Published 2026-08-09 · Last revised 2026-08-09
Know Your Customer is the process by which a business establishes that you are a real, identifiable person before it moves money to you. On a gaming platform it arrives at the worst possible moment — you have won something, you want it, and instead you are being asked to photograph documents. That timing is why the step feels like an obstacle invented to delay payment, and why the scams that imitate it work so well.
It is worth understanding properly, because the rules are specific enough to predict. Nearly every rejection people describe as inexplicable turns out to be one of three failures, and all three are avoidable.
Where the obligation actually comes from
The app is not a bank, so the instinct that it has no business asking is reasonable. It is also wrong, for a structural reason: the app does not pay you. A bank or a payment aggregator does, on the app’s instruction, and those entities operate under India’s anti-money-laundering framework, which requires them to know who is receiving funds. The obligation flows down the chain to whoever is collecting your details.
There is a second, entirely separate reason, and it is the one people underestimate. Winnings from online games attract deduction of tax at source under section 194BA of the Income-tax Act, at 30% on net winnings. Deducted tax has to be reported against a permanent account number. A platform that paid you without one would have a reporting failure of its own, which is why the PAN request is not negotiable no matter how small the payout.
Two consequences follow that people find counterintuitive. There is no threshold below which the deduction is skipped, unlike older lottery and game-show provisions. And “net winnings” is a defined annual computation across deposits and withdrawals rather than the size of the payout in front of you — which is why the amount actually deducted seldom equals 30% of the number you typed into the withdrawal box. What your own position is depends on facts this page does not have; a tax professional is the right place to settle it.
The name-match rule, which fails more payouts than anything else
The rule is simple: money is paid to an account in the same name as the verified account holder. The application of it is stricter than almost anyone expects.
| Initials | An expanded first name on the PAN and an initial on the bank account is a mismatch, even though every human reading both knows they are the same person. |
|---|---|
| Middle names | Present on the document, absent on the bank record — one of the most common causes, and one people never think to check because both are “their name”. |
| Surname changes | A maiden name on one record and a married name on the other. Legitimate, extremely common, and still a hard stop until one is updated. |
| Someone else’s account | A spouse’s or parent’s account, usually offered in good faith because the player has no account of their own. This is the case the rule exists for and it will never be approved. |
The productive response is to make the two records identical, not to resubmit the same pair with a better photograph. Resubmission cycles are where the days go.
What is normally asked for, and what each one proves
| PAN | The tax identity. Required for the deduction to be reported correctly, which is why it is the one document that is never optional. |
|---|---|
| Aadhaar or another identity proof | Identity and address. Where a masked version is accepted — last four digits only, generated from the official UIDAI portal rather than cropped by hand — that is the version to send. |
| Bank proof | A cancelled cheque, passbook page or statement header, tying the account being paid to the name being verified. This is where the name match is actually adjudicated. |
| A liveness or selfie check | Increasingly common, and it defends against the failure mode everything else misses: a genuine document belonging to someone who is not the person operating the account. |
Why uploads get rejected
Beyond name mismatches, the rejections cluster tightly. Glare across the document or a corner cut off in frame. A photograph of a screen showing the document rather than the document itself. Any edit at all — brightness adjustment and cropping are indistinguishable from tampering to an automated check, and a file carrying editing metadata attracts scrutiny a plain camera photo does not. Expired proofs. And details that disagree with the account: a date of birth on the document that does not match the one registered at signup is a mismatch of the same family as a name mismatch.
Flat surface, daylight, no flash, all four corners visible, no editing, first time. That single habit removes most of the delay people attribute to slow support.
What happens to the documents
Honest answer: this varies by platform, and it is the part you have least visibility into. What you can reasonably expect from an operator worth dealing with is a privacy policy that states what is collected, how long it is retained, and who it is shared with — and an actual answer when you ask. What you should not expect is deletion on request the moment verification passes, because retention periods under anti-money-laundering rules are measured in years and the platform does not have discretion to shorten them.
The practical protection is proportionality: send the minimum that satisfies the requirement, prefer masked forms where they are accepted, and send documents only through the platform’s own upload screen — never as an attachment in a chat, however official the person on the other end sounds.
The three requests that are always fraud
Genuine verification has a narrow shape, which makes the imitations identifiable. Three requests are never legitimate, in any context, from any sender:
| An OTP | Aadhaar, bank or app — the code authenticates you, so sharing it lets someone else be you. No verification step requires you to read one out or type it into a chat. |
|---|---|
| A fee | To complete, unlock or expedite KYC. The obligation is the platform’s and so is the cost. This one lands hardest when a real withdrawal is genuinely pending, which is exactly when it is deployed. |
| Remote access or a private channel | A screen-sharing app to “help complete” verification, or documents requested over WhatsApp or Telegram by someone claiming to be support. Verification happens inside the app. |
The tell shared by all three is urgency attached to money you are already owed. That combination — a pending payout plus time pressure — is the engineered part, and recognising it is more reliable than trying to assess whether a particular message looks official.
Before you start
Verify early, when nothing is pending. Verification triggered by a withdrawal is the same process performed under time pressure, with a balance you want to move and every incentive to accept a shortcut offered by a stranger. Done in advance it is an administrative task; done at the moment of payout it is the scenario every KYC scam is designed around.
For the platform-specific steps — where the upload screen lives, and the five things that hold a payout up on IC7 specifically — the walkthrough is on the IC7 withdrawal guide. The money-in side, including why a bank declines a payment before your balance is ever consulted, is covered in how UPI payments work, and what we could and could not verify about the operator is set out on is IC7 safe.
Frequently asked questions
Why does a gaming app need my PAN if it is not a bank?
Because the money leaves through regulated infrastructure even though the app itself is not a bank. Payouts run through a bank or a payment aggregator, and those entities carry customer-identification obligations under India's anti-money-laundering framework that they cannot discharge without knowing who is being paid. There is also a tax reason: winnings from online games attract deduction at source, and the deduction has to be reported against a PAN. An app paying you without one has a problem regardless of what you want.
My withdrawal was rejected for a name mismatch. What counts as a mismatch?
Any difference between the name on the account being paid and the name on the identity document — including an initial expanded on one and abbreviated on the other, a maiden surname, or a middle name present in one place and missing in the other. It is not pedantry: paying out to an account in someone else's name is precisely the pattern the identification rules exist to stop, so the check is deliberately strict. Fix it by making the bank account name and the document name identical rather than by resubmitting the same pair.
How much tax is deducted from winnings in India?
Under section 194BA of the Income-tax Act, tax is deducted at source at 30% on net winnings from online games, and unlike older provisions there is no minimum threshold below which it is skipped. Net winnings is a defined computation across your deposits and withdrawals over the year, not simply the size of one payout, which is why the figure deducted rarely matches a naive 30% of what you withdrew. Treat this as orientation and confirm your own position with a tax professional.
How long should verification take?
Ordinarily a working day or two once the documents are legible and consistent. What extends it is almost never queue length — it is a resubmission cycle, where a rejected upload is replaced with another photograph of the same document at the same angle. The single largest saving available to you is getting the first submission right: flat, uncropped, in daylight, all four corners in frame, nothing edited.
Is it safe to share Aadhaar with a gaming platform?
Share the least that satisfies the request. Where a masked Aadhaar is accepted — the form showing only the last four digits — that is the version to send, and it is generated from the official UIDAI portal rather than by cropping an image yourself. What is never appropriate to share is an Aadhaar OTP: that code authenticates you, and anyone who has it can authenticate as you. No legitimate verification step requires you to read an OTP aloud or type it into a chat.
Someone is asking for a fee to complete my KYC. Is that ever real?
No. Verification is a cost the platform bears because the obligation is the platform's. A demand for payment to 'complete', 'unlock' or 'expedite' KYC is an advance-fee scam in every instance, and it is most convincing when it arrives just as a genuine withdrawal is pending — which is exactly when the target is least inclined to question it. The same applies to anyone offering to complete verification on your behalf through a private channel.
18+ only · Real-money play is not an income source · Not tax advice