Casino KYC Taking Too Long? Why It Stalls and How to Escalate
Standard identity checks at a regulated online casino usually clear within same-day to 72 hours once you submit clear, matching documents. If you’re waiting longer, the likely cause is a document problem (glare, cropped edges, expired ID, a name mismatch) or an enhanced review — most often a source-of-funds (SOF) check — which routinely takes days rather than hours. No UK, Maltese, Canadian or Curaçao law fixes a maximum verification time; the operator’s own terms set the target, and regulators only step in once you’ve exhausted the operator’s internal complaints process. This guide covers why checks stall, realistic timelines by review type, and the actual complaint routes — by licence — once the delay is genuinely unreasonable.
This assumes you already know what KYC is and what documents are typically requested — see our KYC verification guide for the basics, and our withdrawal limits guide for how pending periods and payout caps interact with verification. This piece focuses on what to do when a check is already dragging on.
Why KYC is a legal obligation, not the casino being difficult
An online casino cannot skip or rush identity checks as a customer-service favour, because in most licensed markets verifying who is depositing and withdrawing money is a statutory anti-money-laundering (AML) and counter-terrorist-financing (CTF) duty, not a discretionary policy.
- UK-licensed operators. Online casino operators are “relevant persons” under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, requiring customer due diligence — including on deposits for remote gambling and collection of winnings — plus enhanced due diligence for higher-risk customers. All Gambling Commission licensees must also meet AML/CTF obligations under the Commission’s Licence Conditions and Codes of Practice, tying back to the Proceeds of Crime Act 2002.
- Malta-licensed (MGA) operators. The MGA supervises gaming licensees for compliance with Malta’s Prevention of Money Laundering Act and its implementing regulations, acting as an agent of Malta’s Financial Intelligence Analysis Unit (FIAU). Licensees must appoint a Money Laundering Reporting Officer and apply a risk-based approach to due diligence.
- Curaçao-licensed operators. Since the National Ordinance on Games of Chance (LOK) took effect in December 2024, the Curaçao Gaming Authority (CGA) directly licenses and supervises online operators, including for AML/CFT compliance — replacing the old multi-master-licence system.
In practice, the person reading your documents is required to confirm your identity, your address, and that the money in your account is genuinely yours, before they are legally permitted to release it — not looking for reasons to inconvenience you.
Why verification actually stalls
Delays are rarely arbitrary. The recurring causes, roughly in order of how often they show up:
- Document quality. Glare across a hologram, a cropped corner, a blurry photo, or a screenshot instead of a scan can fail automated ID-verification software (Onfido, Jumio, Veriff and similar) and bump you into manual review.
- Expired ID. An expired passport or driving licence is an automatic rejection at almost every regulated operator, regardless of photo quality.
- Name or address mismatch. If your account name, card name or address proof doesn’t exactly match your ID (maiden name, a recent move, a registration typo), the system usually flags it for human review rather than approving it automatically.
- Address proof that’s too old. Most operators require a utility bill, bank statement or council/government letter dated within the last 3 months; anything older is rejected even if everything else is fine.
- A payment method not in your own name. Depositing or withdrawing via a card, e-wallet or bank account not registered in your name is one of the most common — and slowest to resolve — blocks, because it touches identity and AML rules at once.
- Deposits spread across multiple methods. Several cards, e-wallets or bank accounts each need their own check, often triggering a manual “payment method reconciliation” review before any is cleared.
- A source-of-funds trigger. Large or fast wins, high deposit velocity, or hitting an internal risk threshold moves you into SOF review — a materially longer process (see below).
- Third-party review backlogs. Verification vendors and compliance teams have queues; a signup spike, a public holiday, or a smaller operator with a thin compliance team can add days with no reflection on your specific file.
- Enhanced due diligence (EDD) thresholds. Being flagged as a politically exposed person (PEP), a sanctions-list near-match, or from a higher-risk jurisdiction triggers EDD, which is slower and more document-heavy by design.
Realistic timelines
These are typical ranges at licensed operators, not guarantees — actual timelines depend entirely on the specific operator’s terms, its compliance team’s capacity, and which review tier you land in.
| Check type | Typical timeline | Notes |
|---|---|---|
| Automated ID check (clear documents) | Minutes to a few hours | Passes straight through if the scan is clean and matches account details |
| Standard manual KYC | Same day to 72 hours | Human review of ID + address proof; most first-withdrawal checks fall here |
| Resubmission after a rejected document | +24–48 hours per attempt | Each new upload re-enters the queue; it doesn’t jump ahead |
| Enhanced due diligence / source of funds | 3–10 business days, sometimes longer | Often needs a named compliance officer’s sign-off, not just a queue check |
| PEP or sanctions-list review | 1–3 weeks | May involve manual cross-checks against watchlists before the account is cleared either way |
If you’re past the top of the relevant range with no explanation, that’s the point to start escalating rather than simply waiting — see the ladder below. For how verification interacts with withdrawal caps and pending periods specifically, see our withdrawal limits guide.
What “source of funds” actually means
Source-of-funds checks confirm that the money in your account came from a legitimate source — employment, savings, an asset sale, an inheritance — rather than question whether you’re a “good” customer. They sit alongside identity verification but are a separate, deeper AML control aimed at money-laundering and proceeds-of-crime risk.
What typically triggers it: depositing large amounts quickly (deposit velocity) relative to your normal pattern or the operator’s thresholds; a large or unusually fast win; a PEP match or a partial hit against a sanctions/watchlist screening tool; or total deposits/withdrawals crossing an operator-set cumulative threshold.
What’s usually requested: recent payslips, an employment contract or letter, bank statements covering the relevant period, a contract of sale (property, vehicle, business), or documentation for an inheritance or gift. Operators want documents that trace a specific sum to a specific, verifiable source — a generic statement showing a balance is often not enough on its own.
Why it takes longer: unlike ID verification, SOF review can’t be fully automated. A compliance analyst has to read the documents, judge whether they plausibly account for the funds, and often ask follow-up questions — which restarts part of the clock. This is the single biggest reason “KYC” complaints turn out, on closer look, to be SOF complaints.
Typical documents and what each one proves
| Document | What it’s used to prove |
|---|---|
| Passport, national ID card, driving licence | Identity and date of birth (must be current, not expired) |
| Utility bill, bank statement, council/government letter (usually <3 months old) | Current residential address |
| Card image (masked) or e-wallet account screenshot | That the payment method used belongs to you |
| Selfie or live video check | That the ID document belongs to the person using the account (liveness/anti-fraud) |
| Payslips, employment contract | Regular income as a source of deposited/won funds |
| Bank or savings statements | Accumulated savings as a source of funds |
| Sale contract (property, vehicle, business, shares) | A lump sum from an asset sale |
| Inheritance or gift documentation | A one-off windfall as the source of funds |
The escalation ladder
Work through these in order — jumping straight to a regulator before exhausting the operator’s own process usually gets bounced back, since ADR bodies and regulators require proof you gave the operator a fair chance first.
- Fix the obvious document problems first. Re-check every upload for glare, cropped edges, expiry dates and name matching before contacting anyone. A large share of “stuck” KYC is a document that would fail a second look.
- Written request to support with a clear timeline ask. Ask which stage your verification is at, what’s outstanding, and the standard SLA for that stage. Get the answer in writing (chat transcript or email) — you’ll need it if you escalate.
- Formal complaint to the operator. Use its named complaints process (most licences require one). This starts the clock regulators and ADR bodies require before accepting a referral, and should produce a reference number.
- The licensee’s ADR body or regulator. If the operator’s process stalls or its answer is unreasonable, escalate to the relevant external body for your operator’s licence (see below) — the step most people skip too early, or never reach.
Where to escalate, by licence
- UK Gambling Commission licensees. Get a “deadlock letter” or equivalent confirming the operator’s internal process is exhausted; UKGC rules allow referral to an Alternative Dispute Resolution (ADR) provider once the operator has held the complaint for 8 weeks without resolution. The Commission itself does not adjudicate individual money disputes — it approves the ADR providers operators must use. Currently approved: IBAS, eCOGRA, ADR Group, Pegasus ADR Service, CEDR, ProMediate, Tattersalls Committee and Blexr Limited; your operator’s terms name which one it uses.
- Malta Gaming Authority (MGA) licensees. Complain to the operator first — licensees must investigate and tell you the outcome within 10 working days (extendable by a further 10 days if you’re told why). If unsatisfied, refer the complaint and supporting facts to the MGA’s Player Support Unit or an approved ADR entity.
- Ontario (AGCO / iGaming Ontario). Raise it with the operator’s formal complaints process first; AGCO guidance gives operators up to 90 days to resolve it. If that stalls, or your complaint concerns responsible gambling, suspected illegal activity or advertising, submit through the iAGCO portal — the AGCO does not resolve individual money disputes, and its own initial review can take from a few business days to several weeks.
- Kahnawà:ke Gaming Commission licensees. The complaint must go to the operator first. If unresolved, submit to the KGC by email ([email protected]) or its online form, with full details and the steps already taken with the operator. A dedicated Dispute Resolution Officer handles these; complaints already ruled on elsewhere, or discussed publicly, may be declined.
- Curaçao Gaming Authority (CGA) licensees. Under the LOK regime, licensees must offer a free, CGA-certified ADR route. CADRE (certification CGA/ADR/2025/01) is one such entity — check your operator’s terms for which it uses, since more than one may be certified. This framework is newer and less standardised than the UK’s or Malta’s, so confirm the operator’s own complaints process first.
None of this is legal advice — these are the official complaint routes as published by each regulator; for a binding opinion on your situation, consult a solicitor or your jurisdiction’s citizens’-advice equivalent.
What not to do
- Don’t send documents over unsecured channels. Emailing a passport scan to a personal address, posting it in a public chat, or sending it via social media DM outside the operator’s official upload portal exposes your ID to fraud risk and won’t speed anything up.
- Don’t open a second account. Multi-accounting is against virtually every operator’s terms and can get both accounts (and any pending withdrawal) frozen or voided — it does not “reset” a stuck verification.
- Be cautious with chargebacks. Disputing a card payment mid-verification usually triggers an automatic suspension and can be treated as attempted fraud, blocking any withdrawal entirely and removing you from the operator’s and regulator’s normal dispute process. It’s a last resort, not a shortcut.
Red flags that suggest the operator, not the process, is the problem
Genuine SOF and EDD reviews are slow but bounded and specific. Be more sceptical if you see:
- Shifting requirements — each new document you submit produces a new, previously unmentioned request, with no cumulative list of what’s actually needed.
- Requests unrelated to identity or funds — information that has nothing to do with proving who you are or where your money came from.
- Indefinite “under review” with no named timeline — support repeatedly saying it’s “being looked at” with no stage, SLA, or team named.
- No written trail — refusal to confirm anything in writing, or contradictory answers from different agents with no linking reference number.
If you see this pattern, that’s exactly the situation the formal complaint and ADR/regulator routes above exist for.
FAQ
How long does casino KYC take?
Standard identity checks typically clear within same-day to 72 hours once clear documents are submitted. Enhanced checks — most commonly source-of-funds reviews — take longer: several business days up to a few weeks, depending on the operator and how quickly you supply satisfactory documents. There’s no universal statutory deadline; the operator’s own terms govern the target, though regulators require a defined, published complaints process.
Why is my casino verification taking so long?
The most common reasons are a document issue (glare, cropped edges, expired ID, a name mismatch), a payment method not registered in your name, or being moved into a source-of-funds or enhanced due diligence review — inherently slower because it needs a human compliance analyst, not an automated check.
Do I need ID for a casino withdrawal?
Yes, at any operator licensed by the UK Gambling Commission, MGA, Ontario’s AGCO/iGaming Ontario framework, Kahnawà:ke, or Curaçao’s CGA — verification before or at first withdrawal is a licence condition, not optional. Some operators complete this at signup, others only trigger it at withdrawal; either way it happens before funds are released.
What documents does a casino need?
At minimum, a current government-issued photo ID and proof of address dated within the last few months. For withdrawals, most operators also want proof the payment method belongs to you. If flagged for source-of-funds review, expect to also provide payslips, bank statements, or documentation of a lump sum such as a sale contract or inheritance letter — see the document table above.
Is my casino KYC taking too long?
It depends on the stage you’re in: past 72 hours for a standard document check, or past 3–10 business days for a source-of-funds review (up to a few weeks for a PEP or sanctions check), is longer than the typical range at licensed operators. If you’ve passed that window with no explanation, that’s the point to stop waiting and start the escalation ladder — a written timeline request to support, then a formal complaint, then the relevant ADR body or regulator for your operator’s licence.
Sources
- UK Gambling Commission — Taking your complaint to an Alternative Dispute Resolution (ADR) provider
- UK Gambling Commission — Approved Alternative Dispute Resolution (ADR) providers
- UK legislation.gov.uk — The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017
- Malta Gaming Authority — Lodge a Complaint
- Malta Gaming Authority — FAQ: complaint process licensees must offer players
- Malta Gaming Authority — Anti-Money Laundering
- Alcohol and Gaming Commission of Ontario — Internet gaming complaints
- Kahnawà:ke Gaming Commission — Dispute Resolution
- Curaçao Gaming Authority — The Curaçao Gaming Control Board
- CADRE (Curaçao Alternative Dispute Resolution Entity) — CGA-certified ADR provider (certification CGA/ADR/2025/01)