Reminder of identity verification requirements for remote operators
Our Director of Major Policy Projects and Evaluation Helen Rhodes and Senior Policy Officer Sarah Webster remind remote operators of their identification verification requirements.
Posted 12 August 2026 by Helen Rhodes, Sarah Webster
Drawing on findings from the Commission’s pilot of financial risk assessments, our casework and consumer complaints and research, this blog shares important lessons to support all remote operators to meet the existing identification requirements set out in Licence Condition 17. It is part of a series of blogs touching on issues connected with identity verification and transparency to consumers. By reinforcing existing identity verification requirements and setting out where improvements can be made, we aim to support operators in strengthening their processes to ensure the customer journey is as frictionless as possible.
Effective identity verification is vital to meet a number of legislative and regulatory requirements, including preventing underage gambling, identifying self-excluded customers, supporting anti-money laundering controls, reducing the risk of fraud, and helping to minimise customer complaints. Importantly, while strong identity verification at onboarding stage is fundamental to meeting regulatory requirements, it also has a significant impact on the consumer experience. This is a concern frequently raised by consumers, who express frustration at being asked to provide information to verify identity only when attempting to withdraw funds which emphasises how these practices are leading to negative consumer outcomes. Over a quarter of complaints from consumers that come into our Contact Centre are on this area. It is also one of the most common disputes referred to Alternative Dispute Resolution (ADR) providers. Any checks to verify identity could and should be undertaken as early as practicable in the customer journey to avoid unnecessary friction and delays at the point of withdrawal and thereby improve the overall customer experience.
Reminder of identity verification requirements
Licence Condition 17 has been in place for many years and sets out our rules for verifying the customer identity for remote operators. Identity verification processes must, at a minimum, provide assurance that a customer exists and that their name, address and date of birth all match to the same individual. Licensees must obtain and verify this information to establish the identity of a customer before that customer is permitted to gamble. A request made by a customer to withdraw funds from their account must not result in a requirement for additional information to be supplied as a condition of withdrawal if the licensee could have reasonably requested that information earlier.
Where these basic standards are not met, it not only undermines regulatory controls to protect the vulnerable and keep gambling crime free, but can create disruption in the customer journey, leading to frustration and a lack of trust in operators from consumers, particularly when additional checks are required later, such as at the point of withdrawal.
Findings
Findings from a range of sources suggest that some licensees are not meeting these existing requirements. This blog provides an opportunity for all remote licensees to revisit their processes to ensure that they are meeting the requirements effectively and can avoid compliance action.
Financial risk assessment pilot findings: One of the key objectives of the further analysis undertaken as part of the financial risk assessment pilot was to understand why a small proportion of customers were unable to receive a frictionless assessment; by this, we mean customers who were “unmatched” because their details could not be successfully matched to records held by the credit reference agencies used in the pilot. Encouragingly, only a small percentage of customer accounts in the pilot were unable to be matched by the credit reference agencies but we were still interested to explore what type of customers appeared in this “unmatched category” and what actions could be taken to ensure as frictionless a journey as possible.
Our analysis indicated that identity verification may be a key factor contributing to unmatched customer accounts. When reviewing cases where failed identity verification processes may have led to unmatched returns, we found that previous customer identification was sometimes based on incomplete or inaccurate information, as well as process gaps, even though these customers were the highest spending. These practices reduce the likelihood of successfully matching customer data with third-party sources and undermine effective identity verification. Examples included:
- only an initial recorded, with no full name
- use of a nickname instead of the legal name
- a commercial address provided instead of a residential address
- a combination of two or more of these issues.
This prompted some operators from the pilot to review their identity verification processes and make improvements.
Wider casework: We have also identified examples where customers were onboarded using a middle name in place of their forename, creating mismatches with records held elsewhere, such as GAMSTOP. This undermines the effectiveness of self-exclusion which relies on accurate customer identification.
We have seen some improvement in operator processes since our earlier blogs on the importance of conducting checks prior to a withdrawal request. However, we still see cases where uncertainty around identity verification or risk flags which emerged throughout the customer journey were only investigated at the point of withdrawal through additional checks, even where there was ample opportunity to do so earlier.
Call for action
The pilot findings suggest that, in some cases, unmatched records may originate from weaknesses in the information collected and verified at registration. This demonstrates that by improving upfront identity verification procedures, such as at registration, and meeting existing requirements properly, a better match rate could be reached. Our wider casework shows that reviewing and improving identity verification processes upfront can better protect consumers and operators.
While we recognise that many operators rely on third-party providers for identity verification, we are concerned by the differing levels of data sensitivity and robustness that these providers offer, combined with the differing levels of tolerance among operators. This can result in the use of 'fuzzy matching', where customers are onboarded on the basis of partial or equivocal verification of their credentials. This introduces risk across multiple regulatory areas, including contributing to unmatched data.
As stated in our 2019 consultation response which introduced Licence Condition 17, identity verification should at least be robust enough to give the licensee assurance that the customer exists and that their name, address and date of birth all link to the individual. We therefore want to be clear that onboarding customers based on incomplete or inaccurate information - particularly accepting initials instead of full names, nicknames, or commercial addresses in place of residential ones - is not sufficient to meet existing identity verification requirements. Similarly, onboarding a customer based on a middle name instead of a forename also risks failing to deliver the outcomes required by Licence Condition 17. Operators should ensure that they are capturing complete and accurate customer information at registration, applying verification standards that provide robust assurance, and avoiding over-reliance on permissive matching approaches.
We do not expect the equivalent of Enhanced Due Diligence (EDD) at the point of onboarding all new customers. However, operators should be as robust as possible at registration to assure themselves that they have verified a unique individual at onboarding and to minimise the risk of customer friction later in the customer journey. It is not appropriate to wait until a withdrawal request to follow up outstanding queries.
Ensuring that robust identity verification checks are carried out at the outset is one of the most effective ways to reduce friction for customers. The pilot analysis highlights an opportunity for operators to review and strengthen their registration and verification processes, improve compliance with existing requirements, and ensure the customer journey is as frictionless as possible. Operators must ensure that complete and accurate customer information is collected at registration, that their verification standards provide robust assurance of identity, meet the necessary requirements and that unresolved identity concerns are addressed promptly rather than deferred until later interactions with the customer. Taking these steps will not only support better and more transparent customer outcomes, but will also strengthen operators' ability to meet their wider regulatory obligations.
We will continue to review operator progress in this area and consider whether any further clarification or action is needed.
You can read more in this series of blogs:
Key issues and our expectations concerning account withdrawals
Exploring the topic of withdrawing funds from accounts and what the data shows
Financial risk assessments pilot – update on post-pilot analysis