Dutch Gambling Regulator Issues Bank Account Verification Guidance

The Netherlands Gambling Authority (Kansspelautoriteit, Ksa) published new guidance on October 8, 2026 setting out how licensed online gambling operators must verify players’ bank accounts and other payment methods, after research into the registration process found that gambling companies do not always carry out the checks adequately.

The Ksa said it had received signals that minors, although not permitted to gamble, could in some cases deposit at gambling companies using their own bank account. The research carried out in response found that gambling was possible with youth accounts, and that a minor’s bank account could be linked to the player account of an adult participant. The announcement said the guidance gives direction on checking first names when verifying payment accounts, and also addresses the use of business accounts and other payment methods.

The guidance document applies only to licensed providers of remote gambling. It sets out what the Ksa considers an adequate quality control of a player’s counter-account, the unambiguous tracing of payment transactions to the person of the player, and the prevention of gambling with business bank accounts.

Research Behind the Guidance

According to the document, the trigger was a Ksa study into how minors could gamble online despite age restrictions, conducted among nine gambling providers using data from four Dutch banks. The regulator said the identified problem also applies to people registered in the Cruks self-exclusion register and to people under guardianship. Inadequate checks also give players the opportunity to create a second account under another name, which can be used to commit bonus fraud, hedge bets or circumvent playing limits, the document states.

Verification Duties and Payment Methods

Under the guidance, the licence holder must carry out an adequate quality control on the data collected when a player registers: the surname, all first names, date of birth and place of birth as recorded on the player’s identity document, the bank account number and the account-holder name. Before or during the first deposit from a new or changed counter-account, the operator must check that the full first names and surname on the identity document match the account-holder name. Only payment instruments that can be unambiguously traced to the person of the player may be accepted, and deposits via Paysafe, PayPal, credit cards and possibly other methods must meet the same traceability standard as deposits from a bank account.

For Paysafe, the guidance notes that when an account is created the holder’s identity document is verified, a selfie is taken and the address is established; Paysafe supplies full first names, surname and date of birth to the operator on request, and the operator must verify that information against its own player data. A private PayPal account can be opened without an immediate identity-document upload: initial checks run on basic data through national databases, and identity is indirectly verified when a bank account or credit card is linked and confirmed. PayPal can share the data with the operator, which remains responsible for verifying it.

For credit cards, checking full first names and surnames with issuers is not currently possible. The Ksa said it has been informed that a mechanism capable of this is being developed, and in the meantime recommends checking with as much available information as possible, with the initiative resting with the operator. The regulator classifies transactions where full names cannot be fully checked, or where identity was not established through an identity document, as an elevated risk that operators are expected to mitigate.

Account-Name Checks, Business Accounts and Re-Checks

The Ksa’s research found that checking transaction details alone is insufficient because those details usually show initials rather than all first names, so a name comparison from transaction data cannot confirm the full account-holder name. Initials alone do not satisfy the quality-control or traceability requirements, the document states.

A more reliable account-name check mechanism has been mandatory since October 2025 under European rules in payment traffic between European banks and is offered in the Dutch market by SurePay, BlueM, CDDN and Signicat; variants are already used by two-thirds of Dutch online gambling operators. The mechanism works for Dutch and foreign accounts, uses personal data held directly at the bank, checks full first names and surname, and can identify whether an account is personal or business and how many holders it has. It returns three outcomes: a match, meaning the account or transaction can be accepted; no match, meaning it cannot; and a partial match, which can only be accepted after additional, possibly manual, checks. Such checks can use so-called fuzzy logic, and minor deviations such as “ij” in place of a “y” can still allow registration to be completed, while larger deviations require a stricter assessment of whether it concerns the same person. A partial match need not automatically lead to refusal, and other control mechanisms are permitted provided they enable a full-name check. The Ksa recommends combining an identity-document scan, iDIN data, a liveness check and player-supplied information, with the ID scan advisable as the first step.

Licence holders may register only natural persons as players, and the Ksa states that business counter-accounts and deposits from business accounts held by a legal entity or a sole proprietorship must be prevented, citing risks for the duty of care and under the Dutch anti-money-laundering law, the Wwft. Gambling with the assets of a private limited company (BV) or a general partnership (VOF) can have legal and tax consequences and can erode the trust of shareholders or partners, and such accounts generally cannot be unambiguously traced to one player. For a sole proprietorship a business account is often traceable to the player, but the guidance calls its use “absolutely undesirable”: such accounts hold larger balances, income tax and VAT money can sit on them for months and may tempt a problem gambler to treat it as a temporary loan, transfers to gambling sites are unlimited, a liquidity shortfall can threaten the business, and the spending stays hidden from the player’s partner. Using a business account for gambling also conflicts with banks’ own terms and carries an elevated money-laundering risk.

Players whose counter-account or deposit account was not verified on all first names must be re-checked, with operators free to run a one-off bulk check or to re-verify at a player’s next activity, such as a login, deposit or payout, meaning long-inactive players may only be checked much later. Operators already checking in the prescribed way need not re-check their entire database. Foreign bank accounts are not excluded in advance where the proposed methods work poorly, but that constitutes an elevated risk requiring other measures such as requesting bank statements. The Ksa acknowledges that a minor sharing a parent’s exact first names will likely pass an automated check, and says combining multiple data sources reduces that chance.

The document closes with best practices, including facial recognition and liveness detection to bind a player to a digitally submitted identity document, a measure that is not yet mandatory but is already used by some operators to counter underage participation, meet Wwft obligations, prevent fraud and support the duty of care. Manual-review signals listed include a notation that the holder is unable to sign, hands visible on an identity-document scan that do not match the pictured person’s age, an email address containing a different name or birth year, a bank statement marked “jongerenrekening” (youth account) and a child’s voice when contacting the player. The question-and-answer section notes that banks do not currently supply a date of birth with a transaction, that new possibilities are being examined and that the Ksa will communicate any change to the market.