KYC (Know Your Customer)

The account-opening check sits in section 169 of the Gambling Regulation Act 2024, which says a holder of a remote gambling licence shall not open an account until it has verified both the applicant’s identity and that they have reached 18. Under section 169(4) the player supplies a copy of a photo document showing name, address and date of birth, or a photo document showing name and date of birth together with two documents confirming the address, each issued within the previous six months.

Those address documents are defined narrowly in section 169(7): a utility bill, an insurance policy, or a document from the Revenue Commissioners or a Department of State, and the Authority may prescribe other means of verification under section 169(5).

The money-laundering side is older and runs on a different statute. Gambling service providers were made designated persons under the Criminal Justice (Money Laundering and Terrorist Financing) Act 2010 by regulations in 2018, which means they must apply customer due diligence where payments to or from a customer reach €2,000 in aggregate, whether in one transaction or a series that appear linked. Lotteries, bingo, gaming and amusement machines and land-based poker were left out of that regime after a risk assessment found them low-risk.

Two laws, two triggers.

Most players meet KYC twice: once at registration, when the operator asks for a passport or driving licence and a recent bill or bank statement, and again at the first sizeable withdrawal, when a payout that pushes the running total towards the €2,000 mark is held until the file is complete.

The Department of Justice guidance for designated persons says stakes or payouts of €2,000 or more must not proceed until due diligence is done and the documents retained, and that operators should begin tracking a customer’s spend once it reaches €200. Under section 33(2) of the 2010 Act, establishing the source of funds is a standard part of that diligence, so a request for payslips or a bank statement is the law working as written, not an operator inventing hurdles.

How quickly each operator processes documents, and which file formats or selfie checks it accepts, varies from one site to the next and is set out in its own terms rather than in statute. What I check first on any terms page is whether verification is demanded before the first deposit or only at withdrawal, because the second arrangement is where most of the complaints we read begin.

Enhanced checks apply where a customer is a politically exposed person, a close relative of one, or where transactions look unusually large or follow an odd pattern.

KYC is often treated as the same thing as anti-money-laundering compliance, but it is only one part of it: AML also covers business risk assessments, transaction monitoring and reporting suspicions to the Financial Intelligence Unit and the Revenue Commissioners, none of which the player ever sees.

The second confusion concerns licences. A site licensed by the Malta Gaming Authority, the Kahnawake Gaming Commission or a Curaçao regulator will run its own KYC under its own rules, and passing that check gives an Irish player none of the protections attached to a licence issued by the Gambling Regulatory Authority of Ireland, including its complaints route.

The commencement order signed by the Minister for Justice, which took effect on 5 February 2026, allowed the GRAI to begin issuing remote and in-person betting licences, and remote operators have needed one since 1 July 2026. The GRAI itself says some provisions of the Act await commencement, among them the National Exclusion Register and the rules on advertising and inducements, so you should confirm on the GRAI’s own register which licence an operator actually holds before uploading documents to it.