The numbers are damning: DraftKings generated 620 underage gambling reports totaling $2.78 million in wagers in Ohio alone since 2023. In Tennessee, underage account incidents quadrupled from 105 in 2024 to over 400 in 2025. In Massachusetts, DraftKings blocked roughly 4,800 attempted minor registrations and suspended 243 accounts in a single year. FanDuel stopped 186 attempted sign-ups and closed 330 accounts.
These aren’t hypothetical risks. These are documented failures at the largest operators in the market — companies spending hundreds of millions on technology. If the biggest players can’t keep minors out, the regulatory response was always going to escalate. And in 2026, it has.
The Regulatory Landscape Has Shifted
New York’s Gaming Commission Draft Regulations (March 2026)
On March 30, 2026, New York’s Gaming Commission released detailed draft measures in response to Governor Hochul’s State of the State Address. The rules target three areas simultaneously:
Youth protection measures — New requirements to prevent minors from accessing online sports wagering platforms, including enhanced identity verification at account creation and ongoing behavioral monitoring for accounts that exhibit patterns consistent with underage use.
AI targeting restrictions — A ban on sports wagering operators using artificial intelligence to target bettors with personalized promotions. This is significant because AI-driven engagement tactics often reach audiences that skew younger than intended.
Activity triggers — Mandatory check-in protocols requiring operators to verify patron status when certain activity patterns are detected. This moves beyond point-of-entry verification toward continuous compliance monitoring.
New York isn’t an outlier — it’s a bellwether. With the state’s outsized revenue stake in mobile sports betting (New York’s market generated over $2 billion in operator revenue in 2025), these regulations will likely become the template other states adopt.
The Credit Card Ban (April 2026)
Starting April 2026, new regulations prohibit the use of credit cards for online gambling across multiple jurisdictions. This is part of a broader responsible gambling push aimed at reducing financial risk for users, but it also has a verification implication: operators must now confirm that the payment method tied to an account belongs to the verified account holder. This tightens the link between identity verification and payment processing — making it harder for minors to use a parent’s credit card to fund a gambling account.
UK: Grace Period Eliminated, Immediate Verification Required
The UK Gambling Commission mandated that operators must verify a customer’s name, address, and date of birth before allowing them to gamble — no grace period, no provisional access, no “verify within 72 hours.” This requirement applies to both real-money gambling and free-to-play games. Germany’s GlüStV regime mirrors this approach, requiring immediate KYC completion at sign-up.
For operators serving UK or EU markets, this means any onboarding flow that allows gameplay before identity verification is complete is non-compliant. Full stop.
US State-by-State: 38 Jurisdictions and Counting
Sports betting is now legal in 38 US states plus Washington DC. The regulatory requirements vary, but the direction is converging toward stricter enforcement:
Universal requirements across all 38 jurisdictions:
- KYC identity verification at account creation
- Geolocation enforcement (betting only within state borders)
- Self-exclusion program integration
- Responsible gambling disclosures
Common additional requirements (varies by state):
- Full or partial SSN collection and verification
- Source-of-funds documentation for large deposits
- Advertising restrictions near schools and targeting minors
- Mandatory reporting of suspected underage activity
States like Illinois, Massachusetts, New Jersey, New York, and North Carolina have enacted specific advertising prohibitions against media outlets or channels where a significant percentage of the audience is underage.
The Scale of the Underage Gambling Problem
A January 2026 report by Common Sense Media found that 36% of surveyed teenage boys between ages 11 and 17 said they gambled at some point in the prior year. The National Council on Problem Gambling reported that nearly two thirds of adults aged 21 and older (65%) participated in at least one form of gambling before turning 21.
The sports betting boom has amplified this. CNBC reported in April 2026 that teen sports betting is raising concerns in schools across the country, with educators pushing for financial literacy programs as a countermeasure. But financial literacy doesn’t address the access problem — that’s a verification problem.
The current verification methods at major operators rely primarily on database cross-referencing (matching name, DOB, and SSN against credit bureau and voter roll records). This catches obvious mismatches but fails against a common attack vector: minors using a parent’s or older sibling’s identity credentials. The Tennessee and Ohio numbers demonstrate this failure mode at scale.
What Operators Get Wrong About Age Verification
Mistake 1: Treating KYC as a One-Time Checkbox
Most operators run identity verification at account creation and never revisit it. But the regulatory trend — exemplified by New York’s “activity triggers” — is toward continuous verification. An account that was legitimately created by a 22-year-old can be accessed by their 16-year-old sibling. Point-of-entry KYC doesn’t catch this.
What’s needed: session-level signals that flag behavioral anomalies. Device fingerprinting changes, geolocation patterns inconsistent with the verified user’s profile, and betting patterns that don’t match the account holder’s historical behavior should all trigger re-verification.
Mistake 2: Relying Exclusively on Database Checks
Database cross-referencing (Tier 3 verification) is necessary but insufficient. It confirms that the identity exists and matches public records, but it doesn’t confirm that the person submitting the data is the person it belongs to. A minor who knows their parent’s SSN, DOB, and address will pass a database check every time.
The fix is layered verification: database checks for identity confirmation, plus biometric verification (selfie matching, liveness detection) to confirm the person is who they claim to be.
Mistake 3: Accepting Conversion Loss as Inevitable
Operators resist stronger verification because they fear onboarding drop-off. This fear is legitimate — poorly implemented document verification flows can see 15-30% abandonment rates. But it’s a false dilemma.
Modern verification architectures use progressive assurance: start with the lowest-friction method (AI age estimation from a selfie), escalate to document verification only when the initial check is inconclusive, and issue reusable tokens for returning users so they never verify twice. This approach maintains compliance while keeping conversion rates within 2-5% of unverified flows.
Building a Compliant Verification Stack for Gambling Operators
Here’s what a best-practice implementation looks like for a sports betting or online gambling platform in 2026:
Layer 1: Account Creation (Immediate KYC)
At registration, before any gameplay or deposit:
-
Database cross-reference — Verify name, DOB, and address against authoritative sources (credit bureaus, voter rolls, telco records). This satisfies the baseline KYC requirement in all 38 US jurisdictions and UK/EU markets.
-
Biometric liveness check — A quick selfie with liveness detection confirms the person is real (not a photo or deepfake) and matches the identity being claimed. This is the layer that catches minors using parent credentials.
-
Document verification (conditional) — If the database check or biometric check returns low confidence, escalate to government ID verification. OCR extracts data from the document, template matching confirms authenticity, and face match compares the document photo to the selfie.
Layer 2: Payment Verification
With credit card bans taking effect, operators must verify that the payment method belongs to the verified account holder:
- Bank account name matching against KYC-verified identity
- Microdeposit verification for ACH/bank transfers
- Digital wallet identity confirmation
Layer 3: Ongoing Monitoring
- Device fingerprinting — Flag when account access shifts to a new device profile inconsistent with the verified user
- Behavioral analytics — Detect betting patterns, session times, and interaction patterns that suggest a different user
- Periodic re-verification — For high-risk accounts or accounts flagged by behavioral triggers, require a fresh biometric check
Layer 4: Returning User Optimization
This is where conversion recovery happens. A user who has completed full KYC once should never be forced through the entire flow again. Token-based returning user verification confirms identity in under a second using stored biometric templates or device-bound credentials, reducing friction to near zero for legitimate returning users.
How Xident Fits
Xident’s verification stack is purpose-built for exactly this architecture:
Sub-3-second verification — Fast enough that it doesn’t create meaningful onboarding friction. The median verification time is under 3 seconds for biometric checks and under 8 seconds for full document + face match flows.
0.03% false pass rate — This exceeds the requirements of every gambling regulator globally. For context, the UK Gambling Commission’s “highly effective” standard is met at significantly higher false pass rates.
Progressive assurance — Xident’s API supports tiered verification flows out of the box. Start with age estimation, escalate to document verification when needed, and issue reusable Xident ID tokens for returning users.
80% cost reduction for returning users — Xident ID tokens mean returning users verify via a cryptographic credential check rather than a full biometric or document flow. This is where the conversion math gets compelling: you pay full verification cost once, then near-zero for every subsequent session.
Audit-ready logging — Every verification event is logged with the metadata regulators expect: timestamp, method used, confidence score, escalation triggers, and outcome. This is critical for operators who need to demonstrate compliance during licensing audits.
Multi-jurisdiction support — A single integration handles the compliance requirements across US states, UK, EU, and other markets. You don’t need separate verification vendors for each regulatory regime.
The Business Case Is Straightforward
The average sports betting operator spends $300-500 to acquire a new customer. If 15-30% of those customers abandon during a poorly implemented verification flow, the CAC waste is staggering. Meanwhile, the regulatory penalties for non-compliance range from six-figure fines to license revocation.
The math works like this: invest in verification infrastructure that is fast enough to preserve conversion rates and robust enough to satisfy regulators. The alternative — weak verification that lets minors through — leads to enforcement actions, mandatory remediation, negative press, and the kind of regulatory scrutiny that makes future license applications harder.
With 38 US states now operating legal sports betting markets and regulators explicitly tightening age verification requirements, this isn’t a “nice to have” investment. It’s table stakes.
What to Do Next
If you’re operating a sports betting platform, online casino, or any gambling product:
-
Audit your current KYC flow against the immediate-verification requirements now standard in the UK, Germany, and increasingly in US states. If users can place a bet before verification completes, you have a gap.
-
Add biometric verification as a layer on top of database checks. Database-only KYC is the known failure mode that minors exploit.
-
Implement returning user tokens to recover the conversion cost of stronger verification. The ROI on this alone typically justifies the entire verification stack.
-
Prepare for continuous monitoring requirements. New York’s activity trigger rules are the template. Build the instrumentation now, before it’s mandated in your jurisdiction.
-
Talk to Xident — We can have your verification flow live in under a day, with a single API integration covering every jurisdiction you operate in.
The checkbox era ended years ago. The grace period era ended in 2026. What’s left is real verification — fast, accurate, and privacy-preserving. That’s what Xident builds.
