KYC for iGaming Operators: Age Verification, AML & Player Identity in 2026

Online casino fraud rates surged 73% between 2022 and November 2024, with fraud costing the gambling sector roughly $1 billion per year, according to a January 2025 Biometric Update report. Regulators across the UK, Germany, France, the Netherlands, and Sweden responded by tightening player identity and age verification requirements heading into 2025 and 2026. For iGaming operators, KYC is no longer a single onboarding step. Solid iGaming KYC verification means running document confirmation, age screening, and anti-money laundering (AML) screening as a continuous compliance layer across the full player lifecycle.

This guide covers what iGaming KYC compliance actually requires in 2026, how the rules differ across major regulated markets, and how online casino identity verification and fraud prevention fit together in a compliant stack.

Know Your Customer (KYC) in iGaming is the process of collecting and verifying player identity documents, confirming age eligibility, and screening new players against sanctions lists and AML databases before they can deposit funds or access real-money games.

What does KYC require from iGaming operators?

KYC for iGaming operators covers three separate checks that must run at different points in the player journey. Sequence matters more than most operators expect. Most regulatory audit failures trace back to a specific gap. One check runs late, or the outputs from different systems never connect into a single risk decision. The three obligations are document verification, age confirmation, and AML screening, each with its own timing and evidence rules.

Document and identity verification

Online casino identity verification requires operators to collect a government-issued photo ID, typically a passport, national identity card, or driver’s licence, and confirm the document is genuine, unexpired, and matches the person presenting it. Optical character recognition (OCR) extracts and validates document data automatically. As of 2026, document verification must be completed before a first deposit in virtually every licensed market, not after a deposit has already been processed.

Age verification requirements for online gambling

Age verification online gambling rules set 18 as the minimum across every regulated European market. The UK Gambling Commission (UKGC) removed the 72-hour grace period that previously let players deposit before verification was complete, making immediate age verification checks mandatory at sign-up. Germany’s Interstate Treaty on Gambling requires identity confirmation before any session begins, and a failed age check is treated as a licence condition violation rather than a procedural lapse.

AML screening at onboarding

AML compliance rules in iGaming require operators to screen every new player against Financial Action Task Force (FATF) watchlists, sanctions lists, and politically exposed person (PEP) databases as part of initial customer due diligence. Sanctions and PEP screening must happen at onboarding, not after a player’s first withdrawal. Since February 2025, the UKGC has required financial vulnerability checks once a player’s net spend exceeds £150 in a rolling 30-day period. Operators treating this as a post-onboarding add-on are the ones that appear in compliance enforcement actions.

What iGaming KYC compliance looks like across major markets in 2026

No single global standard governs online casino KYC. Each licensed market sets its own timing, evidence, and ongoing monitoring requirements, and operators with players across several jurisdictions must satisfy multiple regimes at the same time. The UK, Germany, France, the Netherlands, and Sweden are the strictest in Europe, and all five updated their requirements meaningfully in the past 12 months.

UK Gambling Commission requirements

The UKGC operates one of the most detailed KYC frameworks in the sector. Under its emerging AML risks guidance, licensed operators must run customer due diligence (CDD) at registration, enhanced due diligence (EDD) on high-value or high-risk players, and ongoing transaction monitoring throughout the player relationship. As of April 2025, the Commission specifically flagged cryptocurrency funding as a high-risk indicator requiring additional AML scrutiny in a player’s risk profile. UKGC KYC obligations will tighten further under the full rollout of affordability checks, due for complete implementation by Q3 2026.

Germany, GlüStV, and OASIS

Germany’s Interstate Treaty on Gambling (Glücksspielstaatsvertrag, or GlüStV) requires operators to verify identity before any play is permitted, with no deposit threshold and no grace period. All licensed operators must integrate with OASIS, Germany’s central self-exclusion register, to screen players at login. The Commission for Youth Protection in the Media (KJM) enforces age verification gaming standards and requires technically reliable age confirmation at registration, not self-declaration. Deposit limits under GlüStV are tied directly to verified identity, which makes age verification gaming checks and document KYC functionally inseparable under the German framework.

France, the Netherlands, and Sweden

France’s national gambling regulator, the Autorité Nationale des Jeux (ANJ), requires KYC completion before a first deposit and mandates PEP and sanctions screening as part of the onboarding process. The Dutch Kansspelautoriteit (KSA) runs a similar framework under its Remote Gambling Act, requiring real-time identity verification at registration. Sweden’s Spelinspektionen ties player identity to its Spelpaus national self-exclusion system, and operators using BankID as a digital identity layer must still run AML checks on top, since BankID confirms identity but does not perform sanctions or PEP screening independently.

How do casinos prevent fraud and money laundering online?

Fraud prevention in gambling is not a single control. The attacks iGaming platforms face, from bonus abuse to synthetic identity fraud to money laundering through high-value accounts, require different detection methods at different points in the player lifecycle. According to the same January 2025 Biometric Update report, bonus abuse accounts for nearly 66% of online casino fraud. A single identity check at onboarding does not catch the behaviour that drives the majority of that number.

Real-time AML transaction monitoring

Gambling AML rules require operators to monitor transactions continuously, not just screen players at onboarding. Deposits structured to avoid reporting thresholds, withdrawals to accounts that do not match verified player identity, and betting patterns inconsistent with declared income are all red flags under the FATF risk-based approach for casinos. Operators that treat AML as a one-time check rather than an ongoing obligation are the ones that appear in UKGC and ANJ enforcement actions.

Biometric and liveness verification for player identity

Document capture alone does not stop identity fraud in iGaming. A stolen ID paired with an altered photo can pass a document-only check. Biometric verification adds a live selfie match against the ID photo, and liveness detection confirms the selfie comes from a person who is physically present rather than a photo replay or deepfake attack. The best KYC tools for iGaming platforms combine OCR document extraction, biometric matching, and AI liveness detection as a single player verification workflow, rather than running them as separate steps that each generate their own disconnected risk output.

Ongoing player risk assessment

Gambling compliance solutions that screen only at sign-up miss most of the AML risk that accumulates over time. Player risk profiles change after onboarding. A player who passed initial screening can later match a newly added PEP listing, shift their transaction behaviour toward money-laundering typologies, or fund their account from a newly sanctioned entity. KYC software in the gaming industry that runs continuous watchlist monitoring catches these changes in real time rather than flagging them at a periodic manual review cycle.

How Shufti helps iGaming operators meet KYC and AML requirements

iGaming platforms building compliance in-house often end up with a fragmented stack. A separate age verification tool, a different document check provider, and a third AML tool that does not share risk signals with the other two create three separate audit trails where one would serve. Shufti brings identity verification and AML screening into a single API so the outputs from each layer feed into one risk decision rather than three.

Shufti’s KYC solution processes government-issued IDs across 10,000+ document types from 240+ countries, with a 99.3% true detection rate for confirmed fraud attempts. For AML, Shufti’s AML screening runs against 3,500+ global watchlists, 2.6 million PEP profiles, and 215+ sanction regimes, with data refreshed every 15 minutes so screening reflects the current watchlist state rather than a batch run from the previous night.

For operators managing UKGC KYC requirements, KJM age verification rules, or ANJ onboarding obligations, the same verification workflow covers all three frameworks without requiring a separate integration per jurisdiction.

iGaming operators managing compliance across multiple regulated markets need more than a sign-up form with a document upload. Shufti’s identity verification and AML screening platform runs the full player compliance workflow through one integration, so operators cover age, identity, and AML obligations without stitching together separate tools. Request a demo to see how the platform handles your specific market requirements.