KYC and Deposits

Where Verification Slows Players Down

A player signs up, picks a payment method, hits deposit and then waits. Or gets a message asking for a document. Or sees a decline that says nothing useful. Some of those players come back. A lot of them don't.

Identity verification is not optional in regulated iGaming, and nobody at a payment company wants it to go away. But where and when you ask for it makes a big difference to how many deposits actually go through. This article looks at the places where verification and payments rub against each other, why that happens, and what operators can change without loosening any rules.

A quick note on scope: this is about deposits. Withdrawals have their own set of KYC problems, and we've covered the payout side in other articles. Here we're looking at the first minutes of a player's relationship with your brand.

Two checks, two clocks

The first thing to understand is that a deposit usually goes through two separate checks, run by different parties, on different timelines.

The operator runs KYC. That means confirming who the player is, how old they are, where they live and, depending on the market and the risk, where the money comes from. The payment side runs its own checks: is this card or bank account real, does it belong to the person paying, does the issuer approve it, and does the transaction look normal.

Each of those can be fast on its own. The trouble starts when they don't line up. A player verified five seconds ago may still get a decline because the name on the card is spelled differently. A player who passed the payment checks may get stopped by the operator's own rules. From the player's side, it all looks like one thing: "the deposit didn't work."

Where deposits actually slow down

Here are the spots we see come up again and again when verification and payments meet.

1. The document request that arrives after the payment attempt. If a player tries to deposit and only then gets asked for ID, they're already mid-task. They've picked a method, maybe typed card details, and now they're being sent off to find a passport. Anyone who has done this on a phone knows how often that ends with the app being closed.

2. Name mismatches. The account says "Alex Müller." The card says "A. Mueller." Or the bank account is a joint account in a partner's name. These are small differences and they cause a lot of manual reviews, because operators and payment providers both have a reason to check that the payer and the account holder are the same person.

3. Stacked authentication. A player passes the operator's ID check, then gets a 3-D Secure challenge from the card issuer, then possibly a one-time code from the operator as well. Each step is reasonable. All three in a row feel like a wall. The more steps, the more chances for a timeout, a missed text message or a session that expires.

4. Source-of-funds questions at the wrong moment. Operators may need to ask where a player's money comes from, especially when deposit patterns change. That's a legitimate check. The slowdown happens when it lands as a hard stop in the middle of a session, with no explanation and no clear next step.

5. Manual review queues. Some checks need a person. If the queue is short on a Tuesday morning, fine. If a player deposits on a Saturday night before a big match and gets "pending review," the match is over before anyone looks at it.

6. Declines that look like KYC problems but aren't. Sometimes the player is verified and the decline is a plain issuer decision, a risk rule or a limit. If the message is generic, the player assumes the verification failed, contacts support, or tries again and again. Repeated attempts can make the next one even less likely to pass.

What the rules say, and what they don't

It helps to be clear about what regulators actually require, because many operators ask for more, and earlier, than the rule demands.

Take the UK as an example. The Gambling Commission's license conditions say operators must obtain and verify a customer's identity information, at minimum name, address and date of birth, before the customer is permitted to gamble. The same condition does not require identity verification before a deposit. It says operators should tell customers, before they deposit, what documents or information may be needed, when, and how to supply it. It also says a withdrawal request shouldn't trigger a new information requirement if the operator could reasonably have asked for it earlier.

Other markets have their own rules, and some are stricter. The point is that "verify everything up front" and "verify when the law says" are different design choices, and the gap between them is where a lot of deposit friction lives. If you operate in more than one market, it's worth mapping which checks each regulator actually requires at which moment.

On the EU side, the new Anti-Money Laundering Regulation applies directly in all member states from July 10, 2027. Gambling providers are among the obliged entities, and the regulation defines "gambling service" itself, so it doesn't depend on how a country labels a game locally. Member states may exempt some low-risk gambling, but casinos and online betting cannot be exempted. The regulation also sets out customer due diligence triggers specific to gambling, such as when collecting winnings or placing a stake. Some of the technical details are still being worked out in standards from the new EU anti-money-laundering authority, so check the final texts before you build around them.

We're a payment company, not a law firm. Treat this as a map of where to look, and confirm what applies to your licenses with your compliance team or legal advisor.

Practical ways to reduce the friction

None of these require weaker checks. They mostly change timing, wording and information flow.

• Tell players what's coming before the deposit screen. A short line like "You may be asked to confirm your identity. It takes about a minute with a photo ID" removes the surprise. Where the rules call for it, it also does what the regulator wants.
• Verify in steps. Collect basic details at sign-up, run the lighter checks first, and ask for documents when the risk or the rules call for them, not by default.
• Pre-fill and match names. Show the player the name that will be used for the payment, and flag a mismatch before they submit card details. Allow for common spelling variations, accents and middle names in your matching.
• Keep the player in the same session. Mobile document upload, camera capture and a clear way back to the cashier save a lot of lost players.
• Give decline reasons that help. "Your bank declined this payment, try another method" and "We need to confirm your identity first" lead to very different next actions. Work with your payment provider on which reason codes you can show.
• Set expectations for review times. If a manual review is needed, say how long it usually takes and what the player can do meanwhile. Check what your coverage looks like on weekends and during big events.
• Look at the data together. Operators and payment providers often hold different halves of the picture. Sharing decline reasons, drop-off points and review outcomes makes it much easier to see whether a problem sits in the KYC flow, the payment flow or the gap between them.

A note for higher-risk merchants

If your business sits in a higher-risk category, you'll often work with acquirers and banks that want to see strong KYC and AML processes. That's a good reason to document your checks, keep your decision logic consistent and be able to explain why a player was stopped. It also helps with disputes later. A clean record of who was verified, when and how, supports your position if a deposit is questioned.

Where to start

You don't need a big project. Pick one market, walk through the first deposit as a new player on a phone, and count every moment where you're asked for something or told to wait. Then compare that list with what the regulator in that market actually requires and what your payment provider's checks already cover. Usually a few steps turn out to be duplicates, and a few more could happen later or in a lighter form.

If you'd like to talk through how verification and payment approval fit together in your setup, get in touch with our team.

This article was researched and written with the help of AI tools as part of our content process, and reviewed and fact-checked by the MMG team before publication.

Sources

• UK Gambling Commission: Licence condition 17.1.1, customer identity verification
• Bird & Bird: Navigating the EU AML package, implications for online gambling service providers (2025)
• Regulation (EU) 2024/1624 (AMLR), applying from July 10, 2027