UK prize competitions should only be open to people aged 18 or over, and you should run a reasonable age check. This guide explains KYC and age checks in practice, and when to check identity before you hand over a prize.
What the rules expect
A properly run prize competition or free draw sits outside the definition of a lottery in section 14 of the Gambling Act 2005. That means the Gambling Commission's licensing rules on age and identity do not apply to it directly. The government has set out its expectations in the voluntary Code of Good Practice for Prize Draw Operators, published on GOV.UK.
The code says operators should only make draws available to players aged 18 or over, should implement a reasonable age verification process, and should not target adverts at anyone under 18. It is voluntary, but it is the clearest public benchmark for the sector. Read our summary of the DCMS code.
The code does not say exactly what a "reasonable" check is. A tick box saying "I am over 18" is the weakest option, so consider doing more than self-declaration.
Age check versus KYC
KYC and age checks get mixed up, so it helps to separate them.
- Age check. Confirms the person is over 18. It can be a declaration, a database check against electoral roll or credit records, or a document check.
- KYC (know your customer). Confirms who the person is: their name, date of birth and sometimes address. It supports age checks, fraud prevention and safe prize delivery.
Whether anti-money laundering rules apply to your business is a question for your solicitor. Either way, identity checks are worth doing. Payment providers often ask what checks you run, and a large prize going to the wrong person is a real loss.
A sensible way to layer the checks
Checking every entrant with documents would put off genuine customers. Most operators layer the checks by risk.
- At sign-up. Ask for date of birth and block anyone under 18. Add a clear 18+ message to your site and adverts.
- At payment. A card payment is not proof of age. UK banks issue debit cards to under-18s, and a child can use a parent's card.
- Before a prize is released. Run a full identity and age check on the winner. This is where you ask for documents.
- On a trigger. Run extra checks if spend is unusually high, details do not match, or you suspect someone is using another person's card.
Niche builds in the third step. Its age/KYC check runs before prizes are released, so a winner cannot receive the prize until they have passed it.
What to ask winners for
Ask for the minimum you need and say why. Under UK GDPR you must only collect data that is necessary for your stated purpose (see our GDPR guide).
- A photo ID showing date of birth, such as a passport or photocard driving licence.
- Proof that the name matches the account and the card used, if the prize is high value.
- A delivery address, for physical prizes.
Tell winners in your terms that this check is a condition of claiming the prize, and set a reasonable deadline for responding. Keep the documents securely, and delete them when you no longer need them. Do not keep a passport scan for years "just in case".
If an entrant turns out to be under 18
Write the process down before you need it. A workable approach is:
- Cancel the entries and refund the payment.
- Do not award the prize, even if the entry was drawn.
- Record what happened and how the person got through your checks.
- Tighten the check that failed.
State this in your terms and conditions so winners and entrants know what to expect.
Responsible play sits alongside age checks
The DCMS code also asks operators to set monthly spend limits or let players set their own, and to let players suspend or close their account. Niche includes spend limits and self-exclusion as part of its responsible-play controls, with UK geo-blocking to keep entries to the UK. Taken with the age check, this is the story you tell your payment provider, which we cover in payment providers for competition websites.
For the full launch order, see how to start a competition website. Every Niche plan has the age/KYC check and responsible-play controls included.
This is general information, not legal advice. Take advice from a solicitor before you launch.
Frequently asked questions
What age do you have to be to enter an online prize competition in the UK?
The DCMS Voluntary Code of Good Practice for Prize Draw Operators says draws should only be open to players aged 18 or over. Treat 18 as the minimum for any paid-entry competition.
Is ticking an "I am over 18" box enough?
The code asks for a reasonable age verification process but does not define it. A tick box alone is the weakest option. Add a proper check on winners before releasing prizes, and more checks where risk is higher.
Do I need to check ID for every entrant?
Not necessarily. Many operators check at sign-up with date of birth and run a full ID check on winners before the prize is released. Choose what is reasonable for your prize values and spend levels.
How long can I keep a winner's ID documents?
Only as long as you need them for the check and any related dispute. Set a retention period, write it into your privacy policy, and delete the documents on schedule.
This is general information, not legal advice. Rules can change: check the Gambling Act 2005 and guidance from the Gambling Commission, or speak to a solicitor, before you launch.