Safety · Account Verification
Casino KYC Verification: Why an Online Blackjack Site Asks for Your ID
KYC stands for “know your customer.” It is the point where an online casino stops treating you as a screen name and starts treating you as a specific adult with a legal name, a date of birth, a verified address and, at a licensed US operator, a taxpayer identification number. Every regulated US casino does this. So does every serious offshore book. The difference is not whether they ask, but which law governs the answer and who audits the file afterward. If you are still choosing where to play, our comparison of blackjack sites for US players covers the licensing side of the same question.
Most players meet KYC at the worst possible moment. You register in 90 seconds, deposit $200, run it to $1,400 at the blackjack tables over two sessions, hit the cashier, and only then does a message ask for your driver’s license, a utility bill and the last four of your Social Security number. It reads like the casino inventing obstacles because you won. Usually it is not. It is the same check that would have run silently at signup if the electronic lookup had matched, deferred to the cashier because nothing was leaving the account until then.
One boundary first. This page covers ROUTINE verification: the standard document set collected at registration and at first withdrawal from an ordinary recreational player. It does not cover enhanced due diligence, the deeper demand for proof of income or wealth triggered by volume, a very large win or an anti-money-laundering flag. That lives on our page about source of funds requests. Simple test: if you are asked to prove who you are, you are on the right page. If you are asked to prove where your money came from, you are not.
On This Page
- The Legal Basis: A Licensed Operator Has No Discretion Here
- Every Document You May Be Asked For, and Why
- What a Passing Scan Looks Like
- Timing: Signup Versus First Withdrawal
- The Social Security Number Question
- How Long It Takes, and What an Abnormal Delay Looks Like
- What Goes Wrong, and How to Fix Each One
- Sites That Advertise “No KYC”
- Where Routine KYC Ends and Enhanced Due Diligence Begins
- Regulated Versus Offshore: What Happens to Your Documents
- Practical Privacy and Security Steps
- What Happens If You Refuse or Cannot Verify
- Normal First-Withdrawal KYC Versus a Genuine Stall
- The Acronyms You Will See
- A Checklist Before You Deposit Anywhere
- KYC Verification FAQ
- A Note on Playing Within Your Limits
What you need to know about casino KYC
- KYC means “know your customer”: the point where an operator confirms your legal name, date of birth, address and, at a licensed US site, your taxpayer identification number
- Every regulated US casino does it, and so does every serious offshore book. What differs is which law governs the file afterward and who audits it
- The legal root is 31 C.F.R. Part 1021, which requires a written anti-money-laundering program including customer identification and verification
- Most players never see a request at signup, because a multi-source electronic check clears silently. The upload prompt surfaces at first withdrawal instead
- The document universe is finite: photo ID, proof of address, Social Security number, payment-method proof, bank statement, selfie or liveness check
- Most first-attempt failures are image problems, not eligibility problems
- Blackjack players hit this harder, because a low house edge turns a $200 deposit into a $1,400 balance faster than slots does
- Verify on day one, before you deposit. A verified account withdraws inside the operator’s advertised window
The legal basis: a licensed operator has no discretion here
Support agents call KYC “our policy,” which is misleading. For a licensee it is a stack of federal and state obligations with almost no room to waive anything for an individual.
The Bank Secrecy Act and 31 C.F.R. Chapter X
A US-licensed casino with gross annual gaming revenue above $1 million is a “financial institution” under 31 C.F.R. Section 1010.100(t)(5), and falls under Part 1021 of 31 C.F.R. Chapter X, administered by the Financial Crimes Enforcement Network. Every online casino in New Jersey, Pennsylvania, Michigan, West Virginia, Delaware, Connecticut and Rhode Island clears that threshold easily, because each runs on the license of a land-based or tribal operator that already does.
Section 1021.210 requires a written anti-money-laundering program with specified minimum contents: internal controls, independent testing, staff training, a compliance officer, transaction monitoring, records procedures, and procedures “for using all available information to determine” a customer’s name, address and Social Security number, including verification. That clause is the legal root of the upload request in your inbox.
Section 1021.410 requires the casino to record name, permanent address and Social Security number for anyone whose account it opens, whose deposit of funds it accepts, or to whom it extends credit, with additional duties above $2,500 of credit and $3,000 in monetary instruments. It also answers the standard player objection: if the casino made a reasonable effort and still could not get the number, it is not in violation, provided it keeps a list of those customers’ names and addresses for the Treasury on request. Federal law does not force you to surrender an SSN. It forces the operator to try, to document your refusal, and to put you on a list. Most resolve that by declining to pay out an incomplete account.
| Federal rule | Trigger | What it makes the operator do |
|---|---|---|
| 31 C.F.R. 1021.311 | Cash in or cash out of more than $10,000 in a gaming day | File a Currency Transaction Report naming the customer |
| 31 C.F.R. 1021.320 | A transaction of at least $5,000 the casino suspects involves illicit funds, structuring or no lawful purpose | File a Suspicious Activity Report within 30 days, and never tell the customer it did |
| 31 C.F.R. 1021.410 | Account opening, deposit of funds, credit above $2,500, instruments of $3,000 or more | Record and retain name, permanent address and SSN |
| 31 C.F.R. 1021.210 | Always | Maintain the AML program, including customer identification and verification |
Two consequences for a blackjack player. The non-disclosure rule in Section 1021.320 is genuinely why support sometimes cannot explain what is happening with your account. And because online play is card and bank funded rather than currency, the $10,000 currency threshold rarely bites directly; what does is the aggregate view, since a $9,000 bankroll assembled from 11 small card deposits looks different to a monitoring system than one $9,000 wire.
Note too that casinos have no formal Customer Identification Program rule of the kind banks operate under Section 326 of the USA PATRIOT Act. Their duty is the looser “all available information” standard, and each licensee writes its own procedure and files it with its state regulator. That is why one licensed site never asks you for anything and another wants a selfie on day one. Both can be fully compliant.
State licensing conditions, age and exclusion screening
Federal law sets the floor; states set the specifics, and the specifics are stricter.
New Jersey
N.J.A.C. 13:69O-1.3 requires an operator to hold a patron’s verified legal name, verified date of birth, verified residential address with a post office box expressly unacceptable, and the verified full or last four digits of the Social Security number where voluntarily provided. The same rule requires verification that the patron is at least 21, is not self-excluded, is not on an exclusion list and is not otherwise prohibited, and directs operators to use multi-source authentication as the primary verification method. It also bars vendors from retaining patron account information without the permit holder’s express written consent.
Pennsylvania
Pennsylvania works through internal controls: under 58 Pa. Code Section 811a.2 every interactive gaming certificate holder must file with the Pennsylvania Gaming Control Board a written procedure for authenticating the age, identity and physical address of an account applicant and for determining whether the applicant is prohibited.
Michigan
Michigan’s Mich. Admin. Code R. 432.651a is blunter: identity must be verified before an account exists or a wager is placed, only a person 21 or older who is not prohibited may hold an account, and third-party verification vendors are expressly permitted.
Our page on state gaming regulators covers who enforces this where. Every regulated US online casino state sets the minimum age at 21, not 18, which is why a self-declared birthday is never sufficient on its own; see our guide to the legal blackjack age for the detail.
Exclusion screening is the part players overlook, and it is why weak identity data counts as a compliance failure rather than a nuisance. Self-exclusion lists match on identifiers, so the operator needs identifiers good enough to match. Pennsylvania’s Chapter 815a requires an enrollee to supply full name plus aliases and nicknames, date of birth, current address, telephone number, SSN or its last four on a voluntary basis, a physical description covering height, gender, hair and eye color and identifying marks, government photo identification and a photograph, with terms of one year, five years or lifetime. Michigan runs a statewide Responsible Gaming Database that licensees must query. Register under a nickname and an old address and you have handed the operator a record too weak to match against any of it. Operators also screen names against the Specially Designated Nationals list kept by the Office of Foreign Assets Control, and larger groups run politically exposed person screening. Common names produce false positives, and a false positive is one of the quieter reasons an ordinary account sits in review for a few extra days.
Every document you may be asked for, and why
There is no universal list, because each licensee writes its own approved procedure. But the universe is finite.
| Document | What it is for | What makes a submission pass |
|---|---|---|
| Government photo ID | Establishes at once that you exist, that you are 21 or older, and that a face is attached to the account | Unexpired on the day you submit it. Both sides of a license, because the reverse carries the barcode and security features. A passport is normally accepted as a single page |
| Proof of address | The address is a regulatory data element, not a delivery detail, and New Jersey’s rule expressly refuses a post office box | Third-party issued, showing your full legal name and the complete address exactly as the account shows it, dated inside the operator’s window, typically three months and occasionally six |
| Social Security number | Federal recordkeeping, tax reporting, identity matching and exclusion screening | The last four at registration; the full nine only when a reportable payment or a failed electronic match makes it necessary |
| Proof of the payment method | Answers whether the instrument that funded the account belongs to you, since operators are barred from handling third-party funds | A card image showing your name, the first six digits, the last four digits and the expiry, with the middle digits and the security code physically covered before you photograph it |
| Bank statement | In routine KYC it serves one of two narrow purposes: proving your address, or proving the withdrawal account is yours | Bank letterhead, your name, your address, the statement date, the last four of the account and the specific casino transaction line if that is what is in question. Everything else may be blacked out |
| Selfie or liveness check | Binds the document to a living person present at that moment, the defense against a stolen or purchased ID scan | The automated version where offered. The manual version needs a photo of you holding the ID plus a handwritten note showing the date and site name |
The utility bill in the wrong name
Utility bills are both the most accepted and one of the most rejected address documents, for a mundane reason: many households have the bill in one name. If the electricity is in your spouse’s name it proves nothing about you. Use a bank statement, a tax notice or a vehicle registration instead, and do not expect a reviewer to infer a household relationship, because they are trained not to.
The cellphone bill trap
Usually rejected as proof of address, since prepaid mobile accounts open at any address. Also rejected: anything you printed yourself rather than a third party issued, and anything outside the operator’s date window. A statement with the address cropped off fails for the same reason.
Never a full card number
Cover the middle digits and the security code physically with tape before you photograph the card, not with a digital edit afterward, because the unedited original may sit in a ticketing system for months. No legitimate operator needs a full card number, because the processor already holds the token.
Government photo identification
The anchor document, requested almost universally. Accepted: state driver’s license, state non-driver ID card, US passport or passport card, military ID, permanent resident card. It establishes at once that you exist, that you are 21 or older, and that a face is attached to the account. Operators usually want both sides of a license, because the reverse carries the barcode and the state’s security features; a passport is normally accepted as a single page. It must be unexpired on the day you submit it, the most common avoidable rejection there is. The IRS instructions for Form W-2G tell a payer to identify a reportable winner using two forms of identification, one bearing a photo, treating a completed Form W-9 as an acceptable non-photo document. That cage procedure is part of why online operators default to one photo ID plus one supporting record.
Proof of address
The address is a regulatory data element, not a delivery detail, and New Jersey’s rule expressly refuses a post office box. Accepted: a utility bill for electricity, gas, water, landline or broadband; a bank or credit card statement; a property tax notice; a state or federal government letter; a lease or mortgage statement; an insurance schedule; a vehicle registration; a voter registration card. Usually rejected: a cellphone bill, since prepaid mobile accounts open at any address; anything you printed yourself rather than a third party issued; and anything outside the operator’s window, typically three months and occasionally six. The document must show your full legal name and the complete address exactly as the account shows it, so a statement with the address cropped off fails.
Proof of the payment method
Identity proof answers whether you are who you say. Payment proof answers whether the instrument that funded the account belongs to you. Operators are barred from handling third-party funds, so the second question needs its own answer.
For a card, the standard request is an image showing your name, the first six digits, the last four digits and the expiry date, with the middle digits and the security code on the reverse covered. Cover them physically with tape before you photograph the card, not with a digital edit afterward, because the unedited original may sit in a ticketing system for months. Never send a full card number; no legitimate operator needs one, because the processor already holds the token. Our page on card deposits at blackjack sites covers the funding side. For ACH or bank transfer the proof is a statement header or an in-app profile screenshot showing your name, the bank and the last four of the account. For an e-wallet it is the wallet profile page showing the registered name and email, which must match the casino account. Crypto has no payment-method proof in the conventional sense, which is one reason crypto deposits often coexist with heavier identity checks elsewhere; our Bitcoin deposit guide covers that trade-off.
Bank statements
In routine KYC a bank statement serves one of two narrow purposes: proving your address, or proving the withdrawal account is yours. Redact heavily for either. What is legitimately needed is the bank letterhead, your name, your address, the statement date, the last four of the account number, and the specific casino transaction line if that is what is in question. Unrelated transactions, your balance and your salary line are not needed and you may black them out. If an operator refuses a redacted statement and demands a complete unredacted document showing every transaction, you have crossed into enhanced due diligence whether or not the agent said so.
Selfie or liveness check
A selfie holding your ID, or an automated check that asks you to turn your head or blink on camera, binds the document to a living person present at that moment. It is the defense against a stolen or purchased ID scan, and it has spread as forgery kits have become cheap. The manual version asks for a photo of you holding the ID plus a handwritten note showing the date and site name, which makes the image useless elsewhere. The automated version runs inside a vendor’s software, captures a short video and returns a match score in seconds. Take the automated route when offered: it is faster, and the image usually never reaches a human support queue at all.
Social Security number
Requested by essentially every licensed US operator, often as the last four digits at registration and the full nine only when a reportable payment or a failed electronic match makes it necessary. Because the regulated and offshore answers here diverge sharply, it gets its own section below.
What a passing scan looks like
Most first-attempt failures are image problems, not eligibility problems. A human working a queue or a machine scoring a match will fail an ambiguous image rather than guess.
What makes a scan pass
- All four corners inside the frame with a margin of background. A cropped edge reads as concealment
- Flat on a dark, plain surface. A document held in the hand curls and shadows
- Indirect natural light, no flash. Flash on a laminated license blows out exactly the fields the reviewer needs
- One frame for the whole document, not two halves stitched together
- Color, never grayscale or a black and white photocopy
- The original camera file, typically 1 to 10 megabytes. Not a screenshot of a photo, and not something a messaging app has compressed
- Every character of the name, date of birth, address, document number and expiry legible at full size
- No filters and no auto-enhance. Editing an identity document image is itself a fraud signal
- For a passport, the full machine-readable zone, the two lines of characters at the bottom, inside the frame
Why submissions get rejected
- An expired document, the most common avoidable rejection there is
- A cut-off edge
- Glare over a field
- A name that does not exactly match the account
- An address that does not match
- A document outside the date window
- A screenshot or a heavily compressed file
- A payment image redacting too little or too much
- A selfie that does not clearly show both face and document
Timing: signup versus first withdrawal
Verification is two events, not one, and the split explains nearly every complaint players have about it.
Verified at signup
- The operator runs an electronic check the moment you register
- Your name, date of birth, address and SSN go to an identity vendor that matches them against credit header files, public records, telecom and utility data
- If enough independent sources agree, the account passes silently and you never see a document request
- New Jersey’s rule naming multi-source authentication as the primary method confirms this is the intended design, not a shortcut
- It fails for ordinary reasons: a thin credit file, a recent move, a recent marriage that straddles two surnames, several adults sharing one mailing address, or a credit freeze blocking the header lookup
- When it fails, the account routes to manual document review
Triggered at first withdrawal
- A second layer runs regardless of how clean signup was
- It is about the payment leg rather than the identity leg
- That funds are leaving to an account belonging to the same verified person who deposited
- That the closed-loop rule is satisfied
- That no chargeback or bonus flag is open
- That any tax identification needed for reporting is on file
- This is the upload prompt most players remember as “the KYC”
| Stage | What is checked | What you usually see |
|---|---|---|
| Registration | Name, date of birth, address, SSN match; age 21; exclusion lists; sanctions screening; state eligibility | Nothing, if the electronic match clears. A document request if it does not. |
| Deposit | Payment instrument in your own name; not a third party; location inside a permitted state | Usually nothing. Occasionally a card image request. |
| First withdrawal | Full document set, payment ownership, closed-loop routing, bonus and wagering compliance, tax identification | The upload prompt most players remember as “the KYC” |
| Adding a payment method | Ownership of the new instrument | A fresh proof request for that method only |
| Document expiry | Whether the ID on file is still valid | A re-verification prompt, sometimes years later |
| Periodic or risk-triggered review | Refreshed identity data, responsible gambling interventions | An unexpected mid-play request |
| Enhanced due diligence | Income, employment, origin of wealth | Requests well beyond identity, covered on the source of funds page |
Whether you can play while verification is pending varies. Most licensed operators let you deposit and play immediately on a provisional account and hold only the withdrawal, which is precisely how players end up with a large balance and an unverified file. A few block play until the check clears.
The blackjack pattern nobody warns you about
Blackjack players hit this harder than slots players, for structural rather than sinister reasons. Blackjack has a low house edge, roughly half a percent under good rules with correct basic strategy, so session swings are large relative to expected loss. A slots player who deposits $200 typically grinds down. A blackjack player who deposits $200 can be sitting on $1,400 by Tuesday, and that larger, faster balance is exactly what pushes a first cashout across a payout review threshold.
Add the bonus layer. Blackjack is usually excluded from bonus wagering entirely, or contributes at a reduced weighting around 10 percent, as our page on wagering requirements explains. A player who took a welcome offer and then played blackjack has triggered a bonus review on top of the identity review, and the two arrive as one wall of requests. It feels targeted. It is two independent automated checks landing together.
Verify on day one, before you deposit
The fix is simple and almost nobody does it: verify while nothing is at stake. A verified account withdraws inside the operator’s advertised window. An unverified account starts that clock only when the last accepted document lands, which can add a week you will blame on stalling. Our fastest payout guide makes the same point from the cashier side: published payout speeds always assume a verified account.
The Social Security number question
No part of KYC generates more resistance from Americans, and the resistance is not irrational. You are handing the single most abusable number you own to a gambling website over the internet.
Four reasons a licensed US site asks, any one of which would be sufficient
- Federal recordkeeping. Section 1021.410 directs the casino to record the number when it opens an account, accepts a deposit of funds or extends credit, and Section 1021.210 names it in the customer identification element
- Tax reporting. Where a payment is reportable the payer needs a correct taxpayer identification number, and the W-2G instructions require backup withholding at 24 percent on winnings that meet the reporting threshold and are not already subject to regular gambling withholding. Our page on blackjack and taxes covers the reporting picture in full, including the important point that ordinary blackjack hands do not generate a W-2G at all
- Identity matching. Verification vendors match far more reliably with the number than without, so supplying it at signup is the single strongest predictor that you will never be asked for a document
- Exclusion and prohibited-person screening, which matches on identifiers rather than names alone
A licensed operator has no discretion here, and neither do you get compelled
Many licensed operators ask only for the last four at registration and escalate to the full nine when a reportable payment or a failed electronic match makes it necessary. New Jersey’s rule text refers to the entire number or the last four, framed as voluntarily provided, which reflects the federal reality: the operator must make a reasonable effort and document a refusal, but cannot compel you. What it can do, and routinely does, is decline to open the account or process the withdrawal until the record is complete. Regulators permit that. Refusing the number also does not make money untaxed; it can make 24 percent of it vanish at the point of payment while you wait for a refund at filing.
Offshore is different in kind. A casino licensed in Curacao or Panama has no US information-reporting duty, files no W-2G, does no backup withholding, and is not a Bank Secrecy Act financial institution because it is not licensed or authorized to operate in the United States. When an offshore site asks for your SSN it is not acting under US law; it is acting on its own compliance policy or a payment processor’s demand. You can more reasonably decline, and many offshore sites will verify you on a passport plus an address proof without ever asking. But your tax obligation is unchanged. Gambling winnings are taxable income to a US person whether or not a form was issued, and the absence of an SSN on file simply moves the entire reporting burden onto you. Our page comparing regulated and offshore blackjack sites develops the wider contrast.
How long it takes, and what an abnormal delay looks like
No US state puts a statutory clock on document review, which is exactly why it becomes a dispute. What exists is a set of practical norms.
When a delay stops being normal
The point at which each step is running abnormally long with no substantive update.
| Step | Normal | Getting slow | Abnormal |
|---|---|---|---|
| Electronic check at signup | Seconds to minutes | Under 24 hours | Past 48 hours with no explanation |
| Automated liveness or document scan | Under 5 minutes | A few hours | More than 24 hours |
| Manual review, regulated operator | 24 to 72 hours | 3 to 5 business days | Past 7 business days with no substantive update |
| Manual review, offshore operator | 24 to 72 hours | Up to 7 days | Past 10 days, or repeated resets of the queue |
| Re-review after fixing a rejected document | 24 to 48 hours | 3 business days | Longer than the original review took |
| First withdrawal, already verified | Same day to 3 business days for approval, plus the payment rail | 5 business days | Beyond the operator’s own published maximum with no reason given |
Weekends matter more than players expect, because compliance teams are staffed on business days and a Friday evening upload is a Monday morning review. So does volume: a heavily promoted weekend or a major sports event pushes the whole queue back, including the casino side of a combined sportsbook operation.
What goes wrong, and how to fix each one
The name does not match
The account must carry your full legal name as printed on the ID, middle initial and suffixes included. Fix it before uploading anything: most operators correct an obvious typo during initial verification, while the same request after a large win draws far more suspicion.
You registered with a nickname
To a matching engine, Mike is not Michael, Bill is not William and Tony is not Anthony. This is the most common self-inflicted verification failure in the United States. Ask support to amend the account to the legal name and attach the ID in the same message, so correction and proof arrive together.
A maiden name or recent name change
If your ID shows a maiden name and your bank statement a married name, neither document is wrong and the mismatch will still fail. Send a linking document, meaning a marriage certificate, divorce decree or court order, and state explicitly which name is on which document and why. A reviewer with an unexplained two-name file rejects; one with an explained file approves.
The address does not match
Usually you moved and updated one side but not the other. Update the account address first, then supply a proof issued after the update. If no document exists at the new address yet, ask what the operator accepts in the interim; a vehicle registration, state tax notice, jury summons or insurance schedule often clears where a utility bill cannot. This can also stall the separate location check covered on our page about geolocation and state boundaries, and playing through a VPN compounds it, because a location contradicting your stated address is itself a flag.
An expired document
No workaround and no discretion, even by one day. Use a different unexpired document; a passport card or state non-driver ID is usually the fastest replacement, and some operators accept a temporary paper license paired with the expired card.
A third-party payment method
The hardest failure to recover from, because it is not a documentation problem. Depositing with a card or bank account in someone else’s name, including a spouse or parent, breaches the terms of essentially every licensed operator and most offshore ones. The deposit typically returns to its actual source and derived winnings are voided. Consent from the account holder does not help, because the rule exists precisely to stop that arrangement bankrolling a self-excluded or underage player or laundering funds. Our page on voided winnings covers how these decisions get made and what can be appealed.
A shared IP address or household
Two adults playing legitimately in one house look identical to one person running two accounts for a double bonus, because duplicate-account systems flag shared device fingerprints, IP addresses and physical addresses. Disclose it before the flag fires: tell support another verified adult in the household holds an account, that they are separate people with separate payment instruments, and offer both sets of identification. Never share a device or a card between the two, because that turns a soft flag into a hard closure. If an account is already frozen on this basis, our page on account closures sets out the escalation path.
A blurry, cropped or altered image
Re-shoot rather than re-send. If the same document fails twice, ask which specific field could not be read, because the rejection notice is a generic template and support can normally see the reviewer’s actual note.
Sites that advertise “no KYC”
A category of offshore, usually crypto-only casinos market themselves on requiring no verification at all. Some do genuinely let you deposit, play and withdraw on nothing but a wallet address. Understand the trade you are making. There is no regulator, no license worth the name in many cases, and no identity record binding the operator to pay you specifically. The same absence of a file that protects your privacy also means nothing establishes that the winning account is yours if it is compromised, and no authority anywhere will hear a complaint. Our page on gambling licenses and what they actually guarantee covers how to check what is behind a badge.
“No KYC” is frequently “no KYC until it matters”
In practice many such sites also reserve the right in their terms to demand full verification at any time, which in a dispute means at the exact moment you request a large withdrawal. The account that never asked for a document while you were depositing can ask for the full set on the day you try to take a four-figure balance out.
Where routine KYC ends and enhanced due diligence begins
Everything above is the routine layer, and for most recreational blackjack players it is the whole story: verify once, never think about it again. A separate and much heavier process sits on top, triggered by patterns rather than by the act of withdrawing. Sustained deposit volume, a single unusually large win, rapid deposit and withdrawal cycling with little play in between, funding from a jurisdiction the compliance team treats as high risk, or an unresolved monitoring alert all move an account into enhanced due diligence. The requests change character: instead of asking who you are, the operator asks where the money came from, and the document set becomes pay stubs, employment letters, tax returns, investment statements, sale contracts or inheritance papers. Different documents, different timelines, different escalation paths, and very different implications if you decline.
Regulated versus offshore: what happens to your documents
This part of the conversation gets either whitewashed or catastrophized. The documents are identical. The legal regime governing them afterward is not remotely so.
A licensee in New Jersey, Pennsylvania, Michigan, West Virginia, Delaware, Connecticut or Rhode Island holds documents inside a framework a state agency inspects. Internal controls covering patron data are filed with and approved by the regulator, as Pennsylvania’s Section 811a.2 requires, and retention is mandated, in Pennsylvania at a five-year minimum under Section 811a.8. Vendor handling is restricted: New Jersey bars a vendor from retaining patron account information without express written consent, and an identity-verification vendor must itself hold a Pennsylvania interactive gaming service provider certification or registration under Chapter 807a before it can touch the data. State breach notification statutes apply and a state attorney general has jurisdiction. Several live states, including New Jersey, Connecticut, Delaware and Rhode Island, also have comprehensive consumer data privacy statutes in force that add access and deletion rights on top; Pennsylvania, West Virginia and Michigan have not enacted comparable general privacy laws as of August 2026. None of that makes a breach impossible. It makes a breach a legal event with an owner, a notification duty and an enforcement authority.
An offshore site sits outside all of it. No US regulator has audited its data handling, no state attorney general can compel it to tell you about a breach, and no US court is a practical forum. Curacao did rewrite its framework in December 2024 with the National Ordinance on Games of Chance, known as the LOK, replacing the old 1993 arrangement in which four private master licensees resold sublicenses with a system where the Curacao Gaming Authority issues licenses directly, and adding requirements on disclosure of data storage methods, incident reporting for breaches compromising player data, and free access to independent dispute resolution. That is a real improvement on the master-license era. It is still a regulator on a Caribbean island with limited resources and no obligation to an American player, and the transition has been contested enough that any specific claim about a given site’s license status is worth checking rather than assuming.
Regulated: your documents
- Held inside a framework a state agency inspects
- Internal controls covering patron data are filed with and approved by the regulator
- Retention is mandated, in Pennsylvania at a five-year minimum under Section 811a.8
- New Jersey bars a vendor from retaining patron account information without express written consent
- An identity-verification vendor must itself hold a Pennsylvania certification or registration under Chapter 807a before it can touch the data
- State breach notification statutes apply and a state attorney general has jurisdiction
- New Jersey, Connecticut, Delaware and Rhode Island add access and deletion rights through comprehensive consumer privacy statutes
Offshore: the concrete risk
- Your document set, a photo ID plus an address proof plus often a card image, is a complete package for opening credit in your name, sitting on a server you cannot audit under a security standard nobody has verified
- If it is breached you may never be told, because no notification duty runs to you
- The same documents are frequently held by one platform operator behind several brands, so a single compromise exposes you across sites you never joined
- Support ticketing systems and email are common storage locations by accident, so a passport scan can live in a helpdesk archive indefinitely
- You have no realistic mechanism to demand deletion and no leverage if the answer is no
The honest ledger
Millions of Americans have sent documents offshore without incident. The point is not that harm is likely, it is that you have no recourse if it happens, and you should price that in before deciding which document set you are willing to send where. The risk is narrower than “they will sell your ID,” and it is also real: no US regulator has audited the data handling, and no state attorney general can compel anyone to tell you about a breach.
Seven states have live regulated online blackjack, with Maine passed but not launched
New Jersey, Pennsylvania, Michigan, West Virginia, Delaware, Connecticut and Rhode Island license operators whose document handling a state agency inspects. Maine has passed a law that has not launched. If you are somewhere else, the offshore trade-off on this page is the one that applies to you.
Practical privacy and security steps
Seven habits that protect the document set you send
- Use the secure upload portal, never email or live chat. Documents sent through an in-account upload page land in an access-controlled compliance system. One emailed to support or dropped into a chat window ends up in a helpdesk ticket a far wider group of employees can read, retained on a different schedule. If an agent asks you to email a passport scan, ask for the portal instead; if there genuinely is not one, treat that as information about the operator
- Redact before you photograph, not after. Tape over card digits and the security code, an opaque strip over unrelated statement lines. Digital redaction on a phone can be reversible, and the unedited original usually syncs to a cloud album anyway
- Never send a full card number, a visible security code, a PIN or a banking password. No legitimate operator asks for a banking password or a one-time passcode. That request is fraud regardless of how the message looks
- Write the purpose into manual selfies. A handwritten note showing the date and site name makes the image useless to anyone who obtains it later
- Give the account a unique password and enable two-factor authentication. It is now the most valuable account you hold there, because it is attached to a payout method
- Keep your own record. In a dispute, “I sent proof of address on August 4 through the account upload page” is a far stronger position than “sometime last week”
- Watch for phishing afterward. The window right after you submit is when a fake follow-up asking for “one more document” is most likely to work. Log in directly rather than following an emailed link
What happens if you refuse or cannot verify
Nobody can force a document out of you, and the operator’s response follows a predictable sequence. First the account is restricted: play may continue but withdrawals will not process, and many operators block deposits too. Second, if the impasse persists the account is closed and the balance is handled under the terms. The general and legally sensible outcome for a genuinely unverifiable account is that deposited funds return to the original source of payment while winnings are withheld, because paying out to an unverified person is the exact thing anti-money-laundering rules exist to prevent. Third, in a regulated state the operator files whatever its procedures require, and it is barred from telling you if one of those was a suspicious activity report.
Being unable to verify is a worse category than refusing. If your legal name and address genuinely match no record, if your only ID lapsed and a replacement is months out, or if a credit freeze is blocking the lookup, say so directly and early. Lifting a freeze for the 48 hours around verification resolves a surprising share of these, and asking what alternative document combination the operator’s approved procedure permits resolves most of the rest, because there almost always is one.
If you are in a regulated state and believe a refusal to pay is unjustified rather than a genuine verification failure, you have a remedy offshore players do not: a complaint to the state regulator, which licenses and can discipline the operator.
Normal first-withdrawal KYC versus a genuine stall
The single most useful skill here is telling a compliance process working as designed from an operator using compliance language to avoid paying. They look identical for the first few days and diverge sharply after that.
| Signal | Normal KYC | Genuine stall |
|---|---|---|
| The request list | Specific and finite; you are told exactly what is needed | Open-ended; each submission produces a new requirement never mentioned before |
| Rejection reasons | Concrete and fixable, naming a field or a document fault | Vague. “Not clear enough” repeated on a legible document, no field identified |
| Timeline | A window is quoted and roughly kept, or an update explains the delay | The clock restarts from zero with each new document, indefinitely |
| Relation to the win | The same process would have run on a $50 withdrawal | Requests appear only after a large win, or scale with the amount |
| Consistency | Support answers match the terms and match each other | Different agents state different requirements, or cite terms not on the site |
| The account meanwhile | Restricted from withdrawal only | Balance quietly reduced, bonus retroactively voided, or limited to further play only |
| Escalation | A named compliance contact or a regulator complaint route is offered | Escalation requests are ignored or looped back to first-line chat |
A workable rule of thumb: two rounds of document requests is normal, because the first often surfaces a mismatch the second resolves. A fourth or fifth round, each introducing a requirement not previously mentioned, is not verification. At that point stop sending documents, put the full request history in writing, and escalate. In a regulated state that means the gaming regulator. Offshore it means the license authority’s dispute channel and, under the Curacao LOK framework, the independent alternative dispute resolution service operators are now required to offer free of charge.
The acronyms you will see
| Term | Meaning |
|---|---|
| KYC | Know your customer, the routine identity verification described on this page |
| AML | Anti-money laundering, the federal program at 31 C.F.R. Part 1021 that KYC serves |
| CDD and EDD | Customer due diligence and enhanced due diligence, the routine and escalated tiers |
| SoF and SoW | Source of funds and source of wealth, the enhanced-tier proofs |
| POI and POA | Proof of identity and proof of address, the two core routine documents |
| CTR and SAR | Currency transaction report and suspicious activity report, the filings behind the questions |
| PEP | Politically exposed person, a screening category that triggers extra review |
| MRZ | Machine-readable zone, the coded lines at the bottom of a passport page |
| TIN | Taxpayer identification number, for most US individuals the Social Security number |
A checklist before you deposit anywhere
Do this on day one, while nothing is at stake
- Register with your full legal name exactly as printed on your government photo ID, middle name and suffix included
- Use your current residential address, not a post office box and not the address on an old document
- Supply the SSN or its last four at a licensed US site. It is the fastest route to a silent electronic pass and it avoids backup withholding later
- Upload the ID, an address proof dated within three months, and a redacted payment-method image on day one, before depositing
- Fund the account only from an instrument in your own name
- Confirm the withdrawal will route back to that same instrument before you take a bonus or start playing
- Save confirmation of every upload, with dates
None of this is legal, tax or financial advice. Regulations, operator procedures and reporting thresholds change, and the details of your situation matter. Verify anything affecting a filing at IRS.gov or with your state gaming regulator, and talk to a qualified professional where real money turns on the answer.
KYC verification FAQ
Why does an online casino want my Social Security number?
Four independent reasons stack up at a licensed US operator. Federal recordkeeping under 31 C.F.R. Section 1021.410 directs the casino to record the number when it opens an account, accepts a deposit of funds or extends credit. Tax reporting needs a correct taxpayer identification number where a payment is reportable. Verification vendors match far more reliably with the number than without. And exclusion and prohibited-person screening matches on identifiers rather than names alone.
Can I refuse to give my SSN?
Federal law does not force you to surrender it. It forces the operator to make a reasonable effort, to document your refusal, and to keep a list of those customers’ names and addresses for the Treasury on request. What the operator can do, and routinely does, is decline to open the account or process the withdrawal until the record is complete. Regulators permit that.
Why did KYC only start after I won?
Usually it did not. It is the same check that would have run silently at signup if the electronic lookup had matched, deferred to the cashier because nothing was leaving the account until then. Blackjack players hit it harder than slots players because a low house edge produces larger, faster balance swings, which pushes a first cashout across a payout review threshold.
How long should verification take?
A manual review runs 24 to 72 hours at both regulated and offshore operators, and an automated liveness or document scan should finish in under 5 minutes. It is abnormal past 7 business days at a regulated operator with no substantive update, or past 10 days offshore. Weekends matter, because compliance teams are staffed on business days and a Friday evening upload is a Monday morning review.
Why was my utility bill rejected as proof of address?
Most often because the bill is in another household member’s name, which proves nothing about you. Reviewers are trained not to infer a household relationship. Cellphone bills are usually rejected too, since prepaid mobile accounts open at any address, as is anything you printed yourself or anything outside the operator’s window of typically three months.
Can I deposit with my spouse’s card?
No. Depositing with a card or bank account in someone else’s name, including a spouse or parent, breaches the terms of essentially every licensed operator and most offshore ones. The deposit typically returns to its actual source and derived winnings are voided. Consent from the account holder does not help, because the rule exists precisely to stop that arrangement bankrolling a self-excluded or underage player or laundering funds.
Is it safe to send my documents to an offshore casino?
Millions of Americans have done so without incident. The point is not that harm is likely, it is that you have no recourse if it happens. No US regulator has audited the data handling, no state attorney general can compel a breach notification, you have no realistic mechanism to demand deletion, and the same documents are frequently held by one platform operator behind several brands.
Do casinos that advertise “no KYC” really skip it?
Some genuinely let you deposit, play and withdraw on nothing but a wallet address. But many reserve the right in their terms to demand full verification at any time, which in a dispute means at the exact moment you request a large withdrawal. “No KYC” is frequently “no KYC until it matters.”
A note on playing within your limits
Verification friction has a way of turning a bad week into a worse one, because a held withdrawal tempts players to keep the balance in play rather than take it off the table. If you find yourself depositing again while a payout is pending, that is worth noticing. Set deposit and loss limits at registration, when being sensible costs you nothing. Should the fun go out of it, call 1-800-GAMBLER, free and staffed around the clock, or see our responsible gambling resources for state helplines, self-exclusion routes and blocking tools. Enrolling in self-exclusion uses the same identity data this page describes, and in every regulated state it is free and it is enforced against the licensee rather than against you.
USA Blackjack Sites is an independent informational guide to blackjack sites for USA players. We may earn a commission from some of the sites we list, at no extra cost to you, which does not affect our rankings. The verification rules, federal regulation citations, state licensing conditions, reporting thresholds and operator procedures on this page were researched for 2026 and change frequently; each licensee writes its own approved procedure and files it with its state regulator, so the exact documents you are asked for will vary. This page covers routine identity verification only and is informational, not legal, tax or financial advice. Verify anything affecting a filing at IRS.gov or with your state gaming regulator. You must be 21 or older to gamble at a regulated site. Gambling problem? Call 1-800-GAMBLER.
