What ID and Documents Do You Need for a Casino Withdrawal?
Do you need ID for a casino withdrawal?
Yes, essentially always. Licensed online casinos are legally required to confirm who you are before releasing a withdrawal, and in most cases before you can gamble at all. This isn’t a casino being awkward or trying to slow down your payout — it’s a condition of the operator’s gambling licence and its anti-money-laundering (AML) obligations. In the UK, for example, Licence Condition 17.1.1 requires licensees to “obtain and verify information in order to establish the identity of a customer before that customer is permitted to gamble,” and equivalent duties exist under the licensing and AML frameworks of other regulators. Skipping or delaying verification is one of the most common reasons withdrawals get held up, so knowing what’s needed in advance is the single biggest thing you can do to avoid delays.
This guide is a practical checklist of the documents casinos ask for, why each one is needed, what makes a submission acceptable or rejected, and what your data-protection rights actually are once you’ve sent your documents. For a broader explainer of how the KYC (know your customer) process works end to end — including timelines and what happens at each stage — see Casino Capybara’s KYC verification guide. This page focuses specifically on the documents themselves.
The four standard document categories
Requirements differ by operator, licensing jurisdiction and the size of your withdrawal, so treat the following as the common pattern rather than a universal rule. Most licensed casinos will ask for some combination of these four categories.
1. Proof of identity
This confirms you are who you say you are and that you meet the minimum gambling age. Accepted documents are usually a passport, national ID card, or driving licence.
- Validity — the document must be in date. Expired IDs are rejected automatically by most verification systems.
- All four corners visible — the whole document must be in frame, not cropped, with no part obscured by a finger or a card sleeve.
- No glare — a flash reflection over the photo or the machine-readable zone is one of the most common reasons a first attempt bounces. Photograph the document flat, in indirect light.
- MRZ readability — passports and many ID cards have a machine-readable zone (the row of characters along the bottom). Automated systems scan this line, so it needs to be sharp and complete, not blurred or partially cut off.
2. Proof of address
This confirms where you live, which matters for both AML checks and for confirming you’re gambling from a jurisdiction the operator is licensed to serve. Typical accepted documents are a utility bill, a bank or credit card statement, or a council/municipal tax bill.
- The “issued within 3 months” convention — most operators want a document dated within the last 90 days, on the logic that an older bill may no longer reflect where you actually live. This is a common convention, not a universal law, so check the specific operator’s terms.
- Mobile-phone bills are often rejected — many casinos specifically exclude mobile bills because a phone contract can be registered to an address without the account holder actually living there, and because they’re easier to falsify than a bank or utility document tied to a fixed supply address.
- PO boxes — a PO box or a mail-forwarding address usually won’t satisfy proof-of-address checks, because it doesn’t establish a residential address for AML purposes.
3. Proof of payment method
This confirms the money is going back to the same source it came from — a card, e-wallet or bank account you actually own. Typical documents are a photo of the payment card with the middle digits and CVV masked, an e-wallet account screenshot, or a bank statement header showing your name and account details.
- Why the name must match — the name on the payment method has to match the name on your verified ID and casino account. This is a direct AML control: it stops funds moving between unrelated third parties, which is exactly the kind of layering activity AML rules are designed to catch.
- What happens if it doesn’t match — a mismatch (a card in a partner’s name, a joint account where only one person is verified, a maiden name that hasn’t been updated) will typically freeze the withdrawal until you supply extra documentation proving the connection, such as a marriage certificate or a bank letter. Some operators will not accept third-party payment methods under any circumstances and will require the funds to be returned to a matching account instead.
4. Source of funds / source of wealth
This isn’t routine — it’s triggered by specific risk signals rather than requested on every withdrawal. Typical triggers include unusually large deposits or withdrawals relative to your normal play, a sudden change in deposit pattern, or hitting an internal threshold the operator’s risk team monitors. When it is triggered, acceptable documents usually include recent payslips, bank statements showing regular income, tax returns, or documentation of a one-off event such as an inheritance, property sale or gambling win elsewhere.
Source-of-funds checks exist because AML obligations require operators to understand not just who you are, but where your money legitimately comes from, particularly once activity moves outside your normal pattern.
Selfie and video (liveness) verification
An increasing number of operators now ask for a selfie, or a short live video where you turn your head or hold your ID next to your face. This is a “liveness” check: it confirms that a real person is present at the moment of verification, not a static photo of someone else’s documents. It’s designed to catch identity theft and stolen-document fraud, and it’s typically handled by a dedicated verification vendor rather than casino staff reviewing the image manually. Expect it to be paired with, not a replacement for, the standard document checks above.
What to redact — and what must stay visible
This is one of the most commonly misunderstood parts of the process. Over-redacting a document is almost as likely to get it rejected as under-redacting it, because the verification team needs enough visible information to actually confirm the document is genuine and matches your account.
| Redact | Keep visible |
|---|---|
| The middle 6–8 digits of a payment card | The first 4 and last 4 digits |
| The CVV / security code (the 3–4 digits on the back or front) | The cardholder’s name |
| Full account numbers on a bank statement, beyond what’s needed to confirm ownership | The expiry date |
| Unrelated transactions on a statement, if the operator allows redacting them | The bank/issuer name and statement date |
Never redact your name, the document’s expiry date, or the issuing authority on an ID document — these are exactly what the verification team is checking against your account. If in doubt, use a black marker or an image-editing tool to cover only digits, and leave the rest of the document intact.
Why documents get rejected — and how to fix it
| Rejection reason | Fix |
|---|---|
| Document has expired | Submit a current, in-date document |
| Glare or flash reflection over text/photo | Photograph in indirect natural light, angled slightly away from a direct light source |
| Cropped edges or missing corners | Include the full document with a small margin of background visible |
| Blurred or low-resolution image | Use a phone camera in focus mode rather than a low-res scan or screenshot of a screenshot |
| Address document older than the operator’s cut-off (commonly ~3 months) | Request a recent statement or download a current e-bill from your provider’s online portal |
| Name mismatch between ID, account and payment method | Supply supporting evidence (marriage certificate, deed poll, bank letter) or update your account name to match your ID |
| File format not accepted or file too large | Check the operator’s upload page for accepted formats (usually JPG/PNG/PDF) and size limits |
| Screenshot or photocopy instead of an original document | Photograph the physical document directly rather than a printed copy |
Your data-protection rights
The following is a factual summary of how these laws generally apply, not legal advice. Exact obligations depend on the operator’s licence and where you and the operator are based — if you have a specific dispute, contact the operator’s data protection officer or your local regulator.
Casinos process your ID and financial documents on the legal basis of complying with their licensing and AML obligations, not just because you agreed to it. Under the EU/UK GDPR, Article 6(1)(c) sets out “legal obligation” as a lawful basis for processing, separate from consent — which matters because it means you generally cannot simply withdraw consent to make an operator delete your verification documents while it remains under an active legal duty to hold them.
That duty has a time limit. In the UK, the Money Laundering Regulations 2017 (Regulation 40) require regulated businesses to keep customer due diligence records — including the documents you submit — for five years from the end of the business relationship or the completion of the transaction, with a maximum of ten years for certain records. Once that retention period expires, the regulations require the operator to delete the personal data unless another legal ground to keep it applies.
This is also why the GDPR’s right to erasure has a built-in carve-out. Article 17(3)(b) states that the right to erasure does not apply where processing is “necessary for compliance with a legal obligation.” In practice, this means an operator can lawfully refuse a “please delete my documents” request while its AML retention period is still running, but must act once that period ends and no other legal ground remains.
Other jurisdictions follow a broadly similar shape, though the mechanics differ:
- Canada (PIPEDA) — gives you a right to access the personal information an organisation holds about you and to have it corrected if inaccurate, but does not grant a general right to erasure in the way GDPR does. Data still has to be destroyed once it’s no longer needed for the purpose it was collected for, subject to other retention laws such as AML rules.
- Brazil (LGPD) — Article 18 gives data subjects the right to request anonymisation, blocking or deletion of data that is unnecessary, excessive, or processed in breach of the law, and the right to delete data processed with consent — but this is explicitly qualified where the controller has another legal basis (such as a regulatory retention duty) to keep it.
In short: you have a genuine right to ask what data an operator holds on you and how it’s used, and a right to have it deleted once the operator’s legal retention obligations have run out — but AML and licensing law generally take priority over an erasure request while your account or transaction history is still within the mandatory retention window.
Staying safe when you send documents
Identity documents are exactly the kind of data criminals want, so treat the upload process itself as part of your security.
- Only use the operator’s own secure upload page — the verification section inside your account, not a link sent to you unprompted.
- Never send documents by email or live chat — these channels aren’t designed for sensitive-document handling and legitimate verification teams don’t normally ask for it that way.
- Watch for phishing that impersonates verification requests — a message urgently demanding you “re-verify” via an external link, especially one threatening account closure or withdrawal cancellation, is a common fraud pattern. Log into the casino directly through its known URL rather than clicking through, and check any request against your account’s own message centre.
- Check the operator is who it claims to be before submitting anything — see Casino Capybara’s guide on checking an online casino’s licence if you’re unsure.
FAQ
Do I need ID for a casino withdrawal?
In almost all cases, yes. Licensed operators are required by their AML and licensing obligations to verify your identity, typically at sign-up or before your first withdrawal. A small number of unlicensed or “no-KYC” platforms advertise skipping this — see Casino Capybara’s guide on no-KYC casino claims for what that actually means in practice and the trade-offs involved.
What documents does a casino need?
Typically proof of identity, proof of address, and proof of payment method, with source-of-funds documents requested only if your activity triggers a risk review. Exact requirements vary by operator and licence — check the specific casino’s verification page for its list.
Can I withdraw without verification?
Most licensed casinos will not release a withdrawal until verification is complete, and many won’t let you deposit or play beyond a small threshold either. Some operators run automated checks that clear in minutes; others require manual document review, which can take longer. It helps to complete verification as early as possible rather than waiting until you want to cash out — see Casino Capybara’s guide on withdrawal limits for how verification status interacts with cashout caps.
Why does the casino want a bank statement?
Usually for one of two reasons: to confirm the payment method you’re withdrawing to actually belongs to you (proof of payment), or, if your activity has triggered a risk review, to evidence where your deposited funds came from (source of funds). A bank statement can serve either purpose depending on what the operator has specifically asked for, so check which one applies before you redact or submit it.
What is the KYC checklist for a casino withdrawal?
Most licensed casinos work through four document categories: proof of identity (passport, national ID, or driving licence), proof of address dated within about the last three months, proof that your payment method belongs to you, and — only if your activity triggers a risk review — source-of-funds documents such as payslips or bank statements. An increasing number of operators also add a selfie or short liveness video on top of these to confirm a real person is submitting the documents.
Sources
- UK Gambling Commission, LCCP Condition 17.1.1 — Customer identity verification: gamblingcommission.gov.uk
- The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, Regulation 40 (record-keeping): legislation.gov.uk
- General Data Protection Regulation, Article 6(1)(c) — lawfulness of processing: gdpr-info.eu
- General Data Protection Regulation, Article 17(3)(b) — right to erasure exception for legal obligations: gdpr-info.eu
- Office of the Privacy Commissioner of Canada — PIPEDA access rights: priv.gc.ca
- Brazil’s Lei Geral de Proteção de Dados (LGPD), Article 18 — data subject rights: lgpd-brazil.info