How does an Ontario online casino decide when to ask for additional identity documents after I have already been playing?

Picture this: you've been playing at a regulated Ontario site for a few months without a hitch, then one day you go to process a withdrawal and the platform asks for a copy of your government ID, a utility bill, or proof of your payment method. No warning, no obvious reason. What's actually going on?

The short answer is that KYC — "know your customer" — doesn't end at registration. It's an ongoing obligation layered across two separate rule-sets: the AGCO's regulatory standards and Canada's federal anti-money laundering law.

The AGCO layer: keeping your file accurate and current

Player information must be kept complete and accurate throughout the life of an account — that's a direct requirement in the AGCO's standards for iGaming operators. Separately, the list of prohibited and excluded individuals changes from time to time, and player information must be re-verified at the time of change and at regular intervals thereafter. In plain terms: if the self-exclusion registry is updated, the operator has to recheck every account against it. That periodic sweep can surface your account for re-verification even if nothing you did personally raised a flag.

The AGCO's framework is deliberately outcomes-based rather than prescriptive. The standards represent the Registrar's expectations for a registrant, and operators have the flexibility to develop the best control activities for their business that are able to meet the stated outcome. That flexibility means each operator sets its own internal triggers — so the exact threshold at which one site asks for a selfie with your ID may differ from another site's threshold, even though both are playing by the same rulebook.

The FINTRAC layer: federal AML obligations

Ontario's regulated operators are also reporting entities under Canada's Proceeds of Crime (Money Laundering) and Terrorist Financing Act. Casinos enter into a business relationship with a client when they open an account or the second time they are required to verify the client's identity — and once a business relationship exists, casinos have ongoing monitoring requirements. That ongoing monitoring is what produces mid-account document requests.

The contextual information acquired through KYC requirements, or the behaviour of a client particularly surrounding a transaction or a pattern of transactions, may lead an operator to conduct an assessment to determine whether a suspicious transaction report is required. In other words, the system is watching patterns, not just individual transactions. A sudden spike in deposit volume, a change in payment method, or activity that doesn't match the profile on file can all be enough to prompt a fresh document check — even for a player who verified cleanly at signup.

iGaming Ontario has established a comprehensive Anti-Money Laundering Policy and Program that includes the key elements prescribed by FINTRAC, and iGO monitors operator risk and oversees operator compliance with iGO AML requirements. So there's a second layer of oversight sitting above the individual operator, watching whether operators are doing their ongoing monitoring properly.

The practical triggers you're most likely to encounter

• First significant withdrawal. Where winnings equal $10,000 or more, additional verification must take place — that's baked into the OLG standards and mirrors federal thresholds. Private operators have their own (often lower) internal limits.
• Change in payment method. Switching from one card or e-wallet to another often triggers a proof-of-ownership check, since the operator must confirm the withdrawal goes to an account the player legally holds.
• Account information update. Changing your address, name, or phone number can require supporting documentation to keep the file accurate under the AGCO's standards.
• Transaction patterns that deviate from your profile. A risk-based AML review can fire on unusual deposit frequency or size, regardless of whether you've done anything wrong.
• Routine periodic review. Some operators schedule re-verification at fixed intervals as part of their compliance programs, independent of any specific event.

If you're playing on a legitimate, registered Ontario site, you'll see both the iGaming Ontario logo and the BetGuard logo displayed — those are the signals that the site is conducted and managed by iGaming Ontario and regulated by the AGCO. If a document request comes from a site that can't show both, that's worth pausing over. The full list of registered operators is at the official iGaming Ontario registry.

One practical note: being asked for documents mid-account is normal and not a sign your account is in trouble. Cooperating promptly is the fastest path through it. If gambling ever feels like it's becoming a source of stress rather than entertainment, ConnexOntario (1-866-531-2600) is the Ontario support line — and BetGuard (betguard.ca) lets anyone 19+ self-exclude from every registered Ontario operator in a single step.