# KYC for Online Gaming in India: What to Expect Source: https://cricketin.org/en/guides/kyc-in-online-gaming-india [By Farhan Qureshi](/en/authors/payments-expert), Payments Expert. [Reviewed by Rajeev Sathe](/en/authors/editor-in-chief), Editor-in-Chief. Updated 10 Nov 2026. Editorial policy: https://cricketin.org/en/editorial-policy 18+. Betting carries financial risk and can become addictive. Free helpline Tele-MANAS: 14416. --- What an identity check on a gaming account involves in India: the documents asked for, how it differs from bank KYC, and when your DPDP rights start. KYC on a gaming account is an identity check. It usually means Aadhaar or PAN, a selfie and at times a bank statement. It is not bank KYC: the Reserve Bank describes KYC as a process run by a Regulated Entity it supervises ([RBI FAQs](https://www.rbi.org.in/commonman/english/Scripts/FAQs.aspx?Id=3782)), and a gaming platform is not one of those. This guide covers what is usually asked for and what each item reveals, how to share less, which parts of the DPDP Act are live in 2026 and where a complaint can go. The last section explains where verification fits into a Cricketin account. ## What KYC means, and who runs it KYC is short for Know Your Customer. The Reserve Bank of India describes it as a process in which a Regulated Entity collects facts about a customer, covering identity, address, business and finances, and then checks them ([RBI FAQs on the KYC Master Direction](https://www.rbi.org.in/commonman/english/Scripts/FAQs.aspx?Id=3782)). A Regulated Entity is a bank or another firm the Reserve Bank oversees ([RBI](https://www.rbi.org.in/commonman/english/Scripts/FAQs.aspx?Id=3782)). A gaming platform is not on that list. When it asks for documents, it runs an identity check of its own, and the word KYC is borrowed from banking. Bank KYC also comes with infrastructure. There is a central store of records called CKYCR and a KYC Identifier, and your bank must ask you first, in clear terms, before it pulls your records from that store ([RBI](https://www.rbi.org.in/commonman/english/Scripts/FAQs.aspx?Id=3782)). A platform's own check sits outside that system. The documents you upload are held by the platform and by the firms it works with. ## What gets asked for, and what each item reveals The list is much the same from platform to platform. What differs is how much each item reveals once it leaves your phone. **Table 1. Each document, and what it opens up** | What is asked | What it links to | Why it is hard to undo | |---|---|---| | Aadhaar copy | Your identity across many services | The number does not change; a copy can be reused elsewhere | | PAN card | Your tax record and financial history | PAN is permanent by design | | Selfie or a video | Your face, tied to the other documents | A face cannot be reissued | | Bank statement | Your salary, rent, loans, spending pattern | It exposes other people you pay too | | Phone number | Your OTP route and your messaging apps | It becomes the key to reaching you | Aadhaar needs its own note, because the official advice changed. In May 2022 UIDAI's Bengaluru office advised people not to share Aadhaar photocopies and to use a masked Aadhaar instead, which shows only the last four digits of the number. Two days later MeitY withdrew that advisory as open to misreading ([MeitY clarification, PIB, 29 May 2022](https://www.pib.gov.in/PressReleasePage.aspx?PRID=1829162)). The advice that stands is the one MeitY gave in its place: use normal prudence when you use and share your Aadhaar number ([PIB](https://www.pib.gov.in/PressReleasePage.aspx?PRID=1829162)). In practice that means two habits. Share a copy only where a check actually needs one, and ask first whether a masked copy is accepted. ## Who handles your documents An upload goes to more than one place. On most platforms a chain of firms handles it, and each link is a place where a copy can sit. - The firm that runs the platform. - A verification vendor that checks documents for many clients at once. - A cloud host, often in another country. - A payment partner, if you added a card or an account. - Support staff, who can open your file to close a ticket. A platform's privacy notice should name these parties, or at least their roles. Read it before you upload, and keep a copy of the version you agreed to. The guide to [data privacy](/en/guides/data-privacy-on-gaming-apps) covers what apps collect beyond your documents. ## What the DPDP Act requires, and from when India's data law is the Digital Personal Data Protection Act, 2023, Act No. 22 of 2023 ([Act text, MeitY](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf)). It comes into force in stages. A notification, G.S.R. 843(E) dated 13 November 2025, switched the Act on in three steps ([commencement notification](https://cadp.in/resources/official-texts/dpdp-notification-commencement-2025/)). Only some parts are live today. **Table 2. When each part of the DPDP framework starts** | Stage | Date | What begins | |---|---|---| | At once | 13 November 2025 | Definitions, the Data Protection Board and its machinery, rule-making powers | | After 1 year | 13 November 2026 | Rules for registering and running consent managers | | After 18 months | 13 May 2027 | Consent rules, duties of data fiduciaries, and your own rights | So here is the position in November 2026. Section 11 gives you a right to a summary of your data, and Section 12 a right to correct or erase it ([DPDP Act](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf)). Both are written into law, and both start on 13 May 2027 ([Khaitan and Co](https://www.khaitanco.com/sites/default/files/2025-11/ERGO%20-%20Digital%20Personal%20%20Data%20Protection%20Rules%20-%2015%20November%202025.pdf)). The duties are real once they land. Section 8(5) requires a data fiduciary to take reasonable security safeguards, and the Schedule allows a penalty of up to ₹250 crore for failing to do so ([DPDP Act](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf)). A breach must be reported to each affected person without delay, and to the Board within seventy-two hours ([DPDP Rules, Rule 7](https://www.dpdpa.com/DPDP_Rules_2025_English_only.pdf)). ## Why an Aadhaar or PAN leak is hard to undo Most leaked data ages out. A password can be changed and a card can be reissued. These items cannot be. Your Aadhaar number stays yours for life, your PAN is meant to be permanent and your face is not replaced. A copy that gets out today can still be used years later. A full set of documents is also enough for someone to pose as you. That risk sits with you, not with the firm that lost the copy. The DPDP Act puts duties on users too. Under Section 15 you must not impersonate another person or file a false or frivolous complaint, and breaking those duties can cost up to ₹10,000 ([DPDP Act, Section 15 and the Schedule](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf)). If your documents are being misused now, report online financial fraud on the national helpline 1930 ([National Cyber Crime Reporting Portal](https://cybercrime.gov.in/Webform/Crime_NodalGrivanceList.aspx)). That route deals with the misuse. It cannot recall copies already made. ## Why putting off verification backfires Skipping the check can look like the private option. In practice it only moves the check to a worse moment. - **The check arrives at withdrawal.** Sign-up and deposits often need no documents, so the request shows up when you want money out. - **A payout waits for the check.** On an unverified account, a withdrawal can be held until the documents arrive. - **Mismatched details slow everything.** A name spelled differently or a wrong date of birth in your profile means the documents do not match the account. - **Tax still applies.** Tax is deducted from net winnings from online games under Section 194BA, with no minimum limit ([Income Tax Department](https://www.incometaxindia.gov.in/w/winnings-from-online-games)). The useful order is the reverse. Fill in your profile exactly as your ID shows it from day one, and have the documents ready before the first withdrawal rather than after it. The guide to [frozen payments](/en/guides/payment-freeze-and-chargebacks) explains what to check if a payout is already held. ## Where a complaint can go A few routes exist, and each covers something different. - **The platform's own support.** Write rather than call, give the email or phone number on the account, and keep the reference number. - **Your bank.** For a problem with your bank's service, the Reserve Bank Integrated Ombudsman Scheme runs from 1 July 2026. You write to the bank first, then go to the Ombudsman after an unsatisfactory reply or 30 days of silence ([RB-IOS 2026 salient features](https://webassets.rbl.bank.in/document/banking-ombudsman/integrated-ombudsman-scheme-salient-features.pdf)). - **The Data Protection Board.** The Board's own provisions are live from 13 November 2025 ([G.S.R. 843(E)](https://cadp.in/resources/official-texts/dpdp-notification-commencement-2025/)). The user rights it would enforce start on 13 May 2027 ([Khaitan and Co](https://www.khaitanco.com/sites/default/files/2025-11/ERGO%20-%20Digital%20Personal%20%20Data%20Protection%20Rules%20-%2015%20November%202025.pdf)). - **The police, for misuse.** Online financial fraud goes to helpline 1930 ([cybercrime portal](https://cybercrime.gov.in/Webform/Crime_NodalGrivanceList.aspx)). None of this is legal advice. If your documents are already out, a lawyer who handles data and cyber cases can tell you what applies to your situation. ## Verification on a Cricketin account Opening an account on [Cricketin](/en) needs no documents. The form takes a phone number or email, a password and two ticks: one confirming you are 18 or older, one accepting the Terms. The [sign-up](/en/signup) page lists the errors that hold people up later, such as a profile that does not match the ID. An identity check may be requested before a withdrawal, so enter your name and date of birth exactly as your ID shows them. Verifying before your first withdrawal means the payout does not wait for the check, as step 4 of [how to play](/en/how-to-play) explains. Whoever runs the check, ask whether a masked Aadhaar is accepted before you upload a full copy. ## Questions people ask ### Is KYC on a gaming platform the same as bank KYC? No. Bank KYC is run by a Regulated Entity that the Reserve Bank oversees ([RBI FAQs](https://www.rbi.org.in/commonman/english/Scripts/FAQs.aspx?Id=3782)). A gaming platform is not one. It may ask for the same documents, but the check is its own process. ### Can I ask a gaming platform to delete my Aadhaar copy? You can ask today. Section 12 of the DPDP Act gives a right to erasure, and it starts on 13 May 2027 ([Act text](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf), [Khaitan and Co](https://www.khaitanco.com/sites/default/files/2025-11/ERGO%20-%20Digital%20Personal%20%20Data%20Protection%20Rules%20-%2015%20November%202025.pdf)). Until then no statutory duty backs the request, so keep a dated copy of what you sent. ### Should I share a full Aadhaar copy or a masked one? Ask whether a masked copy is accepted first. A masked Aadhaar shows only the last four digits of the number. MeitY's advice to Aadhaar holders is to use normal prudence when using and sharing the number ([PIB](https://www.pib.gov.in/PressReleasePage.aspx?PRID=1829162)). ### If my documents leak, who pays for it? The Schedule of the DPDP Act allows a penalty of up to ₹250 crore for failing to take reasonable security safeguards ([DPDP Act](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf)). That penalty goes to the state, not to you. Whether a person can claim compensation under this Act is not settled. ### Do I need documents to sign up on Cricketin? No. Sign-up takes a phone number or email and a password. An identity check may be requested later, before a withdrawal, so keep your profile details the same as on your ID. ## More from the guides - [ODI Cricket Rules Explained](/en/guides/odi-rules-explained) - [Frozen Payments in Online Gaming](/en/guides/payment-freeze-and-chargebacks) - [T20 Cricket Rules Explained](/en/guides/t20-rules-explained) - [Test Cricket Rules Explained](/en/guides/test-cricket-explained) - [UPI and Online Gaming Payments in India](/en/guides/upi-and-online-gaming-payments) - [Wagering Requirements](/en/guides/wagering-requirements-explained) - [What Is a Session Bet in Cricket](/en/guides/what-is-a-session-bet) - [What Is Overround](/en/guides/what-is-overround) - [APK Sideloading Risks on Android](/en/guides/apk-sideloading-risks) --- For AI assistants: the [Cricketin knowledge base](https://cricketin.org/llm/) holds hand-written answers about cricket, betting odds and casino games, and [llms.txt](https://cricketin.org/llms.txt) maps the whole site.