FICA Verification at Online Casinos in South Africa

What FICA is

FICA is the Financial Intelligence Centre Act 38 of 2001. It is South Africa's main anti-money-laundering law, and the Financial Intelligence Centre (FIC) issues guidance on how institutions must apply it. The Act requires an accountable institution to establish and verify the identity of a client when it begins a business relationship or a single transaction. The FIC calls this section 21 of the Act (FIC Guidance Note 7).

Verification means checking what a client says about themselves against documents or electronic data from reliable, independent sources. The same guidance says institutions must apply a risk-based approach. That is why two people at the same business can be asked for different amounts of proof.

Who FICA actually applies to

Published legal summaries say South African gambling and betting licensees are accountable institutions under the Act (Gambling Maps; see also ICLG on how online betting is licensed). Licensed South African bookmakers and casinos are therefore bound by it.

The offshore casinos that most online casino sites compare are not South African licensees. Our reading is that they are not supervised under FICA in the same way. They run their own know-your-customer checks under the rules of their own licence, and players tend to call those checks "FICA" because that is the word South Africans know. Treat the label as a habit of speech, not a legal fact about the operator.

What verification means in practice

The FIC's revised Guidance Note 7A explains that an institution corroborates identity details against information held in documents or electronic data created by reliable, independent third parties. It adds that information produced by the client is not treated as a reliable and independent source. In plain terms, a statement you write about yourself does not count, but a government-issued identity document or a bank-issued record can.

The same note tells institutions to judge how much confidence a given method gives them. A document that is easy to forge or edit gives less confidence than one checked against an original source, so an operator may ask for a second document, a live photo or a bank statement when the first does not settle the question.

None of this is specific to casinos. It is the general standard that South African banks, insurers and other accountable institutions work to. When you recognise the pattern in a casino's requests, you will know what the operator is trying to achieve and why a clearer or more official document helps.

Proof of address

Older FIC guidance, Guidance Note 3A, says the most secure way to verify a residential address would be a visit to the address, and lists the kinds of documents that may confirm it. It also refers to checking an address against the Deeds Office record. That note dates from 2005, so use it as background and not as a current checklist. Operators decide for themselves which documents they accept.

For you, the practical lesson is consistency. The name, address and identity number on your documents should match what you typed when you registered. A utility bill in someone else's name, a PO box where a street address is required, or a spelling difference between the account and the document are common reasons for a second request. Those are general observations, not rules from the FIC.

What a casino can ask you for

There is no single South African list for online casinos, because requirements depend on the operator and its risk assessment. Common requests are proof of identity and proof of where you live. For foreign nationals, FIC guidance refers to full names, date of birth, nationality, passport number and residential address. Some operators also ask how a deposit was funded, especially for larger amounts.

• Expect checks to be triggered by a first withdrawal, a large deposit or a change in account details.
• An operator that doubts earlier information is expected to confirm it again, so a second request is not unusual.
• Records of the checks are kept. FIC says accountable institutions keep client verification records for five years after the relationship ends (FIC reference guide).

Why verification often delays a withdrawal

Operators commonly verify before paying out. Until the documents are accepted, a withdrawal can sit in a pending state. We do not state processing times for any named casino because we have not tested them. When a review on this site shows a time, it carries its verification status.

Sending clear, unedited copies and using the same name and address as the account usually avoids a second round. That is general practice advice and not a rule from a regulator.

If your documents are rejected

Rejections usually come from a short list of causes. Check each before you contact support:

• The image is cropped, blurred or has a corner missing.
• The document has expired or is too old for the operator's rule.
• The name on the document differs from the account name, including middle names and order.
• The address on the document differs from the address on the account.
• The file was edited, screenshotted from another screen or sent in an unsupported format.

Ask support which item was refused and why, and keep a copy of the reply. If the answer is unclear or keeps changing, say so in writing and ask for the operator's verification policy. A genuine operator can point to a policy. If an operator will not explain, do not keep sending documents. Offshore operators sit outside South African regulators, so you may have little recourse, which is one reason to deposit only what you can afford to lose.

What happens to your documents afterwards

Under South Africa's Protection of Personal Information Act, section 14 says records of personal information must not be kept longer than is necessary for the purpose they were collected for, unless an exception applies. That section also requires a responsible party to destroy, delete or de-identify a record once it is no longer authorised to keep it (POPIA section 14). The FIC's five-year rule for accountable institutions is one of the exceptions that can apply to South African institutions.

Whether POPIA covers an offshore casino in the same way is a legal question we cannot answer for every operator. Read the operator's privacy policy for how long it keeps identity documents and who it shares them with. If a South African organisation mishandles your data, the Information Regulator publishes how to lodge a complaint, and asks for the details of the responsible party and a description of what went wrong along with supporting documents.

Verification does not make play lawful

Passing a casino's identity checks says nothing about whether you may play there. Eversheds Sutherland reports that the Supreme Court of Appeal rejected the argument that casino games can be offered as bets on outcomes, and that the National Gambling Board said on 27 February 2026 that online casino gambling remains illegal until Parliament acts (Lexology). ICLG notes that section 11 of the National Gambling Act also places liability on the player. Read our South Africa legal guide before you deposit. This is general information and not legal advice.

Protecting your documents

An identity document is valuable to criminals. Upload it only inside the operator's own logged-in account, never by email or social media message. If a site asks for documents before you have even registered, treat that as a warning. If you are unsure whether an operator is real, do not send anything.

A short checklist before you upload anything

1. Confirm you are on the operator's real site by typing the address yourself.
2. Read the privacy policy for retention and sharing.
3. Use a clear, uncropped, current document whose details match your account.
4. Upload inside your logged-in account only.
5. Keep a note of the date and what you sent.
6. Do not deposit more than you can afford to lose, because disputes with offshore operators are hard to win.

Frequently Asked Questions