KYC Tools for Online Casinos: Free vs Paid
Key takeaways
- KYC tools must cover five jobs: data and document checks, liveness and face match, screening, ongoing monitoring, and case records with an audit trail.
- OFAC's Sanctions List Search is free but, per OFAC, should not be used by automated systems that continually run searches.
- OpenSanctions data is CC BY-NC 4.0 for non-commercial use; commercial use needs a paid licence.
- Free official lists support manual spot checks but do not authenticate documents, match faces or keep an audit trail.
- Most small operators fit a hybrid: free references for spot checks plus paid per-check ID, screening and case components.
KYC tools are the software and data sources an online casino uses to verify players, screen them against sanctions lists, monitor them over time and keep a record of every decision. Free official lists support manual spot checks, but they do not authenticate documents, run liveness checks, supply licensed PEP data or keep an audit trail.
Most pages on this topic are vendor listicles written for banks. This guide is written for a small casino or sportsbook that wants to know where free ends and risk begins. It maps free sources to the five jobs a KYC stack has to do, using each publisher's own stated limits, then gives a starter stack and a checklist to use before you sign with any vendor. It is general information, not legal advice; confirm obligations with counsel in each market where you operate.
The five jobs your KYC tools must do
Know your customer (KYC) is the process of establishing who a customer is before and while they transact. It sits inside a wider anti-money laundering (AML) programme. In an online casino, the KYC tools you choose have to cover five separate jobs, and a tool that handles one of them says little about the others.
- Data and document checks. Confirm the name, date of birth and address a player gives you, either against data sources or against an ID document captured by camera. Optical character recognition reads the document; separate checks judge whether it is genuine.
- Liveness and face match. Show that the person holding the document is present and is the person pictured. A liveness test is the selfie or video step that does this.
- Screening. Check the player against sanctions lists, politically exposed person (PEP) data and adverse media.
- Ongoing monitoring. Re-screen existing players when lists or circumstances change, rather than only at signup.
- Case management and audit trail. Record who decided what, when and why, so a regulator can reconstruct an account's history.
The regulators set the timing. The Alcohol and Gaming Commission of Ontario (AGCO) Registrar's Standards for Internet Gaming, standard 3.04, require a player's name, date of birth, address, contact information and PCMLTFA information to be collected and validated before an account is created. For photo ID checked without the person present, the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) describes a method that authenticates the document using technology and then matches the name and photo through a live video comparison or a selfie plus facial recognition; viewing the document over video alone is not enough. That is the standard your tools are measured against, and it is why the first two jobs rarely have a free answer.
If you are still choosing between vendors, our guide to how to compare KYC providers and platforms covers the four vendor categories, benchmarks, an RFP checklist and a pilot design.
Free KYC tools that exist - and their stated limits
Several governments publish sanctions data at no charge, and some open-data projects publish more. These are genuinely useful for a human making a spot check, for learning how matching behaves and for a backup when a vendor is down. Each one also states a limit, and the limits matter more than the price.
Official sanctions lists and search tools
| Tool or list | Publisher | What it covers | Stated limit |
|---|---|---|---|
| Sanctions List Search | Office of Foreign Assets Control (OFAC) | Searches OFAC sanctions lists, including the Specially Designated Nationals and Blocked Persons List; fuzzy name matching | A free tool to assist the public; OFAC says it should not be used by automated systems configured to run searches continually, and points to its machine-readable files for that. Matching works on the name field. |
| UK Sanctions List | Foreign, Commonwealth and Development Office | All UK sanctions designations; downloadable in several formats plus a search tool | Single source since 28 January 2026. The OFSI Consolidated List of Asset Freeze Targets closed that day and is no longer updated, so any process still using it is stale. |
| Consolidated Canadian Autonomous Sanctions List | Global Affairs Canada | Designations under the Special Economic Measures Act (SEMA) and the Justice for Victims of Corrupt Foreign Officials Act; HTML, PDF and XML; last updated 22 September 2026 when we checked | The page states the list is not a regulation and does not have force of law. |
| Consolidated List | United Nations Security Council | The Security Council maintains a Consolidated List of sanctions designations | Format and terms not verified for this guide; check the source before building a process on it. |
| Open sanctions and PEP data | OpenSanctions | Open data on sanctioned persons and politically exposed persons | Licensed CC BY-NC 4.0 for non-commercial use; commercial use needs a paid licence. |
The OFAC row deserves emphasis. OFAC's own guidance on its Sanctions List Search FAQ describes the tool as free and says it should not be utilized by automated systems that are configured to continually run searches through it. It also explains that fuzzy matching on the name field uses Jaro-Winkler and Soundex algorithms, which means a human still has to judge the candidate matches. A casino that wires its signup form to the web tool is using it in a way its publisher advises against.
List sources, matching quality and the PEP and adverse media categories are covered in detail in our guide to KYC screening for iGaming; this page covers the free-versus-paid decision instead.
Where free tools stop
Free lists answer one question: is this name on this list? They do not answer who the player is, whether the document is real, whether the face matches or what happened last month. The table below sets each KYC job against the free route and the gap a casino has to close.
| KYC job | Free route | Gap | Why it matters for a casino |
|---|---|---|---|
| Data and document check | Staff review uploaded ID by eye | No technology-based authentication of the document | FINTRAC's non-face-to-face method requires the document to be authenticated using technology; AGCO 3.04 requires validation before account creation. |
| Liveness and face match | Video call or selfie compared by staff | Viewing over video alone does not meet FINTRAC's method | Needs live video comparison or a selfie with facial recognition after document authentication. |
| Sanctions screening | Manual search of official lists | Not for automated use (OFAC); no force of law for the Canadian list; no re-screening | A manual search is a point-in-time check. Lists change, and a player cleared at signup can be designated later. |
| PEP and adverse media | Open data under a non-commercial licence | Commercial use needs a licence; we found no official free source for adverse media | Operating a casino is commercial use, so non-commercial data cannot simply be loaded into production. |
| Eligibility checks | None in the sanctions lists | Self-exclusion and age rules are separate integrations | AGCO 3.01 makes players under 19 and self-excluded persons ineligible; no sanctions list covers that. |
| Monitoring, case notes and audit trail | Spreadsheet or shared folder | Hard to prove completeness, access control or timing | AGCO 3.10 requires an auditable trail of events for account creation, activation, deactivation and account changes. |
Open data licences: OpenSanctions as an example
OpenSanctions publishes its data under the CC BY-NC 4.0 licence, which allows non-commercial use. A casino using it in production is a commercial user. According to OpenSanctions' licensing page, commercial use requires one of three arrangements: a Screening API sold as prepaid credits, a flat-rate Screening Licence for in-house use, or an OEM licence for products that embed the data. No prices are published; you request a quote. The example generalises. Before loading any free dataset into a live onboarding flow, read its licence for the words commercial, automated and redistribution, and ask whether your use falls inside them.
Free tools are still useful, but as references rather than a compliance system. None of them meets the AGCO or FINTRAC expectations above on its own.
When to move from free to paid
There is no single player-count trigger, but five conditions usually push a small operator to a paid platform.
- Your licence requires validated data before account creation. If staff would have to validate every signup by hand before the account opens, the process cannot scale and cannot be consistent.
- You need technology-based document authentication and face matching. No free official tool provides these.
- Manual review time grows faster than signups. Our KYC providers guide treats a first-attempt document pass rate of 80 to 92 percent as healthy, so even a well-run flow sends roughly 8 to 20 percent of attempts to retry or review.
- You need an exportable audit trail. A regulator or an internal audit will ask for a player's full verification history, not a folder of screenshots.
- You need screening that runs without a person. Automated use of the OFAC web tool is discouraged, and OpenSanctions data needs a commercial licence, so automation means machine-readable files you maintain or a licensed provider.
Cost is the usual objection, so use the ranges from our own guides to size it. Our KYC providers guide puts data-source checks at about $0.10 to $0.50 per check and document-plus-biometric checks at about $0.50 to $2.00 or more. As an illustration only, 1,000 document-plus-biometric checks in a month would cost roughly $500 to $2,000 at those ranges, and 1,000 data-source checks roughly $100 to $500. Actual quotes vary by vendor, volume and market, and some markets accept data-source verification alone for onboarding. Our KYC cost per check guide explains the pricing models and what to ask for in a quote.
A minimal KYC tool stack for a small operator
This is our editorial view, not a sourced requirement: small operators are usually better served by a hybrid of free references and paid per-check components than by either extreme. Free references stay useful for human spot checks. Production screening should use machine-readable files or a licensed provider, not a person typing names into a web form.
| Layer | Free reference | Paid component | Note |
|---|---|---|---|
| Identity and document | Regulator guidance (AGCO, FINTRAC) to set the rules | Per-check ID and biometric service | Choose by the markets you hold licences in; confirm the method meets the regulator's wording. |
| Sanctions screening | OFAC, UK and Canadian lists for a manual second opinion | Screening API or licensed list data | Automated screening needs machine-readable data, not the web search tools. |
| PEP and adverse media | None we can recommend for commercial production use | Licensed dataset through your screening provider | Check the licence terms on commercial use. |
| Eligibility | Regulator information on self-exclusion and age rules | Registry integration where the regulator provides one | A separate integration from KYC vendors. |
| Review and audit trail | Internal procedures | Case management; optionally outsourced review | See KYC managed services for outsourcing and KYC onboarding software for the onboarding flow. |
Start with the layer that carries the most regulatory risk and the least free coverage: document authentication and the audit trail. Add screening automation next, and treat free lists as a check on your vendor rather than a replacement for one.
How to evaluate any KYC tool before you sign
Use these questions in demos and in the RFP. Ask for written answers, and test them in a pilot with your own traffic rather than a vendor's sample set.
- Does the data licence permit commercial use in a live casino, and is automated use allowed?
- Which of the five jobs does the tool cover, and which does it leave to a partner?
- How is pricing structured: per check, per active player, platform fee or a mix? What counts as a billable check, including retries?
- Can you export a player's full event history for a regulator, and in what format?
- What is the retention period, and can you change it by jurisdiction?
- Which jurisdictions and ID document types are supported, and what is the fallback when a check fails?
- How does the tool handle self-exclusion registry checks and age eligibility?
- Does the document check authenticate the document with technology, and does the face-match step meet the regulator's method?
- How does ongoing screening work after signup, and how are alerts routed to reviewers?
- What are the support hours and response commitments, and can you run a pilot before committing?
When you have answers, take them to the RFP checklist and pilot design in our operator guide to KYC providers.
Responsible gambling: online gambling is for adults only: 19+ in Ontario and 18+ in many other jurisdictions, depending on local law. Verification protects players and operators alike. If gambling stops being fun, contact your local support service, and use deposit limits, time-outs and self-exclusion tools.
Frequently asked questions
Are there free KYC tools for an online casino?
There are free official sanctions lists and search tools from OFAC, the UK, Canada and the UN, and open data such as OpenSanctions for non-commercial use. They help with manual spot checks. They do not authenticate ID documents, match faces, supply commercially licensed PEP data or keep an audit trail, so licensed operators normally add paid components.
Can I automate sanctions screening with the OFAC search tool?
OFAC says the Sanctions List Search tool should not be utilized by automated systems that are configured to continually run searches through it, and it points to its machine-readable files for automated checking. Use those files or a licensed provider for production screening.
Is open sanctions data free for commercial use?
Not necessarily. OpenSanctions licenses its data CC BY-NC 4.0 for non-commercial use. Commercial use needs a paid Screening API, Screening Licence or OEM licence, and prices are quoted on request. Read the licence of any dataset before using it in a live casino.
What does a paid KYC platform add over free tools?
Technology-based document authentication, liveness and face matching, automated screening under a commercial data licence, ongoing monitoring, case management and an exportable audit trail. These map to expectations such as AGCO standards 3.04 and 3.10 and FINTRAC photo-ID methods.
How much does a KYC check cost?
Our KYC providers guide puts data-source checks at about $0.10 to $0.50 and document-plus-biometric checks at about $0.50 to $2.00 or more per check. Quotes vary by vendor, volume and market, so treat these as approximate and test with a pilot.
Compare independently vetted sites.
See reviews18+ only. Gambling can be addictive — please play responsibly and only bet what you can afford to lose. If gambling is affecting you or someone you know, contact a local support service. This content is informational and never a guarantee of winnings.
Written and reviewed by the iGaming Expert Hub editorial team. Facts checked against primary sources; see the reference above.