you may let the player play with deposits up to €100, provided you’ve told them payouts are blocked until verification. Several vendor guides state that Germany allows no play at all before verification; the statute says otherwise.

Data must be re-confirmed regularly, and play stops if more than a year has passed since the last verification. Each player may hold only one account per operator. On top of that sit the OASIS exclusion check (§8) and the LUGAS system that enforces the cross-operator €1,000 monthly deposit limit in force since 1 July 2021.

Threshold-based KYC: Malta, Curaçao and the EU from 2027

Malta: MGA and FIAU

Malta separates player protection from AML due diligence. You collect basic identity data at registration, but full CDD (verifying identity and residential address and completing a customer risk assessment) is triggered when a player’s deposits reach €2,000, calculated over a rolling 180-day period. Maltese practitioners describe a 30-day window from hitting the threshold to complete the checks. Higher-risk players also need source of funds or wealth information. Our MGA licence guide covers the licensing requirements that sit around these AML duties.

The FIAU enforces this closely. In March 2026 it imposed a €225,730 penalty on Stanleybet Malta (under appeal), partly because the operator couldn’t link transactions to individual customers and so couldn’t tell when they crossed the €2,000 threshold. It also added a €2,000-a-day periodic penalty until that was fixed. The lesson: your threshold logic is only as good as your transaction data.

Curaçao: CGA under the LOK

The National Ordinance on Games of Chance (LOK) came into force on 24 December 2024, ending the sublicence system, and the Curaçao Gaming Authority’s AML/CFT policy took effect in early 2025. Licensees need a written business risk assessment, documented CDD and EDD procedures, sanctions and PEP screening, transaction monitoring, an independent MLRO and a goAML account with the FIU before accepting real-money deposits. Unusual transactions are reported on suspicion, not certainty.

The CDD threshold is less clear-cut than in Malta: practitioners place it in the NAf 4,000 to 5,000 range (roughly €2,000 to €2,500), and crypto deposits, PEP links and high-risk residence trigger EDD. Our Curaçao gaming licence guide covers the licence side.

EU: AMLR from 10 July 2027

The EU Anti-Money Laundering Regulation (Regulation (EU) 2024/1624) applies directly in every member state from 10 July 2027, replacing national transpositions of the AML directives. Gambling service providers are obliged entities and must apply CDD when collecting winnings, wagering a stake or both, for transactions of €2,000 or more, single or linked. Member states can exempt low-risk gambling such as some lotteries, but not casinos, betting or online gambling by private operators.

The new EU authority, AMLA, is drafting the technical standards on CDD. If you hold a Malta or other EU licence, plan your 2027 onboarding changes now rather than in the summer of 2027.

Before payout: Ontario and Canada’s federal rules

Ontario splits responsibilities. The AGCO’s Registrar’s Standards bar anyone under 19 from an iGaming site (Standard 3.1.2.b), and age must be verified before the player reaches any area where they can play. Browsing the game lobby doesn’t require it. Self-excluded players and those restricted by court order must be kept out.

The AML side is federal. FINTRAC’s casino guidance requires you to verify the identity of account holders before any funds are disbursed, and to verify identity at the time of a large cash or large virtual currency transaction of $10,000 or more, or a casino disbursement of $10,000 or more (all subject to the 24-hour rule, which adds up related transactions within 24 hours). Extending credit of $3,000 or more also triggers verification.

What are AML KYC standards for US iGaming operators?

US operators work under two layers. State regulators set the account and age rules described for New Jersey above. Federally, the Bank Secrecy Act treats state-licensed casinos with more than $1 million in gross annual gaming revenue as financial institutions. Under 31 CFR Part 1021 you need:

• A written AML programme with internal controls, independent testing, training and a named compliance officer (§1021.210).
• A currency transaction report for cash in or cash out above $10,000 (§1021.311), aggregated per gaming day.
• A suspicious activity report for transactions of $5,000 or more that you suspect, filed within 30 calendar days of detection, or up to 60 days if no suspect has been identified (§1021.320).
• Name, permanent address and SSN recorded and verified for every deposit or credit account (§1021.410), with SAR records kept for five years.

Two common errors on pages ranking for this topic: one converts these thresholds to euros (they are US dollar figures in the regulation), and another applies FinCEN’s bank-focused CDD rule to casinos, which have their own rules in Part 1021.

What are the new KYC rules for 2026?

For iGaming specifically, the changes that matter this year are:

• UK financial risk assessments confirmed (7 July 2026), staged from a £5,000 24-hour net deposit trigger down to £1,000, with the Stage One date still to be set.
• EU AMLR countdown: €2,000 CDD rule and a single EU rulebook from 10 July 2027, with AMLA technical standards in draft.
• Malta enforcement focus on threshold tracking, shown by the Stanleybet Malta decision in March 2026.
• US state enforcement on identity fraud, such as Pennsylvania’s BetMGM fine in March 2026.
• Brazil’s regime is suspended. Brazil had one of the strictest onboarding models (CPF validation against the federal tax database, facial biometrics with liveness, deposits only from accounts in the player’s CPF). Provisional Measure 1,394 of 25 September 2026 banned fixed-odds betting and online casino gaming and ordered sites offline from 6 October. Congress has 120 days to convert the measure into law, and trade groups have asked the Supreme Court to suspend it, so watch it before you write Brazil off.

Our monthly iGaming regulation roundup tracks these as they move.

What does this mean for your onboarding flow?

The timing rule is the decision that drives cost and conversion. A practical way to design for several markets:

1. Build to the strictest market you serve. If you operate in the UK or Sweden, verification before play is the baseline, so instant electronic checks matter more than document upload.
2. Keep threshold logic per jurisdiction. Malta counts deposits over 180 days; the AMLR will count stakes and winnings; FINTRAC looks at 24-hour totals; the UK’s affordability triggers use net deposits. One global “KYC at €2,000” switch will be wrong somewhere.
3. Link every transaction to a customer record. The Stanleybet case shows a regulator will penalise you if you can’t prove when a threshold was crossed.
4. Treat the exclusion check as part of KYC, run before play and, where required, at each login.
5. Prove residence, not just identity, where the law requires it (Sweden is the clearest case).
6. Don’t hold balances hostage. The UK rule bars confiscating funds over late ID, and Germany’s 72-hour window only blocks payouts.

Your verification vendor sits at the centre of this, and our KYC provider comparison sets 12 vendors side by side. KYC is only half of the picture: bonus abuse and multi-accounting need device and behavioural signals, covered in our guide to iGaming fraud detection.

Common KYC mistakes regulators fine

• Letting unverified players gamble in verify-before-play markets, often through a “lite” registration path that skips checks.
• Weak residence evidence, such as utility bills where the regulator expects e-ID or registry data.
• No reliable threshold tracking, so CDD and EDD start late or never.
• Thin source of funds files for high spenders: a self-declaration with no supporting evidence.
• Single-source checks where the rules ask for multi-source authentication, leaving the door open to synthetic and stolen identities.
• Template policies that describe a generic process rather than your actual platform, payment methods and thresholds.

What affiliates should check

If you promote operators, KYC rules affect you too. In verify-before-play markets the friction comes at sign-up, so a referred player may never reach a first deposit; in threshold-based markets it comes later, often at the first large withdrawal, which is where complaints and chargebacks show up. Regulators also hold operators responsible for the marketing done on their behalf, so a licensed brand will drop affiliates who send traffic from markets it can’t serve. Check which regime each partner brand runs under before you build content around it.

Your next step

List the markets you serve or plan to enter, then write down for each one: when KYC must be finished, the threshold that triggers CDD or EDD, the exclusion register and the residence rule. That one-page map is what your KYC vendor, your platform’s PAM (see our PAM explainer) and your licensing adviser all need before they can quote. If you need help on the licence side, compare iGaming licensing consultants.

This guide is independent information, not legal advice. Rules and thresholds are taken from regulator publications, legislation and enforcement notices as of the date above; confirm current requirements with the regulator or a qualified gambling lawyer before you launch.