AML & KYC Policy

Why we wrote this page

Sooner or later every player who tries to withdraw runs into a verification request, usually at the worst possible moment: the day a payout is due. This page explains what anti-money laundering and know-your-customer checks are, why any operator you deal with will run them, and how to get through them without losing a week. It is written as guidance for players. It does not describe a compliance programme of our own, because this site is an editorial guide and holds no player accounts.

What AML and KYC mean

Anti-money laundering, or AML, is the broad obligation on financial businesses to stop criminal money passing through them. Know your customer, or KYC, is the practical part players see: proving you are a real, identifiable adult and that the money moving in and out is yours. Payment processors, banks and card networks impose these requirements down the chain, so an operator that ignored them would quickly find itself cut off from DuitNow, Touch ‘n Go eWallet, Maybank2u, CIMB Clicks, Public Bank transfers and the other channels you actually use.

The checks also protect you: they stop someone who has obtained your details from opening an account in your name and draining a payout elsewhere.

Documents you are typically asked for

• Proof of identity. MyKad, passport or driving licence. All four corners visible, nothing cropped, no glare across the photo or the number.
• Proof of address. A utility bill, bank statement or government letter showing your name and address, usually dated within the last three months. Screenshots of an online statement are normally accepted if the header shows the issuing institution.
• Proof of payment method ownership. A bank statement header, an e-wallet profile screen, or a card image with the middle digits covered, showing that the account is registered to you.
• A selfie or liveness check. Increasingly common, sometimes holding your ID or a handwritten note with the date.
• Source of funds. Requested at higher volumes: payslips, a bank statement showing salary credits, a business or dividend record.

What U88 says it needs

The list above is what the industry asks for in general. U88’s own published requirement is narrower: it states that KYC needs your IC only. That is a low bar compared with operators that ask for proof of address and a liveness check up front, and it is worth knowing so you are not talked into sending more than is required.

The rule U88 does enforce is on the money rather than the documents. Withdrawals go out by bank transfer, the receiving account name must match the full name you registered with, and U88 does not accept third-party withdrawals. Not a spouse’s account, not a parent’s. A withdrawal you have already submitted can still be cancelled, provided the relevant department has not yet processed it. Deposit and withdrawal limits are on our payment methods page.

When verification is triggered

Rarely at sign-up, and almost always at one of these moments. The first withdrawal is the classic trigger, because that is the point real money leaves the platform. Changing a payment method triggers it again, since a new bank account or wallet is a new thing to verify. Crossing a cumulative deposit or withdrawal threshold pulls an account into review. So do irregular patterns: a sudden jump in stakes, deposits from several different sources, near-immediate withdrawal of an untouched deposit, or logins from locations that do not match the registered address. USDT and other crypto rails often attract extra scrutiny for the same reason.

The name-matching rule

This single rule causes more failed withdrawals than everything else combined, so learn it now. The name on the receiving bank account or e-wallet must match the name on the gaming account exactly. Not a spouse’s account, not a parent’s, not a friend’s, not a business account with a similar name. Third-party payments are what money laundering looks like on a screen, and they are refused as a matter of course.

Small mismatches also cause delays: a MyKad reading Muhammad against a bank record reading Mohd, or a middle name present in one place and absent in the other. Register with the name printed on your ID, in the same order, and keep it consistent across every payment channel you link.

Preparing in advance

1. Register with your legal name and real date of birth from the very first day. Corrections later are painful and sometimes impossible.
2. Photograph your ID and a current proof of address before you need them, in good light and uncropped, in one folder.
3. Link only a payment method held in your own name.
4. Submit documents the day the request arrives, since the clock starts when the last acceptable file lands, not when the first one does.
5. Keep basic records of large deposits so a source-of-funds question is answered in one message rather than five.

What to expect on data handling

Identity documents are sensitive, so it is fair to expect certain things from any operator holding them: an encrypted upload form rather than an email attachment or a chat window, storage limited to the compliance function, retention only for the period regulation requires, and a clear contact route if you want to know what is held. Ask before uploading if none of that is stated. How we handle the far smaller amount of data we collect is set out in our privacy policy.

If something feels wrong

Verification requests are routine. Requests for your account password, a one-time banking code or remote access to your device are not, and no legitimate compliance team asks for them. Verification is always run by the operator, never by us, and nothing here is legal advice. Anyone under 18 cannot hold an account. If checking your balance has become compulsive rather than casual, our responsible gaming page and Gamblers Anonymous are the right next steps.