Every casino licensed to operate in Ontario has to know who you are. Operators get no discretion about it. Verification is a condition of holding the registration that lets them take your money in the first place.
What almost no site explains is the second half. Where does your driver’s licence go after you upload it? Who looks at it? How long does it sit on a server, and what can you ask about it later?
This guide covers both parts: why the check exists, and what happens to your documents once it’s done.
Why an Ontario casino has to ask
Three different laws converge on the same request for your ID. That’s why no licensed operator will let you skip it.
The first is eligibility. The Registrar’s Standards for Internet Gaming require operators to collect your name, date of birth and address at registration, and to validate that information as complete and accurate before the account is created. The minimum age for online gambling in Ontario is 19, and a self-reported birthday doesn’t establish it.
The second is self-exclusion. Since BetGuard launched on 14 May 2026, Ontarians can exclude themselves from all 82 regulated gambling sites in one registration instead of site by site. Operators have to keep centrally self-excluded people from opening new accounts or getting back into old ones, and that check is only as good as the identity sitting behind it.
The third is anti-money-laundering law. An internet lottery scheme open to the public falls inside the definition of a casino under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act, which carries reporting, record-keeping and identity-verification duties with it. Ontario runs a conduct-and-manage model: iGaming Ontario is the body legally conducting and managing the games, and private operators run the sites under agreement with it. Neither FINTRAC nor iGO publishes a plain statement of where the reporting line falls between the two, so treat any confident claim about that as an assumption. What isn’t in doubt is that someone in the chain has to collect the information, and you’re the only source of it.
When the check actually happens
There’s no single moment called verification. There are several gates, and you pass them at different points.
- At registration, the operator collects and validates your details. Your account shouldn’t be created until that data is complete and accurate.
- At login, you’re authenticated before you can reach the account or place a bet. Most Ontario sites offer multi-factor authentication too, and it’s worth switching on.
- Before a withdrawal comes the hard gate, and the one players tend to notice. The operator has to confirm the withdrawal is being made by the account holder, and that the money is going to an account they legally hold.
- On large wins, a further check applies. Where winnings reach $10,000 or more, the standards call for additional verification before the money is released.
That sequence is why documents usually get requested around the first cash-out rather than at signup, and why it catches people out. You can almost always submit everything on the day you register instead. Nothing stops you, and it moves the slow part of the process to a day when you’re not waiting on money. Our guide to real money casinos in Ontario covers the cashier side of the same process.
What they ask for, and what each document proves
No official AGCO checklist of documents exists. What exists is a set of things the operator has to establish, and the industry has landed on much the same paperwork to establish them.
| Document | What it establishes | Usual requirement |
|---|---|---|
| Government photo ID | That you exist, that you’re 19 or over, and that the name matches the account | Driver’s licence, passport or provincial ID, unexpired, all four corners visible |
| Proof of address | That you live where you say you do, which matters for an Ontario-licensed account | Utility bill, bank statement or government letter, usually dated within three months |
| Proof of payment method | That the card or bank account is legally yours and not a third party’s | Statement or card image with the middle digits and security code covered |
| Selfie or liveness check | That the person holding the ID is the person in the photo on it | Requested by some operators, not all; sometimes only on a flagged account |
| Source of funds | Where unusually large deposits came from | Requested at higher thresholds or on an AML flag, not routinely |
Each document closes a different gap, which is why sending three copies of the same driver’s licence doesn’t move anything along.
The check you never see
Before any of that, most Ontario operators run an electronic identity check against Canadian credit bureau records held by Equifax or TransUnion. If your name, date of birth and address match a credit file of sufficient age, you’re verified without uploading anything and the document request never arrives.
This is an identity lookup rather than a credit application. Soft inquiries of this kind work differently from the hard inquiry a lender runs, and they don’t affect your credit score. No Ontario gambling regulator publishes guidance on that specific point, so we’re applying the standard credit-bureau distinction rather than quoting a rule at you. But the worry that opening a casino account will damage your credit rating is misplaced.
A thin credit file fails the match, though. Younger players and recent arrivals to Canada are the ones most likely to get pushed into manual document review, through no fault of their own.
What happens to your ID after you upload it
It depends on the operator, and the detail lives in a privacy policy almost nobody opens. What the law fixes is the shape of it.
Your documents usually don’t stay with the person you spoke to. Most operators route uploads to a specialist identity-verification provider rather than reviewing them in-house, so the file passes to a third-party processor working under contract. The casino stays accountable for it under Canadian privacy law whoever ends up holding it.
Under PIPEDA, the federal private-sector privacy law, an organisation can only use personal information for the purpose it told you about when it collected it. An ID uploaded to satisfy a verification requirement can’t be quietly repurposed into marketing segmentation. The Office of the Privacy Commissioner also expects organisations relying on identity documents to use them only for that stated purpose, and to have decided in advance how long they’ll keep them and how they’ll be destroyed.
Once the review clears, what usually persists on the live system is a verification status against your account plus a record of how and when the check was done. The underlying image might be kept or deleted according to the operator’s own retention schedule. That’s the thing worth checking before you upload rather than after.
How long they keep it
No single retention figure exists, and anyone quoting you one number is merging rules that don’t merge. At least three separate obligations apply, and they set floors rather than ceilings.
| Record type | Minimum retention | Set by |
|---|---|---|
| Anti-money-laundering records | Five years from when the record was created | PCMLTFA / FINTRAC |
| Account records | Five years from the closure of the account | PCMLTFA / FINTRAC |
| Compliance and control logs | Three years, unless another rule says longer | AGCO standards |
| Personal information generally | Only as long as it serves the stated purpose | PIPEDA |
Read together, they say something uncomfortable. Closing your casino account doesn’t start a clock that ends in deletion any time soon. The five-year AML floor runs from account closure rather than from your last login, and it overrides the general privacy principle that data should go once it’s no longer needed. The law requiring them to hold it beats the law that would otherwise require them to bin it.
The FINTRAC record-keeping guidance for the casino sector has the detail if you want the primary source.
What you’re entitled to ask for
PIPEDA gives you real rights over this material. They’re rarely advertised, and they cost nothing to use.
- You can ask an operator what personal information it holds about you, how it’s being used, and who it has been disclosed to. Put the request in writing and keep the date.
- If the information is wrong, whether that’s a misspelled name or a stale address, you can challenge its accuracy and have it amended.
- An operator has to be able to say why it collected each thing it collected. Compliance on its own isn’t an answer.
- Where a breach of security safeguards creates a real risk of significant harm to you, the organisation has to notify both you and the Privacy Commissioner. It also has to log every breach it suffers, including the ones below that threshold, and keep those records for two years.
- If an operator won’t answer, the Office of the Privacy Commissioner of Canada takes complaints about how private-sector organisations handle personal information. The AGCO separately takes complaints about registered gambling operators.
What you generally can’t do is withdraw consent for the verification data while a statutory retention period is still running. That request will be refused, and the refusal is lawful.
The version of this that should worry you
Everything above describes an operator inside a regulated market, where there’s a regulator to complain to and a privacy commissioner with jurisdiction. The same upload to an unlicensed offshore site buys you none of that.
You’re still handing over a passport scan, a utility bill and a bank statement, which is the exact bundle somebody needs to open credit in your name. What you lose is the recourse. There’s no AGCO complaints process. Enforcement is unrealistic if the data gets sold or leaked, and frequently there’s no identifiable Canadian entity to serve a privacy request on. The documents are worth the same to a criminal either way. The difference is what happens when something goes wrong.
This is the least glamorous argument for playing inside the regulated market, and probably the strongest. Every operator on our Ontario casino rankings is registered with the AGCO, and our Ontario online gambling guide explains how to confirm a site’s registration yourself.
Getting through it in one attempt
Most verification delays are self-inflicted and avoidable. A rejected upload usually restarts the review rather than pausing it, so the first attempt is the one worth getting right.
- Register with your legal name exactly as it appears on your ID, including middle names and hyphens. Mismatches here cause more failures than anything else.
- Photograph the document flat, in daylight, with all four corners in frame. Glare across a hologram gets it bounced.
- Check the expiry date before you send it.
- Send both sides when both sides are asked for.
- Use a proof of address dated within the last three months, showing the same address as your account.
- Deposit and withdraw with a method in your own name. A partner’s card will fail, and correctly so.
- Upload on the day you sign up rather than the day you win.
If a document gets rejected, ask support which specific field failed instead of resubmitting the same file. Operators frequently know the reason and don’t volunteer it. For the payment side of this, our Interac casinos guide covers matching your banking details to your account.
The bottom line
A licensed Ontario casino asks for your ID because eligibility rules, the central self-exclusion register and federal anti-money-laundering law all require it to know who holds the account. An operator that didn’t ask would be the real warning sign.
The back half deserves more attention than it gets. Your documents may pass to a third-party verification provider. A five-year retention floor keeps AML records alive well past the day you close your account. PIPEDA gives you a free right to ask what’s held and who has seen it. Read the privacy policy before you upload rather than after, and keep the bundle away from sites that aren’t registered here at all.
You must be 19 or older to gamble online in Ontario. If gambling is causing problems for you or someone you know, ConnexOntario offers free, confidential support 24 hours a day at 1-866-531-2600.