The integration between player identity verification and payment processing is one of the most technically sensitive areas of iGaming compliance. Regulators require that operators verify player identity — and in the case of financially vulnerable players, source of funds — before or promptly after certain payment thresholds are reached. The practical challenge is implementing these verification gates without creating conversion-killing friction for the majority of players who are low-risk and compliant. This balance between regulatory obligation and commercial optimisation defines the architecture of modern iGaming verification and payment systems.
Regulatory Framework for Verification Timing
The UK Gambling Commission has progressively tightened its requirements on when operators must verify player identity. Under the LCCP Social Responsibility Code Provision 3.2.12 (effective 2019 and subsequently strengthened), operators must verify the age and identity of players before they are permitted to deposit. Prior to this change, operators were permitted to accept deposits from unverified players up to a threshold, with verification required before the first withdrawal.
The current standard requires age verification before deposit — not just registration. This means the payment gateway must be gated: a player cannot reach the deposit screen unless their age has been verified. The verification must be effective, not nominal — a checkbox asking a player to confirm they are over 18 does not constitute age verification under the LCCP. Verification must use either documentary evidence (passport, driving licence) or reliable third-party data sources (credit bureau age verification, Open Banking identity check).
Source of funds (SOF) verification is triggered at higher deposit thresholds. The UKGC's enhanced player protection requirements introduced in 2024 require operators to conduct enhanced financial checks on players who reach defined cumulative spending thresholds — the specific trigger levels are set in the UKGC's guidance following the Gambling Act Review White Paper consultations. Above these thresholds, the operator must obtain and assess evidence of the player's financial position before continuing to accept deposits.
Verification Methods and Their Payment Integration
Document-Based KYC
Traditional document verification — scanning a passport or driving licence and comparing against the player's registered details — is processed through KYC providers such as Jumio, Onfido, or Shufti Pro. These providers perform optical character recognition on the document image, check for tampering indicators, and may require a biometric liveness check where the player photographs their face to confirm the document belongs to them.
Document-based KYC introduces latency into the onboarding flow — if the operator holds the deposit until verification is complete, players may abandon. Industry practice has moved toward allowing a small initial deposit while verification is processing, with a hard gate preventing further deposits until verification is complete. The payment gateway must implement this logic: deposit number one is permitted pre-verification; deposit number two requires verification to be complete before processing proceeds.
Open Banking Identity Verification
Open Banking deposits via PISPs provide a natural identity signal: the player authenticates with their bank using biometric verification, and the payment instruction comes from an account in the player's name. The bank's authentication is a high-confidence identity assertion — the bank has already performed KYC on its account holder. Many operators now use Open Banking data (via AISPs — Account Information Service Providers) as a primary or supplementary identity verification method, with the IBAN of the player's verified bank account serving as a persistent identity anchor for subsequent payment method additions.
This approach reduces document upload friction significantly. A player who deposits via Open Banking has effectively verified their identity through their bank's authentication, and operators can configure their verification framework to treat a successful Open Banking deposit from a named personal account as satisfying the age and identity verification requirement — subject to the operator confirming no GAMSTOP or sanctions issues on the linked identity.
Financial Vulnerability Checks
The Gambling Act Review White Paper (April 2023) introduced the concept of financial vulnerability checks — using credit reference data to identify players whose deposit patterns suggest they may be gambling beyond their financial means. The UKGC consulted on specific trigger amounts, with the implemented requirements including checks triggered by defined monthly net deposit thresholds.
The payment infrastructure must integrate with credit reference agency APIs (Experian, Equifax, or TransUnion) to perform real-time affordability checks when a player reaches the trigger threshold. These checks are not traditional credit checks — they do not affect the player's credit file and are not underwriting decisions. They are instead signals about financial vulnerability: indicators of county court judgments, recent defaults, or thin file status that may indicate the player is in financial difficulty.
Where the check returns a vulnerability signal, the operator's responsible gambling team must intervene before further deposits are processed. The payment gateway must hold pending deposits from flagged accounts in a pending state while the compliance review occurs. Releasing held deposits without a compliance review effectively nullifies the purpose of the check.
Third-Party Payment and Identity Matching
A recurring compliance issue in iGaming payment processing is the acceptance of deposits from payment methods that do not match the player's verified identity. The UKGC's third-party payment prohibition (LCCP Licence Condition 6.1.2) requires withdrawals to go to the same payment method as deposits — a control designed in part to ensure that payment methods are linked to the verified account holder. But the same logic applies to deposits: accepting a deposit from a card or bank account in a different name from the verified player is an AML red flag.
The payment infrastructure should compare the name on the depositing payment method against the player's verified identity at each deposit. Where there is a mismatch — a player with verified identity "John Smith" attempting to deposit from a card in the name "Jane Smith" — the deposit should be flagged or blocked. This check requires name data from the card network (available for Open Banking bank account names) and identity data from the KYC verification, and the comparison logic must account for name variations, abbreviations, and middle name differences.
CCYFX provides specialist banking infrastructure for iGaming, crypto, FX brokers, and offshore structures. UK, European & US IBANs.
Speak to Our Team