Age verification and KYC for online gambling: what obligations for operators?

In short: in the UK, online gambling is restricted to adults aged 18 and over and tightly regulated by the Gambling Commission (UKGC) under the Gambling Act 2005 (as amended). Every licensed operator must verify the player's age and identity at sign-up (KYC), block access for under-18s, ensure customers are checked against GAMSTOP, the UK national online self-exclusion scheme, and comply with its anti-money laundering (AML) obligations.

The real challenge is not to run checks, but to run reliable checks without weighing down sign-up, because every unnecessary point of friction drives a legitimate player away. Internationally, initiatives such as the European digital identity wallet point to a future where a player can prove their age without exposing their full identity. In the meantime, the key is an onboarding that combines identity verification, age checking and document fraud detection in just a few seconds.

‍

Online gambling: who regulates it and what are the obligations?

‍

In the UK, the online gambling sector is regulated by the Gambling Commission (UKGC) under the Gambling Act 2005 (as amended). The Commission is the licensing authority for commercial gambling in Great Britain: it grants and supervises the operating licences held by online operators, from sports betting to poker and casino games.

‍

To obtain and keep their licence, operators must meet a set of strict obligations. Among the most structuring:

• Block access for under-18s. Online gambling is restricted to people aged 18 and over. The operator must ensure that no one under 18 can open an account or play.
• Verify the player's identity and age at sign-up. This is the heart of KYC (Know Your Customer): collecting and checking the player's identity data at the moment the account is created.
• Tackle gambling-related harm. The operator must prevent at-risk behaviour and protect vulnerable players.
• Check customers against GAMSTOP. GAMSTOP is the free national online self-exclusion scheme that lets people self-exclude from all licensed online gambling in Great Britain. Licensed online operators must be registered with GAMSTOP and prevent excluded players from gambling.

These obligations are not merely good practices: they are conditions of the operating licence and expose the operator to regulatory action and sanctions in the event of a breach.

‍

Age and identity verification at sign-up

‍

Verification at sign-up pursues two inseparable objectives: proving that the player is indeed 18 or over and making sure they are who they claim to be.

‍

What the check must establish

‍

A compliant onboarding must make it possible to answer three questions:

1. Is the identity real and consistent? Do the name, date of birth and declared data match an authentic identity document?
2. Does the player meet the required age? Does the verified date of birth confirm that they are 18 or over?
3. Is the player allowed to play? Are they registered with GAMSTOP or otherwise self-excluded?

Why a simple declaration is not enough

‍

Asking the user to tick "I certify that I am over 18" carries no evidentiary value. A checkbox protects neither the minor nor the operator. This is why the check relies on the verification of an identity document and, often, on data cross-referencing. This is exactly the role of an identity verification and fraud scoring solution built into the sign-up journey, as described on our page dedicated to the fraud score and identity verification.

‍

Operators' AML obligations

‍

Beyond age checking, gambling operators are regulated for anti-money laundering and counter-terrorist financing (AML/CFT). In the UK, the Gambling Commission is the AML supervisor for the gambling sector. Gambling is indeed a known money laundering channel: it makes it possible to inject funds of dubious origin, circulate them and recover them under a legitimate appearance (as winnings).

‍

On this basis, operators must in particular:

• Know their customer (KYC). Identifying and verifying the player's identity is the starting point of the entire compliance chain.
• Apply risk-based due diligence. The level of scrutiny must be proportionate to the player's profile and their transactions, with enhanced due diligence for higher-risk situations.
• Report suspicion. In the presence of suspicious transactions or behaviour, the operator must submit a suspicious activity report (SAR) to the competent authorities.

‍

In other words, KYC is not limited to sign-up: it feeds a continuous obligation to know and monitor the player throughout the relationship. For a complete overview of the KYC steps, see our complete KYC guide.

‍

The challenge: reliability without friction

‍

Here is the tension specific to the online gambling sector. On one side, the operator must rigorously check age and identity. On the other, every additional step at sign-up drives down the conversion rate: a player who has to photograph their document, take a selfie and wait for manual validation is a player who gives up.

‍

Two opposite pitfalls threaten operators:

• Too much friction: a long journey, redundant checks, validation delays. Result: sign-up abandonment and the loss of legitimate players.
• Not enough control: superficial, purely declarative verification. Result: risk of under-18s, of fraud, of identity theft and of regulatory breach.

‍

On top of this comes a worsening threat: remote document fraud. Fake proofs, forged identity documents, photo montages and now deepfakes allow a fraudster to circumvent a self-exclusion or steal a third party's identity. Remote verification must therefore be capable of detecting a tampered document or a generated image, and not only of reading the information it displays.

The right answer is not to choose between reliability and smoothness, but to combine the two: an automated, robust and near-instant check that adds only a minimum of visible steps for the player.

‍

How modern age assurance is changing age checking

‍

Age verification technology is evolving fast, and the direction of travel is towards proving age while sharing as little personal data as possible. In the UK, the government's Digital Identity and Attributes Trust Framework (DIATF) sets the rules and standards for certified digital identity and attribute services, including age assurance. Their key contribution for gambling: selective disclosure.

‍

Concretely, a player will be able to prove they are an adult without exposing their entire identity. Rather than sending a full copy of their document (surname, first name, address, document number, photo), they will be able to present a verifiable attestation answering a single question: "is this person over 18?". The answer is yes or no, without disclosing the exact date of birth or the other attributes. This is the same idea now being taken forward internationally, for example through the European digital identity wallet, which we cover in our article on age verification and the European wallet.

‍

For operators, this promises age checking that is at once more reliable (the attestation is backed by a verified identity), smoother (less data to collect and process) and more privacy-respecting (data minimisation in line with UK data protection law). While these approaches mature, operators should rely on verification solutions ready for this evolution, capable of integrating age proofs from trusted digital identity services tomorrow.

‍

How to secure player onboarding

‍

A compliant and high-performing sign-up journey rests on a few concrete principles:

• Verify an authentic identity document. Check the validity and integrity of the document, beyond the information displayed, to establish a real identity.
• Detect document fraud. Spot forgeries, montages and synthetic documents, including those generated or retouched by AI.
• Confirm the player is of age. Extract and verify the date of birth to guarantee that the player is 18 or over.
• Cross-reference against the right sources. Verify in particular that the player is not registered with GAMSTOP or otherwise self-excluded.
• Automate the decision. Deliver a verdict in a few seconds, documented and auditable, to reconcile compliance and conversion.
• Trace every check. Keep an audit trail that can be used in the event of a Gambling Commission review or an AML obligation.

The goal is an onboarding where the check is strong but nearly invisible for the legitimate player, and blocking for the fraudster or the under-18.

‍

In conclusion

‍

For an online gambling operator, age verification and KYC are not optional: they are obligations set by the Gambling Commission under the Gambling Act 2005 and by the AML framework, on which the operating licence depends. The real operational challenge is to make this check reliable against document fraud and deepfakes, while keeping a smooth sign-up that does not drive players away. Modern age assurance and selective disclosure outline a future where proving you are of age will be both safer and more discreet. Until then, the winning equation is an onboarding that verifies identity, checks age and detects fraud in 2 to 5 seconds, without unnecessary friction.

‍

FAQ

‍

Is age verification mandatory for UK online gambling?

‍

Yes. Online gambling in the UK is restricted to people aged 18 and over, and the Gambling Commission requires licensed operators to verify a player's age and identity before they can deposit or play. A simple tick box is not enough: operators must carry out proper identity and age checks at sign-up.

‍

What is GAMSTOP?

‍

GAMSTOP is the free national online self-exclusion scheme for Great Britain. It lets people exclude themselves from all licensed online gambling for a chosen period. Every operator licensed to offer online gambling to British consumers must be registered with GAMSTOP and prevent self-excluded players from gambling.

‍

Who regulates online gambling in the UK?

‍

The Gambling Commission (UKGC) regulates commercial gambling in Great Britain under the Gambling Act 2005 (as amended). It grants and supervises operating licences, sets the conditions operators must meet, and also acts as the anti-money laundering supervisor for the gambling sector.

‍

How can operators verify age without adding friction?

‍

By combining identity document verification, age checking and document fraud detection in a single automated step. A modern onboarding solution can return a documented, auditable decision in a few seconds, so the check stays strong against fraud and deepfakes while remaining almost invisible to legitimate players.

‍

Sources: UK Gambling Commission; Gambling Act 2005; GAMSTOP.

‍