Asked for ID Only When You Cash Out? The UK Regulator Calls That Backwards
On August 12, 2026 the UK Gambling Commission published a reminder to remote operators about licence condition 17, the rule that governs identity verification. The line that matters to players is already in the condition itself: a withdrawal request must not become the moment an operator asks for information it could reasonably have requested earlier. The Commission says more than 25 percent of complaints reaching its Contact Centre are about identity verification. The condition binds operators licensed in Great Britain, which most crypto casinos are not — but it gives you a precise, published standard to measure any casino against before you deposit.
What the Commission actually said
That identity checks belong at registration, not at cash-out, and that a withdrawal request cannot be used to collect information the operator should already have.
The post was written by Helen Rhodes, the Commission's Director of Major Policy Projects and Evaluation, and Sarah Webster, Senior Policy Officer. It is framed as a reminder rather than a new rule, prompted by the Commission finding instances where licensees were not obtaining enough information at registration to satisfy licence condition 17.
Three requirements sit at the centre of it. First, licensees must obtain and verify information to establish a customer's identity before that customer is permitted to gamble, and verification must at minimum give assurance that the person exists and that name, address and date of birth all belong to the same individual. Second, in the condition's own words, a request to withdraw funds “must not result in a requirement for additional information to be supplied as a condition of withdrawal if the licensee could have reasonably requested that information earlier.” Third, operators are expected to tell customers up front which documents may be needed and how to submit them, and to keep identity information accurate over time.
The accompanying guidance is blunter than the condition. Checks “could and should be undertaken as early as practicable in the customer journey to avoid unnecessary friction and delays,” and it is not appropriate to wait for a withdrawal request to follow up outstanding queries.
| Stage | What the condition expects | What it means for you |
|---|---|---|
| Registration | Name, address and date of birth obtained and verified as one real person | Give your legal name and residential address exactly — not initials, not a nickname, not a work address |
| Before first deposit | Customer told which documents may be required, when, and how to send them | If the site never says, assume the request is coming later and ask |
| Before first bet | Verification complete; gambling not permitted until it is | Being allowed to play instantly is not proof you are verified |
| During play | Identity information kept accurate; risk-based checks still available | Keep your details current after a house move or name change |
| At withdrawal | No new demand for information that could reasonably have been requested earlier | A first-time ID request at cash-out points to an onboarding failure, not to you |
Why the reminder landed now
Because poor registration data broke the Commission's own financial risk assessment pilot, and the same poor data is what strands withdrawals.
The pilot was meant to test frictionless background checks: an operator passes customer details to a credit reference agency, the agency matches them to a record, and most customers never notice. Instead a share of accounts could not be matched at all, and those had to be handled through slow manual checks — the exact friction the pilot was designed to remove. The Commission reports the unmatched cases were a minority, and has not published a figure for them; full evaluation of the pilot is expected around September 2026.
The causes it names are mundane. Accounts registered with initials instead of a full forename. Nicknames in place of legal names. A middle name entered where the forename belongs. Commercial addresses rather than residential ones. On top of that, the Commission flags reliance on third-party providers using fuzzy matching — accepting a near-enough match instead of an exact one, so an account can be marked verified while the underlying details never corresponded to a single real person.
Two consequences follow, and only one of them is about withdrawals. A customer who is not truly matched can slip past GAMSTOP, Britain's self-exclusion scheme, which is the more serious harm. The other consequence is the one players feel: the mismatch stays invisible until money tries to leave, and then the account freezes.
What this does and does not change for a crypto casino
Licence condition 17 binds operators licensed in Great Britain. Most crypto casinos are licensed in Curaçao or Anjouan, so it does not reach them — the standard is still worth borrowing.
Nothing in the August reminder creates a right you can enforce against an offshore operator. What it creates is a published benchmark from a mature regulator, in plain language, that you can hold up against any casino's terms. If a site tells you plainly at sign-up which documents it may need and verifies you before you play, it is behaving like a licensed operator whether or not it holds that licence. If it lets you deposit in thirty seconds and asks for a passport only once you request a payout, that gap is a deliberate design choice.
Be precise about what is and is not objectionable, though. Anti-money-laundering and risk-based reviews after play has started are legitimate and expected, and a genuinely new circumstance — a balance far above your deposit history, a payout to a route you have never used, a source-of-funds question — can properly trigger a request at any point. We are not describing a way to avoid verification, and we would not recommend looking for one: an unverifiable account is the one most likely to end with a confiscated balance. The complaint the Commission is addressing is narrower and more specific — basic identity information that was never collected at the start being demanded at the end.
Register with the name and address on the documents you would actually send. A mismatch you introduced yourself — a shortened forename, an old address, a name spelled differently from your ID — produces exactly the same frozen withdrawal, and no regulator will help you with that one.
Six things to settle before you deposit
Find the verification section in the terms
It should say which documents may be required and when. If you cannot find it before depositing, you will find out at withdrawal instead.
Complete verification before your first bet
Many sites allow it voluntarily at sign-up. Doing it while you have no balance at stake costs you nothing and removes the whole failure mode.
Match your registration details to your documents exactly
Full legal forename, residential address, date of birth as printed. This is the single largest cause of the delays the Commission described.
Check whether there is an ADR route
Licensed operators name an alternative dispute resolution provider you can escalate to. Ask who adjudicates a dispute before you have one — on many offshore sites the answer is nobody.
Test a small withdrawal early
A modest cash-out in the first week surfaces a verification wall while the amount at risk is trivial. Our withdrawal times comparison covers what a normal turnaround looks like.
Read the payout clauses, not the bonus headline
Maximum cash-out, dormancy and bonus-voiding terms decide more disputes than verification does. We break the important ones down in five clauses that decide your payout.
If a withdrawal is already being held
Supply precisely what was asked for, document every exchange, then escalate in writing rather than by live chat.
Send the specific documents requested, in the format requested, and keep dated copies of what you sent and when. Move the conversation into the operator's formal complaints procedure, which is usually a named email address in the terms rather than the chat widget. If the operator is licensed and the complaint is unresolved after its internal process, take it to the alternative dispute resolution provider named in the terms — you can confirm that name on the regulator's public register rather than trusting the site's footer. Having your own copy of the account history helps here, which is why we recommend keeping an exported bet history from the start.
For the background on why these checks exist at all, our explainer on KYC and AML at crypto casinos covers the obligations operators are working under, and understanding crypto casino licensing sets out what different licences actually oblige an operator to do. The behaviours that tend to precede a stuck payout are collected in red flags to spot early.