What is KYC verification? FATF, FinCEN and EU rules, and when 24 crypto casinos trigger it
What is KYC verification?
KYC stands for know your customer, the identity check that FATF Recommendation 10 requires of financial institutions and that US and EU rules write into law. Of 24 crypto casinos on the register, 9 make it a condition of withdrawal, 13 reserve it at discretion and 6 publish a money figure.
Piece published Reviewed by CryptoGuardz Register Desk, editorial desk
KYC verification is the check a regulated business runs to confirm who a customer is: KYC stands for know your customer. The global standard is FATF Recommendation 10, which requires identity to be verified "using reliable, independent source documents". Of the 24 crypto casinos on this register, 9 make it a condition of withdrawal, 13 reserve it at their discretion, and 6 publish a money figure that triggers it.
The rules below were read on 9 October 2026. The casino counts are computed from the KYC fields of the 24 records on the KYC-on-withdrawal register, each read from the operator's own terms on 2 September or 2 October 2026. Nothing here is financial advice.
What does KYC stand for?
Know your customer. The phrase is older than crypto. FINRA, the US broker-dealer regulator, still carries it as the title of Rule 2090, "Know Your Customer", which requires every member to use "reasonable diligence, in regard to the opening and maintenance of every account, to know (and retain) the essential facts concerning every customer". Anti-money-laundering law uses a different label for the same job, customer due diligence or CDD. A casino's "KYC" page and a regulator's "CDD" rule are describing one process.
What is KYC verification under FATF Recommendation 10?
Four measures, set by the Financial Action Task Force, whose Recommendations were last updated in June 2026. Recommendation 10 opens with a ban:
Financial institutions should be prohibited from keeping anonymous accounts or accounts in obviously fictitious names.
It then lists the measures. (a) "Identifying the customer and verifying that customer's identity using reliable, independent source documents, data or information." (b) Identifying the beneficial owner. (c) "Understanding and, as appropriate, obtaining information on the purpose and intended nature of the business relationship." (d) "Conducting ongoing due diligence on the business relationship and scrutiny of transactions", "including, where necessary, the source of funds."
Measure (d) is the one casino players meet. A selfie at sign-up is (a). A request for bank statements after a large win is (d).
When does FATF say KYC must happen?
At four points: when "establishing business relations"; on occasional transactions "above the applicable designated threshold (USD/EUR 15,000)"; when "there is a suspicion of money laundering or terrorist financing"; and when the institution "has doubts about the veracity or adequacy of previously obtained customer identification data."
Casinos are covered separately. Recommendation 22 applies due diligence to "Casinos – when customers engage in financial transactions equal to or above the applicable designated threshold." The casino threshold itself sits in an interpretive note this desk could not read in two attempts on 9 October 2026, so the figure is not verified here. Recommendation 15 extends the regime to crypto businesses: "countries should ensure that virtual asset service providers are regulated for AML/CFT purposes".
What does US law require?
For banks and other covered financial institutions, FinCEN's CDD rule. The FinCEN page says the rule "has four core requirements", requiring written procedures reasonably designed to:
| FinCEN CDD rule requirement | Wording on FinCEN's page |
|---|---|
| 1 | "identify and verify the identity of customers" |
| 2 | "identify and verify the identity of the beneficial owners of companies opening accounts" |
| 3 | "understand the nature and purpose of customer relationships to develop customer risk profiles" |
| 4 | "conduct ongoing monitoring to identify and report suspicious transactions" |
The fourth adds that institutions must, "on a risk basis, to maintain and update customer information". The structure follows FATF closely. Offshore crypto casinos are not FinCEN-regulated institutions, and 22 of the 24 on the register list the United States among restricted territories; the US position is set out in no KYC casino USA.
What does the EU AML regulation say?
Regulation (EU) 2024/1624, the AML Regulation, sets one rulebook for the EU in place of national laws. EUR-Lex records 10 July 2027 as its first date of entry into force. For gambling, recital 64 explains how its threshold works:
The EUR 2 000, or the equivalent in national currency, threshold applicable to providers of gambling services is met regardless of whether the customer carries out a single transaction of at least that amount or several smaller transactions which add up to that amount.
The recital goes on: providers "should be able to attribute transactions to a given customer even if they have not yet verified the customer's identity". A licensed EU operator must be able to add up a player's activity before knowing who the player is, so it knows when 2,000 euros has been reached. The operative articles of the regulation did not load in two attempts at the EUR-Lex text, so article numbers and the crypto-asset provisions are not quoted here: not verified. How five gambling regulators apply their own rules is compared in gambling KYC by regulator.
When do crypto casinos trigger KYC verification?
On their own terms, mostly when they decide to. The register classifies each operator's binding documents into one of three modes:
| Mode in the record | What the terms do | Casinos | Count |
|---|---|---|---|
| Required | KYC is a stated condition of withdrawal or of funding | Flush, Jackbit, Lucky Block, Rakebit, Roobet, Shuffle, Sportsbet.io, Thunderpick, Winz.io | 9 |
| Threshold | A published amount triggers it | Cloudbet | 1 |
| Discretionary | The operator may ask at any time | BC.GAME, BetFury, Bets.io, Bitcasino, Duelbits, FortuneJack, Gamdom, mBit, Metaspins, Rollbit, Stake, Vave, Wild.io | 13 |
| No data | No terms readable | Coins.Game | 1 |
Only Cloudbet's terms make a number the main trigger, but 6 operators put a figure somewhere in their KYC text:
| Casino | Figure in the operator's own document | Trigger |
|---|---|---|
| Cloudbet | 2,200 US dollars | Cumulative deposits |
| Lucky Block | 2,000 euros; 5,000 dollars | Deposits for ID; source of wealth above 5,000 dollars |
| Rakebit | USD 2,000 | First deposit below it, where payment providers demand |
| Bitcasino | 2,500 euros | Withdrawals, with smaller ones reserved |
| Sportsbet.io | 2,500 euros | Withdrawals, with smaller ones reserved |
| mBit | 1 BTC | Payouts, with lower ones reserved |
Three of the six, Bitcasino, Sportsbet.io and mBit, publish the figure and then reserve the right to check below it, so the number is a floor for certainty, not a ceiling for privacy. Stake's AML policy describes a withdrawal threshold "dependent on the account's risk characterisation", as the record puts it, and does not publish it. Metaspins clause 9.7 says the operator must verify "upon your gambling reaching a certain threshold" and gives no figure.
Two operators move KYC before the first deposit. Jackbit's policy requires identification "before any financial transaction can be made", as the record summarises it, and Shuffle's AML policy states: "Shuffle will collect any of the above KYC Information before issuing a Shuffle funding address (e.g., QR code) to customers."
How long do casinos give for KYC documents?
Five operators name 30 days: BetFury, Bets.io, Flush, FortuneJack and Thunderpick. Vave's clause 8.7 allows two weeks: "Failure to pass verification within 2 weeks will lead to account closure and any winnings confiscation." What happens to the balance when the deadline passes is in failed KYC: what happens to the balance, and the documents each operator names are in casino KYC requirements.
Do crypto exchanges trigger KYC the same way?
The exchange register does not record KYC triggers as a field, so no count is computed here: no data. The exchange records do hold the consequences. HTX's agreement, for one, lets it "suspend, halt or terminate" a suspicious transaction and report it "without notice to you". The 18 exchange entries are on the exchange register.
What this does not show
How often any casino asks for documents in practice, or how long review takes: not measured. The FATF casino threshold and the EU regulation's operative articles: not verified. Whether operators apply the figures they publish: not measured. A casino advertised as "no KYC" is covered on the no-KYC page, and the terms behind that label in no KYC casino. Nothing here explains how to avoid verification.
Quick answers
What does KYC stand for?
Know your customer. FINRA Rule 2090 carries the phrase as its title, and FATF Recommendation 10 sets the international standard under the name customer due diligence.
What is KYC verification at a crypto casino?
The identity check the operator runs before or during play. Nine of 24 register casinos make it a condition of withdrawal and 13 reserve it at any time. Each clause is on the KYC-on-withdrawal register.
At what amount do crypto casinos ask for KYC?
Six of 24 publish a figure, from 2,000 euros at Lucky Block to 1 BTC at mBit. Cloudbet's is 2,200 US dollars of cumulative deposits. See the Cloudbet entry.
Can a casino ask for KYC after I win?
Yes. Thirteen of 24 reserve the right to ask at any time, and FATF measure (d) expects ongoing scrutiny "including, where necessary, the source of funds." Register entries quote each clause.
If gambling has stopped being a choice, the responsible gambling page lists the helplines and self-exclusion schemes by market. Outside those markets, Gambling Therapy offers free support at gamblingtherapy.org.
Sources
- FATF Recommendations, updated June 2026, Recommendation 10, retrieved 2026-10-09
- FATF Recommendations publication page, retrieved 2026-10-09
- FINRA Rule 2090, Know Your Customer, retrieved 2026-10-09
- FinCEN, CDD Final Rule, retrieved 2026-10-09
- Regulation (EU) 2024/1624, recital 64, retrieved 2026-10-09
- Regulation (EU) 2024/1624, EUR-Lex record, retrieved 2026-10-09
- CryptoGuardz KYC-on-withdrawal register, kyc fields in data/operators, read 2026-09-02 and 2026-10-02
- Cloudbet terms, as recorded 2026-09-02
- Bitcasino terms, as recorded 2026-10-02
- Sportsbet.io general terms and conditions, as recorded 2026-09-02
- Lucky Block AML policy, as recorded 2026-10-02
- mBit player terms, as recorded 2026-10-02
- Rakebit payment policy, as recorded 2026-09-02
- Jack KYC and AML policy, as recorded 2026-09-02
- Shuffle anti-money-laundering policy, retrieved 2026-10-09
- Stake anti-money-laundering policy, retrieved 2026-10-09
- Vave terms and conditions, as recorded 2026-10-02
- Metaspins terms and conditions, as recorded 2026-10-02
- CryptoGuardz safer gambling file
About this piece
Compiled by the CryptoGuardz register team from the sources listed above. Research and drafting are AI-assisted and reviewed by a named editor before publication. Nothing here is a recommendation to gamble. If a figure or a reading is wrong, tell us and the correction is logged in public.