Crypto casino KYC and source-of-funds checks: what evidence may be requested?

Short answer

Verification is a policy process, not a single passport upload

Crypto casino KYC can begin with basic account data and expand when the operator’s rules, risk model or legal obligations require more evidence. A normal request may concern identity and age, residential address, control of a payment method, the origin of one deposit, or the broader economic source of a customer’s wealth. These questions overlap, but they are not interchangeable.

Stake’s current AML statement provides one first-party example. It describes a risk-based customer-identification programme that can collect a wallet address and email at onboarding, assess the wallet used to fund an account, retain identification records, screen sanctions lists and use third-party verification. When a red flag triggers enhanced due diligence, the statement says the account can be suspended and lists legal name, citizenship, permanent address, identification number, identification document, source of funds and source of wealth among possible evidence.

That example does not create a universal casino document list. Each operator’s current contract controls its own process. A site may require verification before a first withdrawal, after a threshold, after account details change or during an unusual transaction review. A registration screen that asks only for email does not waive powers written elsewhere in the terms.

Use only true, current information and documents belonging to the account holder. Do not use another person’s ID or wallet, invent an address, mask location or manipulate a document. If the request is unclear or appears excessive, pause, verify the official support channel and ask for the exact policy basis, accepted evidence and secure upload method before sending anything.

Purpose and scope

Why a casino may ask after registration or before withdrawal

Identity checks can enforce minimum age, one-account rules, country restrictions, sanctions screening, account recovery and payment ownership. Transaction monitoring can separately look for unusual size, frequency, counterparties, rapid deposit-and-withdrawal patterns or wallets associated with restricted activity. A request is not necessarily an accusation, but it can restrict account access while unresolved.

Stake’s AML statement says it performs ongoing monitoring and can pursue enhanced due diligence when red flags appear. It also says withdrawal attempts may be refused while more information is collected, and wallet addresses may be screened by blockchain-forensics providers. This illustrates why a crypto deposit can be confirmed on-chain yet remain under operator review.

Marketing often compresses this into “KYC” as though it were a one-time level. In practice, verification is event-driven. A user may pass identity and address checks but later need to explain a large deposit, a third-party transfer or an inconsistent wallet route. Conversely, an operator may accept basic onboarding information and never request enhanced documents from a low-risk account. Neither outcome can be promised in advance.

Read the whole policy set: terms, restricted-country rules, AML statement, privacy notice, payment rules and the help centre’s document standards. A short FAQ may list examples while the contract reserves broader powers. Save the versions accepted because the policy and upload requirements can change.

Evidence ladder

Basic due diligence and enhanced review answer different risks

Basic due diligence usually establishes that the account holder is a real eligible person. It can collect legal name, date of birth, email, citizenship, address and a government identifier. Automated systems may compare these details with a document, selfie, device or trusted database.

Enhanced due diligence goes further when the operator sees higher risk or needs a deeper explanation. It can ask about occupation, source of income, source of wealth, transaction purpose, relationships between wallets and third parties, or the reason for a particular activity pattern. The response may require several documents that form a coherent trail rather than one isolated screenshot.

“Level 1”, “Level 2” and similar labels are operator-specific. They do not carry a universal meaning across casinos. A level that unlocks a feature on one site may not satisfy another operator’s withdrawal review. Quote the actual requested fields instead of assuming the label.

A good request should identify what is being checked and how to respond. If the message merely says “verification failed”, ask official support which field conflicts, what alternatives are accepted, whether certification or translation is needed, and the response deadline. Do not keep uploading different sensitive documents at random.

Person and age

Identity evidence needs to be valid, complete and readable

Stake’s general proof-of-identity help page currently lists an international passport, national identity card or driving licence. It asks for colour, high-resolution photographs of the original document, the whole document visible, readable details, no glare or blur, no physical damage and at least three months’ remaining validity. Both sides are required for a card or licence.

Those are Stake’s examples checked on 7 October 2026, not guaranteed requirements for every casino or every country. Some operators accept digital documents; others do not. Some require a selfie, liveness video or photograph holding the ID. Only the official request for the exact account can settle the format.

Names, birth dates and document numbers must match the account. A legitimate name change, transliteration difference or dual address should be explained with supporting records rather than edited into an image. Cropping a security feature or hiding a required number can cause rejection.

Before uploading, confirm the domain, secure session and privacy controller. Never send a password, authenticator code or recovery secret with an identity document. If a support agent moves the conversation to an unofficial social account or asks for remote-device access, stop and use the contact listed on the official policy page.

Residence evidence

Proof of address is not the same as a location signal

An IP address or device location indicates where a connection appears to originate; it does not prove permanent residence. Proof of address links a named person to a residential address through a dated issuer record. Operators use it for country eligibility, jurisdiction, account integrity and risk assessment.

Stake’s checked help page lists examples including utility bills, bank or credit-card statements, government tax letters, signed employer or educational letters, tenancy agreements and detailed bank reference letters. It says documents should be recent, show complete name and address, identify the issuer and date, and display the whole document. Mobile bills, purchase receipts and medical bills appear in its unacceptable list.

Another operator may use a shorter age limit, different issuer list or a separate New Zealand standard. Ask whether an electronic bank PDF is acceptable, whether a PO box is sufficient, and how a recent move should be documented. Do not create a false lease, borrow a bill or use an address where the account holder does not live.

Country permission still needs the terms. Passing address verification proves the evidence matched the operator’s process; it does not itself prove that the activity is lawful or that every product is available. Keep verification status and New Zealand eligibility as separate conclusions.

Specific payment trail

Source of funds explains where the money or crypto came from

Source of funds normally concerns the origin of the assets used for a particular deposit or period of gambling. The question is not simply whether the wallet held enough coins. It is how the account holder lawfully obtained those coins or the fiat used to buy them, and how that origin connects to the observed transfer.

Stake’s help centre lists broad examples: bank statements showing regular income, payslips, tax returns, investment statements, gift declarations, inheritance documents, property records, business accounts, lottery records, sale agreements, divorce settlements, loans and mining records. Each category needs context. A payslip can support salary, but the matching bank credit and exchange purchase may be needed to connect salary to a later crypto deposit.

Build a chronological evidence chain. For purchased crypto, it might run from salary credit to bank transfer, exchange purchase, exchange withdrawal, self-custody receipt and casino deposit. For mined assets, records can include mining income, wallet address and transaction hash. For a property sale, the sale contract and matching bank receipt may be relevant.

Do not manufacture missing links. If funds passed through another person or a mixing service, answer truthfully and ask what the operator requires. Trying to create a cleaner fictional route can convert a resolvable question into false-document or account-integrity grounds for rejection.

Broader financial context

Source of wealth asks how total assets were accumulated

Source of wealth is broader than one deposit. It can concern a person’s occupation, business ownership, investment history, inheritance, property or other long-term accumulation. An operator may ask when transaction size or activity appears inconsistent with the profile it has.

A bank balance proves that funds exist, not necessarily how the wealth arose. A credible answer connects the economic event to authoritative records: audited business accounts, tax returns, investment reports, probate documents, property-sale contracts or other records relevant to the true source.

Provide only what is requested through the approved channel, but do not omit facts that make the explanation misleading. Ask whether a summary plus selected supporting pages is sufficient before uploading an entire financial archive. The operator should identify the period, source category and fields needed.

Source-of-wealth checks are not a licence to demand wallet secrets. Proof should establish ownership and provenance through records, signatures or controlled-message procedures where supported—not by revealing a seed phrase or private key.

Blockchain trail

Transaction hashes help prove movement, not lawful origin by themselves

A transaction ID can show that assets moved between addresses at a given time and amount. It does not display a verified legal owner or explain how the sender obtained the assets. That is why on-chain evidence often needs exchange statements, purchase receipts, wallet ownership or income records.

Stake’s AML statement says wallet risk can be monitored and addresses screened through third-party blockchain forensics. It also describes restrictions connected to prohibited jurisdictions, sanctions and suspicious patterns. An operator can therefore assess more than whether a transaction confirmed.

Keep accurate records of asset, network, sending service or wallet, destination, amount, fee, timestamp and transaction hash. If a bridge, swap or multiple wallet hops were genuinely used, preserve those links. Do not move funds again merely to make the route look simpler; extra movement can create more questions and fees.

The companion on-chain privacy guide explains why public addresses are pseudonymous rather than anonymous. This page focuses on supplying truthful evidence, not tracing avoidance.

Control without disclosure

Wallet ownership can be shown without surrendering the wallet

An operator may ask whether the deposit or withdrawal address is controlled by the account holder. Evidence can include a screenshot from an authenticated wallet, an exchange statement, a small verification transaction or a signed message when the wallet and operator support it. The exact method must be confirmed before acting.

A screenshot should show only the necessary account name, address, transaction and date. It may not prove control if the wallet is watch-only or the exchange account belongs to someone else. Conversely, a self-custody wallet may have no legal name in its interface, so the transaction trail and supported ownership method matter.

Never disclose a seed phrase, private key, password, one-time code, backup file or remote-access session. Those items allow asset movement and are not KYC evidence. A request for them is a security incident, not a normal compliance step.

Do not deposit from another person’s exchange or withdraw to someone else’s wallet unless the operator has explicitly permitted and documented that arrangement. Third-party ownership can conflict with payment rules and make later verification much harder.

Marketing boundary

“No KYC” may describe onboarding, not an unconditional exemption

A no-KYC headline can mean that basic registration does not immediately require a photo ID. It does not automatically cancel AML, sanctions, age, country, fraud, payment-ownership or enhanced-due-diligence clauses. The contract may still permit verification at withdrawal, after a threshold or when risk indicators arise.

Compare the headline with the terms. Search for verify, identity, age, residence, source of funds, source of wealth, payment method, sanctions, suspend and withdrawal. If the site reserves broad discretion, publish that limit next to the marketing claim.

Crypto-only payments do not remove the issue. The wallet itself can be screened, and a transaction can lead to a request. Wallet connection, VPN reachability or a successful deposit is not evidence that later checks are impossible.

Do not attempt to preserve “no KYC” status by splitting transactions, using false details, location masking or opening duplicates. Stake’s AML statement explicitly says it will block users who provide fake identification or deceive about location. Other operators can impose similar account-integrity rules.

Secure delivery

Use the authenticated upload route and verify support identity

Open the casino by typing or using a saved official URL, sign in securely and navigate to its verification centre. Confirm that the request also appears inside the account. If it arrived by email, do not upload through the email link until the domain and account notification match.

Use the file formats, size limits and image standards stated in the request. Keep the original files and a copy of the submission confirmation. Avoid public Wi-Fi, shared devices and cloud links with open permissions.

Stake’s privacy policy says it processes government identification, address, location, device and account-activity data for KYC and related purposes, may share data with service providers or for legal reasons, and does not guarantee that Internet transmission is totally secure. That is a reminder to minimise unnecessary exposure while still providing complete required fields.

If the only option is email, confirm the address from the official policy page and ask whether an encrypted portal is available. Stake’s policy page lists support@stake.com, but this guide does not instruct readers to send sensitive files there without a case-specific confirmation.

Necessary versus unrelated data

Redact only when the operator confirms what may be hidden

Redaction can protect unrelated transactions, account balances or identifiers, but it can also destroy the evidence. A source-of-funds reviewer may need the account holder’s name, issuer, account number, period, incoming payment, transfer and balance context. Hiding those fields without permission can cause rejection.

Ask in writing: which pages are required, which fields must remain visible, which unrelated transactions may be obscured, and whether partial account numbers are accepted. Keep the unredacted original in case the operator requests it through a verified secure route.

Do not alter values, dates, names or metadata. A crop that changes meaning is not privacy protection. If a document contains another person’s information, ask for an alternative record instead of uploading their data without authority.

The Stake help examples checked here say the entire document should be visible and that key identifying and issuer fields must appear. That makes unilateral redaction particularly risky for its process. Another operator may publish different rules.

No universal clock

Review duration is an operator condition, not a payment-network estimate

A blockchain can confirm while KYC remains open. The review may include automated extraction, manual inspection, third-party checks, follow-up questions and a decision. Network speed does not predict those stages.

Do not publish a universal “KYC takes 24 hours” claim. Read the current service target, if one exists, and distinguish a target from a guarantee. Complex source-of-funds cases can require more evidence than basic identity checks.

Record the request time, deadline, files submitted, confirmation, follow-up and decision. If there is no update after the stated period, reply through the same official case and quote the reference number. Repeated duplicate uploads can make the record harder to follow.

Verification can delay withdrawal approval without changing the game’s RTP or blockchain confirmation. Keep account review, operator processing and network settlement as three separate timestamps.

Dispute discipline

If evidence is rejected, correct the record rather than evading it

Ask for the specific failure: expired document, cropped edge, mismatch, unreadable image, unsupported issuer, stale address record or insufficient source trail. Fix the exact problem where possible. Do not open another account, submit another person’s document or change location details to bypass the case.

If the operator cannot explain the request, preserve the terms, request, submissions and support transcript. Use its formal complaint process and identify the named contracting entity and regulator before escalating. A social-media post is not a substitute for a complete private evidence file.

Where sensitive data appears compromised, secure the account and linked email, change passwords, revoke sessions and contact the document issuer if necessary. Do not send more documents until the destination is verified.

A rejected KYC result does not prove fraud by either party. The strongest report states what was requested, which policy applied, what was submitted, the reason given and what appeal route remains.

Private audit file

Keep enough evidence to explain the account without oversharing

Store the accepted terms version, account identifier, official support contacts, verification requests, submission receipts, transaction hashes, exchange statements and withdrawal records. Use encrypted local or trusted secure storage, not a public folder.

Label each record with its purpose. Identity, address, payment ownership and source of funds should not be mixed into one unexplained pile. A short index can show which document answers which question and the date range covered.

Never keep seed phrases beside casino documents. Wallet recovery material belongs offline in a separate secure system. The casino evidence file should contain only public addresses and transaction references necessary to reconstruct the payment trail.

Retention requests and deletion rights depend on the operator’s policy and legal obligations. Stake’s privacy notice says deletion can be requested but is not guaranteed where a legal reason requires storage. Closing an account also cannot erase a public blockchain transaction.

Worked evidence chain

A salary-to-exchange-to-wallet deposit requires connected records

Suppose a user receives salary into a bank account, buys cryptocurrency at an exchange, withdraws it to self-custody and later deposits part at a casino. A source-of-funds question may need the payslip or salary credit, exchange account statement, purchase, withdrawal and on-chain transaction into the casino.

The bank statement alone does not show the crypto purchase. The transaction hash alone does not identify the lawful income. The exchange withdrawal alone may not establish control of the intermediate self-custody address. Together, the records can explain the route without revealing the private key.

If the deposit is materially larger than regular income, a source-of-wealth question may remain. That could require investment, sale, inheritance or business evidence. The user should describe the true source rather than forcing an ill-fitting salary explanation.

This example is a documentation model, not a promise of acceptance. The operator decides which records satisfy its policy, and the user should confirm permitted redactions and delivery method before submission.

New Zealand context

Passing KYC does not settle New Zealand gambling eligibility

An operator can verify an identity and still prohibit the account because of country rules or product restrictions. Conversely, a form accepting a New Zealand document does not prove the service is permitted. Read the exact contracting entity’s terms and the site’s dated New Zealand legal-status guide.

Use authentic New Zealand identity and residence records only when a verified operator request lawfully requires them. Do not use fake addresses or location tools to defeat a restriction. Stake’s AML statement specifically treats attempts to deceive about location as a blocking condition.

Privacy, account verification and marketing preferences are also different tasks. A request to stop promotional email does not delete compliance records; a successful KYC check does not consent to every marketing use. The operator’s privacy notice should explain access, correction, retention and complaint contacts.

If gambling causes harm, verification friction should not become a reason to chase a balance or deposit elsewhere. Use the controls and contacts in the responsible gambling guide.

Practical preparation

Crypto casino KYC and source-of-funds checklist

1. Identify the exact domain and contracting operator.
2. Save current terms, AML policy, privacy notice and document rules.
3. Confirm New Zealand eligibility separately.
4. Use truthful account details and one account.
5. Check whether identity, address, selfie or liveness evidence may be required.
6. Ask what event can trigger enhanced due diligence.
7. Keep lawful income and crypto purchase records before depositing.
8. Preserve asset, network, wallet addresses and transaction hashes.
9. Use payment methods and wallets you control.
10. Confirm accepted file formats, dates and permitted redactions.
11. Upload only through a verified secure route.
12. Never disclose a seed phrase, private key, password or one-time code.
13. Record the request, deadline, submission and case number.
14. Do not evade a restriction with false documents, duplicate accounts or location masking.
15. Use the formal complaint path if a documented request remains unresolved.

The safest assumption is conditional: an operator may ask later even if registration is light. Decide whether the possible evidence burden and data exposure are acceptable before money leaves a wallet.