KYC Withdrawal Hold Explained: Normal Check or Scam?
Why casinos hold withdrawals for KYC and source-of-funds checks, what regulators say is fair, and the one sign a 'hold' is really a scam.
In this article
You hit “withdraw” and the money doesn’t move. Instead, you get an email asking for your passport, a utility bill, maybe a bank statement. That can be completely normal, or it can be the start of a scam. A legitimate KYC hold asks you for documents; a scam hold asks you for money — if you’re told to pay a fee, tax or deposit to release a withdrawal, stop. This guide explains why licensed operators check identity and source of funds, what good regulators say about timing, and how to tell the two apart.
Why casinos have to check who you are
Gambling businesses are part of the global anti-money-laundering (AML) system. Under FATF Recommendation 22, the international standard that national AML laws are built on, casinos must apply customer due diligence. That means “identifying and verifying the identity of customers” when they engage in financial transactions of USD/EUR 3,000 or more. Casinos also have to be able to link that customer information to the transactions the customer makes.
The pressure is growing. In September 2026, the FATF published its first detailed look at gaming and gambling risks, drawing on input from more than 80 jurisdictions. It flagged illegal and unlicensed offshore operators and online platforms as major concerns. Its new risk indicators include multiple accounts under different identities, mismatches between customer and payment details, and suspicious ID documents. Those are exactly the things a KYC team is trained to catch.
Takeaway: an ID check is not a sign that something is wrong. It’s a legal duty, and a licensed operator that never checks anyone is itself a red flag.
The three checks behind a withdrawal hold
A “hold” usually comes from one of three levels of checking. Each one asks for more, and each one should come with an explanation.
| Check | What it confirms | Typical requests | When it should happen |
|---|---|---|---|
| KYC (identity and age) | You are who you say you are, and you’re of legal age | Name, address and date of birth, usually backed by an ID document and proof of address | Ideally before you deposit or play. The UK rules require it |
| Payment ownership | The card, e-wallet or bank account is yours | A screenshot or statement showing your name on the payment method | When a payment method is added, or if something doesn’t match |
| Source of funds / wealth | Your gambling money comes from legitimate income or savings | Payslips, bank statements, tax or business documents | Risk-based. Triggered by deposit size, patterns or high-risk profiles |
Takeaway: the further down the table a request goes, the more it should be justified by your activity, and the more clearly the operator should explain why.
What strong regulators say about timing
The UK Gambling Commission (UKGC) has written the clearest public rules on this. They’re a useful benchmark even if you play somewhere else.
- Verify before play, not at payout. Since 7 May 2019, UK-licensed remote operators must verify age before a customer can deposit or gamble, and identity (at minimum name, address and date of birth) before they can gamble.
- No new hurdles at withdrawal. Under the same rules, a withdrawal request must not trigger a demand for extra information that the operator could reasonably have asked for earlier, unless another legal obligation requires it.
- No “deposit freely, block the cashout”. In a July 2024 statement on account withdrawals, UKGC chief executive Andrew Rhodes said operators should not keep accepting deposits and then use AML procedures to block a withdrawal. Nor should they question deposit history only once a withdrawal is requested.
- Tell the customer why. Operators should explain why documents are needed, the reason for any delay, and the full basis for any decision to withhold or void winnings. The exception is where telling the customer would breach “tipping-off” rules in a money-laundering investigation.
- Delays without cause aren’t acceptable. The UKGC said that when there is no regulatory concern, there is no valid reason to delay a payout. Withdrawal delays are the top subject of complaints to the Commission, at around 2,000 a year.
If your site is licensed outside the UK, its regulator’s rules may differ, so check them. Our explainer on Curaçao’s licensing reform covers one of the most common licences in the region.
Takeaway: a well-run operator checks you early, explains every request, and doesn’t save its paperwork for the moment you win.
Normal hold or scam? The side-by-side test
| Signal | Normal compliance hold | Scam “hold” |
|---|---|---|
| What they ask for | Documents: ID, proof of address, proof of payment method, sometimes source of funds | Money: an “unlock fee”, “tax”, “verification deposit” or “VIP upgrade” |
| How you send it | Upload inside your account or through the official support channel | Bank transfer to a personal or new account, crypto to a wallet, via a chat contact |
| Explanation | A stated reason and the specific documents needed | Vague “risk control” or “account frozen” messages, with threats and deadlines |
| Your balance | Stays intact. Any fee is deducted from it, never paid on top | Keeps growing on screen but can never be withdrawn |
| After you comply | Payout is processed, or a reasoned refusal you can complain about | A new fee appears, then the contact disappears |
| Escalation | Complaints process plus a named licensing regulator | No licence you can verify on a regulator’s register |
The scam version is well documented. The Singapore Police Force has described fake betting platforms that “froze” accounts and demanded further deposits, and sometimes “administrative fees”, before winnings could be withdrawn. Once victims paid, the sites went offline. In Penang, police said a woman lost RM759,950 to an online casino “investment” and realised it was a scam when she was asked to pay more to withdraw her supposed earnings, as reported by the New Straits Times. Our full breakdown of fake gambling app red flags covers more cases.
Takeaway: documents for a real check are normal. Payment to release your own balance never is.
How to get a legitimate hold cleared
- Confirm the request is genuine. Log in directly (not through an emailed link) and check the account’s verification page or messages.
- Ask for the reason in writing. Which check is this (identity, payment method or source of funds), and exactly which documents will close it?
- Send genuine, complete, readable documents, only through the official upload or support channel.
- Keep a record. Note dates, ticket numbers and screenshots of every request and reply.
- Use the complaints process if the hold drags on without explanation, then escalate to the licensing regulator or its dispute service. Check the licence is real first: our guide to spotting an unlicensed online casino shows how.
- Read the bonus terms. Some “holds” are really unmet bonus conditions. Our wagering requirements explainer covers why winnings get voided.
Takeaway: cooperate with document requests, but make the operator name the check, explain the reason, and stick to its own process.
If it’s a scam: who to call
If you’ve already paid a “release fee”, stop paying, call your bank, and contact the national scam line. In Malaysia, call NSRC 997 (24 hours, ideally within 24 hours of discovery). In Singapore, call the ScamShield Helpline 1799 (24/7). In Hong Kong, call the ADCC Anti-Scam Helpline 18222 (consultation only, so report at a police station). Then file a police report with every receipt and chat log.
Takeaway: the faster you report, the better the chance banks and police can freeze the money trail.
FAQ
Is it normal to be asked for ID only when I withdraw?
It happens, but good practice is to verify before you play. UK rules ban new withdrawal-only demands where the information could reasonably have been requested earlier. Expect a clear reason either way.
Can a casino ask where my money comes from?
Yes. Source-of-funds checks are a standard, risk-based AML tool, and the UKGC expects them where they are necessary and proportionate. The operator should explain why it is asking.
They want a “tax” before releasing my winnings. Is that legit?
Treat it as a scam sign. Legitimate operators don’t make you send fresh money to unlock your balance.
Can I use USDT to avoid KYC?
No, and you shouldn’t try. A licensed operator’s KYC duty doesn’t depend on how you pay, and the FATF lists virtual assets among payment methods vulnerable to laundering. See our USDT currency page for how operators handle it.
Payment-ownership checks exist partly to stop third-party “mule” accounts; our money mule accounts explainer covers why lending your account can lead to criminal charges.
HotStakes is an independent directory. Some links on this site are affiliate links; we may earn a commission at no cost to you, and it never changes our rankings. Gambling involves risk — only play with money you can afford to lose, and if it stops being fun, seek help.
Looking for operators checked by Cyndia’s team? Browse vetted operators by currency.
Next story →Fake Gambling App Scams: 9 Red Flags and Real Cases
Start the discussion