Know Your Customer (KYC) for iGaming operators refers to the identity verification, age verification, screening and due diligence checks that licensed betting and gambling businesses in South Africa must perform on their players in order to comply with the Financial Intelligence Centre Amendment Act (FICA) and the National Gambling Act 7 of 2004.

The sector sits in an unusual position. iGaming is simultaneously one of the fastest growing industries in South Africa and one of the most heavily scrutinised, because high transaction volumes, rapid digital money movement and non-face-to-face onboarding combine to make gambling attractive to money launderers. Gambling turnover across all verticals reached approximately R1.5 trillion in the 2024/25 financial year, with gross gambling revenue of around R75 billion, and online betting revenue growing roughly 60 percent year on year.

That growth has attracted regulatory attention on two separate fronts at once: what operators are licensed to offer, and how rigorously they verify the people they are offering it to. This guide covers both.

Are iGaming Operators Accountable Institutions Under FICA?

Yes. Item 9 of Schedule 1 to the FIC Act designates as an Accountable Institution any person who carries on the business of making available a gambling activity as contemplated in section 3 of the National Gambling Act, in respect of which a licence is required from the National Gambling Board or a provincial licensing authority.

This captures bookmakers, totalisators, casinos, bingo operators and limited payout machine operators alike. The designation was left unchanged by the December 2022 expansion of Schedule 1, so gambling operators have carried the full suite of FICA obligations for many years.

Those obligations include registering with the Financial Intelligence Centre (FIC), developing and implementing a Risk Management and Compliance Programme (RMCP), conducting customer due diligence, screening players against sanctions lists, monitoring relationships continuously, reporting prescribed transactions, keeping records for five years, appointing an anti-money laundering compliance officer, and training staff. Refer to our guides: What is an Accountable Institution? FICA Obligations Unpacked and What is a Risk Management and Compliance Programme (RMCP)?

Compliance is layered rather than singular. An operator answers to the FIC for its FICA obligations, and separately to the provincial licensing authority that issued its licence for gambling law compliance, with the National Gambling Board providing national coordination. There are nine provincial licensing authorities, and licence conditions are not uniform across them.

Which Online Gambling Activities Are Legal in South Africa?

This question matters for KYC because an operator's licence scope determines which regulator is assessing its controls, and because offering an unlicensed product exposes a business to far more than an AML finding.

The position as it stands is narrower than the market's appearance suggests. Online sports betting and horse racing betting through an operator holding a valid licence from a South African provincial licensing authority is lawful. Interactive gambling that falls outside the four legally recognised modes, being casinos, limited payout machines, bingo and betting, is prohibited under the National Gambling Act unless authorised by national law. The National Gambling Amendment Act of 2008, which would have regulated interactive games, was passed but its commencement was never proclaimed.

The practical position in 2026 is genuinely contested. Following a Supreme Court of Appeal ruling in October 2025, the National Gambling Board took the view that bookmakers may not offer casino-style games under a betting licence, and in February 2026 issued formal notices to provincial licensing authorities to that effect. The Western Cape Gambling and Racing Board and the South African Bookmakers' Association have publicly disputed that interpretation. The dispute remained unresolved through mid-2026, which means operators in different provinces have effectively been working to different rules for the same product.

Meanwhile the Remote Gambling Bill, introduced in 2024, would create a national licensing framework for remote gambling with mandatory player registration and age verification. It remains before Parliament and is not in force. The Department of Trade, Industry and Competition has been reviewing the National Gambling Act since October 2025, and a separate policy process is under way.

Operators should confirm the current position with their own provincial licensing authority rather than relying on market practice, because what competitors are doing is not presently a reliable guide to what is permitted.

What Does the FIC Require Before a Player Can Place a Bet?

This is the single most important compliance point in the sector, and the one most frequently breached.

The FIC issued Public Compliance Communication 20 specifically to address online betting clients. Its central instruction is unambiguous: it is an offence for a bookmaker or totalisator to accept funds from a client for the purpose of betting before the identification and verification process has been completed. Betting accounts should not be active while verification is outstanding.

The FIC issued that guidance precisely because it had observed the opposite industry practice, namely accepting deposits and allowing play for a period while verification caught up. The Centre described that practice as a contravention of the FIC Act. For an industry that competes on speed of onboarding and depends on capturing players during event-driven spikes, this is a direct commercial tension, and resolving it by delaying verification is not an available option.

Three further points from that guidance remain operationally important.

1. A copy of an identity document is not verification: The FIC stated plainly that producing a copy of a client's identity document, whether certified or not, does not establish that identity has been verified. Emailed or scanned documents serve a record-keeping function, not a verification function.
2. Non-face-to-face onboarding must be equally effective: Where a player is never met in person, the operator must take additional steps that provide a similar degree of comfort to what face-to-face verification would give. Among the practical measures the FIC itself suggested was verifying player identity and address against a third-party database such as Home Affairs or a credit verification provider.
3. An operator cannot rely on the bank's KYC: Because bookmakers and totalisators are Accountable Institutions in their own right, they cannot lean on identification and verification performed by the banks handling player deposits.

One caveat on currency. PCC20 dates from 2013 and refers to regulations and exemptions that were repealed with effect from 2 October 2017, when the prescriptive identification chapter of the Money Laundering and Terrorist Financing Control Regulations was withdrawn and FICA moved to a risk-based approach. There is no longer a statutory list of acceptable documents. The principles in PCC20 survive that change, but they now operate through the operator's RMCP rather than through fixed rules, which means the operator must document its own verification standard and then meet it.

What KYC Checks Should an iGaming Operator Run?

A defensible onboarding sequence for a South African operator generally includes the following.

• Age verification: No person under 18 may gamble. Verifying an identity number against the Department of Home Affairs (DHA) HANIS database returns the date of birth from the authoritative source rather than accepting a self-declared age, which is the difference between an age gate and age verification.
• Identity verification: The same check confirms that the identity number is valid and returns the associated name, vital status and citizenship. Refer to our guide: What is Identity Verification (IDV) and Why Does it Matter?
• Document Authentication and Biometrics: Where a player submits an identity document or passport, validating the Machine Readable Zone and scoring the document for tampering detects forgeries, while comparing a selfie against the photograph held at Home Affairs confirms that the person registering is the person the document describes. This is the control that defeats account farming, where genuine identity documents belonging to other people are used to open accounts.
• Address and Contact Verification: Residential address should be corroborated rather than accepted, and the mobile number relied upon for authentication should be checked for recent SIM swap activity, since account takeover in this sector frequently begins with number compromise. Refer to our guides: How to Verify Physical Addresses and Contact Details.
• AML and Sanctions Screening: Players must be screened for Politically Exposed Person status, sanctions exposure, regulatory enforcement listings and adverse media. Screening against United Nations Targeted Financial Sanctions lists is a standalone statutory duty. Refer to our guide: What is AML Screening? PEP, Sanctions & Adverse Media Explained.
• Payment Account Verification: Confirming that the bank account funding the player wallet, and the account receiving withdrawals, genuinely belongs to the registered player closes off third-party funding and payout diversion in a single step. The FIC's own guidance suggested requiring deposits by electronic transfer from an account in the player's name. Refer to our guide: What is Bank AVS?
• Fraud Intelligence: Checking a player against fraud databases at registration surfaces individuals already recorded in connection with impersonation or other fraud incidents, which is particularly valuable where the same person is attempting to register across multiple operators. ThisIsMe's service ecosystem provides access to South Africa's leading fraud intelligence databases that are maintained by the Southern African Fraud Prevention Services (SAFPS). Find out more by reading out guide, SAFPS Report vs SAFPS Snapshot. 

What are the Main Money Laundering Risks in Gambling?

The FIC has published a sector risk assessment for gambling identifying vulnerabilities including the use of casino value instruments, the exchange of low denomination currency for high denomination currency, the use of casino accounts and facilities, the treatment of winnings, and the movement of people and money to casinos.

Online operations add their own patterns. Multiple accounting, where one person operates several accounts using other people's identity details, defeats limits and obscures activity. Mule accounts allow deposits and withdrawals to be routed through third parties. Peer transfer between player accounts can move value with minimal gambling activity. And the laundering of proceeds through deliberate losses, or the manufacture of a plausible explanation for wealth through recorded winnings, remains a persistent typology.

Each of these is detectable at the identity layer before it becomes a transaction monitoring problem. An account whose registered identity does not match its funding account, or whose mobile number is associated with several other identities, is a risk signal available at onboarding rather than after the fact.

Where a player presents elevated risk, enhanced measures apply. Refer to our guide: What is Enhanced Due Diligence (EDD)?

What Ongoing and Reporting Obligations Apply?

Verification at registration is the beginning of the obligation, not the end of it.

Section 21C of FICA requires ongoing due diligence. A player screened clean at signup may later become a Politically Exposed Person or appear on a sanctions list, and the operator is expected to know. Continuous monitoring of the player base is the only workable approach at scale. Refer to our guide: Once-Off AML Screening vs Continuous AML Monitoring: What's the Difference?

Reporting duties include cash threshold reports for cash transactions at or above R49 999.99, suspicious and unusual transaction reports, and terrorist property reports. Records must be retained for at least five years, and the record that matters is the verification result rather than merely the document the player submitted.

What is Changing for Gambling Operators in 2026?

Two FIC instruments are worth tracking closely, because both name the gambling sector explicitly.

Directive 11 of 2026 required specified Accountable Institutions, including casinos falling under items 2 and 9 of Schedule 1, to submit a Risk and Compliance Return through the FIC's reporting platform, with a submission deadline of 30 June 2026 for that group.

Draft Directive 12, published for comment on 31 July 2026, proposes that gambling institutions submit their RMCP to the FIC annually, with a proposed deadline of 30 September each year, and that any revised RMCP be submitted within ten business days of board approval. As the consultation was still open at the time of writing, operators should confirm the final position before relying on those dates.

Taken together with the unresolved question of product scope, the direction is clear. Gambling operators should expect their RMCP and their player verification controls to be examined directly rather than inferred from licence conditions. Refer to our guides: How to Pass a FIC Audit: A Step-by-Step Checklist for SA Businesses and What Happens if You Fail a FIC Audit?

KYC Solutions for South African iGaming Operators

As South Africa's leading provider of world-class identity verification, KYC, AML screening and due diligence solutions, ThisIsMe gives iGaming operators the tools to verify players before the first bet is placed, without sacrificing the onboarding speed the sector depends on. With access to 45+ services, including real-time age and identity verification against the DHA's HANIS database, automatic failover that keeps verification running during DHA downtime, passport and document authentication with tamper detection, biometric photo comparison, address and mobile verification with SIM swap detection, AML and sanctions screening powered by global risk intelligence, continuous AML monitoring, SAFPS fraud intelligence and bank account verification, ThisIsMe helps betting and gambling operators satisfy the FIC and their provincial licensing authority with confidence. To experience our full suite of KYC solutions and find out how we can serve your iGaming business, contact our team here.