If an online casino has asked you to submit financial documents before processing a withdrawal or completing your account verification, there’s a straightforward reason: licensed operators are legally required to make these requests. Anti-money laundering law and player protection rules both demand it, and operators can’t skip these checks without risking their licence. This page explains what triggers a source of funds request, which documents typically satisfy one, and what happens to your account if you don’t provide the paperwork.
The Regulatory Foundation Behind Source of Funds Requests
When a licensed online casino asks where your money comes from, that request comes from a legal obligation set by the regulator that issued the operator’s licence. The operator doesn’t get to decide whether to run these checks. The checks are a condition of holding the licence. If an operator refuses to carry them out, it’s in breach of its regulatory obligations. Knowing this makes it easier to respond to the request accurately and efficiently, rather than treating it as an intrusion.
Anti-Money Laundering Obligations and Customer Due Diligence
Anti-money laundering (AML) regulation is the body of law that requires certain businesses to detect and prevent the movement of illegal funds through the financial system. Know Your Customer (KYC) is the process operators use to identify their customers and verify that their funds are legitimate. Online casinos aren’t treated like ordinary consumer businesses under these rules. They’re classified alongside banks and other financial institutions as businesses whose services carry a defined risk of being used to move criminal money. Once a business falls into that category, it must apply customer due diligence at defined transaction thresholds and on an ongoing, risk-sensitive basis. A source of funds request is a legally required identity and money check, not an arbitrary one.
The specific regulations driving these obligations across the major regulated markets are as follows:
- UK Gambling Commission (UKGC): Licensed operators must conduct risk-based customer due diligence, customer risk profiling, standard CDD, and enhanced CDD with enhanced ongoing monitoring for higher-risk customers, as set out in Parts 6.2–6.7 of the UKGC’s AML and counter-terrorist financing guidance. Operators that fail to enforce these checks face licence action.
- EU (Regulation (EU) 2024/1624 (AMLR)): Providers of gambling services are classified as obliged entities required to apply customer due diligence measures. The regulation sets a threshold of €2,000 (whether reached through a single transaction or a series of linked transactions) at which CDD must be applied. Casinos and online gambling services are explicitly excluded from any member state exemption under Article 4.
- Financial Action Task Force (FATF): FATF classifies casinos, including online casinos, as Designated Non-Financial Businesses and Professions (DNFBPs) subject to AML and counter-terrorist financing requirements. FATF published dedicated risk-based approach guidance for the casino sector in October 2008, establishing the sector’s obligations under the global standard.
- United States (FinCEN and state-level operators): US casinos became subject to Bank Secrecy Act AML regulations in 1985. FinCEN requires casinos to run risk-based compliance programmes and has confirmed that AML obligations apply regardless of betting format. Online operators in regulated US states operate under a risk-based approach rather than a single standardised transaction threshold.
The Responsible Gambling and Affordability Dimension
There’s a second reason operators ask for source of funds documents, separate from AML: affordability. Where AML asks whether the money is clean, an affordability check asks whether the player can sustain their level of spending without suffering financial harm. The UKGC requires operators to identify customers whose spending patterns suggest an elevated risk of gambling-related harm and to verify that the funds being staked are proportionate to the player’s income. This applies to all customers, not just high-value or VIP players. In practice, a single documentation request can be triggered by a concern about spending patterns rather than any suspicion of illegal funds, and in many cases both rationales apply at the same time.
What Triggers a Source of Funds Request
Documentation requests from licensed operators aren’t random. Regulators require operators to monitor defined risk signals throughout the customer relationship and to escalate to enhanced due diligence when those signals are met. Triggers fall into two categories: fixed thresholds tied to transaction values or account events, and behavioural patterns picked up through ongoing monitoring. Knowing which category applies explains why a request arrived at a particular moment.
Threshold-Based and Transaction-Based Triggers
Some triggers are mechanical: once a monetary threshold is crossed or a specific account event occurs, the operator is required by regulation to escalate its due diligence. A request that arrives right after a deposit pushes a cumulative total past a defined value, or just before a withdrawal is processed, isn’t a coincidence. It’s the direct result of a rule the operator must apply consistently. EU Regulation 2024/1624 confirms this explicitly, stating that the €2,000 threshold for gambling-service providers is met whether the customer makes a single transaction of that amount or several smaller linked transactions that cumulatively reach it, and that operators must have systems in place to monitor transactions before identity verification is complete.
The following categories of transaction-based events most commonly trigger a source of funds request.
- Cumulative deposit thresholds: EU Regulation 2024/1624 sets a €2,000 threshold (or the equivalent in national currency) at which gambling-service providers must apply customer due diligence, whether reached through a single transaction or a series of linked transactions. FATF’s risk-based approach guidance for casinos, published in October 2008, establishes that enhanced due diligence is triggered at defined transaction thresholds under the global standard.
- Withdrawal requests: Releasing funds to a customer without completed verification would put a licensed operator in breach of its anti-money laundering obligations. Withdrawal is therefore a standard trigger point at which operators confirm that source of funds documentation is in place before processing the payment.
- Account sign-up verification: In certain regulated markets, operators apply upfront identity and source of funds checks at the point of account creation rather than waiting for a threshold to be crossed, so the customer relationship starts on a verified basis.
Behavior-Based and Risk-Based Triggers
Beyond fixed thresholds, operators are required to monitor behaviour patterns and escalate when those patterns don’t match the customer’s declared profile or normal play. Many requests don’t correspond to any single large transaction. They reflect signals that have built up over time. The UKGC requires operators to conduct risk-based customer due diligence and risk profiling as an ongoing obligation, meaning monitoring runs continuously against a risk-based framework rather than switching on only at a single fixed rule.
The following behaviour categories are most commonly flagged under this framework.
- High or accelerating spend patterns: Sustained heavy spending or an accelerating rate of deposits triggers an affordability review under UKGC requirements. The UKGC’s High Value Customers guidance requires operators to verify that funds being staked are proportionate to the player’s income, and this obligation applies to all customers, not only those classified as VIPs.
- Politically exposed person status: FATF Recommendation 12 requires that institutions, including casinos, identify politically exposed persons (PEPs) and establish their source of funds as a mandatory part of enhanced due diligence. PEP status alone is enough to trigger this escalated review regardless of transaction size.
- Product-level risk classification: Remote gambling products, including online casinos, are classified as presenting a high money laundering risk by the UKGC. The European Commission’s Supranational Risk Assessment Report has also assessed the vulnerability of gambling services to money laundering and terrorist financing risks, and EU Regulation 2024/1624 explicitly excludes online casino and sports betting services from any low-risk exemptions available to other gambling categories.
- Suspicious transaction patterns: The deposit-play-withdraw pattern (depositing funds, doing limited low-risk play, then withdrawing) is identified by FATF as a common money laundering technique in the gambling sector. Operators are required to flag this pattern as a suspicious transaction indicator and to escalate due diligence when they detect it.
Documents Accepted as Proof of Funds
The documents operators request fall into a small number of standard categories that are consistent across licensed operators in the UK, EU, and US regulated markets. Each category serves a specific evidentiary purpose under AML and responsible gambling regulation. Data protection law, including GDPR, requires the operator to have a lawful basis for requesting each document and to handle it securely. An operator can’t request documents arbitrarily. Each item must be justifiable against the specific verification purpose it’s meant to satisfy.
Standard Document Categories
Documents requested during a source of funds check serve two distinct purposes: establishing the customer’s identity and establishing the origin or sustainability of the funds being staked, as set out in UKGC AML/CTF guidance Parts 6.3 and 6.4. A single documentation request often covers both purposes at once, so a player may be asked to supply identity documents and financial records at the same time. Regulators have identified specific weaknesses in operator practice, including the failure to obtain adequate documentation and the failure to apply appropriate scrutiny to higher-risk evidence types such as recycled winnings and cryptocurrency-sourced funds.
The table below sets out the evidentiary purpose behind each category of document typically requested.
| Document Category | Evidentiary Purpose | Typical Use Case |
|---|---|---|
| Government-issued identification | Establishes customer identity as part of KYC | Required at account opening; used to confirm the player is who they claim to be, in line with UKGC Part 6.3 and EU Regulation 2024/1624 CDD requirements |
| Bank statements | Establishes the origin and sustainability of funds | Requested when an operator needs to verify that deposited or staked funds come from a legitimate source and that the player’s account balance is consistent with their financial position |
| Payslips or income records | Establishes that funds staked are proportionate to the player’s income | Used under UKGC affordability and responsible gambling requirements to confirm that spending levels don’t indicate financial harm; applies to all customers, not only high-value players |
| Higher-scrutiny evidence types (e.g. recycled winnings records, cryptocurrency transaction records) | Establishes origin of funds where the source carries elevated money laundering risk | Required when funds come from previous gambling winnings or from cryptocurrency; regulators have found that operators have historically failed to apply adequate scrutiny to these sources, making them a specific area of regulatory focus |
Consequences of Not Providing Documentation
If a player declines to supply documents the operator has requested, the operator can’t legally continue the customer relationship under its licence conditions. Under UKGC AML and counter-terrorist financing guidance, operators are required to conduct customer due diligence as a condition of holding a licence. A customer who withholds the required documents leaves that obligation unresolvable. What follows isn’t a penalty. It’s the operator’s minimum required response under its regulatory obligations.
Escalation Sequence and Account Impact
The consequences of non-compliance follow a predictable progression from targeted restrictions to full account closure. A blocked withdrawal, for example, isn’t the operator withholding funds arbitrarily. It’s the operator being unable to release funds without completed verification, because doing so would breach its licence conditions. The UKGC issued significant fines for AML and responsible gambling compliance failures in the period from January 2023 to April 2024, which explains why operators enforce documentation requirements strictly. Each stage below represents the operator’s minimum necessary response, and resolving it requires supplying the outstanding documents.
- Withdrawal freezes: Any pending withdrawal is held until the requested documentation is provided and verified. The operator can’t release funds without completing verification, as doing so would breach its AML obligations under UKGC guidance.
- Deposit and gameplay restrictions: While verification remains unresolved, the operator applies restrictions on further deposits and gameplay. These restrictions stop additional funds from entering the account before the source of existing funds has been established.
- Account suspension: If documentation isn’t supplied within the operator’s required timeframe, account access is suspended. The player can’t log in, place bets, or initiate transactions until the outstanding documentation is received and reviewed.
- Account closure and fund return procedures: Full closure is the final step when documentation isn’t provided and the operator can no longer maintain the customer relationship. The operator is required under its regulatory obligations to handle any remaining balance in line with its licence conditions, which typically means returning funds to a verified payment method associated with the account.
Reading a Documentation Request With Full Context
A source of funds request can be driven by two distinct legal rationales at once: one concerned with where the money came from, and one concerned with whether the player’s spending is financially sustainable. The rationale behind a given request determines its scope and how urgently the operator needs to resolve it. Knowing which obligation is active, and what each requested document is designed to establish, lets you respond accurately rather than treat the process as arbitrary.
