Sooner or later a casino cashier stops being a payment screen and starts asking for a photograph of your passport. The request has a name, Know Your Customer, and the timing of it is the single biggest practical difference between a British-licensed site and an offshore one. On a Gambling Commission licensee the check lands before your first pound goes in. Elsewhere it tends to arrive at the moment you ask for money back, with a balance already stuck behind a review queue.
What a KYC check covers
A verification check confirms three narrow facts: that you are a real, identifiable person, that you are at least 18, and that the account and the payment method behind it genuinely belong to you. Nothing more profound than that. Operators run it through a mixture of electronic data lookups and human review of uploaded documents.
Running alongside it is a second set of obligations usually labelled AML, anti-money-laundering, which looks less at who you are and more at where your money came from and whether the pattern of play makes sense. The two get bundled together in support e-mails, and the distinction matters when a request escalates from “send us your driving licence” to “send us three months of bank statements”. The first is identity. The second is money.
Why casinos are obliged to ask
Gambling firms sit inside the scope of the Money Laundering Regulations 2017, which require them to identify customers, apply due diligence proportionate to the risk, monitor transactions and keep records of what they checked (1). Record-keeping under those rules runs to five years after a business relationship ends, which is why a casino that has verified you once still holds the files long after you have stopped playing.
Age verification is a separate legal duty with the same mechanism, and commercial self-interest piles on top of both. Card schemes penalise operators that process payments for stolen cards. Payment providers walk away from merchants with high chargeback rates. A self-exclusion or a deposit cap is only enforceable against a person the operator can actually recognise, so the same check that feels intrusive at signup is what stops a blocked account being recreated with a fresh e-mail address an hour later.
The British rule that differs
Here is the part most guides skate over. Under the Commission’s licensing framework, known as the LCCP, a licensee must verify a customer’s name, address and date of birth before that customer is allowed to deposit money or gamble, and the same gate applies to free-to-play versions of its games (2). Verification at a British site is therefore part of opening the account, not a hurdle bolted onto the exit.
An offshore operator licensed somewhere lighter has no such condition on it. The commercial logic pushes the other way: a frictionless signup gets more deposits, so the documents are requested at the first withdrawal instead, once there is money in the account and a reason for the customer to co-operate. Firejackpots falls into that second category, licensed offshore rather than in Britain, and what that costs a player here is unpacked in our breakdown of what that licence does and does not cover.
| Stage | Gambling Commission licensee | Typical offshore casino |
|---|---|---|
| Identity checked | Before the first deposit | At the first withdrawal |
| Play allowed while unverified | Not permitted, demo games included | Usually yes |
| Money at stake during the check | None, nothing is deposited yet | Whole balance |
| Published timing commitment | Rules enforced by the regulator | Rarely published |
| Escalation if the check stalls | Free dispute resolution, binding | Operator, then its regulator |
What a deferred check costs
Deferring verification is not neutral. It shifts the whole risk of a failed check onto the player, after the money has moved.
Three things go wrong in that order. Your deposit is already spent or staked, so a rejection on a name mismatch arrives when the balance can no longer be simply handed back. The withdrawal sits frozen while a reviewer works through a queue nobody has given you a time for. And any bonus wagering clock keeps running through the hold, so an offer with a seven-day expiry can quietly lapse while you wait for an answer about a utility bill.
There is a safer-gambling cost too, and it is the one worth taking seriously. Somebody who has registered with GAMSTOP is blocked from every British-licensed site automatically, because those sites know who their customers are before play begins. A casino that checks nothing until payout can accept that same person, take deposits for weeks and only discover the problem at the end. If limits and blocks are part of how you keep play under control, the tools in our guide to deposit caps, time-outs and self-exclusion only work where identity is established up front.
Documents and what each proves
The requested set barely varies between operators, because they are all answering the same regulatory questions. What changes is how fussy the reviewer is about each item.
| Document | What it proves | What the reviewer looks for |
|---|---|---|
| Passport or UK driving licence | Identity and age | In date, four corners visible, no glare across the photo page |
| Bank statement, council tax or utility bill | Residential address | Issued within three months, full name and street address on the same page |
| Card image or e-wallet screenshot | Ownership of the payment method | Name and expiry legible, middle digits covered |
| Payslip, bank statement or sale contract | Where the money came from | Requested on larger balances, has to tally with deposit sizes |
| Selfie, sometimes a short video | That the document holder is you | Even lighting, face unobscured, no filters or heavy crops |
A British passport is the path of least resistance because it answers identity and age in one file and is designed to be machine-read. A provisional driving licence works at most operators but trips more manual reviews.
Proof of address in practice
This is where more submissions fail than anywhere else, and almost always on the date. The convention across the industry is a document issued within the last three months, so a council tax bill from the start of the financial year is worthless by autumn even though nothing about your address has changed.
What reliably passes: a bank or building society statement, a council tax demand, a gas, electricity or water bill, a mortgage statement. What often does not: a mobile phone bill, anything addressed to a previous occupant, a tenancy agreement with no issue date, and paperwork showing a correspondence address that differs from the one on your account.
Download the PDF from your online banking rather than photographing a screen or sending a cropped screenshot. A genuine statement PDF carries the bank’s own formatting and page numbering, and reviewers treat it as stronger evidence than an image of a phone display. Send the whole first page, including the header with your name and address, even if the transaction lines feel private. Blanking individual transactions is normally fine. Blanking the header defeats the point of the document.
Proving the payment method
Deposit with a debit card and you can expect a request for a photograph of it. The convention is to leave the first six and last four digits showing and cover the eight in the middle, which lets the operator match the card to the transaction without holding a usable number. Keep the cardholder name and expiry date visible, since those are the fields being matched. On the reverse, cover the three-digit security code completely. No legitimate verification team needs it, and any request for the full long number or your online banking password is a fraud attempt rather than a compliance step.
For an e-wallet the equivalent is a screenshot from inside the account showing the registered e-mail address or account ID and your name. Balances and transaction history can be cropped out. The point is to tie the wallet to the person, nothing else.
Source-of-funds requests
Source-of-funds sits a level above identity and catches people off guard because it feels like an audit. Technically, that is what it is. Where deposits are large relative to what the operator knows about you, or where the pattern looks irregular, the Money Laundering Regulations require more than a passport (1). Acceptable evidence is ordinarily a payslip, an employment contract, several months of bank statements, documentation of pension or benefit income, or completion paperwork from a property or vehicle sale.
Two practical points. Redaction has a floor: you can hide unrelated transactions, but if you black out the salary credits on a statement submitted to prove salary, it proves nothing and comes back. And refusing outright is not a negotiating position. The duty sits on the operator in law, so declining the request generally means the funds stay where they are indefinitely. If a cash-out has already stalled, our notes on chasing a held payout and getting an account unstuck cover what to send and in what order.
What to hide, what to show
Redaction is the thing people get backwards, covering the fields that matter and leaving exposed the ones that do not. The rule of thumb: anything that identifies you stays, anything that could be used to spend your money goes.
| Detail | Hide or leave visible | Reason |
|---|---|---|
| Middle eight digits of a card | Hide | Enough remains for matching, not enough to transact |
| Three-digit security code | Always hide | Never needed for any verification check |
| Cardholder name and expiry | Leave visible | These are the fields matched against the account |
| Name and address on a statement | Leave visible | Covering them removes the only thing being proved |
| Unrelated transaction lines | Safe to hide | Irrelevant to identity, unless funds are the question |
| Passport machine-readable zone | Leave visible | Automated reading of it is what clears you fastest |
| National Insurance number | Hide where possible | Not a gambling verification field at all |
Why uploads get rejected
Rejections are mundane. Nine in ten come from a handful of fixable errors rather than anything about you.
- Glare and shadow. A photograph taken under a ceiling light bounces a white patch across the laminate and hides exactly the line the reviewer needs.
- Cropped corners. Filling the frame feels tidy and fails the check, because a missing corner means a missing security feature.
- Expired documents. A driving licence two months past its date proves who you were, not who you are.
- Name mismatches. A married name on the bank statement and a maiden name on the account is enough on its own. Fix the account details first, then upload.
- Screenshots instead of statements. A phone screenshot of a banking app is not a statement, carries no issue date and gets bounced at most operators.
- Stale address documents. Anything outside the three-month window, however legible.
Photograph documents flat on a dark surface in daylight, with the flash off and the camera parallel rather than angled. That one habit removes most of the list.
How long the review takes
Honest answer: timings vary so widely that any single number quoted as typical is marketing rather than information. At a British-licensed site the identity stage is usually invisible, because those three data points are checked against electronic records during registration and most accounts clear in seconds. Documents only come into it when that automated match fails or when the account triggers a risk rule later.
Offshore operators are the opposite case. Verification is a manual queue, staffed to whatever level the operator chooses, and very few publish a service commitment you could hold them to. Treat the absence of a stated turnaround as the real finding. An operator confident about its review times tends to print them.
What Firejackpots publishes
On this specific operator I can only report what is verifiable from outside, and verification turnaround is not part of it. The operator does publish its document requirements, and they were read on 20 October 2026: proof of identity, proof of payment, and a proof of address issued within the last 90 days, with a selfie alongside the document possible on request. What is still missing is any figure for how long a review takes. Rather than borrow a plausible-sounding number from an affiliate page, the accurate statement is that the timing is unknown and should be assumed to be slower than a British site rather than faster.
What follows from that is a planning point, not a verdict. Assume documents will be wanted at the first cash-out, have them ready before depositing, and size that deposit accordingly. The published weekly payout ceiling and the method-by-method detail are covered in our look at how money moves in and out of the cashier.
Your rights under UK GDPR
Handing a passport scan to a company registered 4,000 miles away deserves more thought than it usually gets. UK data protection law travels with the data to an extent: an operator targeting British customers is processing personal data about people in the UK, and the ICO is the regulator that oversees how that is done.
Two rights do most of the work. A subject access request entitles you to a copy of the personal data an organisation holds about you, ordinarily free and answered within one month (3). The right to erasure lets you ask for data to be deleted, with conditions attached (4). Alongside those sits a transparency duty that is easier to use than either: a privacy notice has to tell you what is collected, why, and how long it is kept. If a casino’s notice gives no retention period for verification documents, that silence is itself informative, and it is a fair thing to raise with support before you upload anything.
Where erasure stops
Erasure is not a delete button, and overstating it does readers no favours. The right does not apply where an organisation needs the data to comply with a legal obligation, and anti-money-laundering record-keeping is precisely that (4). A gambling operator can lawfully refuse to delete your identity documents while its statutory retention period runs, five years from the end of the relationship under the 2017 regulations (1).
The same logic protects a self-exclusion. An operator has to keep enough information to recognise an excluded person, otherwise the exclusion collapses the moment you ask to be forgotten. What you can reasonably expect is a clear answer about which categories are being retained, on what legal basis, and for how long, plus deletion of anything held beyond that, such as marketing profiles.
Taking a complaint to the ICO
Data complaints and gambling complaints run down different tracks, and mixing them wastes weeks. A dispute about a withheld payout is a gambling matter, and at an unlicensed-in-Britain operator it ends with that operator’s own regulator rather than a UK body. A dispute about how your documents were handled is a data matter, and that one does have a British route.
Put the complaint to the operator first, in writing, addressed to its data protection officer or privacy contact, and give it a month. If the reply is unsatisfactory or absent, the ICO takes complaints from the public and can investigate how an organisation handled personal data (5). Keep expectations calibrated: the ICO can act on data handling and cannot order anyone to release your balance. Those are two separate problems that happen to arrive in the same support thread.
Before your first deposit
Five minutes of preparation converts verification from an ambush into paperwork.
- Photograph your passport or driving licence flat, in daylight, before you need it, and save the file where you can find it in a hurry.
- Download a current statement or bill as a PDF, checking the issue date falls inside the last three months.
- Match your account details to your documents exactly, including middle names, hyphens and the format of your address.
- Deposit and withdraw with the same method wherever possible, since a mismatch invites a second round of checks.
- Read the privacy notice for a retention period before uploading anything, and keep a note of what you sent and when.
A final word on the opposite approach. Sites marketed on anonymity, the ones advertising that no documents are ever needed, are not a workaround to recommend: an operator running no checks has also given itself no reason to pay out a balance it can dispute, and there is no regulator to escalate to when it decides not to. Verification is friction with a purpose, and the friction is on the side of the player far more often than it feels like at the time.
Frequently asked questions
Why does a British site verify before a first deposit?
Licence conditions require it. Holders of a British gambling licence have to establish who a customer is, and that they are 18, before taking money or allowing play.
Which photo ID clears fastest?
Passports, because the machine-readable strip is designed to be scanned automatically. A full UK driving licence is the next best option for most operators.
How recent does a proof of address need to be?
Three months is the industry convention. Older bills are refused even when nothing about the address has changed, so download a fresh statement instead of resending.
Should card digits be covered before uploading?
Yes. Mask the middle eight digits and the security code, leaving the first six, the last four, your printed name and the expiry legible.
Does a screenshot of a bank statement pass?
Rarely. Screenshots lack the issue date and formatting reviewers check for, so download the statement as a PDF from online banking instead.
What counts as source-of-funds evidence?
Payslips, an employment contract, recent statements, a pension or benefits letter, or the completion paperwork from selling a house or a car.
Can a casino refuse to delete verification documents?
Yes, lawfully. Retention of money-laundering records is a legal obligation, and erasure rights give way to it until the statutory period expires.
Who regulates how gambling firms handle ID data?
The Information Commissioner’s Office. Complaints go to the operator’s privacy contact first, then to the ICO if the response is inadequate or missing.
Are Firejackpots verification timings published?
No published figure exists, and the operator blocks our IP range, leaving its document-upload flow and review queue unverified at first hand.
Sources
- (1) Money Laundering Regulations: your responsibilities, gov.uk. the customer due diligence, monitoring and record-keeping duties that oblige gambling firms to identify their customers.
- (2) Licence conditions and codes of practice, Gambling Commission. sets the customer identity verification condition that British licensees must satisfy before a customer deposits or gambles.
- (3) Your right to get copies of your data, ICO. how a subject access request works, what it costs and how quickly an organisation has to reply.
- (4) Your right to get your data deleted, ICO. the right to erasure and the legal-obligation grounds on which an organisation may lawfully keep records.
- (5) Make a complaint, ICO. the route for raising how an organisation handled your personal data once the organisation itself has been asked.