Casino customer due diligence: build the full process

What is the difference between identification and verification?

Identification establishes the claimed identity; verification checks it against suitable evidence. The UKGC’s casino guidance distinguishes those steps and addresses beneficial ownership and the purpose of a relationship.

Design the account journey so the team can explain which step has been completed. A document uploaded but never assessed should not be recorded as successful verification. Likewise, a failed electronic match needs a defined outcome rather than an indefinite pending status.

How should the workflow be designed?

Map the applicable legal triggers before configuring the platform. Keep age and identity checks distinct from additional AML measures, even where the same data supports both.

• Collect only the information needed for the defined purpose.
• Verify the relevant details using an appropriate method.
• Assess customer risk using the actual facts and activity.
• Define escalation when information is inconsistent or insufficient.
• Monitor changes and transactions throughout the relationship.
• Keep an audit trail of the decision and supporting evidence.

When is enhanced review appropriate?

Higher risk, suspicious activity or inconsistent information can require further assessment under the applicable framework. Do not build a process that assumes all customers below one payment amount are low risk.

For example, a verified customer may begin using an unexplained third-party payment source. The earlier identity check does not answer the new funding question. The case should reach the team responsible for assessing that change, with access to the relevant transaction history.

What should happen when checks fail?

Define permitted account actions and customer communications for each unresolved state. Staff should know when to seek further information, restrict activity or escalate to the responsible compliance officer. The legal basis and licensing rules determine the exact response.

Avoid contradictory system states: customer support should not promise unrestricted use while the verification system shows an unresolved restriction. Test the communication between systems and make overrides visible to authorised reviewers.

How can quality be measured?

Review the evidence behind completed decisions, not only the percentage of accounts passed. Sample cases for completeness, consistency, timeliness and escalation quality. Track whether repeated document requests arise from genuine new information needs or a broken process.

Use privacy controls throughout: restricted access, secure collection and a justified retention schedule. A large archive of identity documents is not proof of effective CDD. The useful record explains what was checked, why it was sufficient and when the decision needs reconsideration.