On 12 August 2026 the UK Gambling Commission published a policy blog reminding remote operators that identity checks belong at the start of an account, not at the moment a customer asks for their money back. The authors are Helen Rhodes, Director of Major Policy Projects and Evaluation, and Sarah Webster, Senior Policy Officer. This is not a new licence condition. It is the Commission restating Licence Condition 17, which has been in force for years, after its own casework and a financial risk assessment pilot kept turning up the same gap.
If you use a UK-licensed casino, the practical point is simple. A cashout should not be the first time the operator decides your name, address or date of birth need a proper check. That is still happening often enough that identity verification now accounts for more than a quarter of complaints to the Commission’s Contact Centre, and it is one of the most common disputes sent to Alternative Dispute Resolution providers.
What the Commission actually restated
Licence Condition 17.1.1 requires a remote licensee to obtain and verify information that establishes who the customer is before that customer is allowed to gamble. The minimum is a name, address and date of birth that all belong to the same person.
The withdrawal rule sits in the same condition. A request to take funds out must not trigger a demand for extra information if the operator could reasonably have asked for it earlier. The Commission can still accept a later request where another legal duty applies at that moment, such as anti-money laundering work. The operator cannot treat the cashout itself as the convenient time to finish basic ID.
Before the first deposit, the operator should also tell you what documents it may need, when it might ask, and how to send them. That notice is part of the same condition, not a courtesy.
Why this still shows up at withdrawal
Rhodes and Webster say consumers keep reporting the same frustration: they play on an account that already passed registration, then get asked for identity documents only when they try to withdraw. The Commission has published that warning before, including in its earlier blog on account withdrawals. Staff have seen some improvement. They still find identity doubts and risk flags that sat on the file for some time and were only chased at payout.
That sequencing is what turns a verification issue into a payment delay. The operator may already have the legal duty to check you. The money just sits until someone opens the file. From the player’s side it looks like a stalled debit-card refund, e-wallet transfer or Faster Payments payout. From the Commission’s side it is often unfinished onboarding.
What the financial risk assessment pilot found
The blog draws on the Commission’s financial risk assessment pilot. One follow-up question was why a small share of accounts could not be matched to credit reference agency records, so those customers could not get a frictionless assessment. The unmatched group was small. The Commission still wanted to know who sat in it.
Its review found that some of those customers, including high-spending accounts, had been identified on incomplete or inaccurate data. Examples it named were:
- an initial on the file, with no full name
- a nickname instead of the legal name
- a commercial address instead of a residential address
- two or more of those problems on the same account
The Commission is blunt about the standard. Onboarding someone on initials, nicknames or a commercial address is not enough to meet the existing identity rule. It also does not expect Enhanced Due Diligence on every new customer. It wants a complete, accurate record of a unique person at registration, then prompt follow-up if something still does not add up. Waiting for the withdrawal request is, in its words, not appropriate.
GAMSTOP matching is part of the same problem
Separate casework found customers registered under a middle name rather than their forename. Those records then failed to match data held elsewhere, including GAMSTOP. Self-exclusion only works if the operator has identified the same person that the scheme holds. A sloppy registration record is not just a payout nuisance. It can weaken the control that is supposed to keep a self-excluded customer off UK-licensed sites.
Third-party verification tools are in the frame as well. Many operators buy an ID check from an outside provider. The Commission is worried about how tolerant those tools are, and about “fuzzy matching” that lets an account through on a partial or equivocal match. The licensee still owns Licence Condition 17 even when a vendor ran the check.
What this does not change for source-of-funds checks
This reminder does not ban later questions. If an operator has a live legal duty, including anti-money laundering or source-of-funds work, it can still ask for documents at withdrawal. Closed-loop routing, payment-method proof and a review of a large or unusual cashout can still add time after the ID file is complete. Those are separate issues from leaving basic identity unfinished until you hit “withdraw”.
The useful distinction for a UK player is this. Name, address and date of birth should already have been verified before the first bet. Extra evidence can still appear later if the law or the operator’s risk assessment requires it. What the Commission is pushing back on is the habit of treating the cashout as the first real KYC gate.
If you want the longer version of how those later checks sit next to payout routing, see our guides to closed-loop withdrawals and what “no ID” claims actually mean in the UK.
What UK players can do now
Use the legal name and residential address that match your payment methods. An initial, a nickname or a work address may get you through a weak registration form and then fail a later match against a bank account, a debit card or GAMSTOP. That is exactly the pattern the pilot flagged.
If a UK-licensed casino asks for basic ID only after you request a withdrawal, ask which information is missing and why it was not requested earlier. Keep the support thread. If the account stays blocked and the operator cannot explain a current legal reason for the extra request, the Commission’s complaints route and an ADR provider are the formal next steps. IBAS is the usual adjudication body for many remote operators.
None of this is a reason to use an unlicensed site. Offshore brands that market themselves as skipping UK checks also sit outside UKGC withdrawal rules, GAMSTOP and the ADR path. Stick to operators on the Commission’s public register.
The Commission says it will keep reviewing operator progress and will consider further clarification or action if needed. Trade coverage after the blog, including iGaming Republic on 17 August, treated it as a restatement of the existing rule rather than a new consultation.
Safer gambling
Identity checks exist to stop underage play, support anti-money laundering controls and make self-exclusion work. They should not be used as a surprise lock on money the operator already accepted. If gambling has stopped being useful or enjoyable, set a deposit limit, take a break, or self-exclude. GAMSTOP covers UK-licensed online operators in one step. Free support is available from BeGambleAware and GamCare. The National Gambling Helpline is 0808 8020 133, free and 24/7. 18+ only.
Sources
- UK Gambling Commission, Reminder of identity verification requirements for remote operators, 12 August 2026
- LCCP condition 17.1.1, Customer identity verification
- UK Gambling Commission, Key issues and our expectations concerning account withdrawals
- UK Gambling Commission public register
- iGaming Republic, 17 August 2026
- GAMSTOP
- BeGambleAware
- GamCare
- Independent Betting Adjudication Service (IBAS)
Published 24 August 2026. Reviewed by Charlie Davids. casinowithdrawal.co.uk receives commission from some operators listed on this site. That does not affect our reporting or which facts we include. 18+. Please gamble responsibly.
