The check you already passed, and the one that comes later

Every licensed US online casino runs a baseline identity check. It happens at registration and again, more seriously, at your first withdrawal. It confirms that you are a real person, that you are at least 21, that you live where you say you live and that the payment method belongs to you. It is standardized, it is the same for the $20 player and the $2,000 player, and it usually resolves in one to three business days on a government ID, a proof of address and a photo of the card or a bank micro-deposit. That layer is covered in detail on our KYC verification guide, and if the email you are holding asks for a driver’s license and a utility bill, that is the page you want.

This page is about the layer above it. Compliance teams call it enhanced due diligence, or EDD. It is not triggered by a calendar event like registration or a first cashout. It is triggered by your behavior against a risk model, it is discretionary rather than universal, and it is about money rather than identity. The operator is no longer asking whether you exist. It is asking whether the funds moving through your account are consistent with a lawful explanation, and it is asking because federal law makes that its problem, not yours.

The practical differences are worth spelling out, because players routinely send an enhanced due diligence request the same documents that cleared their identity check and then wonder why the review drags.

Routine identity verification	Enhanced due diligence
Triggered by registration and first withdrawal	Triggered by deposit volume, win size, pattern or a screening hit
Applied to every account	Applied to a small minority of accounts
Asks who you are and where you live	Asks where the money came from and whether you could plausibly have it
Fixed document list, usually two or three items	Open-ended and iterative, often several rounds
Handled by a verification team on a queue	Handled by a named compliance or AML analyst
One to three business days is normal	Five to 30 days is normal, longer is possible and sometimes justified
Balance usually keeps playing	Withdrawals and often play are suspended until it closes

Source of funds and source of wealth are not the same question

Almost every consumer article on this subject uses the two terms as synonyms. Operators do not, and if you answer the wrong one you will get a second email.

The escalation logic is simple. An operator asks for source of funds first. It escalates to source of wealth when the money is large relative to what your declared occupation and stated income would support, or when the source of funds answer explains where the money came from immediately before it was deposited without explaining how you came to have it at all. A player who deposits $40,000 in a quarter and lists their occupation as a teacher will get the second question even if every deposit traces cleanly to a personal checking account, because the checking account is a conduit, not an origin.

The legal basis: a casino is a financial institution

The reason a blackjack site can demand your pay stubs is that Congress classified casinos as financial institutions more than 40 years ago. The Bank Secrecy Act, formally the Currency and Foreign Transactions Reporting Act of 1970 and codified at 31 U.S.C. 5311 and following, sets the reporting and recordkeeping regime. Section 5312(a)(2)(X) puts inside the definition of financial institution “a casino, gambling casino, or gaming establishment with an annual gaming revenue of more than $1,000,000” that is licensed under the laws of a state or is an Indian gaming operation conducted under the Indian Gaming Regulatory Act. The regulatory definition at 31 C.F.R. 1010.100(t)(5) restates the test as gross annual gaming revenue in excess of $1 million and sweeps card clubs in by reference.

The rules themselves live in 31 C.F.R. Chapter X, and the casino-specific ones are in Part 1021, Rules for Casinos and Card Clubs. Regulated US online casinos sit under this framework because the internet operation is generally tied to a land-based casino license, or to a state-authorized platform holder operating under one. Delaware is the structural outlier, running its online casino through the state lottery in partnership with its licensed casino operators. Either way, being registered in Trenton or Dover rather than standing at a cage changes nothing about the obligation.

The AML program requirement is the real source of the request

Section 1021.210 requires each casino to develop and implement a written program “reasonably designed to assure and monitor compliance” with Chapter X. The minimum elements are a system of internal controls, independent testing scaled to the risk of the casino’s products and services, training of personnel to spot and report unusual transactions, one or more designated compliance officers, procedures for using all available information to determine and verify customer name, permanent address and Social Security number where required, procedures for determining when a suspicious activity report is required, and, for casinos with automated data processing, use of those systems in the compliance effort.

Notice what that list does not contain: any specific dollar figure at which a casino must ask you for a bank statement. This is the single most useful thing to understand about the whole process. Casinos are not subject to the beneficial ownership customer due diligence rule at 31 C.F.R. 1010.230, which covers banks, broker-dealers, mutual funds and futures commission merchants. There is no federal script. Instead, each operator writes its own risk-based thresholds inside its AML program, its state regulator reviews those internal controls as part of licensing, and an examiner later grades the operator on whether the program it wrote was reasonable and whether it actually followed it. That is why trigger points differ between two licensed sites in the same state, why an operator will not tell you what its thresholds are, and why “the other site never asked me this” is not an argument that gets you anywhere.

Currency transaction reports and the $10,000 line

Section 1021.311 requires a casino to file a report of each transaction in currency, cash in or cash out, of more than $10,000. Section 1021.313 aggregates: multiple currency transactions count as one if the casino knows they are by or on behalf of the same person and total more than $10,000 in either direction during a single gaming day, meaning the 24-hour period the casino uses to close its books rather than a calendar day. The filing is FinCEN Form 112.

Here is the part that surprises online players. This threshold has almost nothing to do with your internet account. A currency transaction report is about physical currency. Card deposits, bank transfers, PayPal, pay-by-bank and crypto are not currency for this purpose. If you have read that a casino must report you at $10,000, that rule is real, but it is a cage-and-chip-rack rule. What actually applies to an online account is the recordkeeping regime and the suspicious activity rules below.

Recordkeeping: the $2,500 and $3,000 markers

Section 1021.410 requires casinos to keep, for each deposit of funds, account opened or line of credit extended, the customer’s name, permanent address and Social Security number, verified under 31 C.F.R. 1010.312, with a passport or other government document standing in for nonresident aliens. It requires records of the terms and repayment of any credit extension over $2,500, and a separate chronological log of every personal check, business check, cashier’s check, money order, traveler’s check or promissory note in the amount of $3,000 or more, including time, date, amount and customer identifying information. Records are held five years under 31 C.F.R. 1010.430. Those are the figures that quietly govern documentation on a funded gaming account.

Suspicious activity reports and the $5,000 threshold

Section 1021.320 is the provision that generates most source of funds requests. A casino must report a transaction, or an attempted transaction, that involves or aggregates to at least $5,000 in funds or other assets where the casino knows, suspects or has reason to suspect that the transaction falls into one of four categories:

• It involves funds derived from illegal activity, or is intended to disguise the source, ownership or control of such funds as part of a plan to violate federal law or evade a reporting requirement.
• It is designed, through structuring or otherwise, to evade a Bank Secrecy Act requirement.
• It has no business or apparent lawful purpose, or is not the sort of transaction this particular customer would normally be expected to make, and the casino knows of no reasonable explanation after examining the available facts.
• It involves use of the casino to facilitate criminal activity.

The third category is the one that catches ordinary players, and the phrase to sit with is “the casino knows of no reasonable explanation.” A source of funds request is frequently the casino going looking for that explanation before it decides. Answering well is your one clean chance to supply it. The filing deadline is 30 calendar days from initial detection of the facts, extendable to a maximum of 60 days if the casino is still working to identify a subject, which is one reason reviews so often close at right around the one-month mark.

Why nobody will confirm what is really going on

If a report is filed, the casino cannot tell you. Section 1021.320 and 31 U.S.C. 5318(g)(2) prohibit a casino, and its officers, directors, employees and agents, from disclosing a suspicious activity report or any information that would reveal its existence to anyone other than the authorized government and regulatory recipients. There is no consumer exception, no exception for the person the report is about, and no exception for a lawyer’s demand letter.

The consequence for you is that support agents handling a compliance hold are often not being cagey by choice. They are permitted to tell you that the account is under review, what documents they need and, usually, an expected turnaround. They are not permitted to tell you what the underlying concern is if a filing is in play. Reading hostility into that vagueness is a common and expensive mistake. Reading it as a reason to stop responding is worse.

Structuring: the trap players walk into on purpose

Under 31 U.S.C. 5324 it is a federal crime to structure, assist in structuring, or attempt to structure a transaction with a domestic financial institution for the purpose of evading a reporting requirement. Penalties run to five years of imprisonment, doubled to 10 years where the structuring is tied to another violation or to more than $100,000 in illegal activity over a 12-month period. The offense is the intent to stay under the line, not the size of the amount.

Rule	Citation	Threshold	Relevance to an online account
Currency transaction report	31 C.F.R. 1021.311 and 1021.313	More than $10,000 in currency per gaming day	Low, applies to physical cash only
Suspicious activity report	31 C.F.R. 1021.320	At least $5,000 in funds or other assets	High, this is the online driver
Monetary instrument log	31 C.F.R. 1021.410	$3,000 or more	Moderate, checks and money orders
Credit extension records	31 C.F.R. 1021.410	More than $2,500	Moderate, markers and casino credit
Structuring offense	31 U.S.C. 5324	No dollar floor, intent based	High, patterns matter more than amounts
Record retention	31 C.F.R. 1010.430	Five years	Your documents are kept, see the privacy section below

All of this is examined. FinCEN delegated Bank Secrecy Act examination authority for casinos and card clubs to the IRS at 31 C.F.R. 1010.810(b)(8), and the field procedures live in Internal Revenue Manual 4.26.13. The penalties are not theoretical. On Oct. 22, 2024, FinCEN assessed a $900,000 civil money penalty against Sahara Dunes Casino, doing business as Lake Elsinore Hotel and Casino, which admitted willful failures to implement an effective anti-money laundering program and to file currency transaction reports and suspicious activity reports. Weigh that against the cost of losing one annoyed blackjack player and the operator’s incentives stop being mysterious.

This page explains process, not the law as applied to your situation. It is information, not legal or tax advice. If real money is frozen and the amount matters to you, talk to a lawyer.

What actually triggers a request

Two things generate these letters. The first is automated transaction monitoring, a rules engine that scores every account against thresholds the operator set in its own program. The second is a human referral, from a payments analyst who noticed something odd, a fraud team looking at a linked account, or a VIP host who was asked to confirm what a big new customer does for a living. Neither one requires you to have done anything wrong, and one flag alone rarely produces a request. Two or three together almost always do.

Six more sit alongside those, and the biggest of them is simply asking to be paid.

Trigger	What the system is reacting to
A large withdrawal	The most common trigger of all, because the payout is the last point at which the operator can ask
Adverse media hit	Name matches in news databases tied to fraud, narcotics, corruption or organized crime, including false matches on common names
Sanctions and watchlist screening	An OFAC or watchlist near-match, which freezes first and asks questions second
Behavior change	A dormant account suddenly active, stake sizes jumping an order of magnitude, or a new device and location pattern
Third-party money	A card or bank account not in your name, or a payment instrument shared with another account on the site
Payment disputes	Prior chargebacks or reversed deposits, which move an account into a higher-risk tier on their own

Three of those deserve expansion because players misread them constantly.

Geolocation anomalies belong on the list too, though they usually produce a different kind of hold. A regulated operator has to confirm you are physically inside a legal state at the moment of every wager, and repeated failures or spoofing attempts feed the same risk file that compliance reads. That system is explained on our geolocation page.

Why blackjack players get asked more than they expect

Blackjack has a specific problem, and it is worth understanding rather than resenting. Played with a decent rule set and correct basic strategy, the game returns roughly 99.5 percent, which is to say the house edge is around half of one percent. That is close to the lowest cost of any bet in the building. For a launderer, that is the entire attraction: you can push a large amount of money through the game, lose very little of it in expectation, and walk away with a plausible story about a gambling win. Compliance teams learned this decades ago on the casino floor, where blackjack and baccarat have always drawn the most Title 31 attention for exactly this reason. The rules engines that watch online accounts inherited the same assumptions.

A few blackjack-specific patterns and what they look like on the other side of the screen:

What you did	What the model sees	What resolves it
One big winning session at high limits, then a withdrawal	Large payout with a short account history behind it	Deposit trail plus a plain statement of income. Usually a single round of documents
Steady $100 to $300 play over months, then a $30,000 cumulative deposit year	Volume that outruns declared income	Source of wealth, not just source of funds. Pay stubs plus a tax return
Deposit, a dozen hands, withdraw	Pass-through with minimal genuine risk taken	Bank statements showing the deposit came from ordinary earnings, plus an honest explanation of why you stopped playing
Bouncing between blackjack and a bonus	Bonus terms flag, not usually a compliance flag	A different team and a different argument. See below
Betting patterns that vary sharply with the count	Advantage play flag, again not a compliance flag	Also a different conversation

Keeping those last two separate from a source of funds review matters more than it sounds. Blackjack is usually excluded from bonus wagering requirements entirely or weighted at around 10 percent, so a player clearing a bonus at the tables gets caught by the promotions team under the terms, not by the anti-money laundering program. Likewise, card counting is not a crime and is not a Bank Secrecy Act issue, but it does get accounts restricted under house rules. If your withdrawal was blocked because the operator says your play was irregular or your bonus was abused, you are in the territory covered by our page on voided winnings, and a stack of pay stubs will not help you. Sending compliance documents in answer to a terms dispute, or arguing terms in answer to a compliance request, is the most common self-inflicted delay we see.

Every document you might be asked for

Requests are usually iterative. You will be asked for two or three items, and the answer to those will determine whether a second round follows. Sending the right version the first time is the whole game.

Document	What it proves	What a good version looks like
Pay stubs	Recurring income and the employer behind it	The two or three most recent, showing gross pay, year-to-date totals, employer name and your name. Not a screenshot of one line
Tax return or W-2	Annual income independent of your own claim	Form 1040 with schedules, or the W-2 for the most recent year. Redact nothing but dependents’ Social Security numbers
Bank statements	The money accumulating and then leaving for the casino	Full official PDF statements from the bank’s own portal, covering the whole requested period, with the header, the running balance and every page. Deposits to the casino should be visible
Employment letter	Position, tenure and salary when stubs are thin	On company letterhead, dated, signed, with a contact who can confirm it
Proof of sale, property	A one-off influx that dwarfs your salary	The closing or settlement statement plus the bank credit showing the proceeds landing
Proof of sale, vehicle or other asset	Same, at smaller scale	Bill of sale, title transfer and the matching deposit
Inheritance or estate documents	Money with no income trail behind it	Executor letter, probate or estate distribution schedule, plus the deposit that matches the amount
Legal settlement	A lump sum from litigation or insurance	The settlement agreement or a disbursement letter from the firm. Amounts and dates matter more than the underlying claim
Business accounts, self-employed	Income where there is no employer	Business bank statements, a profit and loss statement, Schedule C, and 1099 forms from clients
Crypto exchange records	That coin you deposited was bought with traceable money	Exchange account statement in your name showing fiat in, purchase and withdrawal, plus the transaction hashes tying it to the deposit address
Gambling wins elsewhere	That the bankroll is recycled winnings, not new money	An account statement or win-loss statement from the other operator showing the win and the payout
Investment, dividend or pension statements	Accumulated wealth behind an ordinary salary	Brokerage, dividend or retirement statements showing the balance and any withdrawal you drew on
Gift from a family member	Money whose origin is not yours	A signed, dated gift letter naming the giver and the amount, the transfer record, and often the giver’s own evidence of source
Loan documents	Borrowed funds, which are legitimate but must be declared	The loan agreement and the disbursement, from a lender, not a friend

Documents get rejected on form as often as on substance, and a rejection costs you another cycle.

Download the real PDF from the institution. If the only version you can get is a paper document, photograph the whole page flat, in daylight, with all four corners visible.

How to answer so the review actually closes

Compliance analysts are working a queue. A file that answers the question closes; a file that argues gets set aside and reopened later. Six things separate the two.

Answer the question that was asked

Read the request literally. If it asks for the source of the $18,400 deposited between May and July, do not send a document about a bonus that was paid in March. If it asks for three months of statements, send three months, not two. If it names an account, send that account. The most common reason a review runs to a second and third round is that the first submission answered a nearby question instead of the one on the page.

Lead with a narrative, not a folder

Attach a short written statement, four or five sentences, before the documents. Who you are, what you do, roughly what you earn, where the money came from, and how the attached documents show it. A workable structure looks like this:

Re: case reference 48812, account ending 4471.

I am a heavy equipment operator employed by Company X since 2019, gross pay about $96,000 a year. Between May 4 and July 22 I deposited $18,400 in seven transactions, all funded from my checking account at Bank Y, which receives my biweekly payroll by direct deposit. Attached are my May, June and July statements from Bank Y, showing the payroll credits and each of the seven casino debits, and my three most recent pay stubs. My withdrawal request of $31,200 on Aug. 9 is winnings from blackjack play on July 26 and Aug. 2, which your own account history reflects. Please tell me in writing if anything further is needed and by what date.

Redact almost nothing

The instinct to black out a bank statement is understandable and it is usually what kills the submission. A statement with the balance blacked out proves nothing, and a heavily redacted document does more than fail to help. It reads as concealment, which is itself a factor in the analysis.

Respond fast and inside the deadline

Most requests carry a stated deadline, commonly seven to 30 days. Meet it. If you need longer because a document has to come from an employer, a lawyer or an estate, say so in writing before the deadline passes and give a date. An extension requested in advance is normal; silence followed by a late submission is treated as non-cooperation, and non-cooperation is a documented factor when the file is closed.

Keep everything in writing, and keep your own copy

Use the secure upload portal or the compliance email address, never a phone call as the only record. Note ticket numbers and timestamps. Save what you sent and when. If this later becomes a regulator complaint, your file of dated submissions and their dated replies is the entire case, and the operator will have its own copy of the same exchange. Vague memories of what a chat agent promised in June are worth nothing.

Do not improvise, and do not contradict yourself

What you say now has to match what you told them at registration. If you registered with an occupation and an income band, and your explanation implies something different, explain the gap rather than pretending it is not there. People change jobs, inherit money and sell houses. That is fine. Retro-fitting a story to a number is not, and analysts compare submissions against the registration record as a matter of routine.

Why partial answers escalate

Go back to the third suspicious activity category: a transaction with no apparent lawful purpose where the casino knows of no reasonable explanation. An unexplained transaction is not automatically reportable. An unexplained transaction that the customer declined to explain is a very different file. Every incomplete round of documents extends the review, resets the internal clock, and moves the analyst closer to the conclusion that the explanation is unavailable rather than merely missing. Evasion does not create doubt in your favor. It removes the only thing that was going to close the case.

Timelines, and when a hold stops being reasonable

Stage	Typical duration
Acknowledgment of your submission	One to two business days
First substantive review	Three to 10 business days
Second round, if documents are missing	Another five to 10 business days
Sign-off by the compliance officer	Included in the above, but adds days on larger balances
Payment released after clearance	One to five business days, depending on method
Whole review, complete submission, no complications	Five to 30 calendar days

The 30-day figure is not arbitrary. The suspicious activity filing deadline in 31 C.F.R. 1021.320 runs 30 calendar days from initial detection, so internal workflows are built around that clock, and a decision that has not been made by day 30 has usually run into something real. A review that reaches 45 or 60 days is not automatically improper, particularly where a sanctions match or an estate document is involved, but by then you are entitled to a written statement of what remains outstanding.

Two or three of those stall signals together, past the 30-day mark, on a complete submission, is the point to escalate rather than keep uploading.

Escalation on a licensed US site is a real process. Put a dated written complaint to the operator first, referencing your submission dates and its own published timelines, then take it to the state regulator: the Division of Gaming Enforcement in New Jersey, the Pennsylvania Gaming Control Board, the Michigan Gaming Control Board, the West Virginia Lottery, the Connecticut Department of Consumer Protection, the Delaware Lottery, or in Rhode Island the director of the Division of State Lottery, who holds iGaming rulemaking and patron complaint authority under R.I. Gen. Laws 42-61.2-3.4 while the Department of Business Regulation handles licensing and casino supervision. Our complaints guide walks through the filing mechanics, and the regulators page lists who supervises what. If the account itself was shut rather than merely held, start with account closures.

What happens if you refuse

Be clear-eyed. Refusal almost never ends with you being paid. An operator that cannot document the source of funds on a flagged account will typically take the following steps in order.

Two things do not happen. The reporting obligation does not go away because you stopped replying, and your refusal does not disappear from the file. It becomes a fact in the analysis, and it is exactly the fact that turns “we could not determine the purpose of these transactions” into a filing. Nor is there a practical legal route back: a regulator will not order a payout while a live anti-money laundering question is open, and no offshore site will respond to pressure of any kind. The only leverage a player ever has in this situation is a complete, prompt, documented answer, which is why the advice above is worth following even when the request feels intrusive.

Regulated operators and offshore sites are doing different things

The letter can read identically. What sits behind it does not.

A licensed US operator asks under a written anti-money laundering program whose internal controls were reviewed by its state regulator, subject to examination by the IRS under the delegation at 31 C.F.R. 1010.810(b)(8), with an enforcement history and a named regulator you can complain to when it goes wrong. Its interest is in closing your file, because an unresolved case is a compliance problem for the operator too. Remember that this only exists in the seven states with live regulated online casinos, plus Maine, which passed a tribal-exclusive online casino law but has not launched as of August 2026. Nevada, despite what the name suggests, licenses online poker only and has no regulated online casino, so a Las Vegas brand name on a blackjack site is not evidence of anything.

An offshore site uses the same vocabulary with far less behind it. Curacao, the most common licensing home for sites accepting US players, replaced its old master and sublicense structure with direct licensing by the Curacao Gaming Authority under the National Ordinance on Games of Chance, which came into force Dec. 24, 2024, with the last master licenses expiring in early 2025. That is a genuine tightening. It is not US consumer protection. There is no US regulator supervising the AML program, no state complaint form, no realistic forum, and nothing stopping an operator from deploying compliance language as cover for a liquidity problem. The distinctions are covered on our comparison of legal and offshore sites, the practical meaning of a license on our licensing page, and the legal position of these sites on whether offshore sites are legal. When an offshore review drags past a month with no named contact and shifting demands, treat it as a solvency signal and read our page on casino shutdowns.

What you are actually handing over

A full source of funds and source of wealth response is more sensitive than anything you gave a lender: Social Security number, employer, salary, account numbers, balances, spending history and often a family or estate situation. Under 31 C.F.R. 1010.430 the records are kept five years, and state licensing rules frequently require longer.

That asymmetry is the strongest practical argument for playing in a regulated state where one exists, and it is worth weighing before you upload a tax return.

Source of funds FAQ

A source of funds request is an unpleasant piece of mail, but for a winning blackjack player on a licensed site it is usually the last obstacle between a good weekend and a payment. Answer it completely, answer it in writing, and keep your copies.

Responsible gambling

Gambling should stay entertainment. If a review has you chasing losses, borrowing to deposit, or hiding play from the people around you, stop and get help: call or text 1-800-GAMBLER for free, confidential support, and read our responsible gambling resources for state helplines and self-exclusion options.