Age Verification for Online Gambling in the UK: What Operators Need

A player signs up, picks a welcome offer, and reaches for their card. Before any money moves, a screen asks them to prove who they are and how old they are. Some are through in seconds. Others have to photograph a passport, then hold the phone steady against an NFC chip and wait while it reads. A few of them close the tab and never come back. The operator has just lost a legitimate, ready-to-deposit customer at the one step meant to protect the business.

Age verification for online gambling in the UK is not optional, and it is not a one-off. The Gambling Commission requires operators to confirm both identity and age before a customer can deposit or play. The method an operator picks at that gate decides whether the player who wanted to deposit actually does.

Which age verification solutions handle online gambling compliance in the UK?

In the UK, online gambling operators must verify a customer’s identity and age before that customer deposits, plays a free-to-play game, or gambles, under the Gambling Commission’s licence conditions. Where a site also runs chat or other social features, the Online Safety Act adds a separate age-assurance duty enforced by Ofcom. Verification that finishes in seconds, across several methods, keeps genuine players from leaving at the gate.

What the Gambling Commission requires before a player deposits

The Gambling Commission sets two distinct duties, and both land before the customer touches their money. Age must be verified before a customer can deposit funds, access free-to-play versions of gambling games, or gamble with their own money, a free bet, or a bonus. Separately, the operator has to obtain and verify enough information to establish the customer’s identity, including name, address, and date of birth, before that customer is permitted to gamble.

There is a disclosure duty on top of that. The operator must tell the customer what identification may be required before they deposit, so nobody hits an unexpected wall mid-flow.

These rules tightened on 7 May 2019, when the Commission removed the old window that let customers play for up to 72 hours before verification completed [Source: Gambling Commission, New age and identity verification rules, 7 May 2019]. The checks now sit firmly at the front door. That makes the speed and completion rate of those checks a commercial concern, not only a legal one.

Does the Online Safety Act apply to a gambling site?

The Online Safety Act runs in parallel to the Gambling Commission’s rules and is enforced by Ofcom. Meeting the Commission’s conditions does not discharge it. The Act does not bite on a gambling site simply because gambling happens there. It applies where the operator runs user-to-user features such as chat, forums, livestream, player profiles, or multiplayer lobbies.

Those social features trigger a children’s access assessment and a duty to use highly effective age assurance to keep under-18s out of them. Where strong age verification already gates entry to the platform, that assessment is usually straightforward to satisfy. An operator running a pure betting product with no social layer faces the Commission’s duties without the additional Ofcom one. Add community features and both apply.

The ordered checks before a first deposit

The sequence below maps the duties an operator works through before and around a player’s first deposit. The first three apply to every UK gambling operator. The fourth is conditional on social features. The fifth runs in the background once spending thresholds are reached.

1. Confirm age before the customer deposits, accesses free-to-play games, or gambles for real money.
2. Verify identity including name, address, and date of birth before the customer is permitted to gamble.
3. Disclose required identification up front, so the customer knows what may be asked before depositing [Source: Gambling Commission, LCCP Condition 17.1.1].
4. Apply highly effective age assurance to social features where chat, forums, livestream, or profiles exist, to keep under-18s out of them.
5. The operator runs background financial vulnerability checks once a customer reaches the spending thresholds, without halting play unless a risk flag is raised.

That fifth point reflects a deliberate design choice by the regulator. The light-touch financial vulnerability checks use public data only, and operators are not required to pause deposits or play while a check runs unless something is flagged. The thresholds sit at GBP 500 net deposits in a rolling 30 days from 30 August 2024, reducing to GBP 150 from 28 February 2025. The Commission’s stated aim is to keep the experience frictionless for the vast majority of players. That gives operators a regulator-backed reason to prioritise verification that does not stall the player.

Why the method decides whether the player stays

Every approved method satisfies the rules, but they vary widely in how many genuine players actually finish the check. Completion rates differ by up to 30 percentage points depending on the method, so a compliant choice can still turn away a third of legitimate players before they deposit.

The gap between 80-90% and 50-60% completion is the difference between a player who deposits and one who abandons. Reading a passport chip asks someone to hold their phone flat against a specific page, keep contact while the chip is read, and then troubleshoot when the NFC handshake fails on a device that handles it inconsistently. A bank-verified check sends the player to a login screen they already trust and finishes in under 12 seconds.

Coverage compounds the effect. While 88% of UK adults hold a passport and 75% hold a driving licence, 98% have a bank account. An operator that depends on document upload alone is, by design, harder to reach for a slice of its audience than one offering bank-based or mobile routes alongside it.

Offering more than one path matters because gambling audiences are not uniform. A younger casino player may resist a face scan, while someone without a passport to hand still has a phone and a bank account. Multiple compliant routes to the same outcome reduce the proportion of genuine players lost at the gate.

Identity, age, and AML in one certified check

Gambling operators carry anti-money-laundering obligations alongside their age and identity duties. HM Treasury and DSIT confirmed in February 2026 that firms in scope for UK AML regulations can use providers certified under the Digital Verification Services Trust Framework to meet Customer Due Diligence obligations. That lets an operator address age, identity, and AML through a single certified route rather than stitching together separate suppliers.

The Trust Framework, renamed from the Digital Identity and Attributes Trust Framework, sets the UK government’s certification standard for verification providers and gained statutory backing on 1 December 2025 under Part 2 of the Data Use and Access Act 2025. Certification means independent assessment against standards covering security, fraud prevention, and risk management, with certified providers listed on a public register. For a gambling operator answering to the Commission on how it chose a verification partner, that register is a clean answer.

Choosing a verification partner for a gambling product

Start with the regulation that applies to the specific product. A betting site with no social layer works through the Commission’s three front-door duties. A platform with chat or community features adds the Ofcom duty on top. Map that first, because it sets the scope of what the verification has to do.

Then look at the player experience. Check the completion rate each method achieves and the coverage it gives across the audience, and confirm the provider offers enough methods to match different players rather than routing everyone through the slowest one. Certification under the Trust Framework should be a baseline, not a differentiator, since it gives the operator an audited answer when the regulator asks.

A provider that offers several of Ofcom’s seven highly effective methods through one integration gives an operator room to match the method to the player. OneID is a UK digital verification services provider, among the first certified under the Digital Verification Services Trust Framework as an Identity Service Provider, the first Orchestration Service Provider, and the first Holder/Wallet provider. It offers five of Ofcom’s seven approved methods through a single integration, with facial age estimation handled on-device, and a bank-verified check that completes in under 12 seconds.

Explore age verification options at oneid.uk/oneid-age-verification.

Frequently asked questions

Which age verification solutions handle online gambling compliance in the UK? UK online gambling operators must verify identity and age before a customer deposits or plays, under the Gambling Commission’s licence conditions. Solutions that meet this offer methods recognised by Ofcom as highly effective, such as bank-verified identity, MNO age checks, and document verification. Providers certified under the Digital Verification Services Trust Framework give operators an audited route.

Does the Online Safety Act apply to gambling sites? The Online Safety Act applies to a gambling site where it runs user-to-user features such as chat, forums, livestream, or player profiles, not simply because gambling takes place there. Those features trigger a children’s access assessment and a duty to use highly effective age assurance, enforced by Ofcom, in addition to the Gambling Commission’s own rules [Source: Online Safety Act 2023; Ofcom, Guidance on Highly Effective Age Assurance, 2024].

What age verification does the Gambling Commission require? The Gambling Commission requires operators to verify a customer’s age before they can deposit, access free-to-play games, or gamble, and to verify identity including name, address, and date of birth before the customer gambles. Operators must also disclose up front what identification may be needed before a deposit [Source: Gambling Commission, SR Code 3.2.11; LCCP Condition 17.1.1].