KYC and ID Verification at Ontario Online Casinos: Complete Guide (2026)

KYC (Know Your Customer) is the regulatory process by which an operator verifies a customer's identity before allowing real-money activity. At AGCO-licensed Ontario casinos, KYC is mandatory before any withdrawals and in most cases before real-money play.

Why it's required:

1. Age verification (19+). The legal minimum gambling age in Ontario. Without verified ID, operators can't confirm you meet this threshold.
2. Anti-money laundering (AML). Federal law (PCMLTFA — Proceeds of Crime Money Laundering and Terrorist Financing Act) classifies gambling operators as reporting entities. They must verify customer identity, monitor transactions, and report suspicious activity to FINTRAC.
3. Cross-operator self-exclusion. iGO's self-exclusion system relies on verified identity to enforce exclusions across all 48 licensed operators. Without KYC, exclusions can't be enforced.
4. Single-account integrity. AGCO rules allow one account per person. KYC prevents people from opening multiple accounts under different email addresses.
5. Protection against fraud. Ensures someone else isn't using your payment methods without authorization. Also catches stolen identity attempts.
6. Withdrawal security. Confirms the person withdrawing funds is the same person who deposited them.

KYC isn't operator discretion — it's a binding AGCO standard tied to federal law. No AGCO-licensed operator can skip it.

Every AGCO-licensed operator requires the same two core documents:

Some operators also require:

• Selfie with ID: holding your ID next to your face. Automated facial recognition matches you to the photo on your ID. Increasingly common — primarily for fraud prevention.
• Payment method verification: photo of your card (numbers partially redacted showing only last 4), or bank statement showing ownership of the account used for deposits. Required before large withdrawals at most operators.
• Source of funds (SOF): for larger deposits or unusual patterns, operators may request pay stubs, employment letters, or bank statements showing deposit origin. Required by AML rules.

Yes — for AGCO-licensed operators specifically. The safety rests on multiple overlapping protections:

1. Information security standards. AGCO requires licensed operators to follow security controls equivalent to Canadian financial institutions: encryption in transit (TLS 1.2+), encryption at rest, access restricted to authorized compliance staff, audit logs of document access.
2. PIPEDA privacy law. Canada's federal Personal Information Protection and Electronic Documents Act governs how operators handle your data. Requires consent, purpose limitation, retention rules, and breach notification.
3. Purpose limitation. Documents uploaded for KYC cannot be used for marketing or third-party sharing. Compliance team access only.
4. Retention rules. AML law requires operators to keep KYC records for at least 5 years after account closure. After that, they must be securely destroyed.
5. Breach notification. Any security breach involving your data must be disclosed to the Office of the Privacy Commissioner of Canada and to affected individuals within prescribed timeframes.
6. No cross-operator sharing. KYC documents stay with the operator you uploaded them to. Operators don't share documents with each other (each requires its own upload). This is different from the self-exclusion cross-reference system, which uses verified identity data (not documents) shared through iGO.

When to be cautious:

• Never upload ID to unlicensed offshore sites. They have no equivalent regulatory obligations and your documents could be misused, resold to data brokers, or exposed in breaches with no recourse.
• Verify the site is on iGO's registry before uploading documents. Five minutes of verification beats years of identity theft cleanup.
• Use secure networks when uploading. Avoid public Wi-Fi; use your home network or mobile data.
• Take photos of IDs rather than scanning to email — never send ID documents via email. Operators always have a secure upload portal; if an operator asks you to email ID, that's a red flag.

A common frustration: "I already uploaded my driver's licence — why do I also need to send a utility bill?" The answer involves AGCO's two-document requirement.

Your ID proves:

• Who you are (identity)
• How old you are (age)
• That you exist (no fictitious identity)

But your ID doesn't prove you currently live in Ontario at the address you registered. Your driver's licence address may be outdated. The photo on it could be 10 years old. And it doesn't confirm you have ongoing residency at a specific location.

Proof of address (your utility bill or equivalent) confirms:

• You currently live at the address you provided at signup
• You have recent recurring residential connection (you're not using an address temporarily)
• Your name and that address are linked (matches your ID)

Both documents together — ID + proof of address — satisfy AGCO's Standard on identity verification and Canada's PCMLTFA customer identification requirements.

The "within 3 months" window matters because an older bill might reflect an address you've since moved from. Operators need recent evidence of current residency.

Typical timing from document upload to approval:

If your account says "Verifying" for more than 72 hours without any operator communication, contact live chat with your reference number. Manual review resolves most stuck cases in 24-48 hours once an agent touches it.

1. Upload high-quality photos. Not scans, not screenshots. Use your phone camera app, good lighting, flat surface, all corners visible.
2. Match registration exactly to ID. Use legal first + last name as on your ID. Avoid nicknames, preferred names, or alternate spellings.
3. Use recent proof of address. Aim for a bill dated within the last 30 days, not 90 days. Reduces edge-case rejections.
4. Match address exactly. If your ID shows an old address, update your ID first OR explain the mismatch with supporting documentation upfront.
5. Provide clean, cropped images. Just the document, not your hand holding it or the document on a busy background. Some operators require the document on a neutral surface.
6. Answer the first follow-up fast. If the operator asks for additional documents, respond within hours, not days. Compliance queues get re-processed serially; fast responses keep you moving.
7. Complete KYC before withdrawal. Don't wait until you want to cash out to verify — the combination of KYC delay + withdrawal processing can extend to a week if done sequentially.

AML law requires operators to retain KYC records for at least 5 years after account closure. During that time:

• Documents are stored in encrypted form, not accessible to regular staff
• Access is limited to compliance personnel with audit logs
• They may be requested by AGCO, FINTRAC, or law enforcement during investigations (very rare, requires legal basis)
• They cannot be used for marketing, sold to third parties, or shared with other operators

After the 5-year retention period, operators must securely destroy the documents unless there's an active investigation or legal hold.

You have PIPEDA rights over your data:

• Access: request a copy of what the operator holds about you
• Correction: request updates if data is wrong
• Withdrawal of consent: close your account; operator must destroy documents after retention period
• Complaint: if you believe data is mishandled, file with the Office of the Privacy Commissioner of Canada