Source of funds (SOF) checks are not the new “affordability” rules you may have read about; they are an older, separately-mandated anti-money laundering requirement that regulators are now enforcing far more aggressively.
Operators caught by the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 must carry out customer due diligence, and where the risk is judged higher, they must apply enhanced due diligence, which under regulation 33 includes obtaining information on your source of funds and source of wealth.
The payslip request you are suddenly seeing is a direct response to a wave of UK Gambling Commission fines, several worth millions of pounds, for operators that failed to ask for exactly that evidence.
Key takeaways
- Source of funds checks are an AML/CDD obligation under the Money Laundering Regulations 2017, legally distinct from the UK’s lighter-touch “financial vulnerability” checks.
- Financial vulnerability checks use only public credit-reference data at a £150 net-deposit threshold in a rolling 30 days; SOF checks require you to submit documents such as payslips, bank statements or tax records.
- Recent Gambling Commission settlements against operators including Spreadex, Videoslots, QuinnBet and three Rank Group-owned casinos were driven substantially by inadequate source-of-funds evidence.
- A single payslip rarely satisfies the obligation on its own: the evidence must cover the scale of the deposits under review, not just confirm that you have an income.
- Licensees cannot legally use a withdrawal request as the first trigger for a document request if they could reasonably have asked earlier.
Table of contents
What is a source of funds check
A source of funds check asks you to prove where the specific money in your gambling account came from.
Source of funds is about showing where the money came from, not just proving who you are: a passport or driver’s licence confirms identity, while a bank statement, payslip, savings statement, dividend record, pension evidence or dated proof of an award helps show how your account is funded.
It is a distinct exercise from “source of wealth,” which looks at how your overall net worth was built rather than the origin of one deposit.
This is easy to confuse with the UK’s newer financial vulnerability checks, and operators have occasionally conflated the two in correspondence with customers. They are not the same obligation.
For financial vulnerability checks, there’s nothing to refuse – the operator runs them automatically against public data without asking you for anything, whereas for source-of-funds checks, which are AML rather than affordability, you can refuse, but the operator can suspend or close your account if it cannot meet its AML obligations.
Financial vulnerability checks at £150 net deposits over a rolling 30 days are in force for remote operators
, and they rely on different data entirely —
UK financial vulnerability checks use public records only.
SOF checks, by contrast, are document-based and tied to anti-money laundering law rather than the vulnerability/harm regime. For a fuller breakdown of how the friction of these processes is distributed across the customer journey, see our related analysis of why casinos wait until you win to ask for your ID.
Why your casino is asking now
The short answer is enforcement risk. The Gambling Commission has spent 2025 and 2026 issuing a run of penalties in which inadequate source-of-funds evidence was a named failing, and the amounts involved have made the business case for requesting documents much harder for compliance teams to ignore.
In August 2026, QuinnBet settled for £609,104 after the Commission found it had allowed customers to deposit significant sums without establishing source of funds.
Some customers were allowed to deposit “significant funds” without the Source of Funds being established to prove the monies were legitimate.
One case involved a customer who
deposited around £120,000 and withdrew £111,000 over less than three months, with QuinnBet failing to verify the source of funds.
The regulator was also critical of the operator’s habit of assuming deposits were simply recycled winnings rather than checking:
the firm relied excessively on source of wealth without adequately establishing source of funds, including assuming that deposits represented recycled winnings without supporting evidence, and one customer earning around £2,000 monthly deposited and lost £9,000 in four days.
QuinnBet is not an isolated case. Spreadex was fined £2,022,000 in May 2025 for
reliance on self-reported finances instead of evidence of source of funds, with core risk factors not considered
, and the Commission found more broadly that
Spreadex was overly reliant on customers’ self-reported financial position and customers could continue depositing substantial amounts of money without providing source of funds information.
Videoslots was fined £650,000 after
AML risk thresholds were not triggered for a customer who funded their account with over £75,000 in digital prepayment vouchers within a 16-day period, resulting in a failure to conduct timely and effective customer due diligence or request source of funds information.
ProgressPlay, previously fined around £170,000 for similar issues in 2022, was sanctioned again after the Commission found it
had failed to scrutinise transactions sufficiently in customer relationships, including verification of source of funds.
Land-based venues are not exempt. In October 2026 three Rank Group-owned casinos were ordered to pay £5 million after an investigation found they had been
implementing unclear policies, procedures and controls which resulted in inappropriate risk levels being ascribed to high-risk customers and high-risk sources of funds being used by customers without appropriate scrutiny
, including a case where no safer-gambling interaction took place during a period in which a customer lost £50,000. Betting shop operator Done Brothers was separately criticised because its
thresholds for enquiries regarding customers’ source of income were not appropriately risk-based, being set at £15,000 for losses and £125,000 for stakes during a 365-day period.
For context on how these compliance costs are reshaping the market for smaller licensees, see our piece on why small casinos are being forced out of regulated markets.
What triggers a SOF request
There is no single public trigger figure, because the obligation is risk-based rather than threshold-based in the way financial vulnerability checks are. In practice, operators build their own escalation points around deposit velocity, payment method risk, and behavioural anomalies. Historical Commission findings illustrate the kind of pattern that should trigger a request even where no document was obtained:
a customer known to have a salaried income of less than £20,000 who had not provided appropriate source of funds or source of wealth evidence, and operators accepting, without independent verification, customers’ assertions that funds were recycled winnings.
- Deposit or loss levels that are disproportionate to a customer’s declared occupation or apparent income.
- A sudden, significant change in deposit pattern or payment method, including high-value e-wallet or voucher top-ups.
- Large or rapid cash-in/cash-out cycles, particularly where winnings are withdrawn and re-deposited quickly.
- Ownership structure or licensing applications, where the Commission itself requires
evidence of the individual’s source of funds, examples of which include bank statements, investment portfolio statements and P60s.
Our algorithm’s AML scoring, described in more detail in how our algorithm spots casinos that ignore money laundering, treats the gap between an operator’s published deposit limits and the point at which it actually asks for documentary evidence as one of the clearer public signals of a weak control framework.
Acceptable evidence and the tiered approach
Regulatory expectation is increasingly described as tiered: operators should exhaust cheaper, lower-friction data before demanding paperwork.
At the first tier, licensees should exhaust open-source verification before making any customer-facing request, with acceptable evidence tiered so that open-source and credit data are used first and documentary evidence such as payslips or account statements is reserved for higher-risk cases.
Critically, a document is not automatically sufficient just because it exists.
A single payslip that accounts for a fraction of the cumulative deposits over the review period does not close the SoF obligation; licensees must assess whether the evidence presented covers the quantum of funds being reviewed, not merely confirms that the customer has some form of income.
| Document type | What it is meant to evidence | Typical scenario |
|---|---|---|
| Payslip or employment letter | Regular earned income | Deposits broadly consistent with salary |
| Bank or savings statement | Origin and ownership of a lump sum | Large one-off deposit or windfall |
| Tax return or P60 | Annual income or self-employment earnings | Self-employed or variable-income customers |
| Sale contract or inheritance letter | Proceeds of an asset sale or gift | Deposit linked to a one-time event |
| Dividend or pension statement | Investment or retirement income | High-net-worth or retired customers |
How the UK compares to other markets
The UK’s approach is principles-based rather than threshold-based.
The UK does not impose a fixed currency transaction report for casinos at a high monetary threshold; instead, even moderate transactions can trigger scrutiny if they appear unusual or without legitimate purpose.
The United States takes a more mechanical approach at land-based casinos regulated under the Bank Secrecy Act:
casinos must file Currency Transaction Reports for any cash transaction exceeding $10,000 in a day, and Suspicious Activity Reports for any transaction of $5,000 or more suspected to involve illegal activity, or any amount if suspicion exists.
That gives US land-based operators a bright line for reporting, whereas UK online operators must build their own internal thresholds and justify them to the regulator after the fact — precisely the approach the Commission criticised at Done Brothers for being set too high to be risk-based.
Your rights during a SOF check
Two protections matter most for players. First, a casino should not wait until you try to withdraw to start asking questions it could have asked earlier.
Licence condition 17.1.1 of the Commission’s licence conditions and codes of practice states that a customer’s request to withdraw funds must not trigger a requirement for additional information as a condition of withdrawal if the operator could reasonably have asked for that information earlier.
Regulators have explicitly flagged this pattern as a problem:
the UKGC has flagged cases where operators took deposits for months or years without asking questions, then demanded years of financial history only after a withdrawal request.
Second, while you can decline to provide documents, the operator is entitled to respond by restricting or closing the account rather than processing further activity, since it cannot meet its own legal obligations without the evidence. Our related piece on how verification data is handled after submission covers what should happen to these documents once you have sent them.
Frequently asked questions
Is sending a payslip mandatory if a casino asks?
There is no legal requirement for you personally to produce a payslip, but the operator has a legal requirement to obtain evidence before it can keep processing your deposits or withdrawals under the Money Laundering Regulations 2017. In practice, refusal typically results in a frozen or closed account rather than a fine against you.
What’s the difference between a source of funds check and an affordability check?
A source of funds check is an anti-money laundering requirement focused on where a specific sum of money came from, verified through documents. Affordability and financial vulnerability checks are a separate, newer regime focused on whether you can afford your losses, and the light-touch version uses only public credit-reference data, not documents you submit.
Why did my bank statement get rejected?
Evidence is assessed against the size of the deposits under review, not just whether you have an income. A payslip showing a modest monthly salary will not close an enquiry into a much larger lump-sum deposit; operators are expected to request evidence proportionate to the amount being scrutinised.
Can I just say the money is “winnings”?
Regulators have specifically criticised operators for accepting this explanation without verification. Past enforcement findings describe cases of operators accepting, without independent check, that deposits were recycled winnings, so expect a follow-up request for evidence even if your funds genuinely originated from a previous win.
Methodology
For this category, our algorithm’s compliance score weighs an operator’s published AML and source-of-funds policy language, the deposit thresholds disclosed in licence terms, the timing of document requests relative to deposits versus withdrawals where evidenced in public complaints data, and matches against Gambling Commission enforcement notices and public statements. Scores are adjusted automatically whenever new regulatory settlements naming source-of-funds failings are published. See our scoring system and algorithmic weights page for how this signal is combined with others, and visit the KYC & AML hub for related coverage.
Gambling involves risk. Only play with money you can afford to lose and use the deposit limits and self-exclusion tools available in your jurisdiction.
