You sent the passport. You sent the power bill. The withdrawal is still held, and now support is asking for three months of bank statements, an employment letter, or an explanation of where the money you deposited came from.
This feels like the operator inventing obstacles to avoid paying. Occasionally it is. Far more often it is a specific, escalating compliance process that most players have never had described to them — and the difference between a withdrawal that clears in two days and one that drags for six weeks is almost entirely about how you respond to it.
Three checks, not one
Verification is routinely discussed as though it were a single step. It is three, with different triggers and different evidence.
Identity (KYC). Who you are. Government photo ID — passport or driver licence — plus a proof of address such as a utility bill, bank statement or rates notice, usually required to be recent. This is standard at every regulated operator and is normally triggered by the first withdrawal, sometimes at registration.
Payment method ownership. That the card or account is yours. A photo of the card with most digits obscured, or a screenshot of the e-wallet or banking app showing your name. This exists because paying winnings to a payment instrument belonging to someone else is precisely the pattern money laundering controls are built to stop.
Source of funds. Where the money you gambled came from. This is the escalation, and it is a different order of intrusiveness: payslips, bank statements, an employment letter, evidence of a property sale, an inheritance, a business distribution.
The first two are routine. The third is not, and it is worth knowing what actually sets it off.
What triggers a source-of-funds request
Not suspicion of you personally, in most cases. Compliance systems run on thresholds and patterns.
Cumulative deposits or withdrawals crossing a threshold. A sharp change in your own pattern — modest play for a year, then a large deposit. A mismatch between deposit volume and whatever the operator knows or infers about you. Deposits from multiple payment methods or from accounts in different names. A large win on an account with limited history. Certain payment types, particularly cryptocurrency from a wallet that cannot be tied to you.
These obligations are not optional for the operator, and they are not negotiable at the support-agent level. In New Zealand the framework is the AML/CFT Act; overseas operators sit under their own jurisdiction's equivalent. The person answering your chat has no authority to waive any of it.
The pattern that causes most of the delay
The single most common cause of a six-week hold is not refusal to provide documents. It is providing the wrong ones, three times.
Documents get rejected for predictable reasons: a screenshot showing a bank logo but not your name; a statement without a visible date; an address document older than the operator's window, commonly three months; a joint account where the connection to you is not evident; a photograph too cropped to show the whole page; a driver licence used as proof of address when it does not display a current address.
Each round trip costs days, because the file goes back into the queue every time.
The way out is to ask one specific question, in writing: exactly which documents, showing exactly which fields, in what format, do you require? Ask for the list before you send anything. A competent compliance team will give it. Then send everything on the list at once — not one document at a time, which restarts the review with each submission.
What is reasonable, and what is not
Reasonable: asking for source of funds at all, where thresholds are met. Requiring documents to be recent and legible. Requiring the payment method to be in your name. Taking some days over it.
Not reasonable, and worth pushing back on: asking for the same document repeatedly without explaining the defect; demanding documents you cannot possibly hold, with no alternative offered; refusing to say what would satisfy the requirement; running the request only after a large win on an account that deposited for months without a single question.
That last pattern is the real complaint, and it is a legitimate one. Verification that could have been done at registration, or at the first deposit, being run only when a payout is due, is a practice regulators in several jurisdictions have criticised directly. A well-run operator front-loads it.
Practical steps that shorten it
Verify before you need to. Most operators let you upload documents at any point. Doing it on a quiet Tuesday, rather than while a withdrawal is held, removes the entire problem.
Deposit from an account in your own name, and use one method. Mixed and third-party payment sources are the fastest way into an escalated review.
Keep a verification folder: a clear scan of your ID, a recent statement, a recent utility bill. Re-scan it every few months so nothing has aged out.
Do not deposit money that came from someone else's account. Not a partner's, not a parent's. It is the one thing that turns a routine check into a genuine and justified problem.
If it stalls beyond the operator's stated timeframe, make a written complaint citing that timeframe, and — if the licence carries one — refer it to the alternative dispute resolution scheme the terms name. ADR is free to you and binding on the operator, and a stalled verification with documents already supplied is exactly the sort of case it handles well.
The part that is genuinely in your control
These checks are not going away, and they are more demanding at better-regulated operators rather than less — which is an uncomfortable but accurate thing to know. The trade is real: the sites that ask the most invasive questions are usually the ones with a regulator behind them and a complaints route that works.
What you control is the timing. Verified before you win, this is administrative. Verified after, it is six weeks of uncertainty about money you can see on a screen and cannot touch.