KYC and licensing: how to tell if a gambling site is regulated

What a licence is

A gambling licence is permission from a public authority to offer gambling to customers in, or from, a particular jurisdiction. It comes with conditions: who may own and run the business, how games are tested, how customer money is handled, what checks are made on customers, how complaints are resolved and which safer gambling tools must be offered. The regulator can fine the operator, impose conditions or remove the licence if those terms are broken.

Two broad models exist. Point-of-consumption regimes license operators to serve customers in a specific market. Great Britain, most EU member states that permit online gambling, Ontario and individual US states such as New Jersey work this way. Other jurisdictions, among them Malta, Gibraltar, the Isle of Man, Kahnawake, Anjouan and Curaçao, license businesses based there to serve customers internationally. Curaçao, long the most common home for crypto casinos, has been replacing its older sub-licence system with direct licensing and tighter supervision under new legislation.

The consequence is that licensed is not a yes-or-no property. A site can hold a valid licence in one place and be unlicensed, and in some countries illegal, in the place where a given customer lives.

How to verify a licence

Logos and seals in a website footer are easy to copy. Verification takes a few minutes.

• Find the licensing statement, usually in the footer or the terms and conditions. It should name the legal entity that operates the site, the regulator and a licence or account number.
• Go to the regulator's own website by typing its address or searching for it, not by following the site's own seal. Most regulators publish a searchable register of licensees.
• Search for the company name or licence number. Check that the status is active and not suspended, surrendered or revoked.
• Check that the exact domain you are using appears in the entry. Registers in Great Britain and Malta, among others, list the domains each licensee is approved to operate. Clone sites frequently borrow a real licensee's name and number.
• Confirm that the licence covers the product on offer, such as casino, betting or both.

Several regulators also publish lists of unlicensed or blacklisted sites and records of enforcement action, which are worth a look.

Signs that deserve caution

No single item is conclusive, but combinations of the following are common among unregulated operators: no named legal entity or registered address; a licence claim that cannot be found on any register; terms that allow the operator to void winnings at its discretion; no mention of a complaints or dispute resolution process; an absence of deposit limits or self-exclusion tools; and an explicit promise that no identity checks will ever be carried out.

Why regulated sites ask for documents

KYC stands for know your customer. Licensed operators are legally required to establish who their customers are, for three main reasons: to confirm that the customer is old enough to gamble, to meet anti-money-laundering and sanctions obligations, and to check new registrations against self-exclusion registers such as GAMSTOP in Great Britain.

In practice this usually means electronic checks against public and credit reference data at registration, followed by document requests if those checks are inconclusive: a photo ID, proof of address and proof of ownership of the payment method. At higher levels of spending or on large withdrawals, operators may ask for evidence of the source of funds, such as payslips or bank statements, and some jurisdictions require financial risk checks.

Timing varies. Some regulators require verification before any gambling can take place; elsewhere operators have verified at the point of first withdrawal, which is a frequent cause of complaints when a payout is delayed. Requests for documents are normal. Documents should only be submitted through the operator's secure upload page, not by ordinary email or chat.

What a licence does and does not protect

Stricter regimes require access to independent dispute resolution, certified games, and clear disclosure of how customer funds are held. Disclosure is not the same as a guarantee: in Great Britain, for example, operators must state their level of fund protection, and the basic level offers no protection if the company becomes insolvent.

An unlicensed site offers none of these routes. If a withdrawal is refused, there is no regulator to complain to and, in practice, little legal recourse. That, more than any question about game fairness, is the practical difference a verified licence makes.