Dutch regulator: initials not enough to verify bank accounts

The Netherlands' gambling regulator, the Kansspelautoriteit (Ksa), says licensed online gambling sites must check that a player's full first names and surname on their identity document match the name on their bank account before or during the first deposit from that account. Checking initials is not enough.

The Ksa published the guidance on 8 October 2026 after an investigation into how operators handle registration. It said it had received signals that minors, who are not allowed to gamble, could in some cases deposit from their own bank account. The investigation found that youth accounts (*jongerenrekeningen*) could be used to gamble, and that a minor's bank account could be linked to an adult player's account. It covered 9 gambling operators and used data from 4 Dutch banks.

The guidance is a reading of rules that already exist in the Dutch decree on remote gambling (Besluit Koa, articles 4.10, 4.11 and 4.25), not a new law. It applies only to licensed online operators.

Why initials let the wrong people through

Players at Dutch-licensed sites register a nominated bank account (*tegenrekening*) with the operator. Operators have often checked it against the account-holder name shown in the payment details, and that name usually appears as initials plus surname. To take an example of our own: a parent and child, or two siblings, called Jan and Julia de Vries would both appear there as "J. de Vries".

The Ksa says the gap is not only about minors. The same weakness affects people registered in Cruks, the national gambling exclusion register, and people whose finances are under court-ordered administration. It also lets a player open a second account in another name, for bonus fraud, to hedge bets or to get around play limits.

What the guidance asks operators to do

• Check all first names and the surname against the identity document, before or during the first deposit from a new or changed account.
• Use a proper name check. The Ksa points to the payee-name check that EU rules have required for payments between European banks since October 2025. Variants are already used by two thirds of Dutch online operators, the guidance says. It names four providers in the Dutch market: SurePay, BlueM, CDDN and Signicat. Other methods are allowed if they check full first names and surname.
• Check a partial match further. A match can be accepted and a non-match cannot. A partial match needs an extra check, possibly by hand. Small differences such as "ij" written as "y" can pass; the bigger the difference, the more critically the operator must judge whether it is the same person.
• Refuse business accounts. Accounts in the name of a company, and those of sole traders, must not be used to gamble. The Ksa calls even a sole trader's account that can be traced to the player "absolutely undesirable" (our translation of *absoluut onwenselijk*), pointing to larger balances, tax money that can sit in the account for months, and money-laundering risk.
• Re-check existing players whose account was not verified on all first names. Operators can do it in bulk or at the player's next login, deposit or withdrawal. For players who have been inactive for a long time, the guidance says, that check may not happen for a long while.

Other payment methods should meet the same standard. Paysafe can supply a verified full name and date of birth. PayPal does not always require an identity document when a private account is opened, and card issuers cannot yet confirm full first names. The Ksa treats PayPal and credit cards as a higher risk that operators are expected to manage.

Where the check stops working

The Ksa is open about the limits. A minor with exactly the same first names as a parent will probably pass an automated check, it says, and that cannot be prevented. Its answer is to combine sources: an identity-document scan, iDIN (the Dutch bank-login identity service), a liveness check and the details the player typed in. Its list of best practices includes looking for a "jongerenrekening" label on bank statements and an email address carrying a different name or birth year. None of those extras is mandatory.

What it means for players in the Netherlands

If you play at a Dutch-licensed site, you may be asked to verify your bank account again, possibly at your next login or deposit. Expect the site to compare your full first names, not just initials, with the name your bank holds. If your bank has your name wrong, the guidance puts the fix on you and your bank; the operator can only complete registration once you can show the account really is yours. A business or sole-trader account will be turned down.

For another cashier identity rule arriving this month, see Spain's payment-method ownership check for withdrawals. For earlier Ksa action, see the 711 deposit-wagering case and the eight online licence renewals.

18+. Gambling can be addictive. If it stops being fun, see our responsible gambling page. In the Netherlands, you can register with Cruks for a gambling stop that covers Dutch-licensed gambling sites, gaming arcades and casinos.