Understanding KYC Requirements for Real-Money Gaming Apps

KYC comes up specifically around withdrawals in this category of app, and the term gets used without much explanation. This page covers what’s actually normal and what isn’t.

What KYC normally involves

• A government-issued ID (commonly PAN or Aadhaar in India) to confirm your identity.
• Basic personal details matching that ID — name, date of birth, address.
• Sometimes a linked bank account or UPI ID specifically for processing withdrawals.

This is typically required once, usually triggered by your first withdrawal request rather than demanded upfront before you’ve even created an account — though practices vary by platform.

What isn’t normal KYC

• Your banking app’s password or PIN. No legitimate identity verification needs this — a linked account number or UPI ID is different from your banking credentials.
• An OTP sent by your bank rather than the gaming platform itself.
• Photographs or documents beyond standard ID verification, requested with no clear explanation of why.

Why this matters beyond convenience

KYC documents are sensitive — government ID numbers, in particular, are useful for identity fraud well beyond this one platform. Submitting them to an unverified platform carries real risk, which is part of why the identity checks in our login safety checklist and APK safety checklist matter before you ever reach a KYC step, not just at the point of withdrawal.

If a platform’s KYC request feels disproportionate to what it should need, that’s worth treating as a signal — proportionality is the practical test here, not a specific document checklist.

KYC requests after May 2026

Since 1 May 2026, online money games are prohibited in India under the Online Gaming Act, 2025, and banks and payment providers may not process payments for them. A real-money gaming app asking for your Aadhaar or PAN today is therefore not operating under any legitimate Indian framework. Treat a KYC request from one with more caution than before, not less.

How to share an ID more safely, if you decide to

• Use masked Aadhaar. UIDAI lets you download a masked Aadhaar from the myAadhaar portal, which shows only the last four digits of your number. It is accepted for most identity checks.
• Mark your copy. Write the purpose and date across any ID image you send, for example “For [app name] KYC only, 5 Oct 2026”. A marked copy is harder to reuse elsewhere.
• Never share an Aadhaar OTP with anyone. The OTP authorises actions in your name.
• Don’t send ID over WhatsApp or Telegram to a “KYC agent”. Genuine KYC happens inside the app or on a verified website.

Check whether your ID has been misused

• The myAadhaar portal shows your Aadhaar authentication history. Look for checks you didn’t make.
• You can lock your Aadhaar biometrics on myAadhaar, so they can’t be used for authentication until you unlock them.
• If you find misuse, report it to UIDAI, and report any money lost to the National Cyber Crime Helpline on 1930 or at cybercrime.gov.in.