Notifications
Clear all
Topic starter
25/06/2026 1:19 am
TL;DR: Gambling operators are under rising pressure to verify customers, monitor source of funds, and screen for sanctions as global fines reached at least $184.8 million in 2025, according to SumSub. The real issue is not whether KYC exists, but whether identity controls actually close the gap between onboarding checks and continuous risk monitoring.
NHIMG editorial — based on content published by SumSub: KYC in Gambling Explained: A Practical Operator Guide (2026)
By the numbers:
- Global fines in the gambling industry totaled at least $184.8 million in 2025 alone.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
Questions worth separating out
Q: How should gambling operators reduce fraud without weakening KYC?
A: Use layered verification, not a single check.
Q: Why do no KYC casinos create higher AML and fraud risk?
A: They remove the control that binds an account to a real person and a legitimate funding trail.
Q: How do you know if KYC monitoring is actually working?
A: Look for timely escalation of anomalies, consistent risk re-scoring, and documented FIU reporting when suspicion is reasonable.
Practitioner guidance
- Tie KYC to transaction provenance Require source-of-funds evidence, payment method ownership, and behaviour review to be assessed together so the account cannot pass onboarding while remaining financially unverified.
- Re-score customer risk after behaviour changes Create escalation rules that reopen due diligence when betting patterns, deposit volume, or withdrawal behaviour diverge from the original onboarding profile.
- Use layered identity proofing Combine document verification, liveness detection, and address or payment validation so synthetic identities cannot succeed by defeating only one control.
What's in the full article
SumSub's full article covers the operational detail this post intentionally leaves for the source:
- Jurisdiction-by-jurisdiction KYC and AML obligations for gambling operators that need implementation detail.
- Step-by-step onboarding flow elements such as document checks, age verification, and payment verification.
- Practical guidance on user retention, including how to reduce KYC friction without weakening assurance.
- Vendor evaluation criteria for choosing a casino KYC provider at implementation stage.
👉 Read SumSub's practical guide to KYC in gambling operations →
KYC in gambling: what identity teams should rethink now?
Explore further
25/06/2026 10:39 am
KYC in gambling is an identity governance problem disguised as compliance. The article describes identity proofing, source-of-funds verification, payment controls, and ongoing monitoring as separate steps, but the governance failure is unified: the operator cannot prove that the account stays bound to a legitimate person and legitimate money source across the customer lifecycle. That is the same lifecycle problem identity teams face in IAM and NHI programmes. Practitioners should stop treating onboarding as the finish line.
A few things that frame the scale:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to Ultimate Guide to NHIs , Lifecycle Processes for Managing NHIs.
- Our research also shows that 97% of NHIs carry excessive privileges, which broadens the attack surface when access is not continuously reviewed.
A question worth separating out:
Q: Who is accountable when gambling KYC fails?
A: Accountability sits with the operator, because licensing and AML obligations do not transfer to the customer. Regulators expect the business to verify identity, assess source of funds, monitor activity, and maintain evidence. If those steps fail, fines and licence exposure usually follow the operator, not the fraudster.
👉 Read our full editorial: KYC in gambling exposes the identity controls operators still miss
