KYC documents: what a casino really asks for and what speeds up the check

KYC, or “know your customer”, is not a casino invention. It comes from anti-money laundering and counter-terrorist financing requirements, supervised in Estonia by the Financial Intelligence Unit, and it applies to all licensed service providers. The casino has to be satisfied of three things: who you are, where you live and whether the payment method belongs to you.

In practice this means the check is triggered either at registration or, at the latest, with your first withdrawal request. If it is only triggered at the moment of the request, the checking time is added directly to the withdrawal time — this is the most common reason why the first withdrawal takes longer than all the following ones.

At casinos with bank identification — those where the account is created via bank link — the first two steps are essentially already done: the bank has identified you and the data passes to the casino. That is exactly why the first withdrawal at Pay N Play casinos is usually much faster.

• Complete the check right after registering, not when a win is already in your account. That way the checking time is not added to the withdrawal time.
• Upload original files, not screenshots of screenshots. A phone photo taken directly of the document is usually better than a scan with cropped edges.
• Use the same name and address as in the population register and at your bank. A different spelling is a common reason for rejection.
• Deposit and withdraw with the same account. If the money came from one bank and you want it out to another, a separate check is triggered.

If your request has already come back, the list of reasons and the next step for each is in a separate article.

Automatic document recognition gives an answer within minutes. Manual review happens during working hours and usually takes hours, less often up to a couple of business days. If the casino asks for an additional document mid-process, the waiting time starts again.

That is why it makes sense to look at a casino's withdrawal time frame together with its KYC practice, not separately: a promise of fast withdrawals does not apply until the account is verified.

The same topic from a bank payment perspective is covered by KYC and identity verification on our sister site; the definition of the term itself is in the glossary.

Three KYC levels and what triggers each

KYC is not one check but a tiered system. Most players only see the first level and are surprised when the second is triggered.

Level 1 — basic identification. Identity document and address. Triggered on account opening or at the first withdrawal. At a bank-link casino it is often already done, because the bank identified you.

Level 2 — ownership of the payment method. The casino checks that the payment method belongs to you: a bank account statement in your name, the front and back of the card with the numbers partly covered, a screenshot of the e-wallet account. Usually triggered at the first withdrawal or when changing payment method.

Level 3 — source of funds. The hardest step, and there is a separate section on it below. Triggered when an amount threshold is crossed, on an unusual pattern or during a periodic review.

What moves the thresholds. Cumulative deposits over a certain period, a single large withdrawal, rapid consecutive transactions, changing payment methods, a change of device or country. None of these means you are suspected — they are rulebook triggers that apply automatically.

The practical conclusion: levels 1 and 2 can be done before they are asked for. Level 3 cannot, because it cannot be submitted in advance — but you can prepare for it by keeping the documents to hand.

Proof of source of funds: the hardest step

If a withdrawal has been stuck for weeks, the reason is usually here. Source of funds is a question most people cannot answer, because nobody has asked it before.

What is asked for. A document showing where the money you played with came from. Typically: a salary certificate or payslips, a bank account statement covering 3–6 months, a sale agreement in the case of an asset sale, a dividend notice, a certificate of inheritance. A screenshot from a banking app is usually not good enough — you need an official statement with the bank's details.

Why it is asked for. Anti-money laundering rules oblige the operator to understand the origin of a customer's funds when amounts exceed a certain level. It is not an accusation, and it applies at every financial institution, including the bank itself.

Why it takes so long. The documents are reviewed by the compliance team, not customer support, and their queue is separate and slower. An incomplete submission starts the cycle over: if you send one month out of three, the other two will be requested separately.

How to speed it up. Send everything at once and in full: the whole period, all pages, a PDF straight from online banking, not a screenshot. Add a one-line explanation linking the document to your account (“salary income, monthly average X, the same account I made deposits from”). That one sentence prevents most follow-up requests.

If you cannot prove it. The withdrawal may stay on hold indefinitely. That is exactly why, for larger amounts, it is worth knowing you have the documents before, not after.

Eight technical reasons a document comes back

Most rejections are not about the content of the document but about its file. All eight are preventable.

1. A corner is out of frame. All four corners must be visible. An image cropped to the scanner's edge is considered incomplete.
2. Glare covers the data. Take the photo in diffuse light, without flash, with the document on a table.
3. The file is a screenshot of a screenshot. Upload the original — a PDF from online banking or a photo taken directly of the document.
4. The statement is too short. If three months were requested, two will not do. The period must be continuous.
5. The name does not match. The account name and the document name must be identical. A married name, a second first name or a difference in letters with diacritics triggers a manual check.
6. The document has expired. The validity period must cover the moment of submission, and proof of address is usually valid for three months.
7. The file is too large or in the wrong format. JPG or PDF, usually under 5 MB.
8. Data has been covered. For a card, the middle digits and the CVV are covered — but only those. The name and the last four digits must not be covered.

One trick that saves a whole cycle: look at the file full-screen before uploading. If you cannot read it yourself, neither can the reviewer.

Bank link and Pay N Play: KYC you do not notice

There is one category in the Estonian market where this entire section barely exists, and that is the casino with bank identification.

When you log in via Swedbank, SEB, LHV or Luminor, the bank has already identified you, and that identification carries over to the casino. Level 1 is essentially done at the moment of deposit. Level 2 as well, because the money came from an account in your name and goes back to the same account.

The practical difference is large: with the account-free model there is no separate document upload step at all, and the first withdrawal does not carry the waiting time of a document check. This is where the “under five minutes” withdrawal comes from that you do not see elsewhere.

What still remains. Level 3, proof of source of funds, applies here too when amounts exceed the threshold. Bank identification answers the question “who are you”, not the question “where did this money come from”. With a big win, a compliance request can come even at an account-free casino.

Who it suits. If you want to avoid sending document photos and want the first withdrawal to be fast, an operator with bank identification is clearly the simpler route. The trade-off is that there is no anonymity — but there is none at any Estonian-licensed operator anyway.

What happens to the documents afterwards

A question that is rarely asked, and whose answer is worth knowing.

Retention is mandatory. Anti-money laundering rules require the operator to keep customer due diligence data for the period set by law after the customer relationship ends. This means “delete my documents” is usually not a request that can be fulfilled — not because the operator does not want to, but because it has a retention obligation.

Who has access. The compliance team, not regular customer support. That is why a regular support agent cannot see your document status as anything other than “under review”.

Your rights. Under EU data protection law you have the right to know what data is held about you and to get a copy of it. An Estonian-licensed operator must respond to this request. With a non-EEA operator this right exists on paper and is hard to enforce in practice — one concrete, measurable difference in the value of a licence.

What you can do yourself. Do not send more than is asked for. If proof of address is requested, there is no need to add a payslip. Every unnecessary document is data you could have avoided giving.

Verification before your first deposit: step by step

The practical summary of this whole article is one recommendation: do the check before you have anything to lose. Ten minutes on registration day saves days later.

Step 1. Register and open your account settings. Look for a section called “Verification”, “My documents”, “Account confirmation” or “KYC”. Most casinos have it even if nothing has been requested yet.

Step 2. Check that your account details match your document letter for letter. First name, surname, date of birth. Letters with diacritics must be the same as on the document. This is the most common reason for a manual check, and it can be fixed before, not after.

Step 3. Upload your identity document. A photo taken directly of the document, diffuse light, all corners in frame, no flash.

Step 4. Upload proof of address. A utility bill or bank statement no older than three months, with name and address clearly legible.

Step 5. Upload proof of the payment method once your first deposit is made, because before that there is nothing to prove.

Step 6. Check the status the next day. If something has been rejected, you have time to fix it calmly, not while waiting on a win.

At a bank-link casino most of these steps fall away — see below.

Special cases that hold up a withdrawal for a long time

Four situations that are entirely ordinary in life and entirely unusual in a casino's rulebook.

Joint account. If the bank account is in two people's names, the account holder must be the player. Some operators accept a joint account if the player's name is on the statement; some do not. Check before depositing, not after a win.

Someone else's card or account. Never acceptable, not even your spouse's. It is prohibited in every operator's terms and is a good reason to freeze an account. Paying out to a third party is a direct breach of anti-money laundering rules.

Name change. After marriage or another name change, the document does not match the old account details. You need a document proving the name change and an update of the account details — do this before requesting a withdrawal.

Company account. Not acceptable. A gambling account is personal, and the withdrawal must go to a private individual's account.

The common pattern in all four: the problem is not unsolvable, but solving it manually takes days. All four can be spotted before the first deposit by looking at whose name the account the money comes from is in.

If the account is frozen during the check

Freezing sounds dramatic, but it is an ordinary procedural step and usually temporary.

What is frozen. Usually withdrawals and sometimes play too. The balance remains — a freeze is not confiscation, and an Estonian-licensed operator may not hold on to your money without a legal basis.

Why it happens. A pending document, an unusual pattern, a suspected third-party payment, or a periodic review that simply fell on your account.

What to do.

1. Ask in writing what exactly is missing. A specific list of documents, not “additional checks”.
2. Send everything at once. Sending in parts extends the procedure every time.
3. Ask for a deadline. “When will this be resolved” is a legitimate question, and the answer gives you a point in time for your next step.
4. Save the correspondence. If the matter goes to a complaints procedure, it is your only evidence.

When to worry. If the operator names no specific deficiency, gives no deadline and repeats a vague reply for over a week, it is time to escalate. With an Estonian-licensed operator, the complaints procedure is in the terms, and there is a supervisor behind it. With an operator licensed outside the EEA, this practical protection does not exist — one concrete reason why the licence matters.

Checklist before your first withdrawal

Seven lines that cover most of this article. If all seven are met, the withdrawal is almost always automatic.

1. Your account details match your document letter for letter, including letters with diacritics.
2. Your identity document is uploaded and approved, not pending.
3. Your proof of address is no older than three months.
4. The payment method is in your name and is the same one you deposited with.
5. The bonus has been wagered through or knowingly cancelled.
6. The amount fits within the withdrawal limit — both the single and the weekly/monthly one.
7. The documents are valid at the time of withdrawal too, not only at the time of upload.

If even one of these is open, the request will probably go to manual review — and manual review is exactly where hours turn into days.

The most important thing here is the timing of points 2 and 3: do them on registration day. It is the only step on this list whose omission is guaranteed to cost time, and the only one that can be done entirely in advance.

Three things people get wrong about KYC

“KYC is the casino's way of dragging out withdrawals.” The check is a statutory obligation, and failing to carry it out puts the operator's licence at risk. Dragging things out would be a cost for it, not a benefit: money not yet paid out is not its revenue, because it is already recorded as a liability. The delay comes from the volume of the procedure and the queue, not from intent.

“If I don't take a bonus, I don't have to verify.” The check is not a bonus condition but a condition of the customer relationship. It is triggered regardless of whether you have touched a bonus.

“Withdrawing a smaller amount avoids the check.” The opposite — several consecutive smaller withdrawals are exactly the pattern that anti-money laundering rules call structuring. It raises the risk score more than one large request and almost certainly sends the account to manual review.

If the amount is large, the fastest route is one request and complete documentation, not splitting the amount.

Why an Estonian licence makes this section shorter

This whole article assumes that the operator has supervision and rules it must follow. That assumption does not hold everywhere, and the difference is practical.

An operator with an Estonian activity licence must carry out customer due diligence according to the law, retain data in the required manner and operate under EU data protection. If the procedure gets stuck, there is a complaints procedure, and behind it a supervisor with the power to intervene and ultimately revoke the licence.

An operator with a non-EEA licence carries out customer due diligence according to its own rules. The documents it asks for may be the same, but what happens to them and to whom you complain is a completely different question. In practice this means the same inconvenient document request is a procedure in one case and a hope in the other.

The practical conclusion. If you are weighing up where to play, KYC in itself is not an argument for either side — it is asked for on both. The argument is what happens when the check gets stuck. With an Estonian-licensed operator you have a step to take; elsewhere you have an email address.

Which operators operate under an Estonian licence can be checked in the official register — and it is worth doing by domain, not by brand name.

Summary: what to do and when

Three points in time that cover this whole article.

On registration day. Check that your account details match your document letter for letter. Upload your identity document and proof of address. Ten minutes that remove the longest single delay from the critical path.

After your first deposit. Upload proof of the payment method if it is asked for. Check that the account the money came from is in your name — not your spouse's, not a joint account, not a company's.

Before a large withdrawal. Check whether your documents are still valid and whether the amount fits within the limit. If the amount is large, expect that proof of source of funds may be requested, and know in advance which document you would submit.

All three points in time come before the moment you have something to lose. That is the whole point of this section: KYC is not part of the withdrawal if it has been done earlier. Only when it has not been done does it become the longest stretch of the withdrawal.

When the check seems unreasonable

Sometimes it is, and it is worth knowing where the line runs.

Reasonable. An identity document, proof of address, proof of ownership of the payment method, proof of source of funds for a larger amount. These are standard and every licensed operator asks for them.

Questionable. Repeatedly asking for the same document without explanation, demanding a document by email, “additional checks” without a specific list, or refusing to give a deadline.

What to do in the second case. Ask in writing and specifically: which document, for what reason, by what deadline. A written request makes the conversation traceable. If no answer comes or it stays vague for more than a week, the next step with an Estonian-licensed operator is the complaints procedure set out in the terms.

And one thing that is not unreasonable, although it seems so. A check that is only triggered after a win. It feels unfairly timed, but usually the reason is that only the withdrawal crossed the threshold that triggered the rule. What is unfair here is the timing, not the check itself — and you can change the timing yourself by doing the check earlier.

One sentence that saves a whole week

If this whole article had to be compressed into one recommendation, it would be this: complete verification on the day you open the account, not on the day you win.

Everything else in this text — document quality, proof of source of funds, special cases, freezes — is a consequence of when the check takes place. A check done before playing is ten minutes you will not even notice. The same check done after a win is a waiting period during which your money is on hold and every follow-up request adds another cycle.

The casino does nothing differently in either case. The only thing that changes is whether the check is on your withdrawal's critical path or not. You make that decision, and you make it before you know whether you will have anything to withdraw.