European Union flags flying outside a large curved office building

Analysis · KYC and identity

Gambling KYC under five regulators, and which of them licenses the fourteen crypto casinos on the register

Published 2026-09-28By the CryptoGuardz Register Desk6 min read19 sources

Photo: Christian Lue / Unsplash

In short, from the documents

When must gambling KYC happen under each regulator?

Three of five regulators publish a hard rule on when gambling KYC must happen: before play in Great Britain, within 30 days of 2,000 euros in deposits in Malta, before any payout in Kahnawake. Anjouan publishes no timing and Curacao's rule pages could not be retrieved, and those two license all fourteen operators on the register.

Piece published 2026-09-28Reviewed by CryptoGuardz Register Desk, editorial desk

Gambling KYC depends on the licence, and three of five regulators publish a hard rule on timing. Great Britain verifies identity before the first bet, Malta blocks withdrawals once deposits reach 2,000 euros and gives the player 30 days, and Kahnawake verifies before any payout. Anjouan publishes no timing at all. Curacao's rule pages did not load. All 14 crypto casinos on the register are licensed in those last two.

Regulator texts read 28 September 2026. Operator licence records checked against the issuing registers on 2 September 2026.

When does gambling KYC have to happen?

Regime	When verification must happen	Documents named	Source of funds rule
UK Gambling Commission	Before the customer is permitted to gamble	Name, address, date of birth at minimum	Enhanced due diligence, named for high-risk third countries
Malta Gaming Authority	Within 30 days of deposits reaching 2,000 euros, no withdrawals until done	Unexpired government photo ID, address proof under six months old	If the customer is deemed high risk at the threshold
Curacao, LOK regime	not verified	not verified	not verified
Anjouan	not disclosed	not disclosed	not disclosed
Kahnawake Gaming Commission	Identification at registration, verification before any payment and within 30 days	Reliable, independent source documents, data or information	Ongoing, where necessary, plus enhanced due diligence

Licensees must obtain and verify information in order to establish the identity of a customer before that customer is permitted to gamble.

LCCP licence condition 17.1.1, Gambling Commission, retrieved 2026-09-28

The same condition bars a licensee from demanding extra information at withdrawal if it could reasonably have asked earlier. That clause is the opposite of the pattern on the offshore register, where the check usually arrives with the first cash-out. The UK market in detail is in what the law says about a no KYC casino in the UK, and the separate deposit-based check is covered in the affordability rules. Germany's treaty takes the same before-play line, set out in the German piece.

Malta does not write its KYC timing in an MGA directive. The MGA's anti-money-laundering page sends licensees to the FIAU's Implementing Procedures for remote gaming, and section 3.3.2 sets the trigger.

However, until such time as the licensee obtains the necessary information and documentation from the customer to meet its CDD obligations, the customer is not to be allowed to effect any withdrawals from the account independently of the amount involved.

FIAU Implementing Procedures Part II, Remote Gaming Sector, section 3.3.2, retrieved 2026-09-28

The MGA's own Player Protection Directive, article 29, then gives five working days to pay out on request, with time allowed first for verifying the player's identity.

Which documents does each regulator name?

Malta is the only one of the five that lists documents. Section 3.2 of the FIAU procedures asks for an unexpired government-issued photo document, such as a passport, identity card, residence permit or driving licence. Where that document carries no address, the licensee takes a bank statement, utility bill, government letter or lease no more than six months old. Electronic verification is allowed in place of paper.

Four green passports fanned out on a grey table — Illustration: passports. Each regulator in the table names the identity documents a casino may accept. Photo: Jon Tyson / Unsplash

The UK names data, not documents: name, address and date of birth. It leaves the document list to the operator, with one duty attached. Before the first deposit, the operator must tell the customer which documents it may ask for and when. Kahnawake's section 19 asks for "reliable, independent source documents, data or information" and stops there.

What each operator asks for is listed in the casino KYC requirements breakdown.

When can a casino ask for source of funds?

In all three regimes with a readable rule, source of funds is a risk-based step, not a routine one. The UK's AML guidance, Part 6.7, lists it among the enhanced measures required where a customer is resident in a high-risk third country. Malta's FIAU procedures require it at the 2,000 euro threshold when the customer is deemed high risk. Kahnawake's section 19 covers it in ongoing monitoring "where necessary", and section 20 adds it to enhanced due diligence.

A budget planner with printed finance sheets, a gold pen and paper clips — Illustration: financial records. A source of funds request asks where the money came from, usually through payslips or bank records. Photo: NORTHFOLK / Unsplash

None of the three makes it a routine request. Offshore terms often reserve it at will. The five operators on the register with a discretionary trigger and no published threshold are listed in what the binding terms say about a no KYC casino.

Which regulator licenses the 14 crypto casinos we track?

None holds a UK, Malta or Kahnawake licence. Eight name Curacao, six name Anjouan.

Operator	Authority as recorded	Regime	Register check	Own KYC trigger
BC.GAME	Anjouan Offshore Finance Authority	Anjouan	Valid in register	Discretionary
BetFury	Curacao Gaming Authority	Curacao	Assessment in progress	Discretionary
Cloudbet	Curacao Gaming Authority	Curacao	Assessment in progress	Threshold
Flush	Government of Anjouan	Anjouan	Operator claim only	Required
Gamdom	Anjouan, per its FAQ	Anjouan	Operator claim only	Discretionary
Jackbit	Curacao Gaming Authority	Curacao	Assessment in progress	Required
Rakebit	Anjouan Offshore Finance Authority	Anjouan	Valid in validator	Required
Roobet	Curacao Gaming Authority	Curacao	Indefinite	Required
Shuffle	Curacao Gaming Authority	Curacao	Indefinite	Required
Sportsbet.io	Curacao Gaming Authority	Curacao	Active, no expiry	Required
Stake	Curacao Gaming Authority	Curacao	Assessment in progress	Discretionary
Thunderpick	Curacao Gaming Authority / Gaming Control Board	Curacao	Assessment in progress	Required
Wild.io	Anjouan, per its terms	Anjouan	Operator claim only	Discretionary
Winz.io	Anjouan, per its terms	Anjouan	Operator claim only	Required

Five of the eight Curacao licences show "Assessment in progress" in the 31 August 2026 registry. Four of the six Anjouan claims were not matched against the issuing register. The full record per licence is on the licences page.

What the thin rules mean for a withdrawal

Where the regulator publishes nothing on timing, the operator's terms are the only rule. On this register that means 8 operators require verification before a withdrawal, 5 reserve it at discretion and 1 publishes a threshold. The Anjouan standards list "Customer due diligence procedures" as an obligation and say nothing about when. The licence conditions page is silent on player checks, which is a short read from a regulator with 1,508 licences in its public register.

Under the UK rule, checks come before money is at risk. Under the offshore terms, they tend to come when money is leaving, and a failed check can cost the balance. The confiscation clauses quote what each operator reserves. Players outside the licence footprint face the territory clauses too, set out for the USA and for Canada. The per-operator withdrawal triggers are on the KYC-on-withdrawal register, and how each field was sourced is on the method page.

Quick answers

Is online gambling KYC mandatory?

Under all three regimes whose rules could be read, yes. Great Britain before play, Malta within 30 days of 2,000 euros deposited, Kahnawake before any payment. See the licences page.

What is the casino KYC deposit threshold in Malta?

2,000 euros in deposits, under section 3.3.2 of the FIAU procedures. No withdrawal is allowed until checks finish, and the licensee must end the relationship after 30 days without them. Operator triggers are on the KYC-on-withdrawal register.

Does Curacao require KYC before play?

Not verified. The Gaming Control Board's rule pages did not load on 28 September 2026, and 8 of the 14 operators on the register cite this regulator.

Does Anjouan publish KYC rules?

It publishes the obligation, not the detail: "Customer due diligence procedures" appears in its regulatory standards with no timing, document list or threshold. 6 of 14 operators on the register name Anjouan.

Help with gambling is listed by country on the safer gambling page.

Sources

About this piece

Compiled by the CryptoGuardz register team from the sources listed above. Research and drafting are AI-assisted and reviewed by a named editor before publication. Nothing here is a recommendation to gamble. If a figure or a reading is wrong, tell us and the correction is logged in public.