KYC ID Verification: Documents Accepted by Market
Key takeaways
- Accept only authentic, valid and current government-issued photo ID with name, photo and unique number.
- Remote onboarding must use technology to authenticate documents; viewing ID over video alone is not enough under FINTRAC guidance.
- Do not collect Ontario or Quebec health cards as ID.
- NFC chip reads of ICAO 9303 ePassports give the strongest result but can't cover Canadian driver's licences.
KYC ID verification means confirming a player's identity from an authentic, valid and current government-issued photo document, usually a passport, driver's licence or national ID card, matched to a live selfie. Which documents you accept depends on the market: Ontario, Quebec, the UK and the EU each have different ID types, age limits and rules.
For an iGaming operator, the document list is where compliance meets conversion. Accept too little and genuine players abandon sign-up; accept the wrong thing and you fail an audit. In Canada the baseline comes from FINTRAC's methods to verify identity; in Ontario the AGCO and iGaming Ontario add their own standards; in Britain the UK Gambling Commission requires verification before any gambling. This guide lists accepted documents by market and explains when NFC chip reading of an ePassport is worth adding.
What makes an ID document acceptable
FINTRAC's methods to verify the identity of persons and entities guidance is a useful template even outside Canada. A government-issued photo ID must:
- be authentic, valid and current (not expired, altered or counterfeit);
- be issued by a federal, provincial or territorial government, or an equivalent foreign government;
- show the person's name and photo and carry a unique identifying number;
- match the name and appearance of the person being identified.
Municipal photo IDs are not acceptable, and a provincial health card cannot be used where provincial law prohibits it. For online (non-face-to-face) onboarding, authenticity must be confirmed with technology that assesses the document's security features. FINTRAC is explicit that simply viewing a person and their ID over video is not enough; a selfie compared by facial recognition, or a verified live video process, is expected.
Choosing a vendor that handles all of this well is the biggest decision here. Our comparison of the best KYC providers for iGaming covers document coverage, NFC support and pricing.
KYC ID verification documents accepted by market
| Market | Minimum age | Commonly accepted photo ID | Watch out for |
|---|---|---|---|
| Ontario (AGCO / iGaming Ontario) | 19+ | Canadian passport, Ontario driver's licence, Ontario Photo Card, permanent resident card, other provincial driver's licences | Ontario health card: do not collect it as ID; Ontario law restricts its use |
| Quebec (Loto-Québec / Espacejeux and private sites) | 18+ | Canadian passport, Quebec driver's licence (SAAQ), permanent resident card | RAMQ health insurance card: restricted; do not require it as ID |
| Rest of Canada | 18+ or 19+ by province | Passport, provincial driver's licence or photo ID card | Age differs: 18 in Alberta, Manitoba and Quebec; 19 in most other provinces |
| United Kingdom (UKGC) | 18+ | Passport, DVLA photocard driving licence, national ID cards of EEA nationals, eVisa share code for status | Biometric residence permits expired at the end of 2024 and were replaced by eVisas |
| European Union (national regulators) | Usually 18+; some countries set higher ages for certain games | Passport, national identity card (chip-enabled under EU Regulation 2019/1157), some national driving licences | Driving licences are not treated as ID documents in every member state |
Age limits and accepted documents above are summarised from public regulator and government information as at September 2026. Confirm the current list with the regulator in each market you are licensed in.
Second documents: proof of address and database checks
Photo ID often needs backing up. Canada's dual-process method lets you confirm identity from two independent reliable sources, such as a utility bill plus a bank statement, and the credit file method uses a Canadian credit bureau file (Equifax Canada or TransUnion Canada) that has existed for at least three years. These non-document methods are useful for players whose ID fails a scan, and for reducing friction on low-risk accounts where your policy allows.
Keep the accepted ID documents list short and clear
The accepted ID documents list you show players should match exactly what your vendor can verify in that market. Showing a long list that includes documents your system cannot authenticate simply moves the failure to later in the flow. For most Canadian flows, passport, driver's licence and provincial photo card cover the large majority of adults; add permanent resident cards and foreign passports for newcomers, and keep a manual-review path for everything else.
How document verification works, step by step
- Capture: the player photographs the front and back of the document in the app or browser.
- Classification: the vendor identifies the document type, issuing country and version against its template library.
- Data extraction: OCR reads the printed fields and the machine-readable zone (MRZ) or barcode, and checks that they agree.
- Authenticity checks: fonts, layout, holograms, microprint and tampering signs are compared with the genuine template.
- Selfie and liveness: a live selfie is matched to the document photo, with liveness detection to stop printed photos, screen replays and deepfakes.
- Decision and screening: the result, plus age and sanctions or PEP screening, decides approve, refer or reject.
NFC passport verification: when it's worth adding
Most passports issued worldwide are ePassports with an NFC chip built to the ICAO Doc 9303 standard of the International Civil Aviation Organization. The chip stores the MRZ data (Data Group 1) and the holder's facial image (Data Group 2), digitally signed by the issuing state. Reading it with a phone gives a far stronger result than a photo of the page.
| Factor | Photo (OCR) verification | NFC chip read |
|---|---|---|
| What is checked | Image of printed document | Cryptographically signed data from the chip |
| Forgery resistance | Good; high-quality fakes can pass | Very high; a signed chip can't be cloned by editing an image (passive authentication) |
| Photo for face match | Photographed, can be low quality | Original high-quality image from the chip |
| Player effort | Low: snap two photos | Medium: scan the MRZ, then hold the phone on the document |
| Device support | Any camera | NFC-capable phones; iPhones and most Android phones support it |
| Document coverage | Very wide | Chip documents only: ePassports, EU national ID cards, some other national IDs |
How the chip is accessed and verified
The phone first reads the MRZ with its camera to derive the access key, then opens a secure session using Basic Access Control or the newer PACE protocol. Passive authentication checks the issuing country's digital signature over the data; chip or active authentication, where supported, proves the chip itself is genuine and not a copy. Your vendor needs up-to-date country signing certificates for passive authentication to mean anything, so ask how they source them.
Where NFC fits for Canadian operators
The Canadian passport is an ePassport, but Canadian driver's licences and provincial photo cards generally have no NFC chip. That means NFC can only ever be one option in an Ontario or Quebec flow, not a requirement. A sensible pattern is to offer NFC first to players who choose a passport, fall back to photo verification for licences, and reserve NFC as a step-up for high-risk triggers such as large withdrawals, suspected document fraud or account recovery. In the EU, where chip-enabled national ID cards are now standard, NFC can cover a much larger share of players.
Reducing drop-off without cutting corners
- Show the accepted list up front, by country, before the camera opens.
- Coach the capture: auto-capture, glare detection and edge guides cut resubmissions.
- Allow a second attempt with a different document before sending the player to manual review.
- Route failures to people, fast: a manual review queue with a same-day target keeps genuine players. If review volume spikes, KYC managed services can absorb it.
- Verify before play: in Ontario and the UK, age and identity must be confirmed before any gambling, so do not rely on "verify at withdrawal".
Why ID documents get rejected
Document verification failures are rarely fraud. Most are capture problems or document types your flow does not support. Tracking the reason codes your vendor returns is the fastest way to lift pass rates.
| Rejection reason | Typical cause | Fix |
|---|---|---|
| Image quality | Glare, blur, cropped edges | Auto-capture with glare detection; allow retakes |
| Expired document | Player uses an old licence | Show the expiry rule before capture |
| Unsupported document | Temporary paper licence, student card, health card | List accepted IDs by market up front |
| Data mismatch | Name or date of birth differs from registration | Pre-fill registration from the document where allowed |
| Face match fail | Old photo on document, poor lighting | Liveness guidance; human review for borderline scores |
| Suspected tampering | Edited image, screen photo, template forgery | Reject and flag; consider NFC step-up |
Identity verification in iGaming: build or buy?
Almost every operator buys document verification rather than building it, because template libraries for thousands of ID types, liveness models and country signing certificates are expensive to maintain. What you should own is the policy: which documents you accept in each market, when you step up to NFC or manual review, and how quickly you resolve referrals. For identity verification in iGaming, that policy is what regulators audit. Budget per check matters too; see our breakdown of KYC cost per check before you sign a volume contract.
Selfie liveness check: passive vs active
A selfie liveness check confirms a real person is present. Active liveness asks the player to turn their head or follow a prompt; passive liveness analyses a single selfie or short clip for signs of a printed photo, mask or screen replay. Passive checks convert better, while active checks can be harder to spoof. Many operators use passive by default and switch to active for high-risk triggers.
Record keeping and data protection
Keep a record of the document type, its unique number, issuing jurisdiction, expiry date and the date and method of verification. FINTRAC generally expects identity records to be retained for at least five years. Store document images only as long as your legal basis allows, encrypt them, and restrict access. In Canada, PIPEDA and provincial privacy laws apply; in the UK and EU, the GDPR does. Collect only what the law requires, which is another reason not to collect health cards.
This guide is general information as at September 2026, not legal advice; document rules and age limits change, so confirm with each regulator. Online gambling is for adults only (19+ in Ontario, 18+ in Quebec and the UK). Operators must offer deposit limits, time-outs and self-exclusion, and players who feel gambling is no longer fun should use them.
Frequently asked questions
What documents are accepted for KYC ID verification in Ontario?
Commonly a Canadian passport, Ontario or other provincial driver's licence, Ontario Photo Card or permanent resident card. Players must be 19 or older, and health cards should not be collected as ID.
What is NFC ID verification?
Reading the chip inside an ePassport or chip ID card with a phone to retrieve data signed by the issuing government, which is far harder to fake than a photo of the document.
Is a video call enough to verify ID remotely in Canada?
No. FINTRAC guidance says simply viewing a person and their ID over video is not enough; technology must be used to confirm the document is authentic.
Can a driving licence be used for KYC in the EU?
Sometimes. Passports and national identity cards are standard; driving licences are not treated as identity documents in every member state, so check each market.
How long must ID verification records be kept?
FINTRAC generally expects identity records to be kept for at least five years. Other regulators set their own periods, and data protection law limits how long images may be stored.
Compare independently vetted sites.
See reviews18+ only. Gambling can be addictive — please play responsibly and only bet what you can afford to lose. If gambling is affecting you or someone you know, contact a local support service. This content is informational and never a guarantee of winnings.
Written and reviewed by the iGaming Expert Hub editorial team. Facts checked against primary sources; see the reference above.