Gambling Commission reaffirms identity verification rules for operators

The UK Gambling Commission has reiterated the importance of timely identity verification for remote gambling operators, with Licence Condition 17 remaining a central requirement for businesses operating under its regulatory framework. The rules are intended to ensure that customers are appropriately identified before they are permitted to gamble while reducing situations in which additional verification is first requested when a customer seeks to withdraw funds.

The regulatory position is particularly relevant to operators reviewing registration, verification and withdrawal procedures. While identity checks can form part of broader compliance obligations, the Gambling Commission's rules distinguish between verification that should reasonably take place before gambling and additional checks that may become necessary later because of changing circumstances or other legal obligations.

Licence Condition 17 sets the timing

Licence Condition 17 requires remote gambling licensees to obtain and verify information establishing a customer's identity before that customer is permitted to gamble. The required information includes the customer's name, address and date of birth. The condition also requires operators to take reasonable steps to ensure that identity information remains accurate.

The timing of the verification process is therefore an important part of compliance. The Gambling Commission has made clear that identity verification should not routinely be postponed until a customer attempts to withdraw money when the relevant information could reasonably have been requested earlier.

The current LCCP, effective from 29 July 2026, continues to list customer identity verification as Licence Condition 17 within its operating licence conditions. This confirms that identity verification remains an established component of the regulatory framework rather than a temporary compliance initiative.

For operators, the practical implication is that verification should be incorporated into the customer journey in a manner that satisfies the regulatory requirement while remaining proportionate and understandable to customers.

Why early verification matters

The Gambling Commission's approach is designed to provide greater certainty before gambling activity takes place. Completing appropriate checks earlier can help operators establish that the person opening an account is properly identified and can also support wider regulatory controls.

Identity verification can assist with the effectiveness of self-exclusion arrangements and help operators identify circumstances involving multiple accounts. It can also form part of wider measures addressing risks associated with crime, money laundering and other regulatory concerns.

The Commission does not prescribe one universal technological method for every operator. Its published material recognises that businesses may use electronic verification services, documentary checks or other appropriate methods depending on their circumstances.

The important regulatory outcome is that the operator should be satisfied that the customer has been properly identified and should be able to demonstrate how its verification process supports that conclusion.

Withdrawal requests remain a regulatory focus

The relationship between identity verification and withdrawals has been a recurring area of attention for the Gambling Commission. In its published material on withdrawals, the regulator has explained that its Contact Centre receives complaints concerning delays to withdrawals and has identified cases where identity checks were conducted only after customers requested their funds.

This does not mean that an operator can never request additional information during a withdrawal. Licence Condition 17 recognises that there can be circumstances in which information must be obtained at that point because of another legal obligation.

The key distinction is whether the operator could reasonably have requested the information earlier. If it could have done so but instead waits until the withdrawal stage, the subsequent request may create regulatory concerns.

This principle is intended to prevent verification from becoming an unexpected obstacle at the point when a customer attempts to access money already held in an account.

Additional checks can still be necessary

Licence Condition 17 should not be interpreted as preventing operators from carrying out further checks after an account has been opened. Gambling businesses remain subject to wider regulatory responsibilities that can require additional information or enhanced due diligence where circumstances justify it.

For example, changes in customer behaviour, unusual transactions or concerns relating to money laundering may require an operator to conduct further enquiries. The Gambling Commission's risk-based guidance recognises that customer due diligence can evolve as the relationship develops and as the operator's assessment of risk changes.

This distinction is important from a legal and compliance perspective. An operator may have a legitimate reason to request additional information after a customer has begun gambling, provided that the request is connected to an appropriate regulatory, legal or risk-based requirement.

The concern arises when information that could reasonably have been obtained earlier is requested only because a customer has submitted a withdrawal request.

Verification standards require reliable information

The Commission's approach also places emphasis on the quality of the information used during identity verification. The regulator's published material explains that verification should establish that the customer is who they claim to be and that information should be supported by documents, data or other information obtained from an appropriate and reliable source.

Recent Gambling Commission material has also highlighted the importance of accurate registration information. The Commission has noted that allowing customers to register using an initial rather than a full name or using a commercial address can undermine effective identity and age verification.

This does not mean that every mismatch automatically indicates wrongdoing. Instead, inaccurate or incomplete information can make automated verification more difficult and may result in additional checks being required later.

For operators, this creates a practical incentive to ensure that registration systems capture customer information accurately from the beginning.

Clear communication is part of the process

Transparency is another important element of the regulatory approach. Before customers deposit funds, operators should explain what identity documents or other information may be required, the circumstances in which such information might be requested and how customers should provide it.

Clear communication can reduce uncertainty and help customers understand that verification is a normal part of operating within a regulated gambling environment.

The Gambling Commission has also stressed the importance of explaining restrictions and requests for additional information where it is appropriate to do so. In its withdrawal guidance, the regulator said operators should make proper efforts to explain checks and restrictions to customers while recognising that certain legal circumstances may limit what can be disclosed.

Compliance requires a proportionate approach

Operators therefore face a balance between maintaining effective compliance controls and avoiding unnecessary friction. Verification should be sufficiently robust to satisfy regulatory requirements without creating avoidable obstacles for customers.

A risk-based approach is particularly important when additional due diligence is required. The Gambling Commission's guidance states that the level of customer due diligence should be proportionate to the risks identified within the customer relationship. Higher-risk situations may require enhanced measures and ongoing monitoring.

This means operators should not treat every customer in exactly the same way where the applicable regulatory framework permits a risk-sensitive approach. At the same time, basic identity verification remains a fundamental requirement before remote customers are permitted to gamble.

What the Gambling Commission's position means for operators

The regulatory message is relatively straightforward. Remote operators should review whether identity verification takes place at an appropriate point in the customer journey and whether their systems capture accurate information from the outset.

Businesses should also examine whether their terms and operational procedures create unnecessary delays when customers request withdrawals. Where additional information is genuinely required for legal or risk-based reasons, the operator should have a clear basis for the request and should manage the process consistently.

The Commission's published LCCP remains the primary reference point for licence requirements. Operators should therefore monitor the current version rather than relying solely on older compliance summaries or historical interpretations.

Wider implications for the remote gambling sector

The continued regulatory emphasis on identity verification reflects a broader expectation that compliance should be integrated into the customer journey rather than treated as an isolated process triggered by a withdrawal.

For customers, early verification can provide greater clarity about what will be required before they begin gambling. For operators, it can reduce the risk of discovering basic identity issues only after an account has accumulated deposits or winnings.

At the same time, operators must retain the ability to conduct additional checks when legitimate regulatory concerns emerge. Identity verification is therefore not a one-time substitute for ongoing compliance monitoring. It is one element of a broader framework covering customer identification, anti-money laundering controls, consumer protection and responsible gambling obligations.

Conclusion

The Gambling Commission's continuing focus on Licence Condition 17 reinforces the importance of getting identity verification right at the earliest appropriate stage of the customer relationship. For remote gambling operators, the central issue is not simply whether a customer can eventually provide identification but whether the verification process is designed and implemented in accordance with the regulatory timing requirements.

The rules also make clear that withdrawal requests should not ordinarily become the point at which information is requested for the first time if the operator could reasonably have obtained it earlier. At the same time, legitimate legal and risk-based checks may still arise later where circumstances justify them.

For the industry, the most sustainable approach is therefore one that combines accurate registration information, timely verification, proportionate risk assessment and transparent customer communication. As the Gambling Commission continues to update and maintain its LCCP, operators that regularly review their systems and procedures will be better positioned to demonstrate that their identity verification practices meet the applicable requirements while providing customers with a clearer and more predictable experience.

FAQs

What is Licence Condition 17?
Licence Condition 17 is an operating licence condition requiring relevant remote gambling licensees to obtain and verify information establishing a customer's identity before allowing that customer to gamble.

What information must operators verify?
The required identity information includes the customer's name, address and date of birth. Operators must also take reasonable steps to keep the identity information they hold accurate.

Can an operator ask for identification during a withdrawal?
An operator may need to request additional information during a withdrawal where there is a legitimate legal or regulatory reason. However, the rules state that a withdrawal should not create a requirement for additional information if the operator could reasonably have requested it earlier.

Why does the Gambling Commission emphasise early verification?
Early verification helps operators establish a customer's identity before gambling begins. It can also support wider compliance processes involving self-exclusion, duplicate accounts and risks associated with criminal activity.

Does Licence Condition 17 prohibit further checks after registration?
No. Operators may need to conduct further checks where circumstances change or additional regulatory risks arise. Such checks can form part of ongoing and risk-based compliance procedures.

Can operators use electronic identity verification?
Yes. The Gambling Commission recognises electronic verification as one possible approach. It does not prescribe a single verification technology for all operators.

What happens if customer information is incomplete?
Incomplete or inaccurate information can make verification more difficult and may lead an operator to request additional evidence. Accurate information at registration can help reduce unnecessary verification friction later.

Are identity checks the same as anti-money laundering checks?
Not necessarily. Identity verification is one part of a broader compliance framework. Operators may also have separate anti-money laundering, source of funds, source of wealth or other risk-based obligations where applicable.

Can verification affect a customer's withdrawal?
It can in circumstances where additional information is genuinely required for a legal or regulatory reason. However, operators should not ordinarily wait until withdrawal to request information that could reasonably have been obtained earlier.

What should operators review in response to the Gambling Commission's position?
Operators should review registration data collection, identity verification timing, customer communications, withdrawal procedures and the handling of additional due diligence. They should also ensure their practices remain aligned with the latest version of the LCCP.