How to share documents securely for KYC

KYC (Know Your Customer) is a mandatory procedure in licensed casinos and fintech services. But the transfer of documents is a moment of increased risk: phishing, theft of files from mail, "mirrors" without HTTPS and accidental leaks through the clouds are used. Below is how the player can send documents as safely as possible and what the operator is obliged to do on his part.

Part 1. Secure transfer of KYC documents - steps for the player

1) Make sure the channel is genuine

Go only from the bookmark to the official domain via https ://( lock without errors).

Transfer files through the built-in KYC portal in your personal account or mobile application.

Do not send documents to chats/instant messengers/social networks and to personal emails of employees.

If you are asked to send to the mail, check with your office. If absolutely necessary, use a secure archive (see paragraph 6).

2) Prepare the correct files

Format: JPEG/PNG color for photos or PDF for scans.

Quality: without filters, everything is readable; do not cut corners, do not "improve" with neural networks.

What you can close:

on a bank statement - hide the balance/unrelated transactions, leave the full name, address, date and details requested by the operator;
on the utility bill - you can hide the amounts.
What cannot be closed: full name, date of birth, document number, photo, MRZ zone and validity period - if the operator asks for a full copy. Follow the official instructions: sometimes partial hiding is allowed (for example, 6 out of 8 digits of the number), sometimes not.

3) Selfie/" liveness "- how to do it correctly

Photo without glasses/hats/filters, good lighting.

If you ask for a selfie with a document, keep a second sheet next to it with the inscription: "For KYC in , date." Do not close the document data, the inscription is on a separate paper, and not on the document itself.

4) Remove unnecessary metadata

Before downloading, delete EXIF (geolocation/phone model) in the file properties or through the built-in editor. For PDF - turn off "Track changes/Comments," save as a "flat" document.

5) Names and order

Clearly name the files: 'ID _ Petrov _ 2025-10-22. jpg`, `UtilityBill_Petrov_2025-09. pdf`.

Do not put documents in a common "sharing" - only address uploading to the KYC portal.

6) If still mail (as an exception)

Compress .zip/.7z with AES encryption, transfer the password by another channel (for example, through a message in the office).

Do not write "passport/ID" in the subject line - use neutral wording.

7) Check confirmation

After downloading, wait for the status in the office (received/checked/approved).

Enable notifications about logins and profile changes; with strange activity - urgently change the password and block sessions.

8) Terms and rights

Find out the retention period and the link to the privacy policy.

In the licensed sector, you have GDPR/analogue rights: data access, correction, processing restriction and deletion after the mandatory deadlines have expired.

Part 2. What the operator is obliged to provide (regarding KYC reception and storage)

A) Secure reception

Full HTTPS/TLS 1. 2/1. 3, HSTS, mixed-content prohibition, strict CSP; mTLS and encryption "behind the CDN."

In-app/KYC portal: download only after login, one-time secure-links with expiration.

Anti-phishing: DMARC (p = reject), MTA-STS/TLS-RPT, CT monitoring of twin domains.

B) Minimization and validation

Request only necessary (SoF/SoW - by thresholds).

Clear rules for masking extra fields in statements; list of valid formats and examples.

C) File and key protection

Encryption at rest, network segregation, access with the least privileges.

KMS + HSM for keys, rotation and auditing.

Antivirus/attachment senning, sandbox for malicious files.

D) Processes and auditing

Maintaining unchanging access logs (who watched/copied), DLP alerts.

Formal retention periods and automatic deletion with act/log.

Support training: no "reset by date of birth," only according to the regulations.

DSAR (Data Subject Access Request) channel and SLA for user responses.

E) UX and transparency

Step-by-step loading wizard with examples of "what to close/what to leave."

Visible status of requisition, ETA and list of missing documents.

Data Security page: goals, rights base, deadlines, DPO contacts.

Common mistakes and how to avoid them

Mistake	What is dangerous	How to
Sending documents to Telegram/mail to the manager	Loss of control, mailbox leaks	KYC portal only; mail - encrypted archive as a last resort
Loading to the "mirror" without HTTPS	MITM, account and document theft	Always check https ://and domain letter-to-letter
Re-photoshopped "improvers"	Rejection due to "suspected editing"	Without filters; light/sharpness - ok, but don't change the contents
Closed critical fields on ID	Revalidation, payment delays	Follow the instructions: you can only close what is allowed
Geometry Files/EXIF	Extra personal data	Delete EXIF before loading
Public link to the cloud	Outsider access, indexing	Only private links with expiration or direct upload to the portal

Checklist for player (print)

I go to the site at https ://from the bookmark; domain without "substitutions."
I download only through the KYC portal (not through chats/mail).
Prepared readable files without filters; EXIF deleted.
On extracts, I mask the excess according to the instructions.
Selfie/sheet labeled "for KYC in , date" (if required).
Gained cabinet status; input/change notifications are included.
I know where to look at retention periods and how to submit a deletion request after the deadline.

Checklist for operator

HTTPS/TLS 1. 2/1. 3, HSTS, CSP; encryption "per CDN," mTLS for internal APIs.
KYC portal with secure-links and expiration, without "reception by mail."
Minimization policy: clearly what we request and how to mask unnecessary.
Encryption at rest; KMS + HSM; Access by role access logs and DLP.
Built-in antivirus/sandbox, EXIF/metadata scanning.
Retention and auto-delete; DSAR channel; support training.
Anti-phishing: DMARC (p = reject), CT monitoring, warnings in the office.

Mini-FAQ

Is it possible to seal part of the document number?

Only if explicitly permitted by the instruction. Otherwise, provide a full copy.

Why not accept via e-mail?

Mail often becomes a source of leaks. Built-in KYC portal is preferred; mail - only with encrypted archive and password via another channel.

Do I need to delete files after verification?

The player - yes, locally. The Operator shall keep by law/license within the agreed terms.

Why delete EXIF?

EXIF has geotags and device details - these are unnecessary personal data, they are not needed for verification.

Secure transfer of KYC documents is two actions: (1) use the correct channel (official KYC portal over HTTPS) and (2) minimize unnecessary data (delete metadata, mask only allowed). Protected infrastructure, minimization, strict access processes and clear communication are critical for the operator. This approach simultaneously speeds up verification, protects privacy and reduces risks for everyone.