Verification at a gambling site is a ladder, not a switch. There are roughly seven rungs, each demanding more of you than the last, and you are only ever asked to climb to the rung the operator currently needs. Most players at a site marketed as no KYC sit permanently on rung zero and never see the rest.
Knowing the full ladder is useful for one reason: it tells you what an operator can escalate to, how each step is triggered, and which steps you can prepare for now instead of scrambling for later while a balance sits frozen.
The seven levels at a glance
| Level | What is asked | What typically triggers it | Typical time to clear | What usually goes wrong |
|---|---|---|---|---|
| 0. None | Nothing. An account and a deposit address. | Default at no-KYC sites. | Instant | Nothing yet — but nothing is guaranteed either |
| 1. Contact | Email confirmation, sometimes SMS or 2FA | Registration, or before a first withdrawal | Minutes | Disposable email domains blocked; number already used on another account |
| 2. Self-declared identity | Name, date of birth, country, address typed by you | Cashier access, bonus claim, or a country-restriction check | Instant | Details typed casually now must match documents exactly later |
| 3. Document | Photo ID plus selfie or liveness video | A withdrawal threshold, a large win, a fraud flag | Minutes if automated and clean; days if referred to manual review | Glare, crops, expired document, name mismatch, unsupported document type |
| 4. Proof of address | Utility bill or bank statement, usually within 3 months | Country risk, address mismatch, higher cumulative volume | Hours to days — manual by nature | Wrong document type, out of date, name or address does not match the ID |
| 5. Source of funds / wealth | Payslips, bank statements, exchange history, tax documents | Large or fast-growing balances, deposit patterns, AML monitoring alerts | Days to weeks | You must obtain the evidence from third parties first; partial answers restart the loop |
| 6. Enhanced due diligence | Everything above plus written explanations and a compliance decision | High-risk profile, politically exposed person status, sanctions or adverse-media hit | Weeks, sometimes open-ended | No fixed checklist — it ends when a compliance officer is satisfied |
The rest of this article takes each rung in turn.
Level 0: no verification
You register, you receive a deposit address, you play. Nothing has been checked and, importantly, nothing has been promised. Note what this level does not mean: the operator still holds your email, your IP address, your device fingerprint and your deposit and withdrawal addresses, all of which are covered in what a no-KYC account still reveals.
The trigger for leaving level 0 is almost always the same event — a withdrawal request.
Level 1: contact verification
The lightest possible check. Confirm an email link, or a code sent by SMS. It establishes a channel to reach you and a weak uniqueness signal to make multi-accounting slightly harder.
Two things go wrong here. Disposable and forwarding email domains are frequently blocked, so an address you cannot receive mail at later is a problem you have created for yourself. And a phone number already attached to another account will link the two, which is precisely how multi-accounting cases begin.
Level 2: self-declared identity
The site asks you to type a name, a date of birth and a country of residence. Nothing is checked at this point. That is exactly why it matters.
Whatever you enter here becomes the baseline that documents are later compared against. A middle name omitted, a nickname used instead of a legal first name, or a country entered as where you are rather than where you are resident becomes a mismatch at level 3, and a mismatch is treated as a risk signal rather than a typo. Enter it as it appears on the document you would eventually upload.
This level is also where jurisdiction restrictions bite: the country you declare is checked against the operator’s restricted list, and a mismatch between the declared country and your IP address is one of the most common reasons a document request appears out of nowhere.
Level 3: document verification
The core of KYC. A photograph of a government-issued identity document — passport, national ID card, or driving licence — plus a selfie or a short liveness video to bind the document to the person submitting it.
Most of this is now automated. The document image is checked for tampering and for the machine-readable zone, and the selfie is matched against the photo page. When everything is clean the result comes back quickly. When anything is ambiguous the case goes to a human queue, and queue time is the variable that turns a five-minute process into a five-day one.
Failure modes are almost always mechanical rather than substantive:
- Glare or shadow across the photo page, or a flash reflection over the hologram
- Corners cropped out — most systems need all four corners and the full document edge
- An expired document, or one within weeks of expiry
- A document type the provider does not support for your country
- The name on the ID differing from the account name entered at level 2
- Screenshots or scans where a live camera capture is required
None of those are accusations. They are image-quality rejections, and the fix is a resubmission in better light. Where a rejection is substantive, you will usually be told nothing about why, which is a deliberate anti-fraud posture rather than an oversight.
Level 4: proof of address
Establishes where you live, which matters because residence determines jurisdiction, and jurisdiction determines whether the operator is allowed to serve you at all.
The standard request is a utility bill, bank statement or government letter showing your full name and full address, issued within the last three months. What routinely gets rejected: mobile phone bills, insurance quotes, anything addressed to a different name, cropped images that omit the letterhead or the date, and documents older than the stated window.
An address mismatch between this document and your ID is a genuine problem rather than a formatting one, and usually requires a written explanation.
Level 5: source of funds and source of wealth
This is the point where the exercise stops being about identity and becomes about money. Source of funds asks where the specific money you deposited came from. Source of wealth asks how you came to have money at all.
The evidence requested is documentary — payslips, bank statements covering a period, exchange transaction history, a contract of sale, a tax return, a grant of probate. Crypto deposits attract this more readily than card deposits, because an incoming transfer from an unhosted wallet carries no counterparty information and the operator has to reconstruct it from what you supply and what chain analysis shows.
This rung is slow for a structural reason: the documents are held by third parties, so the clock includes however long your bank or exchange takes to produce them. The full mechanism, including what a proportionate request looks like versus a fishing expedition, is set out in AML and source of funds checks.
Level 6: enhanced due diligence
Enhanced due diligence is applied to cases assessed as higher risk: unusually large volumes, a politically exposed person, a jurisdiction on a high-risk list, or a name that produces a sanctions or adverse-media hit.
There is no fixed checklist, which is the defining feature. EDD ends when a compliance officer records that they are satisfied, and it can involve written narrative explanations, ongoing monitoring, or a decision to close the relationship and return funds. Some outcomes at this level are not appealable in any practical sense, because the operator is not permitted to explain the reason for certain regulatory decisions.
Where the ladder actually stops for most people
For the overwhelming majority of players at crypto casinos, escalation stops at level 3, and it happens on the first withdrawal that crosses whatever internal threshold the operator has set. The full list of events that push you up a rung is in why no-KYC casinos still ask for ID, and the amounts involved are usually governed by the site’s withdrawal limit structure.
The preparation that actually pays off is unglamorous: hold a valid, unexpired ID; have a compliant proof of address you could produce today; register with a name matching that ID and an email you will keep; and know, before depositing, which rung the terms allow the operator to jump to. That last one is a ten-minute read of the terms, and it is worth doing while your balance is zero rather than while it is frozen.
Frequently asked questions
What are the levels of KYC verification?
Broadly seven: no verification, contact verification (email or phone), self-declared identity details, document verification (photo ID plus a selfie or liveness check), proof of address, source of funds or wealth, and enhanced due diligence. Each level is requested only when a trigger fires, so most players never see the upper rungs.
How long does casino KYC verification take?
An automated document and liveness check usually returns a result within minutes when everything matches. If it fails or is referred, it enters a manual review queue and can take days. Source-of-funds reviews take longest because you must obtain statements from banks or exchanges first, and the operator then reads them by hand.
What is the difference between KYC and enhanced due diligence?
Standard KYC establishes who you are. Enhanced due diligence establishes whether your money and circumstances are consistent with your activity. EDD applies to higher-risk cases — very large volumes, politically exposed persons, high-risk jurisdictions — and involves documentary evidence, written explanations and a compliance officer's judgement rather than an automated check.
Why does a casino want a selfie with my ID?
To bind the document to the person submitting it. A photo of an ID proves the document exists, not that you hold it. A selfie or a short liveness video is checked against the photo page to establish that the account holder and the document holder are the same person, and to detect a document that has been stolen or bought.
What counts as proof of address for a casino?
Typically a utility bill, bank statement, council tax bill or government letter showing your name and address, dated within the last three months. Mobile phone bills and screenshots of online banking are often rejected. The document must be a full page rather than a crop, and the name must match the ID exactly.
Can I refuse KYC and just withdraw to a different wallet?
No. Withdrawal requests are processed by the operator, not by you, and a pending verification request will normally block payout to any address. Changing the destination address mid-review is also a classic fraud signal and tends to escalate the review rather than bypass it.