Gambling age verification: timing and failure handling

When must the check happen?

The UKGC’s age-verification changes require the relevant remote operators to verify age before deposits, applicable free-to-play games and gambling. Its identity requirements are related but distinct. Other jurisdictions must be checked separately.

Map each entry point into the service. A mobile app, promotional game and direct deposit link can bypass the intended registration journey if they are not included in the design. The control should follow the customer across those routes.

How should age and identity states be separated?

Use explicit states such as pending, verified, failed and manual review. Record what each state permits. A completed form is not the same as evidence checked, and identity information may require assessment beyond the age question.

Avoid a single vague “KYC done” flag where different obligations have different timing. Staff should be able to see which requirement remains unresolved without exposing unnecessary documents to every team.

What should happen when electronic verification fails?

Provide a defined alternative process and explain the information needed. A failed match can reflect data quality or insufficient evidence; it should not automatically be treated as fraud.

• Keep restricted actions unavailable while the relevant requirement is unresolved.
• Provide a secure evidence-submission route.
• Assign manual review to authorised staff.
• Record the decision and reason.
• Prevent ordinary support overrides from bypassing the control.
• Test provider outages and delayed responses.

Why should checks not be deferred until withdrawal?

The UKGC warns against requesting age or identity evidence only as a withdrawal condition when it could have been requested earlier. Additional checks can still arise from genuine later obligations, but delay should not be built into the process as a commercial tactic.

Review the customer journey from registration to payout. If the system accepts activity that should have been restricted and only detects the problem at withdrawal, investigate the earlier control failure. Do not merely add another document request at the end.

How should evidence and privacy be managed?

Keep enough evidence to support the decision and comply with the applicable retention requirements. Restrict access and avoid collecting documents that are irrelevant to the assessment.

Test the user experience as well as the compliance logic: instructions should be readable on mobile, upload errors understandable and support routes available. A process that users cannot complete reliably creates manual work and makes exceptions harder to control.