A new online casino account in the UK cannot take a deposit until the operator has confirmed the customer is 18 or over, and cannot let that customer play until name, address and date of birth have been verified. Those rules have applied since May 2019 under licence condition 17 of the Gambling Commission’s Licence Conditions and Codes of Practice, and anyone comparing sign-up offers meets them at the first screen. That is why a page listing the current Virgin Games promo code is only half the story: the code does nothing until the account behind it has cleared verification.
What has changed since 2019 is the machinery: database lookups instead of document uploads, selfie checks on mobile, and since July 2026 a confirmed structure for financial risk assessments built on credit reference data. Each layer adds a step between registration and first play.
Document OCR, liveness checks and database matching at registration
Most licensed operators start with an electronic check: the name, address and date of birth typed into the form are matched against credit reference files, the electoral roll and other public records. If the match is strong enough, the customer never sees a document request. Licensees must tell customers before they deposit which documents might be needed.
When the electronic match fails, the fallback is a document and a face. The customer photographs a passport or driving licence, optical character recognition reads the machine-readable zone and the printed fields, and the software checks security features against known templates. A liveness check then asks for a short selfie, turning the head or following a dot on the screen, to confirm a real person is present rather than a printed photo or a replayed video. The face from the selfie is compared with the face on the document, and every added step loses some customers.
Age verification before deposit and before free-to-play games
Social responsibility code provision 3.2.11 requires remote licensees to verify age before a customer can deposit funds, access free-to-play versions of games, or gamble with their own money or with a free bet or bonus. The requirement is set out in the Commission’s consultation response on age and identity verification, in force since 7 May 2019. The demo slots on a casino homepage therefore sit behind the same gate as real-money play.
For most adults the age check is invisible, because the identity match already confirms a date of birth. The exceptions are younger customers with thin credit files, recent movers and people who have changed their name. The Commission’s July 2026 blog noted that its pilot found some high-spending customers whose identity had never been verified properly.
Financial vulnerability checks at £150 and the staged financial risk assessments
Since 28 February 2025, operators have had to run a light-touch financial vulnerability check on any customer whose net deposits exceed £150 in a rolling 30 days, down from the £500 threshold that applied from 30 August 2024. These checks use only public data such as County Court Judgments and Debt Relief Orders, and they do not affect credit ratings.
After a pilot that ran from August 2025, the Commission announced on 7 July 2026 that it would introduce financial risk assessments in a staged approach. Stage one covers the largest operators and triggers at net deposits above £5,000 in a rolling 24 hours for customers aged 25 and over, or £2,500 for under-25s. The final-stage thresholds are £1,000 in 24 hours or £3,000 in 90 days for over-25s, and £750 or £2,000 for under-25s. The assessment is document-free: the credit reference agency returns an overall risk rating plus four data points (defaults, multiple arrears, significant arrears and any debt management plan), with no mark on the customer’s credit score.
The pilot numbers explain why the regulator pressed on despite objections from the Betting and Gaming Council. 97% of customers above the thresholds could be assessed frictionlessly, against the 80% assumed in the 2023 white paper, and fewer than 3% of all accounts would need an assessment at the final stage. The stage one start date has not been published, and no enforcement action will follow a failure to act on an assessment during the early stages.
UK GDPR and the ICO’s limits on what operators may do with the data
All of this processing falls under UK GDPR. In a July 2023 open letter to UK Finance, the Information Commissioner’s Office confirmed that data protection law does not stop credit reference agencies sharing information for financial risk checks, provided the sharing is proportionate, that operators may use the data only for the check itself, and that customers must be told in advance that such checks can happen. The Commission’s 2026 guidance repeats the point: using assessment data for marketing or any commercial purpose is treated as a serious licensing matter.
The legal basis has also shifted. The Data (Use and Access) Act 2025 added a “recognised legitimate interest” to UK GDPR from 5 February 2026, with safeguarding of vulnerable individuals among its listed purposes, and the ICO published final guidance on it on 23 March 2026. Operators relying on it must update their privacy notices.
What the checks mean for sign-up time and promo code redemption
For a reader who has just entered a promotional code, the effect is sequencing. The code is attached to the account at registration on sports betting or casino platforms, but the qualifying deposit cannot be made until age and identity are confirmed. Operators cannot confiscate deposited funds or bonus winnings because a document arrived late, a position set by Competition and Markets Authority action and restated by the Commission in 2019. The next dated checkpoint is the Commission’s formal consultation response fixing the stage one start for financial risk assessments, still outstanding on 14 October 2026.
