The casino has asked for repeat verification at withdrawal: what a player should do

If a casino has asked for repeat verification at withdrawal, don't cancel the request and don't send your documents through a random channel. First, ask the operator to state in writing the purpose of the check, the full list of materials, the format requirements and a secure way to upload them. Then compare the request against the terms, the licence and your account details. Share only information relevant to the check, and keep the files, emails and ticket numbers.

Repeat KYC doesn't automatically mean the casino is refusing to pay out. A regulated operator may update customer data or run an additional AML check if the risk of the transaction has changed. But the request shouldn't turn into an endless chain of identical documents with no explanation. If the requirements arrive one at a time, contradict the terms or bear no relation to the stated purpose, record that and move on to a written complaint.

Why KYC may be requested a second time

KYC means verifying the customer's identity. The initial verification confirms that the account belongs to a specific adult. A repeat check clarifies whether that information is still current and whether the transaction matches the known customer profile.

The FATF treats customer due diligence as an ongoing process: the customer relationship and the transactions may be reviewed throughout the whole time the service is provided. The specific grounds, the depth and the timing of a check depend on the applicable law, the licence, the GEO and the operator's risk model.

An additional request may appear if:

• the ID document or proof of address no longer meets the operator's requirements;
• the name, address, phone number or other details in the profile have changed;
• a new payment method is being used;
• the transaction differs from previous behaviour in amount, frequency or direction;
• the operator doubts the accuracy of information received earlier;
• a duty to carry out enhanced AML due diligence has arisen;
• ownership of the payment instrument needs to be confirmed;
• the automated check produced no clear result.

A change of device, IP address or login method may also be picked up by the internal risk system, but on its own it proves no breach. A player is entitled to ask what exactly needs to be confirmed, as far as the terms and the law allow.

Why the request appears precisely at withdrawal

A withdrawal request is often the moment when the operator reconciles the profile, the payment route and the transaction history. That, however, gives no right to postpone checks that could reasonably have been carried out earlier.

Condition 17.1.1 of the UK Gambling Commission requires remote operators licensed in Great Britain to verify key details before a customer is allowed to gamble. It also states that a withdrawal request itself shouldn't become the reason to demand information the operator could reasonably have requested earlier. An exception is possible where the additional information became necessary at that moment because of another legal obligation.

This rule belongs to the UKGC licence and doesn't transfer automatically to every site. For another casino you need to check its regulator, its KYC rules and the applicable law. The logic is still useful as a quality benchmark: an operator should separate a lawful additional check from an artificial delay.

Lawful check or stalling: a table of signals

No single signal settles a dispute on its own. Assess the sequence of actions, the wording of the terms and the requirements of the specific licence.

Which documents may be requested

The set isn't universal. The UKGC describes identity verification documents as depending on the operator's procedure, not as a mandatory identical package for every case.

The operator may ask for:

• a photo ID document;
• proof of your current address;
• a selfie or a short liveness check;
• proof of ownership of the card, account, wallet or crypto address;
• a bank statement showing the relevant transaction;
• an explanation of a specific transaction;
• source of funds documents if a separate AML check is being carried out.

Don't send "everything just in case". Ask which field has to be visible, which period the document should cover and whether you may hide data unrelated to the check. Whether a copy may be edited depends on the operator's policy and the purpose of the KYC, so get written agreement first.

What to do: an eight-step algorithm

1. Don't create a new request and don't change the payment route

Several requests or a new withdrawal method can make reconciling the transactions harder. Record the number, amount, currency, date and status of the original withdrawal.

2. Save the terms that were in force at the time of the transaction

Download or screenshot the Verification, Withdrawals, Payments, AML and Complaints sections. The images should show the URL and the date.

3. Ask for a single list of requirements

Write to support: "Please state the purpose of the repeat check, the full list of documents, the requirements for each file, a secure channel for sending them and the stage my request has reached."

4. Cross-check your details

Check the spelling of your name, the address, date of birth, phone number and the holder of the payment method. If there is a discrepancy, explain it straight away and attach proof of the change.

5. Prepare legible copies

Don't crop the required edges of a document, don't alter the text in an editor and don't use damaged files. If the operator asks for a colour copy or a particular format, make sure that is set out in the official requirements.

6. Send the documents securely

A secure section inside the account is preferable. If email is offered, compare the domain with the official website. Don't publish materials in open cloud storage.

7. Get confirmation

Ask for confirmation that each file has been received and for any missing item to be named in a single message. Note down the ticket number.

8. Keep a timeline

Build a table: date, action, document, reply, the next stage promised. It will be useful if a casino complaint becomes necessary.

How to protect your personal data

A KYC file may contain your address, signature, document number and financial transactions. Under the data minimisation principle, an organisation should collect information that is adequate for the purpose, relevant to it and not excessive. That principle is set out in the ICO's official guidance for organisations covered by the UK GDPR. Other GEOs have their own rules.

Before uploading, clarify:

• who the recipient and the data controller are;
• what purpose each document serves;
• how the transmission channel is secured;
• how long the materials are stored;
• who they may be shared with;
• how to make a personal data request;
• whether unrelated transactions may be hidden.

Don't redact anything on your own initiative if that makes the document unusable. Ask first which fields may be hidden. Keep the original separately from the version you send.

How long repeat verification may take

There is no universal timeframe. It depends on the licence, the complexity of the case, the quality of the documents, the involvement of the payment provider and whether an additional AML check is needed. Even the UKGC, in its information for players, sets no single deadline for identity verification.

So the main benchmark isn't a promise to "get back to you soon" but how manageable the process is. The operator should confirm receipt, state the status and explain what is holding completion up. Instead of "when will you pay?", ask:

• Have all the documents been accepted?
• Which department is handling the request?
• Is any further action needed from me?
• What timeframe do the terms or the complaints procedure set out?
• When will the next status update come?

Don't make a new deposit and don't carry on playing to "unlock" a withdrawal. Such a request is a serious red flag.

When a requirement can be challenged

There is reason to move from clarification to a complaint if:

• the operator names no legal or contractual basis;
• documents are rejected with no specific reason;
• information that could have been obtained earlier is requested and no new obligation is explained;
• the requirements change after every reply;
• support suggests cancelling the withdrawal and carrying on playing;
• you are asked to send data by an insecure method;
• the operator ignores its own complaints procedure;
• the restriction stays in place after confirmation that the check is complete.

The UKGC has specifically drawn attention to cases where questions about the payment method arose only after a win, even though the operator had allowed the deposit and the play earlier. For a licence from another regulator, use its rules and its alternative dispute resolution procedure.

How to file a casino complaint

Don't write an emotional story with no structure. Prepare a short claim:

1. State the account, the amount and the withdrawal number.
2. Set out a timeline of requests and replies.
3. List the documents already sent.
4. Cite the specific clauses of the terms.
5. Ask for confirmation that the package is complete.
6. Ask for the check to be completed or for a reasoned refusal.
7. State that you want an official reply under the complaints procedure.

If the reply doesn't resolve the problem with the casino, check whether a regulator, an ADR body or another authority is available for your operator and GEO. Don't post your passport, statements or full payment details publicly.

How IPU.bet helps

The IPU.bet rating is a place to start choosing an operator, but the rating doesn't remove the need to read its terms and check the licence for your GEO. If the casino isn't paying out after a repeat KYC, you can pass the timeline, the terms, the correspondence and anonymised information about the documents to IPU.bet support.

The team helps structure the materials and work out the possible route for a claim. This is informational and organisational support, with no guarantee of a payout, a refund or a particular regulatory decision.

Join IPU.BET

Checklist before you send documents

• the purpose of the repeat KYC is stated in writing;
• the full list of requirements has been received;
• the domain and the transmission channel have been checked;
• the account details match the documents;
• unrelated information isn't being sent without explanation;
• the original withdrawal request is on record;
• the terms and the correspondence are saved;
• every file has a clear name;
• confirmation of receipt has been obtained;
• a timeline is ready for a possible claim.

What to remember

Repeat verification can be a lawful part of ongoing KYC and AML, but its purpose, scope and process should be clear. First ask for a single list, then send proportionate documents through an official channel and keep proof of every step.

The fact of a withdrawal shouldn't be used as a convenient pretext to request what the operator could have checked earlier, unless a new legal obligation arose later. Where the requirements are endless or contradictory, move to a formal complaint.

Choose your operator through the IPU.bet rating and check the KYC and payment rules in advance. If a repeat check has stopped your withdrawal, gather the timeline and contact support.

Join IPU.BET