Identity verification and data security
Gambling operators collect some of the most sensitive data any consumer business holds: identity documents, dates of birth, addresses, sometimes biometric checks and source-of-funds evidence. That data must be protected, and the verification process itself is a security control. Regulators have fined operators when weak identity checks let fraudsters open and fund accounts.
What identity data operators hold
Identity verification data typically includes name, address and date of birth, copies of identity documents, selfie or liveness checks, verification results from third-party providers, and for higher-risk customers, source-of-funds documents. Each item has a different sensitivity and retention need.
Controls
| Area | Control |
|---|---|
| Minimization | Collect only what the verification and AML duties require; store results rather than raw documents where the provider allows. |
| Access | Role-based access with MFA; support agents see masked data; log every view of documents. |
| Encryption | Encrypt in transit and at rest; manage keys separately from data. |
| Retention | A documented schedule tied to legal duties, with deletion that actually runs. |
| Suppliers | Contracts covering data location, sub-processors, breach notice and deletion; see vendor risk. |
| Staff | Vetting and licensing where required, training, and prompt removal of access. |
The ICO's security outcomes, developed with the NCSC, are grouped into managing security risk, protecting personal data against cyber-attack (including identity and access control and data security with "appropriate encryption"), detecting security events, and minimizing the impact of incidents.
What regulators have fined
Pennsylvania's Gaming Control Board has fined operators where identity controls failed:
- March 2026: BetMGM, $100,000. The Board's release said it had "insufficient Know-Your-Customer ("KYC") protocols that allows for the creation, access and use of multiple accounts" and "the funding of those accounts using stolen or fraudulently obtained payment devices."
- May 2026: Wind Creek Bethlehem, $50,000 for "failure to follow Know Your Customer (KYC) guidelines", enabling fraudulent withdrawals of more than $92,000 from iGaming accounts; and Greenwood Gaming, $40,000 "for permitting the employment of five unlicensed individuals" with access to iGaming account holders' personal identifying information (Board release).
The lesson runs both ways: weak verification lets fraud in, and too-broad access to verification data is itself a compliance failure.
Verification as a security control
Strong identity verification at registration makes account takeover recovery more reliable and multi-accounting harder. In Great Britain, license condition 17.1.1 requires remote operators to verify name, address and date of birth before a customer can gamble. Link verified identity to payment instruments and devices so that a second account using the same card or device is noticed.
Questions about KYC data security
Have gambling regulators fined operators for weak KYC?
Yes. In 2026 Pennsylvania's Gaming Control Board fined BetMGM $100,000 and Wind Creek Bethlehem $50,000 for KYC failures that enabled fraudulent accounts or withdrawals.
Should operators keep copies of ID documents?
Only as long as legal and AML duties require, with strict access controls and encryption. Where a verification provider can return a result instead of a document, keeping less data reduces risk.
Sources
- Pennsylvania Gaming Control Board releases, 25 March 2026 and 20 May 2026
- ICO, Security outcomes (9 September 2025)
- Gambling Commission, LCCP condition 17.1.1
- All sources checked 24 October 2026.