Crypto Casino Player Verification System: Modular Architecture
Designing a verification system for a crypto casino requires balancing Web3 anonymity with regulatory demands. Crypto casinos face dual pressure: users value privacy, while licensing bodies and payment partners require KYC, AML, and age verification. Our approach is a modular tiered system that adapts to the license and region. Our team has over 8 years of experience in crypto compliance and has delivered 30+ turnkey KYC solutions for crypto projects, including casinos and exchanges.
How Tiered Verification Works — Building the Verification System
Not all players require the same level of scrutiny. A tiered approach is the standard for gambling:
| Level | Limit | Requirements | Verification Time |
|---|---|---|---|
| Tier 0 | Up to $500/month | Email + wallet + auto AML | Instant |
| Tier 1 | Up to $5,000/month | Name, date of birth, country | 1–2 min |
| Tier 2 | Up to $50,000/month | Government ID + liveness | 5–10 min |
| Tier 3 | > $50,000/month | Source of Funds, PEP | 1–2 days |
Tier 0 (minimal): email, wallet connection, and automatic AML address screening via Chainalysis or Elliptic. No documents, instant response.
Tier 1 (basic): name, date of birth, country of residence. Automatic sanctions list check. Account confirmation via email or SMS.
Tier 2 (extended): government ID (passport, driver's license), liveness check, proof of address. We use Sumsub, Onfido, or equivalent.
Tier 3 (enhanced due diligence): Source of Funds, Source of Wealth, extended PEP/Sanctions check, manual review by a compliance officer.
Example of level configuration
Limits and requirements for each tier are set in the configuration. For example, Tier 0 deposit limit is 0.1 BTC/month, Tier 1 is 1 BTC. Levels are automatically upgraded when the limit is reached.Which AML Tools to Use?
For casinos, it is critical: funds from darknet markets or stolen funds — direct liability for the platform. Provider comparison:
| Provider | Monitoring Type | Speed | Customization |
|---|---|---|---|
| Chainalysis KYT | On-chain transactions | Real-time | High |
| Elliptic | On-chain + off-chain | Real-time | Medium |
| OFAC Parser | Static lists | Daily | Full |
According to Chainalysis KYT documentation, risk categories include darknet market, stolen funds, ransomware, sanctions. For such addresses — reject deposit and freeze account. Grey zone (gambling, P2P exchange, mixing) requires manual review. We additionally check wallet addresses against the OFAC SDN List via Chainalysis or our own parser — the list is updated daily.
Sumsub processes requests 3 times faster than manual verification, and Chainalysis KYT detects suspicious transactions with 95% higher accuracy than static OFAC screening. Our clients save up to 60% on verification costs compared to manual processes. A typical project starts at $20,000 and saves $30,000–$100,000 annually.
Chainalysis KYT (Know Your Transaction) Integration
async function screenAddress(address: string, asset: string): Promise<RiskScore> {
const response = await chainalysisClient.post('/v1/users', {
userId: address,
});
const transferResponse = await chainalysisClient.post('/v1/transfers', {
network: asset,
asset: asset,
transferReference: address,
direction: 'received',
});
return {
riskScore: transferResponse.data.riskScore,
cluster: transferResponse.data.cluster?.name,
category: transferResponse.data.cluster?.category,
};
}
How to Integrate a KYC Provider?
Sumsub — Standard Choice for Gambling
Sumsub provides WebSDK for an embedded flow. Token generation on the backend:
async function getSumsubToken(applicantId: string): Promise<string> {
const timestamp = Math.floor(Date.now() / 1000);
const method = 'POST';
const url = `/resources/accessTokens?userId=${applicantId}&levelName=basic-kyc-level`;
const signature = crypto
.createHmac('sha256', SUMSUB_SECRET_KEY)
.update(timestamp + method + url)
.digest('hex');
const response = await axios.post(
`https://api.sumsub.com${url}`,
{},
{
headers: {
'X-App-Token': SUMSUB_APP_TOKEN,
'X-App-Access-Sig': signature,
'X-App-Access-Ts': timestamp,
}
}
);
return response.data.token;
}
// Frontend initialization
import SumsubWebSdk from "@sumsub/websdk";
const sdk = SumsubWebSdk.init(
accessToken,
() => refreshToken(),
{
lang: "en",
onMessage: (type, payload) => {
if (type === "idCheck.onApplicantStatusChanged") {
if (payload.reviewResult?.reviewAnswer === "GREEN") {
handleKYCApproved(payload.applicantId);
}
}
},
onError: (error) => console.error("Sumsub error:", error),
}
);
sdk.launch("#sumsub-container");
An important point is verifying the webhook signature to avoid accepting fake callbacks:
function verifySumsubWebhook(req: Request): boolean {
const signature = req.headers['x-payload-digest'];
const secret = process.env.SUMSUB_WEBHOOK_SECRET;
const expectedSignature = crypto
.createHmac('sha256', secret)
.update(req.rawBody)
.digest('hex');
return crypto.timingSafeEqual(
Buffer.from(signature),
Buffer.from(expectedSignature)
);
}
async function handleSumsubWebhook(payload: SumsubWebhookPayload) {
const { applicantId, reviewResult, type } = payload;
if (type === "applicantReviewed") {
if (reviewResult.reviewAnswer === "GREEN") {
await db.updateUserKYCStatus(applicantId, "APPROVED", reviewResult.reviewRejectType);
await updateUserTier(applicantId);
} else if (reviewResult.reviewAnswer === "RED") {
await db.updateUserKYCStatus(applicantId, "REJECTED", reviewResult.moderationComment);
await notifyUser(applicantId, "kyc_rejected");
}
}
}
Age Verification Without Documents
For markets where documentary KYC is unacceptable, we use Yoti Age Verification. The user receives a signed age token; the casino only sees "over 18". AgeID (UK standard) follows a similar approach. Integration via OAuth 2.0: Yoti acts as identity provider.
Geo-blocking and IP Verification
KYC does not replace geo-blocking. Mandatory checks:
async function checkPlayerEligibility(ip: string, walletAddress: string): Promise<EligibilityResult> {
const geoResult = await maxmindClient.country(ip);
const country = geoResult.country.isoCode;
if (BLOCKED_COUNTRIES.includes(country)) {
return { allowed: false, reason: 'geo_blocked', country };
}
const ipRisk = await ipqualityscore.check(ip);
if (ipRisk.vpn || ipRisk.proxy || ipRisk.tor) {
return { allowed: false, reason: 'vpn_detected' };
}
return { allowed: true, country };
}
Blocked country lists are determined by the license: Curacao, Malta, Estonia — each with its own list of restricted jurisdictions.
Why Responsible Gambling is Necessary?
Licensed casinos must implement responsible gambling features:
- Self-exclusion (block from 1 day to permanent)
- Deposit limits (daily/weekly/monthly — decrease instantly, increase after cooling-off 24–72 hours)
- Reality check (notification of time and losses)
- Cooling-off period (temporary pause)
These measures not only comply with regulatory requirements but also reduce risks of negative user experience. Automating responsible gambling is a mandatory compliance element.
Process
- Analysis: study license requirements and select providers.
- Design: KYC/AML architecture, flow diagrams.
- Integration: connect Sumsub, Chainalysis, MaxMind, Yoti.
- Testing: regression and load tests.
- Deployment and training of the compliance team.
Timelines
| Component | Timeline |
|---|---|
| KYC tier system + Sumsub | 2–3 weeks |
| AML screening + webhook | 1–2 weeks |
| Geo-blocking + IP | 1 week |
| Responsible gambling | 1–2 weeks |
| Admin dashboard | 1–2 weeks |
A full compliance system — 6–10 weeks. Automation savings reach 60% compared to manual verification. Cost is calculated individually based on the set of providers and integration complexity.
What's Included in the Work
- Architectural documentation
- Provider integration (Sumsub, Chainalysis, Yoti, MaxMind)
- Smart contract writing (if needed)
- Load testing
- Compliance team training
- Launch support
Get an estimate for your project — contact us. We will help select providers and optimize your budget. With 8+ years of experience and 30+ delivered projects, we guarantee a compliant and efficient KYC system. Order a turnkey verification system — discuss details with our engineers.