Compliance Guide · 2026

KYC and AML onboarding for online casinos: a practical flow for operators

In October 2026, operators in Brazil had to give banks each customer’s remaining balance, identified by CPF taxpayer number, and the account used to deposit. That let banks return the money after the national ban on online betting and games. It only works when every account is tied to a verified person and a verified payment account. This guide sets out an onboarding flow that keeps that link intact, from sign-up to closure.

Identity and age before real money

The first rule of onboarding is order. Verify identity and age before a player can deposit or place a real-money bet, not at the first withdrawal. Play before verification creates two problems: possible underage gambling, and balances you cannot reliably return to a known person.

A typical flow collects name, date of birth, address and a national identity number at registration. It then checks them electronically against trusted data sources. If that fails, the player uploads an identity document and, where needed, proof of address. Ireland’s Gambling Regulation Act 2024 prohibits children from gambling and sets obligations to protect them online, so age is a hard gate.

The flow at a glance

The table is a general template. Thresholds, data sources and documents depend on your licence and market.

Tiered checks and source of funds

Checks should deepen as activity grows. A common design sets tiers by cumulative deposits or by balance. Basic verification happens at sign-up and enhanced checks at the next tier. High balances, or large amounts that move fast, trigger a source-of-funds review. Write the tiers into policy so every reviewer applies them the same way.

High balances draw attention from authorities, not only from your own team. In Brazil, high-balance accounts are to be examined for money laundering and links to criminal organisations. A source-of-funds file prepared while the balance grew is far easier to produce than one rebuilt under pressure.

Self-exclusion at sign-up and at every login

A self-exclusion check run only at registration misses players who exclude later. Check at sign-up, at every login and before any marketing message is sent. On a match, block play and deposits at once.

Maine shows where this is heading. Its third draft of online casino rules is dated 30 September 2026 and is not yet final. It provides for a third-party automated system that updates the self-exclusion list in real time, replacing email and fax notices and lists sent once a month. Build the check as a live lookup, not a nightly file import.

Payment methods and limits

Payment rules belong in onboarding, not in a separate project. Ireland’s Act bans credit cards as a payment method for gambling and provides for customer-set monetary limits online. Set allowed methods per market in the cashier, and offer limit-setting during registration rather than deep in account settings.

Require every method to be in the player’s own name, and record how ownership was confirmed. That record decides where money goes at withdrawal and at closure. In Brazil, an injunction of 8 October 2026 lets Stake operate until 25 October. Its conditions include keeping identification, age verification, AML and self-exclusion in place, and blocking banned people and welfare funds such as BPC and Bolsa Família.

Monitoring and suspicious activity reports

Transaction monitoring looks for activity that does not fit the player’s profile. Typical alerts cover deposits withdrawn with little play, rapid deposits from several methods, third-party payments and sudden jumps in stake size. Each alert needs an owner, a review and a recorded outcome.

Ireland’s Act places a duty on licensees to report suspicious gambling activity. Decide in advance who files reports, on what grounds and how quickly. Most AML regimes also restrict telling a customer that a report has been made. Monitoring is only as good as its data, so reconcile wallet, payment and game records first, as covered in casino API reporting and reconciliation.

Records, account closure and returning balances

Keep verification results, documents, reviews, alerts and reports for as long as your licence requires, linked to the account. Ireland’s Act also sets rules on online gambling accounts, account closure and refunds. Closure should follow a script: stop play, settle open bets, return the balance to a verified account in the player’s name and record the reason.

Brazil showed how large this can get. After the ban covered in our Brazil news, operators sent banks each balance and deposit account on 7 October. Banks were due to return funds from 9 to 14 October, with unpaid amounts moving to Caixa Econômica Federal from 14 October. In early October the Secretariat of Prizes and Betting reported R$1.325bn awaiting repayment to about 26.5 million bettors.

Who runs each step depends on your operating model, as set out in white label vs turnkey casino.

Sources: gov.ie press release, February 2026; G3 Newswire, October 2026; SBC Americas, 8 October 2026; Legal Sports Report, 7 October 2026.

Frequently asked questions