Pennsylvania Gaming Board Tightens KYC Rules for Online Gambling After Fraud Surge
28 October 2026
On January 22, 2025, the Pennsylvania Gaming Control Board (PGCB) issued updated guidance on enhanced KYC and identity-verification requirements for interactive gaming accounts. The move comes after a string of fraud enforcement actions and exclusion-list additions by the PGCB in recent years.
The updated guidance from the PGCB aims to implement stricter fraud prevention measures by tightening controls on account creation, multifactor authentication (MFA), payment methods, and geolocation checks. The enhanced requirements, designed to better safeguard consumers, apply to both casinos and sports wagering platforms in the state.
What changed?
The January 22 guidance established new rules that operators must follow for interactive gaming accounts in Pennsylvania. Key elements include:
- Govt-ID Upload: Patrons must now upload a valid government-issued photo ID when creating a gaming account, and their identity must be verified through a liveness check.
- Data Matching: A strict match is required between the player's account details and the information on the photo ID, including an exact match for date of birth, Social Security number, and last name.
- More Frequent MFA: MFA checks must occur at least every 14 days for each device used to access a gaming account. This prevents account sharing and ensures the user is authorized.
- Age-Verification: PGCB enforcement actions in 2024 and 2025 underlined the need to prevent access by those under age 21.
The enhanced Kcontrolss are part of a broader effort to prevent fraud, bonus abuse, account sharing, and unauthorized play by self-excluded individuals. Pennsylvania's updated guidance aims to align the state's requirements with emerging industry best practices.
What else changed?
Other updates in the PGCB guidance include:
- Limits on verified payment methods, including caps on amounts that can be deposited via credit/debit cards, ACH accounts, and third-party payment services.
- A maximum aggregate withdrawal limit of $10,000 before additional geolocation checks are required.
The rules do not appear to mandate a blanket deposit limit for all online casino play, though some sources had reported this as a component of the changes. It seems the new measures focus more on linking payment methods to verified identities.
Why did the board act now?
The PGCB's actions come after recent investigations found evidence of fraudulent activity on poker and casino sites in the state. In response, the board cracked down by adding multiple groups to its involuntary exclusion list, bringing the total to 95 individuals by late 2026. Warning letters were also issued to other gaming entities found to have insufficient KYC and anti-fraud protocols.
As an example, the board fined BetMGM $100,000 in 2025 after finding that the platform failed to prevent fraudulent behavior. This included allowing multiple accounts to be created and funded with stolen or fraudulently-obtained payment devices, highlighting gaps in BetMGM's KYC protocols
What's the impact on the industry?
The PGCB's enhanced requirements will likely increase onboarding friction for new customers and increase compliance costs for Pennsylvania gaming operators. However, they also put Pennsylvania's online casino market in line with a number of other states that have made similar updates in recent years.
The guidance also includes a limited schedule to comply with individual aspects of the updated requirements. Some changes, such as the verification of third-party payment instruments, will need to be in place by September 30, 2025. But the updated MFA, payment method, and geolocation requirements will not be required until February 28, 2026.
Overall, these changes position Pennsylvania as a relatively strict jurisdiction for online casino identity verification and anti-fraud compliance.