Kahnawake Gaming Commission KYC Requirements (2026)

Kahnawake Gaming Commission KYC requirements oblige licensees to collect set registration data, block anyone under the "approved age", identify each player at sign-up and finish verification before any payout and within 30 days, file suspicious matter reports within five business days, and report transactions of $10,000 or more within ten business days.

Those obligations come from two documents published by the Kahnawake Gaming Commission (KGC), the regulator based in the Mohawk Territory of Kahnawake near Montreal: the Regulations concerning Interactive Gaming, most recently amended on 25 March 2026, and the separate Regulations concerning Anti-Money Laundering and Counter Terrorism Financing, dated 30 June 2021. This guide walks through both with section numbers so a compliance officer can map each rule to a control. It is a plain-language summary, not legal advice: confirm every obligation against the current text and with the Commission or qualified counsel before relying on it.

Kahnawake Gaming Commission KYC requirements at a glance

Know your customer (KYC) under the KGC is not a single rule. It is a chain that starts with the registration form, runs through age controls and customer due diligence, and ends with reporting and record-keeping. The table below pulls the core obligations into one place, with the section of the relevant regulation so your team can check the source wording.

The detail that matters most is timing: a player may deposit before verification is complete, but cannot be paid anything until it is, and the whole process has a 30-day ceiling. That ceiling is the first thing to test when you shortlist KYC providers for iGaming operators: automated checks need to clear most players quickly and leave time for manual review of the rest.

Which rules apply: the 2026 Interactive Gaming Regulations and the AML/CTF Regulations

The Regulations concerning Interactive Gaming were first enacted on 8 July 1999 and have been amended many times since; the version on the Commission's site at the time of writing is dated 25 March 2026. They cover licensing, game fairness, player accounts and player protection. The AML provisions that used to sit in Part XXII of those regulations (sections 226 to 235) have been repealed and replaced by the stand-alone Regulations concerning Anti-Money Laundering and Counter Terrorism Financing, dated 30 June 2021. Both documents are listed on the official Kahnawà:ke Gaming Commission regulations page, which is the place to check for later amendments.

The player-facing duties fall mainly on holders of a Client Provider Authorization, the authorization the Commission issues to operators that run player-facing gaming sites, and in places on holders of a Casino Software Provider Authorization. In practice, if you run the player account and take deposits, you should assume both sets of regulations apply to you in full. White-label arrangements do not remove the obligation; they only change who performs each control, so contracts should say clearly which party runs CDD, files reports and keeps the records.

The AML/CTF Regulations follow the risk-based approach promoted by the Financial Action Task Force: identify the customer, understand the relationship, monitor it, escalate higher risk and report suspicion. Teams already running an FATF-style programme elsewhere will recognise the structure; what differs is the specific deadlines and thresholds below.

Player registration and the "approved age"

The Interactive Gaming Regulations define the "approved age" as the greater of 18 years or the age at which the player is allowed to gamble in the jurisdiction where they live. That means a single global age gate set to 18 is not enough. A resident of a province or country that sets the threshold at 19, 20 or 21 must be held to that higher figure, so your age logic has to read the declared residence and apply the correct threshold per market.

Mandatory registration fields (s.243)

Section 243 lists what the registration process must capture: the player's full names, residential address, age or date of birth, contact details, a password, and positive acceptance of the terms and conditions. "Positive acceptance" means an active step such as ticking an unticked box, not a line of small print the player scrolls past. These fields feed later verification, so validate formats at entry rather than cleaning data when a withdrawal is pending.

One account per website (s.245)

Section 245 limits each player to one account per website. Duplicate detection is therefore a compliance control, not just a bonus-abuse tool. Matching on name, date of birth, address, device and payment instrument helps you catch second accounts opened to dodge self-exclusion, deposit limits or a failed verification. Section 247 adds that no wager may be accepted unless it is made from an account in the player's own name with adequate funds, and section 252 ties withdrawals to completed identity verification.

Underage play: refunds, forfeiture and fines (ss.237-240)

Section 237 requires licensees to take all reasonable measures to prevent anyone under the approved age from playing. Where a breach is wilful or careless, the Commission may suspend or revoke the authorization and impose a fine of between $1,000 and $20,000 for each instance. If an underage player does get through, section 239 requires any money they paid to be returned as soon as reasonably practicable, and section 240 forfeits any prizes they won to the Commission. Because the fine is per instance, a weak age gate puts both money and the licence at risk.

Customer due diligence: timing and measures

Customer due diligence (CDD) is the core of the AML/CTF Regulations, which set both when checks happen and what they must contain.

When CDD starts and the 30-day deadline

Under section 18, identification happens at account opening, which the regulations tie to registration and acceptance of the terms. Verification of that identity must then be completed as soon as reasonably practicable after the first deposit, before any payment is made to the customer, and in any case within 30 days. The order matters for product design: you can let a player deposit and play while checks run, but cash-out must stay locked until verification clears, and accounts that are still unverified on day 30 need a defined outcome rather than being left open indefinitely.

That window is the main thing to test when choosing vendors: a provider that clears most players in seconds but has no manual-review path for the rest leaves you with a backlog against a fixed deadline. Our provider comparison looks at document, database and biometric options you can combine to clear most players automatically and route the remainder to analysts well before the 30-day limit.

What CDD must include

Section 19 describes CDD as identifying the customer and verifying that identity using reliable, independent documents, data or information. For customers that are legal entities, it includes identifying beneficial owners. It also requires understanding the purpose and intended nature of the business relationship and conducting ongoing monitoring of that relationship, including scrutiny of source of funds where necessary. If your monitoring flags deposits that do not fit a player's profile, our guide to source of funds checks covers triggers, acceptable evidence and how to document the decision.

When you can't verify a player

Section 19(3) is the rule most competitor summaries miss. Where you cannot complete CDD, you must not open the account, or must terminate the relationship, and make a suspicious matter report. A failed verification is therefore not just a customer-service ticket to be fixed by asking for another document; it is a reporting event that the compliance function should review and record with reasons.

Enhanced due diligence and PEPs

Section 20 requires enhanced due diligence (EDD) where risk is higher. Section 20(2) lists the triggers: a change in the customer's risk assessment, signs that the identity is wrong or has changed, transactions inconsistent with what you know about the customer, a suspicion of money laundering or terrorist financing, or doubts about identification data obtained earlier. Section 20(3) measures are additional information to verify identity, additional information on source of funds, senior management approval to start or continue the relationship, and enhanced monitoring. In an online casino, practical signals that feed those triggers include high deposit volumes, rapid changes in staking pattern, use of multiple payment methods, or residence in a higher-risk jurisdiction; your risk assessment should define them in writing so analysts apply them consistently.

Section 21 sets specific measures for a politically exposed person (PEP), and extends them to family members and close associates. That means screening has to cover relatives and known associates, not only the player's own name, and screening has to be repeated during the relationship because a player can become a PEP after onboarding. For PEPs, section 21(3) requires senior management approval, reasonable measures to establish source of funds, and enhanced ongoing monitoring; document how you do this in your casino AML compliance program alongside the risk assessment and training plan.

Reporting and record-keeping deadlines

The reporting rules give the clearest numbers in the KGC framework. A suspicious matter report must be made within five business days of forming a suspicion that a transaction or matter may relate to money laundering or another crime. Where the suspicion concerns possible terrorist financing, section 25(3) shortens that to 24 hours. The report must state the grounds for the suspicion, and decisions on whether or not to report should be documented so the reasoning can be reviewed later.

A threshold transaction report is required under section 28 for any transaction of $10,000 or more, filed within ten business days and stating whether the transaction was in cash, by electronic funds transfer, in e-currency or in crypto-currency. Section 24 then sets the record-keeping floor: transaction records for at least five years, and CDD records such as identification copies and account files for at least five years after the business relationship ends.

Two practical points follow. First, business-day clocks need a calendar that your case-management system understands, including weekends; a "five days" timer that counts calendar days will drift. Second, the threshold report is based on transaction size, not suspicion, so it should be generated automatically from payment data rather than left to an analyst to notice.

KGC vs FINTRAC for Canadian-facing operators

Many KGC licensees serve players in Canada, which raises the question of how the Commission's rules sit next to FINTRAC, Canada's financial intelligence unit. The short answer is that they are separate frameworks with different reporting channels, terminology and deadlines. The KGC regulations talk about suspicious matter reports and threshold transaction reports; Canadian federal law uses its own report types and thresholds, which provincially regulated casinos follow. A KGC authorization governs your obligations to the Commission; it does not by itself make your offer lawful in every Canadian province, and provinces take different positions on operators they have not licensed.

For a team building one KYC stack for several markets, the safest design is to meet the stricter rule on each point and keep the reporting outputs separate. Our guide to client identity verification in Canada covers the federal side; we have deliberately not restated FINTRAC thresholds here, because they should be checked against FINTRAC's own current guidance rather than a secondary summary.

Implementation checklist for compliance teams

The checklist below converts the cited sections into controls. It is a starting point for a gap analysis, not a substitute for reading the regulations or taking advice.

• Age gate that reads declared residence and applies the approved age (18, or higher where local law says so), with documented reasonable measures under s.237.
• Registration form capturing every s.243 field, with an unticked terms checkbox for positive acceptance.
• Duplicate-account detection across identity, device and payment data to enforce s.245.
• Payment rules that block wagers from accounts not in the player's name (s.247) and lock withdrawals until identity is verified (s.252).
• A CDD workflow with a 30-day timer from first deposit, automated verification first and manual review before the deadline (AML/CTF s.18).
• Beneficial-owner checks for any corporate customers and ongoing monitoring with source-of-funds escalation (s.19).
• A failed-verification path that closes the account and routes the case to compliance for a suspicious matter report (s.19(3)).
• Documented EDD triggers (s.20) and PEP screening that covers family and close associates, repeated during the relationship (s.21).
• Case management with business-day timers: 5 business days for suspicious matter reports, 24 hours for terrorist financing, 10 business days for threshold transaction reports (ss.25, 28).
• Retention rules of at least five years for transactions and five years after closure for CDD files (s.24).
• An underage-play playbook covering refunds (s.239), forfeiture of winnings (s.240) and an incident log.

KYC also supports player protection. Real-money gambling is for adults only: 18+ at a minimum and higher where local law requires. Players should treat gambling as paid entertainment, never as a way to earn money, and operators should make deposit limits, time-outs and self-exclusion easy to find. Players who feel gambling is becoming a problem can contact a local support service such as the gambling help line in their province.

Regulations change; the Interactive Gaming Regulations alone have been amended many times since 1999. Treat this page as a map to the current documents, not legal advice, and confirm the wording with the Kahnawake Gaming Commission before you finalize policies.

18+ only. Gambling can be addictive — please play responsibly and only bet what you can afford to lose. If gambling is affecting you or someone you know, contact a local support service. This content is informational and never a guarantee of winnings.

Written and reviewed by the iGaming Expert Hub editorial team. Facts checked against primary sources; see the reference above.

← All articles