Has Online Casino Regulation Gone Too Far?
Online casino regulation is supposed to protect players, prevent financial crime and create a safer alternative to unregulated gambling. Few would argue with those objectives. But somewhere along the way, gambling operators have also been turned into investigators of their customers’ private finances.
Identity checks are one thing. Confirming that a payment method belongs to the person using it is understandable. But asking customers to explain their income, demonstrate their wealth, reveal the source of their money or provide weeks of private banking transactions is something entirely different.
At what point did providing this level of financial information to a casino become a reasonable requirement simply to gamble? Bigwinboard recently encountered this first-hand while playing at Coolbet, and the experience raised a much bigger question than whether one particular operator handled one particular withdrawal correctly.
Perhaps it is time to ask whether the regulatory system itself has gone too far.
30 Days of Private Bank Transactions
After making several deposits and playing slots for a few days, a withdrawal was requested. It was at this point that Coolbet requested a bank statement showing 30 days of personal transactions.
We declined.
There was nothing to hide. That wasn’t the issue. It became a matter of principle. A bank statement can reveal an extraordinary amount about someone’s private life. It can show where a person shops, where they travel, what subscriptions they have, medical payments, memberships, donations, transfers between family members and potentially even political affiliations. Most of this has absolutely nothing to do with gambling.
It also raises another uncomfortable question. Who exactly are players handing this information to? Casinos are not banks or financial institutions. They are commercial gambling businesses, often operating through corporate structures that the average customer knows very little about.
Players are therefore being asked to trust gambling companies with some of the most sensitive information they possess, simply because they want to use a gambling service. That should not be considered normal without question.
This Isn’t Really About Coolbet
It would be easy to make this entirely about Coolbet, but that would miss the more important point. After the matter was raised publicly, Coolbet contacted Bigwinboard directly and explained its position in considerably greater detail. To the company’s credit, the communication was open and professional, and its representative made a genuine effort to explain why the checks had occurred.
Coolbet has regulatory and compliance obligations. So do other licensed gambling companies. That is precisely why the issue deserves a wider discussion.
If gambling operators are being required or strongly incentivised by regulators to investigate customers’ income, wealth, source of funds and private financial transactions, perhaps the question shouldn’t simply be whether an individual casino is following the rules correctly. The question should be whether casinos should have been given this role in the first place.
Casinos Are Not Financial Investigators
There seems to be an assumption that because financial information might potentially reveal something useful, it is therefore reasonable for a gambling company to request it. That logic deserves to be challenged. A person’s bank can see their financial activity because providing financial services is the bank’s business. Tax authorities and law enforcement agencies have specific powers to investigate finances under circumstances established by law. A casino exists to provide gambling.
Yet gambling regulation has increasingly pushed casino operators into a position where they are expected to make judgements about customers’ income, wealth and wider financial circumstances. Should a casino employee really be deciding whether someone’s salary is sufficient for their gambling? Should a gambling company be examining transfers between spouses? Should it be reviewing where customers spend their money outside the casino?
Even the concept of “source of wealth” deserves more scrutiny than it often receives. Why should an ordinary customer have to demonstrate their overall wealth to a gambling company simply because they want to spend some of their own money? There will always be exceptional situations involving obvious criminality, fraud or genuinely suspicious financial activity. Authorities already have extensive powers to investigate such matters.
Turning ordinary gambling operators into quasi-financial investigators is a very different proposition.
Then There Is the Timing
There was another aspect of our Coolbet experience that initially caused concern: the checks appeared when a withdrawal was requested. Several deposits had already been accepted and gambling had taken place for many days. Then money started moving in the opposite direction and additional documentation was required.
Having played for years at Swedish regulated casinos, this was the first time we had personally encountered a request for 30 days of private banking transactions. Coolbet subsequently contacted Bigwinboard and provided further context around why the checks occurred when they did. While the explanation gave us a better understanding of the company’s position, it doesn’t change the underlying concern.
From a player’s perspective, money can be deposited and gambled without issue, only for significantly greater financial scrutiny to appear when a withdrawal is requested. If these checks are considered necessary, it seems reasonable to question why they so often appear at the point of withdrawal rather than before the customer is allowed to deposit and gamble in the first place.
Compare That With a Land-Based Casino
The contrast with land-based gambling makes the situation even more difficult to understand. Physical casinos have AML obligations too. This isn’t an argument that somebody can walk into every European casino carrying unlimited amounts of cash without ever encountering identification requirements or financial controls. But the practical difference between physical and online gambling is enormous.
A person can enter a land-based casino and play cash through slot machines without every individual wager necessarily being attached to the kind of personal account that exists online. An online casino, meanwhile, has an extraordinarily detailed record of the customer. It knows every deposit made into the account, every withdrawal requested, every game played, every wager placed, how much was won or lost, when the customer played and which payment methods were used.
Online gambling arguably provides operators with more information about an individual’s gambling behaviour than has ever existed before. Yet it can be the online customer who faces the greatest demands for information extending far beyond their gambling. That seems backwards.
If regulators consider extensive investigation of someone’s personal finances necessary to prevent financial crime or protect gamblers, why can the same individual gamble substantial amounts in a physical environment where considerably less of their gambling behaviour may be personally attributable to them?
The inconsistency deserves an explanation.
Privacy Is Also a Form of Consumer Protection
Gambling regulation frequently talks about protecting consumers, but protection tends to be discussed almost entirely in terms of gambling behaviour. Privacy matters too.
A complete bank statement isn’t just another verification document. It can provide a detailed picture of someone’s life. Once that information has been handed to a gambling company, customers must trust that it will be stored securely, accessed only by appropriate employees, retained only for as long as necessary and never exposed through a security breach or misuse. The more sensitive information companies collect, the greater the consequences if something goes wrong.
There is an obvious contradiction in protecting consumers by requiring them to surrender increasingly large quantities of sensitive personal information to commercial gambling companies. That trade-off deserves far more scrutiny than it currently receives.
What Happened With Coolbet?
In our particular case, we ultimately refused to provide the requested transaction history. Coolbet subsequently closed the account. The company explained that the account could potentially be reopened if the requested documentation were provided and approved at a later stage.
That is unlikely to happen. The information simply isn’t something we consider a casino’s business. Coolbet has its policies and regulatory obligations, while we have a line regarding financial privacy. In this case, those positions weren’t compatible, so the customer relationship ended.
The discussion with Coolbet actually shifted our criticism away from the casino to some extent because it highlighted the much larger problem. Casinos don’t create the regulatory environment in which they operate.
Regulation Can Go Too Far
AML legislation exists for legitimate reasons. Money laundering is real, financial crime is real and gambling can be used for both. But acknowledging those facts doesn’t mean every measure introduced in response is automatically proportionate. Regulation should always involve a balance between preventing abuse and preserving the rights and privacy of ordinary people. That balance can shift too far.
There is also an important distinction between authorities investigating suspected financial crime and commercial businesses being expected to conduct increasingly intrusive investigations into ordinary customers as a precaution. If the regulatory answer to every theoretical risk is more monitoring, more documentation and more personal information, there is effectively no natural stopping point.
Eventually, “Know Your Customer” risks becoming “Know Everything About Your Customer.”
And Then Regulators Wonder Why Players Choose Crypto Casinos
There is another consequence to all of this that regulators would be foolish to ignore. The regulated gambling market has competition.
Offshore and crypto casinos have grown enormously, and part of their appeal is obvious. Many advertise faster payments, fewer restrictions and greater privacy. That does not automatically make them safer. Players using poorly regulated casinos can sacrifice important consumer protections and avenues of recourse, while some crypto casinos also conduct extensive KYC procedures of their own. But the attraction isn’t difficult to understand.
If one gambling experience involves identification, extensive monitoring, affordability assessments, source-of-funds questions, source-of-wealth checks and potentially handing over weeks of private banking activity, while another appears considerably less intrusive, some customers will inevitably prefer the latter.
Regulators can respond by attempting to block or discourage access to those alternatives, but perhaps they should also ask why players are attracted to them. There is little point creating an exceptionally controlled regulated market if increasing numbers of customers decide they would rather not participate in it.
Where Should the Line Be?
Identity verification? Absolutely. Confirming that a payment method actually belongs to the customer? Perfectly reasonable. Investigating clear evidence of fraud or criminal activity? Of course. But examining an ordinary customer’s salary, overall wealth and unrelated private transactions simply because they gamble raises a fundamentally different question. Casinos are not banks. They are not tax authorities. They are not law enforcement agencies. They are gambling companies.
Perhaps legislation permits them to request this information. Perhaps regulatory pressure increasingly encourages them to do so. In some circumstances, operators may conclude that they have little choice. None of that means the system itself is beyond criticism.
Regulated gambling should offer players a safer and more trustworthy environment than the alternatives. It should give people reasons to choose licensed operators. If participating in that market increasingly requires customers to open up their wider financial lives to gambling companies, regulators should seriously consider whether the pendulum has swung too far.
Because privacy has value too and players shouldn’t have to surrender it simply because they want to place a bet.
