Automated vs Manual KYC in iGaming: What FINTRAC, UKGC, MGA and FinCEN Accept

No regulator reviewed for this article prohibits automated identity verification, and none certifies a named KYC vendor. FINTRAC, the UK Gambling Commission, the Malta Gaming Authority and the US casino rules all accept electronic verification where the licensee can show it meets the regulator’s own outcome test, and in each regime the obligation sits with the licensee, not the vendor. The regimes differ in how prescriptive the method is (FINTRAC lists five), what must be matched (the UKGC requires name, address and date of birth to resolve to one individual), and what evidence must be kept.

This comparison rests on a read of the FINTRAC methods guidance, the UKGC Licence Conditions and Codes of Practice (LCCP, version effective 6 April 2026) and the Commission’s 12 August 2026 blog on identity verification, the MGA Compliance Audit Manual, 31 CFR Part 1021 as published on eCFR (current to 26 May 2026), N.J.A.C. 13:69O, and GLI-19 v3.0. Onfido, Jumio, Veriff, Trulioo and Sumsub do not appear in any of these texts, so the question is always what a vendor’s product does, not what it is called.

Do regulators accept fully automated identity verification?

Yes, with conditions. GLI-19 v3.0 states that third-party identity verification service providers may be used “as allowed by the regulatory body”, and requires the check to authenticate legal name, residential address and date of birth at a minimum, confirm the player is on no exclusion list, keep verification details secure, and complete before the player account becomes active. GLI-33 v1.1 uses the same structure for event wagering, with physical address and age as the minimum attributes. GLI-16 v3.0 adds a full or partial government identification number and permits further checks during the account lifetime where the operator has reasonable suspicion that identification has been compromised.

Those standards defer to the licensing regulator. The table below sets out how each regime treats automated checks as of October 2026.

In practice, regulators specify the outcome and the evidence, not the tool, so vendor selection is a risk decision the licensee must be able to defend.

What does FINTRAC’s dual-process method actually require?

The dual-process method is one of five methods FINTRAC allows for verifying a person: government-issued photo identification, credit file, dual-process, affiliate or member, and reliance. FINTRAC’s guidance sets no separate rules for software, so an automated tool is acceptable to the extent it executes one of the five methods and produces the records that method requires.

Under the dual-process method, the reporting entity does any two of the following: refers to a reliable source with the person’s name and address and confirms the match, refers to a reliable source with name and date of birth and confirms the match, or refers to a reliable source that confirms the person’s name and a financial account (deposit, prepaid payment product, credit card or loan). The two items must come from different sources, so two statements from the same bank cannot serve as separate categories. The source cannot be the person being identified, and social media is expressly not an acceptable source.

On mismatches, FINTRAC says a slight typo in a name or address can be judged a match, but an incorrect date of birth is more likely a non-match, in which case the information cannot be relied on and the entity must use a different source or method. In practice, a vendor workflow that auto-passes on fuzzy date-of-birth matches sits outside this guidance. Where a credit bureau acts as an aggregator, it must supply two independent tradelines that each confirm one category, and the tradelines cannot be the reporting entity’s own.

For the government-issued photo identification method, the document must be authentic, valid and current, issued by a Canadian government (or an equivalent foreign government), and show name, photo and a unique identifying number. When the person is not physically present, FINTRAC requires a process to authenticate the document. Its examples are a mobile-camera scan compared by technology against known characteristics and security features such as holograms, barcodes and watermarks, followed by a live video session comparing the person’s features to the photo on the authenticated document. The authentication step and the face-match step need not occur at the same time, but both must be completed. Document-and-selfie products are, in practice, the commercial form of this example.

Records differ by method. The government-ID method requires name, verification date, document type, unique number, jurisdiction and country of issue, and expiry date. The dual-process method requires name, verification date, the names of both sources, the type of information referred to, and an account number or associated number. The credit file method requires the name of the Canadian credit bureau or third-party vendor and the credit file number, and credit files from foreign bureaus are not acceptable.

Where a vendor makes the determination for the licensee, the agent or mandatary rules apply. The agent must use the government-ID, credit file or dual-process method, the licensee needs a written agreement, and it must record that agreement together with all the information the agent referred to and the information the agent confirmed as being the person’s. The reporting entity remains responsible for its identification obligations, and the compliance program review includes the agreements with agents or mandataries and a sample of the information they relied on.

FINTRAC enforcement reported in 2026 has concentrated on reporting and programme failures at provincial gaming corporations rather than on identification technology. According to press reports in September 2026, the New Brunswick Lotteries and Gaming Corporation paid $399,712.50 and the Nova Scotia Gaming Corporation $231,826 for failures to report suspicious transactions, and press coverage in July 2026 reported that Atlantic Lottery Corporation paid $212,025 for reporting, policy maintenance and risk assessment failures.

UKGC Licence Condition 17 and the cost of weak onboarding data

Licence Condition 17 requires remote gambling licensees to obtain and verify identity information, which must include at least name, address and date of birth, before a customer is permitted to gamble. The Commission’s 12 August 2026 blog restates the outcome test.

Identity verification processes must, at a minimum, provide assurance that a customer exists and that their name, address and date of birth all match to the same individual.

A withdrawal request must not trigger a requirement for additional information if the licensee could reasonably have requested it earlier, and licensees must take reasonable steps to keep identity information accurate. The condition’s text also says licensees should tell customers before a deposit which identity documents or information they may need. Separately, social responsibility code provision 3.9.1 requires procedures to identify separate accounts held by the same individual, which depends on reliable identity data.

The condition does not prescribe a method, so a licensee may use any combination of document, biometric or database checks that meets the match standard. According to iGaming Business, 13 August 2026, the Commission found that nicknames, initials and commercial addresses captured at onboarding left customers “unmatched” against credit reference agency records during its financial risk assessment pilot of 2024 to 2025, and that more than 25% of complaints reaching its Contact Centre concern identity verification. The Commission also criticised licensees that investigate identity flags and financial risk alerts only at withdrawal, noting this can contravene licence conditions and anti-money laundering legislation.

In practice, the consequence for automated KYC is a data-capture requirement. Free-text name fields, unvalidated address entry and permissive date-of-birth handling degrade the vendor’s match rate and then the downstream financial risk assessment. The same report says the Commission will roll financial risk assessments out in phases, with the phase one timeline to follow industry engagement. Press coverage of Tim Miller’s remarks in July 2026 reported that 97% of checks in the pilot’s second phase were frictionless.

In practice, an age-estimation tool that does not verify against an identity record does not discharge Licence Condition 17 by itself, because date of birth is one of the three attributes that must match.

MGA, Gibraltar, Denmark and France: automated by design, audited by evidence

The MGA does not name a digital identity scheme or approve vendors in the Player Protection Directive (Directive 2 of 2018), the Compliance Audit Manual (MGA/G/001) or the technical infrastructure guidelines reviewed, and acceptance is tested through audit. Section 6.17 of the Compliance Audit Manual directs auditors to obtain the licensee’s KYC procedures and test adherence, confirm that players register with date of birth, name, permanent residential address and a contactable email or mobile, run dummy registrations to confirm duplicates are blocked and play is impossible before email verification, check that the back office displays each player’s verification status, and confirm the licensee can quickly produce a secure list of registered players and copies of all verification documents. An automated tool must therefore expose its status and documents to the licensee’s own back office.

The MGA’s remote gaming technical infrastructure guidelines say acceptance of a proposal depends largely on risk assessment and that deviations from identified industry standards will be considered. They also state that responsibility for the regulatory principles “will remain that of the licensee at all times”. As of October 2026, an MGA FAQ records the Customer Due Diligence trigger under section 3.3.2 of the FIAU Implementing Procedures for remote gaming as EUR 150. Licensees should read the FIAU Implementing Procedures directly and take Maltese legal advice on how the split between the MGA and the FIAU applies to them. The MGA system audit requirements article covers the evidence pack auditors expect from the technology stack.

Gibraltar is the most explicit on automated versus manual. Its AML Code of Practice for Remote Gambling (2026 update) requires enhanced due diligence at registration or at the deposit following registration, “usually by way of background electronic identification methods”, completed by electronic or customer-facing “manual” methods. Section 18 of the Proceeds of Crime Act, cited in the code, addresses non-face-to-face customers.

Denmark treats identification as part of certified system design. Spillemyndigheden’s SCP.02.03 v2.0 requires the gambling system to ensure the customer is at least 18, check ROFUS, register the time identification data was received, and transfer registration data over an encrypted connection. Customers may play from a temporary account pending verification, with deposits limited to DKK 10,000 as of October 2026. In France, Décision 2023-187 provides that where electronic identification means under article R. 561-5-1 of the Code monétaire et financier are not implemented, the player must send a copy of an identity document within 30 days of requesting the account.

The Curaçao Gaming Authority’s AML/CFT policy names biometric checks as a permitted way to confirm that the person presenting a document is the person described, and permits cross-referencing with geolocation, IP address and funding-method data. It requires minimum identification (name, permanent residential address, date of birth) with PEP and sanctions screening at account opening, and full CDD at the NAf 4,000 threshold as of October 2026.

FinCEN and US state rules: no casino CIP rule, a reasonably designed programme

The Customer Identification Program rule under the USA PATRIOT Act applies to banks and similar financial institutions, and the casino rule in 31 CFR Part 1021 does not replicate it. Section 1021.210(b)(1) requires each casino to maintain a written programme “reasonably designed” to assure and monitor compliance, and section 1021.210(b)(2)(v)(A) requires procedures for using all available information to determine, when required, a person’s name, address, social security number and other information, “and verification of the same”. The text sets no method and no technology constraint, and any FinCEN guidance on digital identity sits outside the rule text and was not reviewed.

Under 31 CFR 1021.410(a), when funds are deposited, an account is opened or credit is extended, a casino must secure and maintain a record of the person’s name, permanent address and social security number, with a reasonable-effort exception where an SSN cannot be obtained. For non-resident aliens the record must include a passport number or a description of another government document used to verify identity. Section 1021.410(c) governs retention of required records in machine-readable form, which matters where a vendor holds the underlying images.

For online casino and sports wagering, the operative method rules are state rules. N.J.A.C. 13:69O-1.3(b) requires an electronic patron file with, at a minimum, legal name, date of birth, the entire or last four digits of the Social Security number (or foreign equivalent), account number, address, email address and telephone number. State regulators then rely on GLI-19 or GLI-33 for the verification function, where “as allowed by the regulatory body” applies. In practice, licensees should obtain written confirmation from each state regulator that the chosen vendor configuration is acceptable.

What must a licensee document about its KYC vendor?

A licensee must keep method-specific verification records and, where a vendor acts as agent or mandatary under FINTRAC guidance, a written agreement and the information the vendor relied on. Elsewhere the obligation is evidential: no regulator reviewed prescribes a vendor-file template, so the table below combines specific record obligations with the audit tests described above, as of October 2026.

AGCO Registrar’s Standards 1.18 and 1.19 require operators to contract only with reputable suppliers and make operators responsible for third parties, who must conduct themselves as if bound by the same laws, regulations and standards. A KYC vendor engaged by an Ontario operator therefore carries the Registrar’s standards by contract. The AGCO and AGLC comparison sets out how the Ontario and Alberta standards differ. A vendor’s SOC 2 or ISO/IEC 27001 attestation does not show that its verification logic meets a given regulator’s method, but it supports the supplier-reputation and data-security tests, and the ISO/IEC 27001 article covers common certification errors.

Source: FINTRAC, Meth

Matt Denney

Editorial · gamingcompliance.io

Reads the primary source so you don't have to. Fifteen years inside iGaming compliance: operator, supplier, and crown-corporation lottery.