Casino Account Locked During a Withdrawal? What It Means
A casino account that’s locked, frozen or suspended right when you try to withdraw is unsettling, but in most cases it’s a specific, legitimate compliance process rather than the operator trying to avoid paying out. The common lawful triggers are an anti-money-laundering (AML) hold, a pending source-of-funds request, a duplicate-account match, a breach of bonus terms, a partial match against a sanctions or politically-exposed-person (PEP) list, or a self-exclusion register match. Each of these has its own trigger, its own document request and its own realistic timeframe — and none of them entitles the operator to hold your money indefinitely without explaining why or moving toward a decision.
This assumes you already know the basics of casino KYC and roughly what documents get requested — see our KYC verification guide — and that verification delays in general have their own escalation path, covered in full in our KYC delays and escalation guide. This piece is specifically about the account being locked or frozen, not just slow: what each state actually means, why it happens, and how far it can lawfully go before you escalate.
“Locked”, “frozen” and “suspended” aren’t standardised terms
Operators use these words loosely and often interchangeably, so the label your account shows matters less than what you can actually still do. In practice there are three functionally different states:
- A withdrawal hold. You can usually still log in, see your balance, and sometimes still deposit or play, but the specific withdrawal request is paused pending review. This is the most common state during an AML or source-of-funds check.
- A full account suspension. You can’t log in at all, or logging in shows a restricted view with no ability to play, deposit or withdraw. This is more typical of a self-exclusion match, a duplicate-account finding, or a live suspicion-of-fraud investigation.
- Permanent closure. The relationship is terminated outright, usually only after a review concludes — for example, under Malta’s FIAU/MGA remote-gaming framework, a licensee is required to terminate a business relationship if a customer hasn’t supplied requested due-diligence information within 30 days of a compliance threshold being met.
Whichever term the operator uses, the useful question is which of the reasons below applies, since that determines what you need to send and roughly how long it should take.
The legitimate reasons an account gets locked mid-withdrawal
AML hold
An anti-money-laundering hold means the compliance team wants to satisfy itself about the legitimacy of the funds or the account activity before releasing money — it’s the umbrella category that source-of-funds requests, PEP screening and duplicate-account checks all sit under. The UK Gambling Commission has published direct expectations on this: operators “should not continue to accept deposits indefinitely and then seek to rely on their AML procedures to frustrate a withdrawal request,” and any additional information needed should have been requested earlier in the relationship, not sprung on the customer only once they try to cash out. Under Licence Condition 17.1.1, a withdrawal request specifically “must not result in a requirement for additional information” if the operator could reasonably have asked for it before.
Source-of-funds request pending
If the hold is specifically about proving where a deposit or win came from, that’s a source-of-funds review rather than a general AML hold — it has its own document requirements and its own realistic timeline. See our dedicated source-of-funds request guide for what’s typically asked for, what counts as insufficient, and what happens if you can’t provide it.
Duplicate account
Operating more than one account with the same operator — deliberately or accidentally, including via a partner’s device or a shared household IP address — is against virtually every operator’s terms and is treated as a standard AML/fraud red flag. Malta’s FIAU/MGA guidance lists “customer attempts to register more than one account with the same licensee” explicitly among the behaviour patterns licensees are trained to watch for. Where a duplicate is found, expect both accounts (and any pending withdrawal on either) to be frozen while the operator establishes which one is genuine and whether any self-exclusion or exclusion-limit evasion was involved.
Bonus-term breach
Most bonus terms reserve the right to void winnings or freeze funds if the operator concludes you breached wagering requirements, game-weighting rules, maximum-bet limits while a bonus was active, or used the same promotion across linked accounts. This is a contractual matter governed by the specific bonus terms you accepted rather than a statutory AML process, so the resolution path is usually a direct dispute with the operator about whether the breach actually occurred, rather than a document-based review — though the freeze itself can look identical to an AML hold from the player’s side.
Sanctions or PEP near-match
Automated screening checks your name and details against sanctions lists and PEP databases, and a shared or similar name can produce a “false positive” — a flag on an innocent customer because of a name or detail overlap with someone on a watchlist, rather than any real connection. Industry data on this kind of screening consistently shows the overwhelming majority of initial matches turn out to be false positives once reviewed manually, which is exactly why it takes a human compliance step (and sometimes further ID confirmation from you) to clear. Genuine PEP status — for you, a family member, or a close business associate — triggers a separate, mandatory process: under Malta’s FIAU/MGA framework this specifically requires senior management sign-off before the relationship can continue, plus establishing your source of wealth and funds, all within 30 days of the relevant threshold being met.
Self-exclusion register match
UK-licensed operators must check new and existing customers against GAMSTOP, the free multi-operator self-exclusion scheme, alongside land-based equivalents (SENSE for casinos, BACTA and SmartEXCLUSION for arcades). If your details match a self-exclusion entry, the operator is required to block access rather than allow you to continue gambling, regardless of how the account came to exist or how much is in it. Because GAMSTOP works by matching the details a customer enters, a minor variation in name, address or date of birth can sometimes still let an excluded person register — which is precisely why later discovery of a match, even well after the account was opened, is a legitimate reason to lock it retroactively.
What to send, per reason
| Reason for the lock | Typically requested | Where to go for the detail |
|---|---|---|
| AML hold / general review | Standard ID, address and payment-method proof if not already complete | Our withdrawal ID documents guide |
| Source-of-funds pending | Payslips, bank statements, sale contracts, inheritance documentation | Our source-of-funds request guide |
| Duplicate account | Confirmation of which account is genuine; ID matching that account | Contact support directly — this is usually resolved by account, not by document type |
| Bonus-term breach | An explanation of your play pattern; the operator’s own wagering logs are the primary evidence | Review the specific bonus terms you accepted before disputing |
| Sanctions/PEP near-match | Further ID confirmation to distinguish you from the listed individual; PEP declaration if applicable | Standard ID documents — see our document rejection guide if resubmissions keep failing |
| Self-exclusion match | None — access is blocked, not paused; see our responsible gambling tools guide | This isn’t a document issue; the account stays blocked for the exclusion period |
How long it can lawfully take
There is no single statutory maximum across all licences for how long an account can stay locked, but the frameworks that regulate it are explicit that it cannot be open-ended:
- The UK Gambling Commission’s own published position is that an operator “should not continue to accept deposits indefinitely and then seek to rely on their AML procedures to frustrate a withdrawal request” — if there are genuinely no regulatory concerns about you, “there is no valid reason to delay the withdrawal.”
- Before an operator can confiscate funds on suspected money-laundering grounds, UK guidance requires it to submit a Suspicious Activity Report and obtain clearance from the National Crime Agency — it cannot simply keep the money unilaterally.
- Under Malta’s FIAU/MGA rules, once a due-diligence threshold is met, the licensee has up to 30 days to obtain the necessary information from you; if you haven’t supplied it by then, the licensee must terminate the relationship and — absent an actual suspicion of money laundering — return your deposited funds through the original payment channel, not simply retain them.
In short: a lock that resolves within days to a couple of weeks, with a stated reason, is normal. A lock with no stated reason, no named review stage, and no end in sight is the point at which you should treat it as a dispute rather than wait it out further.
The escalation ladder, in brief
If your account has been locked past a reasonable point with no clear reason given, the process is the same one used for any stalled verification: fix any outstanding document issues first, then request a written explanation with a stated timeline, then file a formal complaint through the operator’s own complaints process, then escalate to the licensee’s Alternative Dispute Resolution (ADR) body or regulator if that stalls. Our KYC delays and escalation guide covers this ladder in full, including the specific ADR providers and waiting periods for UK Gambling Commission, Malta Gaming Authority, Ontario’s AGCO, Kahnawà:ke and Curaçao licensees — the same routes apply whether the underlying issue is a slow KYC check or a locked account, since both are ultimately disputes about an operator’s compliance process. If your dispute is with a Canadian-facing operator specifically, our Canada complaints guide covers that route in more detail.
What not to do while an account is locked
- Don’t open a second account to “get around” the freeze. This is precisely the duplicate-account pattern that triggers locks in the first place, and doing it while under review will almost certainly extend the investigation rather than resolve it.
- Don’t file a chargeback as a first move. Disputing a card payment while an account is under review is typically treated as an automatic red flag, can trigger an immediate and harder-to-reverse suspension, and may remove you from the operator’s and regulator’s normal dispute process entirely.
- Don’t ignore a self-exclusion outcome. If the lock is a genuine self-exclusion match, it exists for your protection under the scheme you (or a household member’s overlapping details) registered for — see our responsible gambling tools guide if you’re trying to understand or manage a self-exclusion.
- Don’t send fresh documents by email or chat. Use the operator’s own secure verification channel; documents sent elsewhere may not even enter the review queue.
FAQ
Is it legal for a casino to freeze my account before a withdrawal?
Yes, where there’s a genuine compliance reason — an AML hold, a pending source-of-funds check, a duplicate-account investigation, or a sanctions/self-exclusion match. It becomes a problem when the operator can’t or won’t state a reason, or keeps the account frozen indefinitely without progressing toward a decision.
How long can a casino legally hold your withdrawal?
There’s no single universal maximum, but regulators expect the process to be proportionate and moving toward a decision, not indefinite. Where a specific framework does set a figure — such as Malta’s 30-day window to supply due-diligence documents — going past it without resolution is a clear signal to escalate.
What does it mean if my casino account is “under review”?
It usually means a compliance trigger — deposit size, a win, a document mismatch, a screening flag — has moved your account into manual review rather than automatic processing. Ask support which specific stage it’s at and what’s outstanding; a vague “under review” with no stage named is itself a reason to push for specifics.
Can a casino keep my money if my account gets permanently closed?
Not simply for closing the account. Where there’s no suspicion of money laundering and no freezing order in place, regulators expect deposited funds to be returned to you, typically through the original payment channel — funds can be genuinely withheld longer only where a formal suspicious activity report has been filed with the relevant financial intelligence unit.
Sources
- UK Gambling Commission — Key issues and our expectations concerning account withdrawals
- UK Gambling Commission — LCCP Condition 17.1.1 — Customer identity verification
- UK Gambling Commission — Free multi-operator and national self-exclusion schemes
- Financial Intelligence Analysis Unit / Malta Gaming Authority — Implementing Procedures Part II: Remote Gaming Sector (duplicate-account red flags, PEP/EDD process, 30-day termination and fund-return rules)