Best KYC Providers for Gambling Operators: 9 Vendors Compared

Nine identity verification vendors publish a dedicated gambling or gaming page and a list of security certifications: Entrust (formerly Onfido), GBG, iDenfy, Incode, Jumio, Shufti, Socure, Sumsub and Veriff. Three of them (iDenfy, Sumsub and Veriff) also publish per-check prices. The rest quote on request.

This page compares what each vendor says on its own site, checked on 4 November 2026. We have not run any of these products. Vendors are listed alphabetically, not ranked.

How we picked

A vendor made the list if its own website shows all three of the following:

1. A gambling or gaming industry page describing player onboarding, age checks or fraud for operators.
2. Published security or biometric certifications, such as ISO/IEC 27001, SOC 2 Type II or iBeta presentation attack detection (PAD) testing under ISO/IEC 30107-3.
3. A clear pricing model, either a public price list or an explicit “contact sales” route.

Persona, on the original shortlist, publishes strong certifications (SOC 2 Type II, ISO 27001, iBeta, FedRAMP) on its security page, but we couldn’t find a gambling or gaming page on its site, so it is left off for now.

At a glance

The vendors

Entrust Identity Verification (formerly Onfido)

Onfido no longer trades under its own name. Onfido.com now redirects to Entrust, and the Entrust product page states “Onfido is now Entrust Identity Verification Solutions”. The product line covers document and biometric verification, data checks, AML compliance and fraud detection, and Entrust pitches it as part of a wider identity stack that runs into authentication and digital signing.

The gaming page talks about player verification, real-time fraud detection and compliance “across jurisdictions”, but names no operators. Existing Onfido integrations still sit on Onfido-branded developer docs and dashboards linked from the Entrust site.

GBG

GBG (GB Group plc) positions its gaming product around three jobs: onboarding, bonus abuse and affordability. Its gaming page describes age verification, a cross-operator “trust network” for spotting bonus abusers, and financial risk checks that screen for bad debt and bankruptcy. None of the other gambling pages on this list pitch affordability checks.

GBG’s trust centre lists ISO/IEC 27001:2022, SOC 2 Type 2, PCI DSS v4.0.1 and Cyber Essentials Plus. The gaming page cites NSUS Group as a partner and says its genuine player pass rate rose 30%.

iDenfy

iDenfy is one of three here with public pricing. Its pricing page lists a pay-as-you-go plan at $1.35 per verification with a $135 monthly minimum, covering ID, face match and liveness, with a free trial. The gambling page targets age checks, bonus abuse and multi-accounting.

iDenfy’s security page is specific: an ISO/IEC 27001:2022 certificate (No. ISMS-1851/A) held since 2020, a SOC 2 Type II report covering 12 months, PCI DSS compliance, and certification for remote authentication under the EU eIDAS regulation and ETSI TS 119 461. We couldn’t find named gambling clients.

Incode

Incode publishes the longest list of named gambling clients in this group. Its gambling page names FanDuel, BetMGM, Kindred, Caliente, MaxBet and Draftea, with a BetMGM case study claiming “97% of genuine players approved on the first try”. Products include document and liveness checks, facial age estimation, face-based duplicate account detection and a cross-operator fraud signal service aimed at bonus abusers.

The homepage lists iBeta PAD Level 3 and SOC 2 Type II, coverage of 190+ countries and territories and 4,900+ document types, and a Gartner Magic Quadrant Leader placement for three years running.

Jumio

Jumio describes itself on its gaming page as the “#1 identity verification provider to sportsbooks and gaming operators”, and says it serves nine of the ten largest operators in Europe. Those are Jumio’s own claims; it names only Stanleybet in text. In the US, Jumio says it is licensed or permitted to serve operators in “the majority of U.S. states where sports betting is legalized”.

Jumio’s trust centre lists SOC 2, ISO 27001 and PCI DSS 4.0.1. Its coverage page claims more than 5,000 ID types across 200 countries and territories. Pricing is not published. We compare Jumio and Sumsub line by line in Sumsub vs Jumio.

Shufti

The company now brands itself Shufti, though its domain is still shuftipro.com. The iGaming page covers the full player lifecycle: age and document checks, NFC chip reading, AML screening, geolocation, self-exclusion register integration, device fingerprinting and 1:N face matching to catch duplicate or excluded players. Named gambling clients are Whitehat Gaming and BigCash, with Penn National Gaming in the logo strip.

Its certifications page lists iBeta Level 3, SOC 2 Type II, PCI DSS, ISO 27001:2022, Cyber Essentials Plus and a GDPR certification from a UK accreditation body. The homepage claims coverage of 240+ countries and territories and 10,000+ document types.

Socure

Socure is US-centric. Its gaming page is headed “Prediction Markets, Gaming, Sportsbooks” and covers identity verification against 400+ data sources, document checks with liveness, selfie reverification at high-risk moments such as large withdrawals, bank account checks and watchlist screening. The homepage logo carousel shows DraftKings, PrizePicks, Fanatics, Caesars Entertainment, Underdog and Kalshi, and claims “6 of 7” top sportsbooks and prediction markets. The page doesn’t label these logos as clients in text, and we couldn’t find a published certification list.

Sumsub

Sumsub is the most iGaming-heavy vendor here by its own count: its iGaming page claims 400+ active iGaming clients and says it was the first identity verification provider to join the European Gaming and Betting Association (EGBA) as an associate member. Named clients include Kaizen Gaming, Betmaster and Yolo Group.

Its pricing page shows a Basic plan at $1.35 per verification ($149 monthly minimum) and a Compliance plan at $1.85 ($299 minimum) that adds AML screening, ongoing monitoring and address checks. Transaction monitoring and fraud prevention sit in a custom plan. The trust centre lists ISO/IEC 27001, SOC 2 Type 2, PCI DSS and iBeta Level 1, 2 and 3 reports.

Veriff

Veriff publishes the lowest entry price in this group. Its pricing page shows self-serve plans at $0.80, $1.39 and $1.89 per verification, with monthly minimums of $49, $99 and $209. PEP and sanctions screening costs an extra $0.64 per check. Volumes above 5,000 a month move to enterprise pricing.

The iGaming page covers age validation, facial age estimation, AML screening, proof of address and database checks, and lists SOC 2 Type II, ISO/IEC 27001:2022, ISO/IEC 30107-3 Levels 1 and 2, UK DIATF, UK Cyber Essentials and FIDO certifications. That makes Veriff the only vendor here whose gambling page names UK DIATF certification.

Published pricing, side by side

For the three vendors that publish prices, here is what a small operator would pay at entry level, from their pricing pages on 4 November 2026:

A worked example: an operator onboarding 2,000 players a month on Sumsub’s Compliance plan would pay 2,000 × $1.85 = $3,700, above the $299 minimum. On Veriff Essential with PEP and sanctions screening added, the same volume would be 2,000 × ($0.80 + $0.64) = $2,880. Neither figure includes negotiated volume discounts, retries or proof of address, and plan contents differ, so compare scopes before price.

What a gambling operator should check

• Regulator expectations first. Your licence conditions decide what you need: age verification before play, enhanced due diligence thresholds, source-of-funds checks. Our iGaming compliance briefing and gambling licence guide cover the main regimes.
• Self-exclusion and duplicate accounts. Only some vendors describe self-exclusion register integration (Shufti) or face-based duplicate detection (Incode, Shufti). Ask how this works with GAMSTOP or your national register.
• Affordability. GBG is the only vendor here that pitches financial risk checks on its gaming page.
• Platform integration. Most platform providers pre-integrate one or two KYC vendors. Check your platform’s list before signing, using our platform providers comparison.
• Certification scope. An ISO 27001 certificate covers a defined scope. Ask for the certificate and statement of applicability, not just the badge.

This site covers the gambling industry for professional readers aged 18 and over. If gambling is affecting you, our responsible gambling page lists support services, including the UK National Gambling Helpline on 0808 8020 133.