Four document families, one name that has to match across all of them, and a request that almost always lands at the worst possible moment: the day you ask for your money back. Identity verification is the one piece of casino admin that nobody reads about until it stalls a payout. Done properly, it is a twenty-minute job you do once.
This walkthrough covers how verification works at online casinos in general, what each document actually proves, and how to submit one so it passes on the first attempt. Where a rule needs a concrete anchor, we quote Golisimo’s own terms by clause, because its published wording is specific enough to show the general shape. Those clauses are one operator’s rules, not an industry standard.
What verification asks for
Verification asks an operator to establish three things: that you exist, that you are over 18, and that the money moving through the account is yours. The industry calls the process KYC, from “know your customer”, and the related money-laundering checks sit alongside it under the heading of customer due diligence.
It is paperwork, not suspicion. A casino asking for a passport scan is doing what a bank does when you open a current account.
The timing is what confuses people. Registration usually needs nothing more than an email address, a date of birth and a currency choice, so the account feels verified when it is only opened. Documents come later, triggered by a withdrawal, a deposit above a threshold, or a risk score from fraud-screening software running quietly in the background.
Why the law requires it
Anti-money-laundering law requires it, and the obligation sits on the operator rather than on you. Gambling businesses are treated as obliged entities under the European AML regime: they have to identify customers, keep records of that identification, monitor transactions for patterns that do not fit the customer, and report what looks suspicious. Failing to do that costs an operator its licence, so the request you receive is not optional on their side either.
Licensing conditions add a second layer. In Ireland the Gambling Regulatory Authority of Ireland sets the conditions a licensed operator has to meet, verification among them (1). Where no licence is published at all, as at Golisimo, KYC still happens, though it happens under the operator’s own contract rather than under supervision, and that difference matters when a check goes wrong.
Verified accounts also keep under-18s out and make self-exclusion stick once somebody asks for it.
The four document families
Four families of document cover almost every request you will ever see: photo identification, proof of address, proof that you own the payment method, and evidence of where the funds came from. The first two are near-universal. The third appears whenever a card or wallet is involved, and the fourth is reserved for larger or stranger activity.
| Document family | What counts | What gets rejected | Typical validity |
|---|---|---|---|
| Photo identification | Passport, national identity card, driving licence; full data page | Expired documents, cropped edges, greyscale scans, library cards, student passes | Must be in date on the day of upload |
| Proof of address | Utility bill, bank statement, council or tax letter showing name and street address | Mobile-phone bills at some operators, PO boxes, documents with the address blanked out | Usually dated within 3 months |
| Payment-method ownership | Card photo with middle digits masked, wallet screen showing your name, bank statement header | A different name on the rail, a fully masked card number, a third party’s account | Re-requested whenever a new rail is added |
| Source of funds | Payslips, employer letter, bank statements covering several months, sale or inheritance paperwork | Screenshots of a banking app balance, unexplained large transfers, crypto with no purchase trail | Commonly 3 to 6 months of history |
Photo identification
A passport is the easiest document to get accepted, because the machine-readable zone on the data page is what automated checks are built to read. A national identity card works as well, provided both sides go in. Driving licences usually pass, though a provisional one is weaker evidence and some compliance teams decline it.
The document has to be valid on the day you send it. An out-of-date passport fails even when the photograph is obviously you, since the check is on the document and not the face.
Proof of address
A proof of address has to show four things in one frame: your full name, the street address on your account, the issuer, and a date. A utility bill is the classic, a bank statement the most common, and a letter from a tax or local authority the most reliable of the three because it is hardest to forge.
Three traps catch people. Paperless billing buries the address on page two, so send the whole file. Plenty of operators refuse mobile-phone bills, on the grounds that a phone contract proves nothing about residence. And a statement with its transactions blacked out often comes back unreadable.
Payment-method ownership
Proving ownership of a rail is where most mismatches surface. For a card, the usual ask is a photograph of the front showing the first six and last four digits, the cardholder name and the expiry, with the middle digits covered and the CVV on the reverse hidden. For a wallet or a bank account, a screen or statement header carrying your name and the account reference does the job. Crypto deposits are different again: the evidence there is the exchange account in your name and the transaction hash, not the wallet address alone.
Golisimo’s terms put this squarely in the request list, asking for proof of ownership and transaction history of the payment methods used, including bank or card statements (2). Transaction history is the part readers miss. A photograph of a card proves the plastic exists; a statement proves the account behind it is yours and that the deposit left it.
Source-of-funds requests
A source-of-funds request asks you to explain where the money came from, not just who you are, and it is a different animal from ordinary verification. It is triggered by the shape of the activity rather than by any suspicion about your documents: deposits that are large relative to the account’s history, a sudden jump in stake size, funding from several unrelated rails, a big win heading for withdrawal, or a cumulative deposit total crossing an internal threshold.
What satisfies it is a paper trail connecting an income event to the money deposited: payslips with a matching bank credit, an employer letter, several months of statements, a sale contract, probate paperwork, or exchange records for crypto income. A screenshot of a balance proves nothing, because a balance carries no origin.
Refusing has one predictable consequence: the funds stay put. Operators cannot release money they are unable to account for, so the request outlasts your patience every time.
Photographing a document
Photographing a document well is mostly about light and framing, and a phone camera beats a flatbed scanner for this job. Lay the document flat on a dark, matte surface, stand directly over it rather than at an angle, and use daylight from a window instead of the flash, which bounces straight back off the laminate.
- All four corners inside the frame, with a visible margin of background around the document. A clipped corner is the single most common rejection reason.
- No glare across the photograph or the data line. Tilt the document a few degrees, not the camera, until the hotspot moves off the text.
- Colour, never greyscale. Security features such as holograms and tinted backgrounds only read in colour, and a mono scan looks like a photocopy of a photocopy.
- Nothing cropped out, including the machine-readable zone, the issuing authority and the expiry date. Crop the background, never the document.
- Under the upload limit. Limits vary by operator and are frequently not published, so if a file is refused, reduce the resolution rather than cropping the image.
- Both sides of anything that has two. Identity cards, driving licences and some residence permits carry the address or the issue data on the reverse.
We do not recommend submitting a cropped or screenshotted document. A screenshot strips the file metadata that automated checks use to tell an original photograph from an edited one, and a crop that removes a corner looks, to a compliance reviewer, exactly like a crop that removed something inconvenient. Both get bounced, and each bounce restarts the review clock.
Why the names have to match
Payment-method names have to match the registered account holder because third-party funding is the oldest laundering route in gambling and the easiest to police. If your partner’s card funds your account, the operator cannot evidence who owns the stake, which breaks the audit trail it is legally required to keep.
In practice the mismatches are innocent and the outcome does not change. A maiden name on an old card, a middle name on the passport but not at registration, a joint account, a shared family wallet. Each stalls a payout until it is reconciled, and a deposit from a rail that was never yours may go back to source instead.
Fix it at registration, where it costs nothing. Enter your name exactly as it appears on your identity document, including middle names and accents, and fund the account only from a rail in that name.
What one operator’s terms require
Golisimo’s terms set out a verification regime that is unusually explicit about timing, which makes it a useful worked example. We read version 1.12 of the operator’s rulebook, last updated 19 August 2026, and the relevant clauses sit in section 5 (2).
- Documents requested: certified identification, proof of residence, and proof of ownership plus transaction history for every funding rail on the account, statements included.
- Your deadline: 30 days. Supply everything inside that window, or the account faces suspension and permanent closure.
- Their target: usually 10 days after the request is answered in full, with complex cases taking longer.
- When checks run: around any deposit or any withdrawal, at the operator’s sole discretion.
- Who else is involved: credit reference agencies, identity verification services and fraud-prevention software.
- How far it can go: a phone call or a face check may form part of it.
That last point is worth preparing for rather than being surprised by. A face check means a live selfie or a short video, usually with a liveness prompt such as turning your head, and a call means somebody confirming details you registered with. Neither is unusual in 2026, though an operator that publishes no licence and no regulator is asking you to accept them purely on contract.
The asymmetry in the deadlines
The two deadlines in those clauses are not written the same way. Your 30 days is firm and carries a stated penalty: miss it and the account can be suspended and closed permanently. The operator’s 10 days is qualified with the word “usually”, and complex cases are explicitly allowed to run longer, with no outer limit attached and no remedy named if they do.
That is one operator’s drafting, and it is worth noticing before you need it.
From request to decision
The sequence from request to decision has five stages, and at each one the wait belongs to a different party. Knowing whose clock is running tells you whether chasing support will help or just add a ticket to a queue.
| Stage | Who is waiting | Typical duration | What moves it along |
|---|---|---|---|
| 1. Request issued | You | Same day it is triggered | Read the list in full before uploading anything |
| 2. Documents gathered and sent | You | Your choice, inside the stated window | Send every item in one batch, not one file at a time |
| 3. Automated screening | The operator’s software | Varies; often minutes | Nothing; a clean capture either passes or it does not |
| 4. Manual review | The compliance team | Golisimo states usually 10 days once answered in full | Answering any follow-up question the same day |
| 5. Decision or further request | Both | A new request restarts stage 2 | Treating a follow-up as a new deadline, not a formality |
Stage five is the one that ruins timelines. A partial reply does not pause the review, it resets it: send a passport on Monday and a utility bill on Thursday, and Thursday is the real start date.
Why checks get rejected
Rejections cluster around a handful of avoidable faults rather than your eligibility. Roughly in order of frequency: an edge outside the frame, glare over the data line, a name mismatch, a proof of address past the operator’s window, a greyscale capture, an expired document, and a reply that left one requested item out.
None of those is a judgement about you. All of them cost days.
One habit removes most of the risk: verify before you need the money. Nothing stops you uploading identification the week you open an account, while there is no pending withdrawal and no reason to feel rushed, and a cleared account turns a payout into a payments question rather than a compliance one.
What happens to the documents
Your documents become personal data the moment they are uploaded, and in the EU and the EEA the GDPR governs what happens next. An operator processing an identity document relies on legal obligation as its basis, which has a consequence worth understanding: the usual right to have data erased does not override a statutory duty to keep it.
Two rights are reliably useful. The right of access lets you ask what is held about you, including who it was shared with, and get a copy, normally inside a month. Rectification lets you correct an error such as a misspelled name causing a mismatch.
Erasure is the one with limits. AML record-keeping duties typically hold identification records for five years after a relationship ends, so a request to delete a passport scan inside that period is refused lawfully, and deletion comes at the end of the retention period rather than on demand. Where no regulator and no jurisdiction are named, no supervisory authority exists to escalate to either, which argues for being deliberate about what you upload.
When the check does not move
A stalled check needs a specific question, not a chase. Ask which document failed and which field in it failed: “please resubmit your identification” gives you nothing to act on, while “the expiry date is obscured” takes two minutes to fix. Keep the reference number and note the date of every upload.
If a payout is sitting behind the check, our page on what to do when verification stalls sets out the escalation path and the complaint route. And if the reason you are pushing for a cash-out is that the session stopped being fun, the independent help and blocking tools listed on our responsible gambling resources page are a better first call than support (3).
Common questions
What documents does casino verification need?
Verification normally needs photo identification, a proof of address under three months old, and evidence that the payment method belongs to you. Source-of-funds paperwork is requested separately.
How recent must a proof of address be?
Most operators accept a utility bill, bank statement or authority letter dated within three months, showing your full name, the registered street address and the issuer.
Can a screenshot of a passport be used?
No. Screenshots strip the metadata that automated checks read, and cropped captures hide the corners reviewers need. Photograph the original document flat, in colour.
Why must the card name match the account?
Name matching proves the stake is yours. Third-party funding breaks the audit trail an operator is legally obliged to keep, so mismatched deposits are often refunded to source.
What triggers a source-of-funds check?
Source-of-funds checks follow unusual activity: deposits that are large for the account’s history, several unrelated rails, a sharp rise in stakes, or a sizeable win awaiting payout.
Is a face check compulsory?
Face checks are optional for operators to use and compulsory for players once asked. Golisimo’s clause 5 allows either at the operator’s discretion.
Can identity documents be deleted afterwards?
Deletion usually waits. Money-laundering rules oblige an operator to keep the file for five years once an account closes, so erasure requests inside that window are refused.
Sources
- The Irish gambling regulator: the authority that sets identity and age-verification duties for operators licensed to serve players in Ireland.
- Section 5 of the Golisimo terms, on verification: one operator’s written rules on documents, deadlines, outsourced identity checks and the circumstances in which a call or a face check may be required.
- Gambling Therapy: independent live chat and email support in many languages, run with no connection to any operator.