Casino Asked for Source of Funds? What to Send

A casino asking for “source of funds” (SOF) is a compliance step, not an accusation — the operator is meeting an anti-money-laundering (AML) duty to confirm that the specific money sitting in your account, or the specific sum you’re trying to withdraw, came from a legitimate place before it can be released. It’s usually triggered by something measurable: a deposit or win that’s large relative to your normal pattern, a fast run of deposits (deposit velocity), or simply crossing a threshold the operator’s licence requires it to check — commonly around €2,000 in EU/UK-style frameworks, though the exact figure and how it’s calculated is set by each regulator and licensee. In practice it means providing documents — payslips, bank statements, a sale contract, an inheritance letter — that trace that specific sum back to a verifiable source, not proving your entire life’s wealth.

This assumes you already know what KYC is and that identity documents (ID, proof of address, proof of payment method) are the first layer of verification — see our KYC verification guide for that basics. Source of funds is a separate, deeper check that sits alongside it; if you’re here because a check is dragging on generally, our KYC delays and escalation guide covers timelines and complaint routes across all review types. This guide focuses specifically on SOF: what it is, what satisfies it, and what happens if you can’t.

Source of funds vs source of wealth — they are not the same question

Operators and regulators draw a specific distinction between two related but different checks, and mixing them up is one of the most common reasons players over- or under-supply documents.

• Source of funds (SOF) asks: where did the specific money used for this transaction come from? It relates to a particular deposit, win or withdrawal, not your whole financial life.
• Source of wealth (SOW) asks a broader question: what generates your overall net worth, and does your account activity make sense against it? This is used to build a risk profile, not to trace one transaction.

Malta’s Financial Intelligence Analysis Unit (FIAU), working with the Malta Gaming Authority (MGA), sets this out directly in its remote gaming sector guidance: source of wealth “consists in determining the activities which generate the customer’s net worth and whether the same justifies his projected and actual level of account activity” — explicitly not “a forensic accounting exercise” — while source of funds “relates to how the funds used for a particular transaction were obtained by the customer,” and only needs to be established “where a transaction presents a departure from the known or expected behaviour of a customer.” In practice, most player-facing requests are source-of-funds requests: you’re being asked to explain one deposit or one win, not to document everything you’ve ever earned.

What actually triggers a source-of-funds request

SOF checks aren’t random and they aren’t personal — they follow specific, documented triggers built into the operator’s risk-based AML programme. The recurring ones:

• Deposit velocity. Depositing significantly faster, or in larger amounts, than your established pattern. A player who typically deposits £50 a week and suddenly deposits £5,000 in two days will trigger review regardless of where the money actually came from.
• A large or unusually fast win. Any win that’s disproportionate to normal stakes, or that comes very quickly after account opening, is a standard risk indicator across licensed operators.
• Hitting a regulatory or internal threshold. Under the EU/UK-style framework, customer due diligence obligations attach once a customer’s transactions — deposits, in most operators’ implementation — reach or exceed €2,000 (or the sterling equivalent), whether in one transaction or several that are linked. This is a regulatory floor, not a number the operator invented; the MGA/FIAU guidance is explicit that “CDD measures are to be applied when carrying out transactions amounting to Euro two thousand (€2,000) or more.” Individual operators may set internal thresholds below this for their own risk appetite.
• Structuring-like patterns. Several deposits that are each below a threshold but add up to or exceed it are treated as linked transactions for CDD purposes — splitting a deposit into smaller amounts does not avoid the check.
• A change in account behaviour. Sudden departures from your own established pattern — a different funding method, a big jump in stake size, unusual login geography — can trigger a review even below any fixed monetary threshold, because on-going monitoring is a continuous obligation, not a one-off gate.
• Politically exposed person (PEP) or sanctions-list status. Being identified (or partially matching) as a PEP, a family member or close associate of one, triggers mandatory enhanced due diligence (EDD) — including source-of-wealth and source-of-funds checks — independently of your actual transaction pattern.
• Geographical or payment-method risk. Funds routed through higher-risk jurisdictions, anonymous or quasi-cash payment methods (prepaid cards, certain e-wallets), or third-party accounts raise the risk score and can bring SOF forward even at lower amounts.

It’s worth being clear about what this is not: it is not a judgement that you’ve done something wrong. The regulatory framework explicitly treats deposit-and-win patterns outside your normal profile as something that has to be questioned, not automatically escalated or reported — the vast majority of SOF requests resolve with the player simply supplying an ordinary document.

The documents that actually satisfy a source-of-funds request

The common failure point is submitting a document that proves you have money, rather than one that proves where a specific sum came from. The table below sets out what’s typically requested against what it needs to demonstrate.

Source of the funds	Typical satisfactory evidence
Employment income	Recent payslips (usually 3 months), an employment contract or a letter from your employer confirming salary, matched to the bank account the funds moved through
Savings built up over time	Bank or savings account statements covering a period long enough to show the balance accumulating, not just a single-day snapshot
Sale of property, a vehicle or a business	The signed sale/completion contract, plus a bank statement showing the sale proceeds landing in your account
Inheritance or a gift	Probate or grant of representation documentation, a solicitor’s letter, or a signed gift deed, again tied to the account the funds arrived in
Winnings from another licensed operator	A withdrawal confirmation or account statement from that operator showing the win and the payout, plus the receiving bank/e-wallet statement
Cryptocurrency gains	Exchange transaction history showing the acquisition and disposal, plus the on-ramp/off-ramp trail connecting it to a bank account in your name — self-custody wallet balances alone rarely satisfy this on their own
Redundancy, benefits or compensation payment	The official notification letter or settlement documentation plus the bank statement showing the payment received

Two features run through all of these: the document has to be specific enough to trace a sum of money to an origin (not just a balance), and it has to connect to an account or channel you’re verified as controlling. A generic document that shows you have funds, without showing where they came from, routinely gets kicked back as insufficient — see the next section.

What “insufficient” actually looks like

Compliance teams reject far more source-of-funds submissions than they reject standard ID documents, because SOF review requires human judgement rather than an automated pass/fail check. Common reasons a submission is judged insufficient:

• A balance without a trail. A bank statement or screenshot showing a healthy balance proves you have money, not where it came from. Reviewers are specifically looking for the transaction that brought the money in, not the total sitting there afterwards.
• Inconsistency with your declared profile. If you’ve told the operator you’re employed as a teacher and then submit a document showing six-figure consultancy income with no supporting context, that mismatch itself becomes the thing under review.
• Documents from an unrelated or unverifiable account. Funds that appear to originate from an account not in your name, or from a jurisdiction with weak record-keeping standards, generally need a further layer of evidence linking them to you specifically.
• No independent corroboration. A self-written declaration of income, without any supporting document, is treated as low-value evidence except in genuinely low-risk cases — the MGA/FIAU framework explicitly allows a simple declaration only “where the risk is medium or lower”; anywhere the risk is higher, “the information obtained would need to be supplemented by means of independent and reliable information and documentation.”
• Screenshots instead of exportable statements. A cropped phone screenshot of a banking app is harder to verify than an official downloadable or bank-issued statement, and is more often queried or rejected outright.
• Untranslated foreign-language documents. Where a document isn’t in a language the operator’s compliance team can read, expect a request for a certified or otherwise verifiable translation before the document is accepted — see our guide to why verification documents get rejected for the equivalent issue on identity documents.

Realistic timelines

Source-of-funds review is inherently slower than standard ID verification because it requires a compliance analyst to read and judge documents rather than run an automated check. There is no single statutory maximum that applies across all licences, but the frameworks that do specify a window are informative:

Stage	Typical/regulatory timeframe	Notes
Initial request for documents after a trigger	Prompt — “promptly” per UK Gambling Commission guidance	Operators are not meant to wait until a withdrawal request to ask; the request should follow the trigger, not the cash-out
Compliance review of submitted documents	Several business days, sometimes 1–2 weeks	Depends on document quality, queue size and how many follow-up questions are needed
MGA-regulated EDD/PEP window	Up to 30 days from the €2,000 threshold being met	Under Malta’s FIAU/MGA remote gaming guidance, licensees must complete enhanced due diligence and PEP screening within 30 days of the threshold being reached — this is a hard regulatory ceiling, not a target
Consequence of non-response at 30 days (MGA)	Mandatory account termination	If the customer hasn’t supplied the requested information or documentation within 30 days of the threshold being met, the licensee is required to terminate the relationship

Outside Malta’s specific 30-day figure, most licences (UK Gambling Commission, Ontario’s AGCO, Kahnawà:ke, Curaçao’s CGA) don’t publish a fixed statutory number for SOF review — they instead require the process to be proportionate and not indefinite. Our KYC delays and escalation guide covers the general escalation ladder and typical ranges by review type if your specific case is past a reasonable point.

What happens if you refuse, or can’t produce satisfactory evidence

This is the part players usually don’t ask about until it’s already happened, and the consequences differ by what the operator concludes.

• No suspicion of wrongdoing, just missing paperwork. Under the MGA/FIAU framework, if there are no grounds to suspect money laundering and no freezing order or FIU objection in place, the operator has “no reason rooted in the AML/CFT regime justifying the retention of any such funds” — it is required to close or permanently suspend the account and remit your deposited funds back to you, ordinarily through the same payment channel you used to deposit. You lose access to the account and any further play, but you are not entitled to keep winnings that were never verified, and the operator is not entitled to simply keep your money either.
• Grounds for suspicion. If the compliance team develops an actual suspicion of money laundering — as opposed to simply lacking documents — the operator is required to file a Suspicious Activity Report (a “STR” under Maltese law, a “SAR” under the UK’s Proceeds of Crime Act 2002) with the relevant financial intelligence unit (the FIAU in Malta, the National Crime Agency in the UK). Once filed, the transaction is frozen for a set period (one working day under Maltese rules) while the authority decides whether to object; the operator is legally barred from telling you a report has been filed. This is the scenario where funds can be genuinely frozen for a longer, and less predictable, period.
• Refusing outright. Declining to engage at all is treated the same way as failing to respond — the account gets closed or suspended once the response window lapses, and the fund-return logic above applies. Refusing does not “reset” anything or force a faster resolution; it simply moves you to account termination.
• Practical fallout beyond the one account. Operators that share a licence, a compliance function or a group KYC database across multiple gambling brands may apply the same restriction group-wide, particularly where the account was closed for AML reasons rather than a simple documentation gap.

None of this is legal advice — retention and reporting obligations are set by each regulator’s own AML legislation and by the operator’s licence conditions; if you believe funds are being withheld without a lawful AML basis, the complaint and regulator escalation routes in our KYC delays and escalation guide apply equally to SOF disputes.

If a source-of-funds request feels disproportionate

Genuine SOF checks are specific and bounded: they ask about one transaction, they name what’s missing, and they resolve once you supply it. Be more sceptical of the process — not necessarily the individual request — if you see:

• A moving target. Each document you supply produces a new, previously unmentioned requirement, with no running list of what’s actually needed to close the review.
• Requests unrelated to the money itself. Questions or documents that don’t help trace the specific transaction being queried.
• No timeframe, ever. Support repeating that your account is “under review” with no stage, no named team and no indication of when a decision will be made.
• An unlicensed or unverifiable operator. If you’re not certain the site holds a real gambling licence in the first place, source-of-funds language can be used as a stalling tactic with no regulator behind it to enforce a resolution — see our guide on checking an online casino’s licence.

FAQ

What counts as proof of source of funds for a casino?

Documents that trace a specific sum of money to where it came from: payslips or an employer’s letter for salary, bank or savings statements showing the funds accumulating, a sale contract for a property or asset sale, or probate/gift documentation for an inheritance — always tied to an account you’re verified as controlling. A balance alone, without the transaction that brought the money in, is usually treated as insufficient.

How much money triggers a source-of-funds check at a casino?

There’s no single universal figure, but the EU/UK-style AML framework sets customer due diligence obligations in motion once transactions reach or exceed roughly €2,000, whether in one go or across several linked deposits — operators may also apply their own, lower internal thresholds based on their own risk assessment.

Can a casino keep my money if I don’t provide source of funds?

Not simply for lacking paperwork. If there’s no suspicion of money laundering and no freezing order in place, the operator is expected to close the account and return your deposited funds through the original payment channel. Funds can be genuinely frozen for longer only where the operator has filed a formal suspicious activity report with its financial intelligence unit.

Is source of funds the same as source of wealth?

No. Source of funds asks where the money for one specific transaction came from; source of wealth asks about your overall financial situation and whether your account activity is consistent with it. Most player-facing requests are source-of-funds requests about a single deposit or win, not a full financial history.

Sources

• Financial Intelligence Analysis Unit / Malta Gaming Authority — Implementing Procedures Part II: Remote Gaming Sector (source of funds/source of wealth definitions, €2,000 CDD threshold, EDD/PEP 30-day window, inability-to-complete-CDD and fund-return rules, STR process)
• UK Gambling Commission — Key issues and our expectations concerning account withdrawals
• UK Gambling Commission — Threshold approach to customer due diligence
• UK Gambling Commission — Duties and responsibilities under the Proceeds of Crime Act 2002 — customer relationships
• UK Gambling Commission — LCCP Condition 17.1.1 — Customer identity verification