How does KYC work in iGaming?
KYC operates at two levels in iGaming. At the player level, operators must verify the identity of players before allowing withdrawals or when activity triggers defined thresholds. Standard player KYC requires proof of identity, proof of address, and source of funds verification above those thresholds. At the corporate level, operators must verify the identity of business partners, investors, and service providers — covering company registration documents, Ultimate Beneficial Owner (UBO) verification, and director and shareholder identification.
The CGA, MGA, and KSA all require licensed operators to have documented, risk-based KYC procedures in place. Those procedures must specify who is responsible for collecting and reviewing documents, what the escalation path looks like when something raises a concern, how records are stored, and how long they are retained. Most regulators require a minimum five-year retention period.
Where KYC differs from CDD is in its scope. KYC is the identity verification component. CDD is the broader process of understanding the client relationship and assessing its risk. In practice, the two are closely linked — a strong KYC programme is the foundation of a strong CDD programme.
Our compliance team provides KYC programme design, implementation, and ongoing management
for iGaming operators.
