ID and source-of-funds checks: UKGC targets late verification as EU rules near

On 12 August 2026 the UK Gambling Commission reminded online operators that they must verify a customer's name, address and date of birth before that customer gambles, not when they try to withdraw. It also criticised loose matching of identity data. The reminder comes as regulators in Britain and Sweden penalise weak source-of-funds checks, and as the EU's new anti-money laundering rulebook, which covers gambling, gets closer to applying on 10 July 2027.

Players often treat these checks as one thing, but they answer two different questions. Identity verification asks who you are. Source-of-funds checks ask where your money came from. The first applies to everyone at a licensed site. The second is risk-based and usually aimed at higher spending or unusual payment patterns.

Identity: a UK rule since 2019, stressed again in 2026

Since 7 May 2019, British-licensed online operators have had to verify a customer's name, address and date of birth before letting them gamble. Condition 17.1.1 was introduced after complaints that operators asked for ID only at withdrawal. It says a withdrawal must not trigger requests for information the operator could reasonably have asked for earlier. The Commission also said operators cannot keep customer funds as a penalty for late ID.

The August 2026 blog says the rules are still not always followed. The Commission found operators onboarding customers with initials, nicknames or commercial addresses, and still leaving checks until withdrawal. It raised concerns about fuzzy or permissive matching. It also noted that using a middle name instead of a forename can cause a mismatch with GAMSTOP, which weakens self-exclusion.

Source of funds: what recent fines show

On 20 November 2025 the Commission fined Videoslots Limited GBP 650,000. In one case, a customer deposited more than GBP 75,000 in digital prepaid vouchers over 16 days, but the operator's automated AML risk score did not trigger due diligence in time. In another, the operator assumed an account was funded by recycled winnings, without checking enough.

Sweden shows the same pattern. On 2 July 2026 the Administrative Court in Linköping upheld AML penalties against three operators: SEK 5.5 million for Snabbare, SEK 6.5 million for Betsson Nordic and SEK 10 million for Spooniker. On Snabbare, the court found weak risk-based due diligence on high-risk customers aged 18 to 29 who deposited between SEK 950,000 and SEK 3.2 million. It found slow collection of information on where funds came from, and reliance on unsupported assumptions that deposits came from earlier winnings.

The EU's new anti-money laundering rulebook

The EU Anti-Money Laundering Regulation, Regulation (EU) 2024/1624 of 31 May 2024, sets one rulebook for obliged entities, including gambling providers. The EUR 2,000 due diligence threshold for gambling services is met by a single transaction or by several smaller ones that add up to that amount. Member States may exempt some low-risk gambling services, subject to the Commission's approval.

European Gaming reports that the Regulation applies from 10 July 2027 and gives the first EU-wide definition of gambling services. The new EU Anti-Money Laundering Authority (AMLA) began operating in Frankfurt on 1 July 2025. According to European Gaming, AMLA will directly supervise only selected, mainly financial, entities, not gambling operators. It may still affect gambling indirectly through the banks that process payments.

Financial risk checks are a separate track

Anti-money laundering checks ask whether money is legitimate. Harm-prevention checks ask whether a customer is in financial difficulty. In the UK, the new financial risk assessments use credit reference data and, the Commission says, will be document-free for the great majority of customers. In the Netherlands, deposits of EUR 300 a month for 18 to 24 year olds, or EUR 700 for older players, trigger checks that the player can afford them. Our affordability and deposit limits analysis covers these in detail.

What is confirmed and what is not yet known

Confirmed: the UK identity rules and the August 2026 reminder, the Videoslots fine, the Swedish court ruling, and the EU Regulation's EUR 2,000 threshold and 10 July 2027 date. Not yet known: which low-risk gambling services individual EU states will exempt, and how national regulators will change their guidance before 2027. Finland's new market, opening on 1 July 2027, will require strong identification for all gambling.

What it means for players

Register with your full legal name and home address so that checks, and self-exclusion matching, work first time. Expect ID checks before your first bet at a licensed site, not at cash-out. If a source-of-funds request comes, it will usually follow large or unusual deposits, and answering it promptly is the quickest way to keep your account moving. Our payments guide explains how payment method choice affects checks.

Frequently asked questions

Sources

1. Gambling Commission - Reminder of identity verification requirements for remote operators
2. Gambling Commission - New age and identity verification rules, changes to the LCCP from 7 May
3. Gambling Commission - New licence condition on customer identity verification
4. Gambling Commission - GBP 650,000 fine for online operator Videoslots Limited
5. Sveriges Domstolar - Spelbolag har överträtt reglerna om åtgärder mot penningtvätt
6. EUR-Lex - Regulation (EU) 2024/1624 (AMLR)
7. European Gaming - EU AML law: first EU-wide definition of gambling services
8. German Federal Ministry of Finance - AMLA launches operations
9. Gambling Commission - Commission to introduce Financial Risk Assessments in staged approach
10. iGaming Business - NL regulator sets EUR 300 deposit limit for players aged 18-24
11. Finnish Government - Finland to open some gambling services to competition