KYC for Rewards Sites: When and How to Verify Users

When should a rewards site require KYC?

A rewards site should require full KYC (an ID document plus a live selfie) only where fraud turns into real money: when a cashout or a user’s lifetime withdrawals pass a set amount, when several risk signals point at the same account, or when a payout provider or the law requires it. Everyone else gets lighter checks: a verified email, a phone number before the first cashout, and device and network checks in the background. This stops most abuse while keeping friction away from the honest majority who withdraw small amounts.

This guide is for owners of rewards websites, GPT sites, and apps with an offerwall. It is general information, not legal advice. If you hold user funds or operate in a regulated market, your duties may go further, so talk to a lawyer.

Why rewards sites verify users at all

A rewards site pays real money for activity that is easy to fake at scale. Four problems push owners toward identity checks:

• Multi-accounting. One person with twenty accounts collects twenty sign-up bonuses and twenty sets of referral rewards. One verified identity per cashout is hard for a farm to copy. Stop multi-accounting and VPN abuse covers the other signals, and How to prevent referral fraud covers referral farms.
• Reversals after payout. Offer results can be reversed days or weeks after the credit. If the user has already cashed out, you lose the money.
• Payout partners. Payment and gift card providers have their own rules about who you may pay. PayPal payouts for rewards sites and Rewards site payout methods cover the main options.
• Age and sanctions. Some people you may not pay at all: users below your minimum age, or people and places under sanctions.

KYC does not replace the rest of your fraud stack. A verified person can still use a VPN, run bots, or abuse offers. Treat ID checks as the last gate, not the only one.

Verification levels compared

Each level adds certainty and friction. Costs here are relative; the vendor section below has real list prices.

The first four levels catch the bulk of abuse for almost no friction. What is device fingerprinting explains the device layer, and What is a residential proxy explains why IP checks alone miss some location spoofing.

When to ask for ID: thresholds and risk signals

Ask for an ID and selfie when the amount at stake justifies the friction, or when the account looks risky enough that you want proof before you pay. Write both down as rules so support applies them the same way every time.

Amount thresholds

• Single cashout: any one withdrawal above a set amount.
• Lifetime withdrawals: once total cashouts pass a set amount, verify once and remember the result.
• Referral earnings: a favorite target for farms, so give them their own, lower threshold.

Risk signals

• The device, payout destination, or phone number is linked to another account.
• The IP country, device language and time zone, and payout country disagree.
• Offers are completed faster than a person could, or in the same order as on other accounts.
• A high personal reversal rate, or a reversal right after a cashout.
• A sudden spike in earnings on a new account.

Pair verification with holds. A held reward that a reversal cancels costs you nothing, so a good hold lets you raise your ID threshold. Reward hold periods shows how to tier them.

Age checks: 16+ and parental permission

Many offerwalls and advertisers set a minimum age for people who complete offers, so match the strictest one you work with. Sharklio, for example, requires end users to be at least 16, with parental permission under 18. Put the same rule in your terms and on sign-up.

Ask for age without inviting lies

The US Federal Trade Commission’s COPPA FAQ describes a neutral age screen: let users enter their real date of birth, do not offer only birth years above the cut-off, and do not use a checkbox such as “I am over 12 years old”. It also suggests a cookie so a user who was turned away cannot simply enter a different age. COPPA protects children under 13 and was amended in 2025, so check the current text. If your audience is young, read Offerwall COPPA rules first.

Parental permission and EU rules

For users aged 16 and 17, keep a record that a parent or guardian agreed, for example a confirmation sent from the parent’s own email address. In the EU, GDPR Article 8 makes consent-based processing for online services offered directly to a child lawful from 16, with parental consent below that, and member states may lower the age to no less than 13. That rule is about consent to data processing, not about whether a minor may earn rewards, so get advice for your markets.

Verify age at the same point as identity

You rarely need a separate age check: a date of birth at sign-up is the first layer, and the ID check at your threshold confirms it. The European Data Protection Board’s statement on age assurance (February 2025) sets out ten principles, and the EDPB Chair said “the method to verify age must be the least intrusive possible.” If your vendor can return “over 18: yes or no”, store that rather than the full date of birth.

Sanctions screening and prohibited countries

Sending money to people or places under sanctions can break the law where you, your company, or your payment partners are based. You do not need to be a bank to be affected. In general terms:

• Screen names against official lists. The US Treasury’s Office of Foreign Assets Control runs the Sanctions List Search tool, which fuzzy-matches names against the Specially Designated Nationals list and its other lists. The EU and the UK keep their own lists. Most KYC vendors sell screening as an add-on.
• Block payouts from restricted countries in code. Base the list on the sanctions programs that apply to you and on your payout partners’ terms, and enforce it at cashout, not only at sign-up.
• Handle a possible match by hand. Common names cause false positives. Hold the cashout, compare date of birth and nationality, and take real matches to a lawyer.
• Review on a schedule. Sanctions programs change, so recheck your country list and vendor settings regularly.

Data protection: collect less, keep it shorter

An ID check is the most sensitive data most rewards sites ever touch. If you have users in the EU or UK, the GDPR applies, and its principles are a good default anywhere. Start from your offerwall and GDPR setup; ID checks add a few things.

• Data minimization. GDPR Article 5(1)(c) requires data to be “adequate, relevant and limited to what is necessary”. You need to know the person is real, unique, old enough, and not sanctioned. You rarely need to keep a copy of their passport.
• Biometric data. A selfie matched against an ID photo is biometric data used to identify a person, which Article 9 lists as a special category allowed only under specific conditions, such as explicit consent. Ask for that consent clearly, and offer another route where you can, such as manual review of an ID.
• Impact assessment. Article 35 requires a data protection impact assessment before likely high-risk processing, naming large-scale processing of special category data as one case. If you verify many users, plan on one.
• Storage limitation. Article 5(1)(e) says data should be kept no longer than necessary. Keep the result (verified, date, vendor reference, age band, sanctions result) and let the vendor delete images on a short schedule.
• Vendor contract. Sign a data processing agreement, know where data is stored, and name the vendor in your privacy policy.

The official text is on EUR-Lex. Other countries differ, and some US states have their own biometric privacy laws, so check where your users live.

KYC vendors: types and list prices

You will not build document and liveness checks yourself. Vendors fall into two types: identity add-ons from payment companies, simple to start and priced per check, and specialist identity platforms with more settings, sanctions screening, and case management, usually with a monthly minimum. These prices come from each vendor’s own pricing or help page, checked on October 22, 2026. They vary by region and change often, and are listed for comparison, not as a recommendation.

Before you sign, ask: which countries’ documents are supported, whether failed attempts are billed, whether a result can be reused, how long images are kept, where data is stored, and whether you can get an over-18 result without the full date of birth.

User experience, refusals and appeals

Keep drop-off low

• Say it up front. State in your terms and on the cashout page when ID may be needed. Terms of service for rewards sites covers the wording.
• Ask once. Verify at the threshold, then remember the result. Asking at every cashout feels like suspicion.
• Explain why. One true line, such as “We verify identity on larger cashouts to stop fraud. Our provider deletes your ID images after the check.”
• Make it work on a phone. Most users take the selfie on their phone, so offer a desktop-to-mobile QR code if your vendor supports it.
• Show a status. “Verification in review, usually within 24 hours” prevents tickets, if you can meet it.

When a user refuses or fails

• Refuses: they keep earning and can cash out below the threshold, but not above it. Do not cancel their balance.
• Technical failure (blurry photo, unsupported document): allow a few retries, then route to manual review.
• Clear fraud (a document that does not match, a face that matches another account): close the account under your terms, keep the evidence, and do not pay rewards earned by breaking the rules.

Give every refusal a human appeal

Automated checks make mistakes. GDPR Article 22 gives people a right not to be subject to decisions based solely on automated processing that significantly affect them, and where such decisions are allowed it requires safeguards including human intervention and the right to contest. Outside the EU it is still good practice: tell the user which rule applied, let them add information, and have a person decide. If many appeals succeed, your rules are too strict. Handling missing reward tickets has tips on answering upset users that work here too.

Frequently asked questions