Identity Checks at Online Casinos, Step by Step

What verification is

Identity verification is the moment an online casino stops treating an account as an email address and starts treating it as a person with a birth date, an address and a bank. Every regulated gambling business runs a version of it. The shorthand, KYC or know your customer, is borrowed from banking rather than invented by casinos.

In practice it means handing over copies of documents a stranger could not easily assemble about you: a government photo document, something tying your name to a street address, and proof that the payment method on the account is yours.

The check is rarely difficult. It is usually badly timed.

That timing is what this guide is about, because most complaints about casino verification trace back to one sequence: sign up in three minutes, deposit in one, play for a fortnight, win, request a payout, and only then learn that an identity file was expected all along. The documents were never the problem. The order was.

Why operators run the check at all

Four separate obligations sit behind one document request, and they pull in slightly different directions.

• Anti-money-laundering rules. A gambling account is an attractive way to put money in through one channel and take clean money out through another. Licensed operators must know who holds an account and be able to explain its transaction pattern to a regulator later.
• Age verification. Every licensing regime sets a minimum age, and a photo document with a date of birth is the only way an operator can evidence that it checked.
• One person, one account. Bonus abuse is built on duplicates. Matching an identity document against existing records is how a second account from the same household surfaces, which is why a bonus is often voided at verification rather than at the claim.
• Payment fraud. A stolen card used to fund a gambling account produces a chargeback weeks later, and the casino absorbs the loss. Proving the card belongs to the account holder moves that risk forward, before the money does.

Those four reasons explain the document list. They do not explain the sequencing, which is a commercial decision rather than a compliance one.

How this guide was built

The general mechanism above is standard across the industry. The specifics in this guide come from one operator’s published rules, used here as a worked example because its requirements are documented in unusual detail.

We downloaded the complete published content of Stellar Spins on 19 October 2026 and searched it for every statement about documents, verification, review times and data handling. Nothing here is a report of our own account being verified; we did not open one. Where the operator commits to something in writing, this page quotes the commitment. Where the site is silent, the silence is recorded as such rather than filled in with an industry average.

Naming a brand as the example is not a recommendation to use it. This rule set earns its place because it contains one requirement most casinos leave implicit and one clause that catches players out, and both are worth recognising wherever you meet them.

The document pack, item by item

Most casinos ask for the same three things in different words. Here is the published list, with the condition on each that causes most resubmissions.

Two rows carry more weight than they look. The three-month window on the address document is a hard limit rather than a guideline, so a bill uploaded in January is stale by April if the record is reopened. The card rule goes further than the industry norm, and gets a section of its own below.

What the list leaves out is a bank statement, a selfie holding the document and a source-of-funds declaration. Larger operators ask for all three at higher stakes, and the terms here reserve the right to ask for more.

Why the check fires on the way out, not the way in

Deposits at almost every offshore casino are frictionless by design, and verification arrives later. Setting the two stages side by side makes the asymmetry plain.

Read the first and last rows together. An account can be opened, funded and played without a single document, and then cannot be emptied without four of them.

There is a defensible compliance argument for that order. Laundering risk attaches mainly to money leaving a business, and checking documents at every registration would mean collecting sensitive files from thousands of people who deposit twenty dollars once and never return. Collecting less data from fewer people is, in isolation, better privacy practice.

The argument also happens to suit the operator commercially. Friction at the cashier door costs sign-ups; friction at the exit costs nothing, and some proportion of players who hit a document request simply play the balance away instead of completing it. Both things are true at once, and a reader is entitled to notice the second one while accepting the first.

Reversed, not queued

One clause turns the ordering above from an inconvenience into a trap, and its effect is worth stating precisely. At Stellar Spins, a withdrawal requested before verification is complete is reversed rather than placed in a waiting queue.

Those two words describe different outcomes. A payout that waits sits out of reach until the file clears, then pays. A reversed one returns to the playable balance, so the request has to be lodged again from scratch and the money is bettable in the meantime.

Consider what that looks like with numbers attached. A player finishes a Sunday session A$1,800 up, requests the lot, uploads nothing, and finds the balance restored on Monday with no payment pending. The three-to-five-business-day clock never started. The temptation to play a restored A$1,800 is a real behavioural cost, and it is the strongest practical reason to treat verification as a registration task rather than a withdrawal task.

No timeframe for reviewing documents appears anywhere on the operator’s site. That gap compounds the clause: a player who lodges a request, gets it reversed, uploads documents and re-lodges has no published basis for estimating how long the whole sequence will take. The single withdrawal rail and its published timings are documented separately, but the review stage sits inside that window with no duration attached to it.

What gets a document bounced back

Rejections are mostly mechanical. A handful of faults accounts for the bulk of them, and each is avoidable with a two-minute reshoot.

The name mismatch is the one that genuinely strands people. A maiden name, a middle initial the registration form never asked for or a shortened first name can all read as somebody else’s card to a reviewer working from two images, and correcting an account name after a deposit needs its own evidence.

Third-party payment is the hard stop in this category. A card in another person’s name cannot be verified as yours at any casino, however willing that person is, and a balance funded that way can sit unpayable indefinitely. If the card is not yours, do not register it.

The card copy, and what to mask

This is the document people get wrong most often, and the operator’s own instruction is more careful than its reputation suggests.

The published rule asks for copies of registered cards with only the first six and last four digits visible. Everything in between must be blocked out, and so must the CVC or CVV on the back. That is the opposite of the instruction attached to the other two documents, where nothing may be covered and the image must not be blurry. Photo ID and the utility bill go in whole; the card goes in masked.

Worth saying plainly: this is good practice, and it is better than several Curacao-licensed operators manage. A first-six-and-last-four image proves the card exists and belongs to the account holder without handing over a working credential. If a casino asks for an unmasked CVC, that is the moment to stop, and this one does not.

The residual risk sits elsewhere. The masked image still carries the holder name, the issuing bank, the expiry and the card’s first six digits, which together identify the account well enough to support a convincing impersonation attempt. And the party receiving it cannot be identified: Stellar Spins publishes no licensee company, no registration number and no corporate address, so a player has no named entity to write to, no privacy officer to contact, and nobody to pursue if the file is mishandled. our read of the licensing disclosure sets out what we searched for and did not find.

Nothing on the site states how long document images are kept, who inside the business can open them, or whether a deletion request would be honoured. Those three answers are what a data-protection regime normally requires, and their absence is the honest reason for caution, rather than the card rule itself.

Precautions that still satisfy the requirement

Refusing the request means refusing the payout, so the useful question is how to comply while limiting exposure. These measures do not breach the published conditions.

• Register one card and only one. The requirement covers every card attached to an account, so each extra card added for convenience is one more image sent.
• Use a card with a low limit. A secondary debit card holding a small working balance limits what a leaked image could be used for. This is also the card most likely to be reissued soon, which shortens the useful life of the image.
• Leave the middle digits covered unless the instruction says otherwise. Many operators accept far less careful handling than this one asks for. Where a casino specifies that nothing may be obscured, send what is asked and do not improvise, because a rejected document restarts the review.
• Write the purpose and date across the image. A watermark naming the casino and the date, placed over a non-essential part of the card face, leaves every required field readable while making the file awkward to reuse anywhere else.
• Send it through the account upload tool first. An upload leaves the file inside the operator’s own system. Email leaves a copy in your sent folder, in your provider’s storage and in whatever inbox receives it. Use the documents address only when the uploader genuinely fails, which the operator does allow.
• Delete the photograph from your phone afterwards. Camera rolls sync to cloud storage by default, so a card image taken for a one-off verification can end up replicated across devices and shared albums months later.
• Watch the statement for a fortnight. Misuse usually opens with a small test charge instead of a large one, so a single unexplained dollar or two is worth a call to your bank.

None of that makes the requirement comfortable. It does make the decision an informed one.

What is published, and what is not

Absences matter as much as statements here, so both halves are set out together.

Six published positions, six gaps. The published half is more specific than many offshore casinos manage; the other half is where a reader has to judge rather than read.

The crypto exemption and what it buys

One line in the operator’s rules looks like a way around the whole process. Crypto deposits below $2,000 require no identity documents at all.

The figure is written as a bare dollar sign on a site that quotes promotional values in euros and converts them, so do not assume the threshold is exactly A$2,000 until the cashier shows it.

The exemption is also narrower than it first appears, because it covers funding and nothing else. Withdrawals at this casino run on Visa alone, and a Visa payout triggers the full document pack regardless of how the balance was built. A player who deposits in Bitcoin to stay anonymous therefore gets anonymity for exactly as long as the money stays in the account. At the point of cashing out, the same photo identity, the same address document and the same card copies are requested, and the card in question may be one that never touched the account before. Anyone funding through coins should read our walk-through of buying crypto for a deposit with that exit in mind.

What the exemption genuinely offers is a way to try a casino without surrendering documents to it. Deposit a small amount in coin, play, and if you decide against the operator you have handed over nothing. That is a reasonable use of it. Treating it as a permanent shield is not.

After you press send

Most guides stop at the upload. The interesting part is what happens next, and at an operator with no published licensee that is largely a question of what can be established at all.

A review is normally a person comparing images against account data: name against name, date of birth against the age declaration, address against the registration address. Where no review time is published, the honest conclusion is that queue length is unknown and may move with volume rather than being a service commitment.

A cleared file does not expire, and that cuts both ways. A verified account pays out inside the normal window on every later request, which is the benefit. The same record can be reopened after a change of address, a newly registered card or a large win, and a fresh address document is then requested with the three-month rule applied from that day.

If something goes wrong with the file itself, the escalation path is short. There is an in-house disputes inbox with a published response window, and beyond it nothing: no named company, no local regulator and no Australian complaints scheme, because an offshore casino sits outside the domestic licensing system entirely. Account-level problems that are not disputes, such as a locked login during a review, are covered in our notes on fixing common account problems.

A sequence that avoids all of this

The practical advice is one line long. Verify on the day you register.

We do not recommend leaving verification until the day you request a withdrawal. The reversal clause described above means an unverified payout request does not wait for your documents, it hands the money back to you as a playable balance, and no published review time exists to tell you how long the second attempt will take. Uploading the same three documents during a quiet five minutes at sign-up removes that entire failure mode at no cost.

Beyond that, the right sequence depends on how you intend to play.

• If you plan to deposit by card, register the card you want paying out to, then upload the identity file and the card copy in the same session.
• If you plan to deposit in crypto, use the document-free threshold to test the games, then complete the paperwork the moment you decide to keep the account.
• If your card and account names do not match exactly, fix the account name first and deposit second, since resolving a mismatch after a win is slower.
• If you are not willing to send a card image showing the security code, accept that a payout from this operator is not available to you, and do not deposit on the assumption that the rule will be waived.
• If none of those describes your situation, upload the photo identity and the current month’s utility bill on day one and leave the card image until a card is actually registered. That covers two of the three requirements before any money is at stake.

What to take away

Verification is not the obstacle most players expect. It is a twenty-minute administrative task that turns into a multi-week problem purely because of when people do it.

The document list here is ordinary in two of its three items and unusually demanding in the third, and the demanding item cannot be negotiated away. The real unknowns are procedural rather than documentary: how long a review takes, who performs it, how long images are kept and which legal entity holds them. Anyone deciding whether to proceed is weighing one known requirement against four unpublished answers.

For Australian readers there is a layer underneath all of this. Offshore casino operators hold no Australian licence, which is why none of the verification safeguards described here carry any domestic legal backing, and the statutory position sits in our guide to Australian gambling law. Anyone worried about their own play can call Gambling Help Online free on 1800 858 858, day or night.

If you do nothing else with this page, do the one thing in it: send the documents on the day you open the account.

Sources

• (1) Stellar Spins published terms, verification rules and the document checklist, the governing record for the document list, the three-month address rule, the card-copy requirement and the reversal clause, downloaded and read on 19 October 2026.
• (2) FATF Recommendations - the international anti-money-laundering standards behind customer due diligence obligations in gambling, including the requirement to identify and verify customers.
• (3) Curacao Gaming Authority - the licensing body for Curacao gaming licences and the register against which a licensee company and licence number would ordinarily be checked.

Questions readers ask