KYC clears in 3 days; the document you uploaded expires in 90

Most offshore and Malta-licensed operators now clear standard KYC in roughly 72 hours, sometimes under 48 if you upload a passport instead of a utility bill. What almost nobody tells you at the upload screen is that the document you just handed over has its own clock running — and for proof-of-address documents, that clock is often 90 days. You've passed verification. You're also already a quarter of the way to failing the next one.

The three-month shelf life nobody mentions

Here's the mechanic. When a compliance team verifies your identity, it doesn't verify you. It verifies a snapshot: a specific PDF of a bank statement dated 14 March, a photo of a passport valid until 2029, a council tax bill from the January cycle. That snapshot gets stamped with a review date.

For identity documents — passports, national ID cards, driving licences — the expiry is usually the document's own. A passport good until 2031 stays good until 2031, subject to the operator's periodic re-verification cycle, which under most EU AML regimes runs every 12 to 36 months depending on risk tier.

For proof of address, it's different. The document itself is treated as perishable. Industry practice, shaped by the Fourth and Fifth Anti-Money Laundering Directives and the UK Gambling Commission's 2020 guidance, converges on a 90-day validity window for address evidence at the point of collection. Some operators stretch to 180 days. A handful of UK-licensed books, post-2020, tightened to 90 days flat and never loosened.

So the sequence looks like this:

• Day 0: You register, deposit, upload a statement dated three weeks ago.
• Day 3: KYC clears. You're live.
• Day 87: You request a £4,000 withdrawal.
• Day 87: The system flags your address document as expired by three days.
• Day 88: You're asked to re-upload. Your withdrawal sits in pending.

The frustrating part isn't the re-upload. It's that the request arrives at the worst possible moment — withdrawal, not deposit — because that's when the check actually bites.

Why the 90-day rule exists, and why it's inconsistent

The stated rationale is fraud prevention. A utility bill is a weak identity signal; it proves someone at that address receives post from a utility company. Its value decays because people move. A three-month-old statement is a reasonable proxy for "you probably still live there." A two-year-old one isn't.

That logic holds. What doesn't hold is the inconsistency. There is no single global standard. The 90-day figure is convention, not statute. The EU's AML directives require "verification" and "ongoing monitoring" but don't specify a document age. The UKGC's guidance says licensees must ensure documents are "current" without defining the term. Malta's FIAU leans toward 90 days in practice. Curaçao, historically the loosest of the major licensing jurisdictions, has no fixed rule at all — which is why some Curaçao-licensed casinos will accept a six-month-old bill and some won't.

The practical result: a player verified on one platform in January can be fully compliant, then move to a sister brand in April and be asked to start over, because the second operator's policy clock reset.

The passport asymmetry

Notice the imbalance. Your passport, valid for ten years, gets accepted once and typically stays accepted. Your electricity bill, valid for a month in reality, gets a 90-day grace period that operators then treat as a hard deadline.

If you're a frequent player across multiple sites, the rational move is to keep a rolling folder of address documents — a recent bank statement, a recent utility bill — and re-upload proactively before requesting anything large. Operators rarely prompt you in advance. The expiry is silent until it isn't.

What actually triggers re-verification

Not every withdrawal trips the check. In practice, re-verification tends to fire on:

1. Withdrawal above a threshold. Many operators set enhanced checks at £2,000 or €2,000 cumulative, or at any single withdrawal over a set limit.
2. A change in your details. New address, new payment method, new phone number.
3. A gap in activity. Dormant accounts often re-verify on reactivation, regardless of document age.
4. Random sampling. Some compliance teams audit a percentage of active accounts quarterly — commonly 5% to 10% — and will request fresh documents from accounts that passed months ago.
5. Source-of-funds requests. A large win or an unusual deposit pattern can trigger a full re-check, address document included.

The dormancy trigger catches people out most often. You take six months off, come back, deposit, win, and try to withdraw — and you're treated as a new customer for documentation purposes even though your account never closed.

The player-side workaround, and its limits

There's no trick that defeats a 90-day rule, but there are habits that stop it costing you money.

Keep a statement PDF you can access in under two minutes. Most banks now generate these on demand rather than waiting for a monthly cycle — a same-day PDF from your banking app usually satisfies the "dated within 90 days" requirement, and some operators accept digital-only statements while others still demand a scan of paper. Check which before you need it.

For crypto-native operators, the rules differ again. A handful of Curaçao and Anjouan-licensed casinos accept on-chain verification or a self-declaration for address, skipping the utility bill entirely. That's a genuine trade-off, not a free lunch: you're trading document friction for weaker regulatory recourse if a dispute arises.

And keep the dates straight. If your statement is dated 1 March and you upload it on 20 March, you have roughly 70 days of validity left, not 90. The clock starts at the document date, not the upload date. This single misunderstanding accounts for a large share of "my KYC expired for no reason" complaints.

Where this leaves you

The 72-hour clearance and the 90-day expiry are two ends of the same process, and operators have little incentive to explain the second one — a document that expires quietly is a document you'll re-supply, and a withdrawal paused for re-verification is a withdrawal still sitting in the operator's account for a few more days.

The open question is whether regulators will ever force a single standard. The UKGC has been moving toward tighter, more prescriptive verification timelines since 2020, and if a 90-day address rule became statutory rather than conventional, operators would have to notify players before expiry rather than after. Until then, the expiry date is your problem to track — and the only reliable way to track it is to know the date on the document, not the date you uploaded it.