7 step compliance checklist for ID checks in UK competitions

Prize draws and free competitions in the UK are generally lawful once a genuine free-entry route exists, but that doesn’t remove the need for sensible age and identity checks wherever real risk sits in the prize or payment flow. Acceptable proof usually means a passport, a photocard driving licence or a combination of documents confirming name, date of birth and address. Anyone collecting that data must handle it under UK GDPR, which usually means running a Data Protection Impact Assessment and keeping retention to the minimum.

TL;DR:

• Identity and age verification methods should match the competition’s risk level, with biometric checks for high-value prizes and basic age-gating for low-risk draws.
• Acceptable proof includes passports, driving licences, or supporting documents like utility bills, with electronic checks preferred but physical documents may take longer to verify.
• Data handling must comply with UK GDPR, requiring secure storage, minimal retention, and clear transparency on what data is collected and how it is used.
• Verification should be triggered early in high-risk cases, especially with suspicious operational signs such as repeated entries from the same IP address or unreachable winners.
• Clear, published verification policies and transparent terms increase trust and reduce disputes, especially when they specify what evidence may be required before awarding prizes.

Table of Contents

• When organisers must carry out ID or age checks
• What documents and evidence are generally accepted
• Online verification options and their trade-offs
• Data protection essentials for handling ID data
• A practical checklist for running compliant ID checks
• How entrants can prove identity safely and spot fake competitions
• Why clear verification policies matter more than people assume
• How we help you find raffles with transparent verification
• FAQ
• Sources
• Key official guidance and primary sources to consult

When organisers must carry out ID or age checks

Whether verification is a legal necessity depends on how a competition is classified. A lottery (where entry is purely a matter of chance and paid entry is the only route) falls under the Gambling Act and typically requires a licence, alongside the identity and financial checks that licensed gambling businesses must run. A genuine prize draw or skill-based competition, where a free-entry route exists alongside any paid option, usually sits outside gambling licensing and instead follows the Voluntary Code of Good Practice for Prize Draw Operators, which sets out expectations for transparency and fair treatment of entrants in Great Britain.

Several practical triggers push an organiser from “probably fine without checks” to “needs a documented verification step”:

• A chance-based element combined with a paid entry fee, which edges the competition towards gambling regulation.
• A prize valuable enough that fraud, multiple accounts or underage entry becomes a real financial risk.
• Any suspicion of fraud, money laundering or a winner who may be subject to a self-exclusion scheme.
• Payouts that involve cash, cars or property, where financial verification sits alongside identity verification.

Licensed gambling operators carry a firm obligation here: the Gambling Commission’s guidance makes clear that online gambling businesses must verify age and identity, and should not leave this only until a withdrawal request arrives. Checks should be prompted as soon as risk indicators appear, not bolted on as an afterthought.

Operational red flags matter too. A sudden spike in entries from a single IP range, repeated use of the same payment card across apparently unrelated accounts, or a winner who is unreachable through the contact details supplied are all signs that verification should have happened earlier, or needs to happen now before any prize is released.

What documents and evidence are generally accepted

Most UK competitions that do require proof lean on the same core documents used across financial services and licensed gambling: a passport, a photocard driving licence, or a combination of a less formal document (a utility bill, bank statement or council tax bill) used to confirm address and date of birth where a single document doesn’t cover both. The Gambling Commission notes that verification can happen almost instantly through electronic checks, or take longer where physical documents need to be examined.

Sensible acceptable evidence for an organiser running checks might include:

• A valid passport or photocard driving licence as primary proof of identity and date of birth.
• A recent utility bill, council tax statement or bank statement as supporting proof of address.
• A combination of two secondary documents where no single document confirms both identity and address.
• A digital identity check through a recognised provider, where the entrant consents to an electronic lookup instead of uploading scans.

Not every entrant holds a passport or driving licence, and refusing a prize purely on that basis risks excluding people unfairly, a consideration that sits close to Equality Act principles around reasonable treatment. Building in an alternative route, such as a bank statement plus a benefits or pension letter, or a short video call where an entrant holds up accepted documents, keeps the process fair without weakening it.

Terms and conditions should say plainly what you might ask for and why. A clause along the lines of “winners may be asked to provide proof of identity and age before a prize is released, which may include a passport, driving licence or recent utility bill” sets expectations before anyone enters, rather than springing a surprise on a winner who has already told their family they’ve won.

Pro Tip: Publish your acceptable evidence list on the entry page itself, not buried in a linked terms document; winners are far less likely to feel ambushed when the request matches what they read before entering.

Online verification options and their trade-offs

Online identity checks for competitions generally fall into three families, each with a different balance of friction, cost and certainty.

Third-party ID verification services check a submitted document against government or credit-reference databases, confirm it hasn’t been reported lost or stolen, and often cross-reference the name against sanctions and fraud lists. These suit mid-to-high value prizes where the cost of a wrong payout outweighs the cost of the check itself, and they map closely to what licensed gambling operators already run under Gambling Commission expectations.

Selfie-to-ID biometric matching goes a step further, comparing a live photograph against the picture on a submitted document to confirm the person presenting the ID is the person it belongs to. This gives stronger assurance against stolen or borrowed documents, but because it involves biometric data, it counts as special category data under UK GDPR, which means a Data Protection Impact Assessment becomes necessary before deployment, not optional good practice.

Age-estimation tools, which assess likely age from a photograph or behavioural signals without pinning down a fixed identity, sit at the lower-friction end. They’re faster and cheaper to run, but less certain, and better suited to low-risk draws where the main concern is keeping out under-18s rather than confirming a specific identity for a high-value payout.

The right choice depends on a few practical factors:

• Prize value: higher-value prizes justify stronger, slower checks.
• Fraud risk: competitions with a history of bot entries or duplicate accounts need firmer identity confirmation.
• Expected audience: a family-friendly draw with modest prizes may only need basic age-gating.
• Accessibility: any method chosen should have a fallback for entrants who can’t or won’t submit biometric data.

Data protection essentials for handling ID data

Collecting passports, driving licences or biometric selfies turns a competition into a data-handling exercise, and UK GDPR applies in full. Where biometric data forms part of the check, it’s treated as special category data, which raises the bar: a DPIA becomes a practical necessity and organisers need a clear lawful basis for processing before a single document is collected.

Retention is where many otherwise careful organisers slip. The safer approach:

• Store the verification outcome (pass or fail, and the method used) rather than the document image itself.
• Delete raw ID scans and selfies once verification is complete, unless a specific legal or regulatory reason requires keeping them longer.
• Set a defined retention period in writing and apply it consistently, rather than leaving files sitting indefinitely “just in case”.
• Keep verification records separate from marketing data, so a winner’s ID scan never ends up feeding a mailing list.

Transparency obligations run alongside this. A privacy notice should explain, in plain terms, what’s collected, why, how long it’s kept and how an entrant can exercise their data subject rights. Storage needs to be secure, with access limited to people who actually need it, and a breach response plan should exist before it’s ever needed rather than being written in a panic afterwards.

Certification offers a useful shortcut to demonstrating good practice. The ICO points to schemes such as ACCS and the PAS 1296 standard as an independent way for age-assurance providers to show their systems meet recognised conformity standards, which is worth checking for when choosing a third-party verification partner.

Pro Tip: If you’re unsure whether your draw needs a full DPIA, ask whether you’re processing biometric data or data about children; either answer being “yes” tips the balance firmly towards doing one.

A practical checklist for running compliant ID checks

Turning the legal context into something you can actually follow before launch takes a short, repeatable process:

1. Decide and document the competition’s legal classification (lottery, prize draw or skill contest) and keep that decision on file in case a regulator or payment provider asks.
2. Draft clear terms and conditions covering what evidence you may request, when, and what happens if a winner can’t or won’t provide it.
3. Map verification strength to prize value and risk: light-touch age-gating for modest prizes, full identity and financial checks for cars, cash or property.
4. Choose a verified provider if outsourcing checks, and confirm they hold relevant certification such as ACCS against PAS 1296.
5. Set the verification timing: at entry for higher-risk draws where underage or fraudulent entries carry real cost, or at the point of award and payout for lower-risk free draws.
6. Record timestamps and decision logs for every check carried out, so there’s a clear audit trail if a winner is later challenged or a complaint arrives.
7. Publish the acceptable evidence list, provide a secure upload channel rather than an open email address, and give winners a simple way to appeal a failed check.

Keeping friction low matters as much as keeping the process sound. A winner who’s asked for five documents through an unencrypted email thread is far more likely to walk away from a legitimate prize than one who’s pointed to a secure portal with a short, clearly explained list.

Pro Tip: Build the decision log as you go rather than reconstructing it after a dispute; a simple spreadsheet with entry date, verification method and outcome usually covers what a regulator or payment processor needs to see.

How entrants can prove identity safely and spot fake competitions

If you’re asked to prove who you are to claim a prize, the safest route is almost always a dedicated, encrypted verification flow run by the operator or a named third-party provider, not an email attachment sent to a personal inbox. Legitimate operators rarely ask you to send a full scan of your passport over unsecured channels when a proper upload portal exists.

A handful of checks help separate genuine competitions from the rest:

• Clear, specific terms and conditions that explain entry rules, prize value and what verification might be required.
• Published evidence of previous winners, ideally with some detail beyond a first name and a stock photo.
• Visible operator contact details, including a registered business address rather than only a social media handle.
• A stated verification policy that matches what you’re actually asked for when you win.
• Gambling Commission registration details, where the competition involves a licensable element, which you can check against the regulator’s own register.

Checking whether a raffle site is legitimate before you enter is worth the five minutes it takes, particularly for newer operators you haven’t used before.

If an operator asks for something unusual, such as your full bank login details, a selfie holding your card details visible, or insists you email scanned documents to a personal address rather than a secure portal, decline and treat it as a red flag. Suspicious requests connected to a gambling-licensed activity can be reported to the Gambling Commission, and anything that looks like outright fraud is worth reporting to Action Fraud.

Why clear verification policies matter more than people assume

Most entrants don’t check a Gambling Commission register before entering a draw. Research into the free-draw and prize-competition market found that participants lean heavily on visible trust signals such as terms and conditions and evidence of previous winners, with only a minority taking the extra step of checking formal registration. That gap between what people rely on and what actually proves legitimacy is where a lot of avoidable disappointment lives.

Our view is that a published, specific verification policy does more to earn trust than a long, legalistic terms page ever will. An operator who states plainly what they’ll ask for, when, and why, signals they’ve thought the process through rather than bolted it on after a dispute. We think that visible clarity, not formal credentials alone, is what actually moves a cautious entrant from hesitation to confidence, and we’d encourage any organiser reading this to treat their verification policy as a trust feature worth promoting, not small print to hide.

— matt

How we help you find raffles with transparent verification

We built a platform to make comparing UK raffles and prize draws straightforward, tracking live odds, ticket prices and closing times across operators so you can see where your money goes furthest. The listings update regularly, and free-entry routes are flagged wherever operators offer them, which matters just as much for spotting fair play as for finding better odds.

Alongside odds and prices, we surface signals that point to how seriously an operator takes verification, which is part of why we maintain a list of trusted operators worth starting with if you’re new to a platform. A few things worth knowing before you dive in:

• Raffles are compared across categories such as cars, cash, homes, watches and jewellery, tech, holidays and motorbikes, alongside free-entry options.
• Our trusted operators list highlights platforms that publish clear verification and terms policies.
• Operators wanting visibility on the platform can get their raffle listed with us directly.

We’re a comparison tool, not a legal advice service, so nothing here replaces checking the specific terms of the draw you’re entering or speaking to a qualified adviser if a dispute arises. If you’d like to browse live options with clearer odds and fewer surprises, our raffle comparison page is the place to start, and our Play to Win feature lets you earn extra tickets through free games while you do.

This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.

FAQ

What are some legitimate competition sites in the UK?

Legitimate UK competition sites typically publish clear terms and conditions, verifiable evidence of past winners and a stated verification policy, alongside visible operator contact details. Checking a platform against our operator comparison guide before entering gives you a quicker read on which ones meet those standards.

How can I tell if a competition is legit?

Look for specific terms and conditions, published winner evidence, a clear verification policy and proper operator contact details rather than only a social media page. Research into the free-draw and prize-competition market found many entrants rely on exactly these visible cues rather than formal checks, which makes them worth examining closely yourself.

Are ID cards happening in the UK?

There’s no general national ID card scheme currently in place for UK residents. Specific sectors, including licensed gambling, already require operators to carry out their own age and identity verification under Gambling Commission guidance, separate from any wider national ID debate.

How can I prove my identity without photo ID?

A combination of documents, such as a recent utility bill, bank statement or council tax statement, can often confirm your name, address and date of birth where you don’t hold a passport or driving licence. Many organisers and verification providers accept these combinations precisely to avoid excluding entrants without standard photo identification.

Sources

• Age, ID and financial verification
• Voluntary Code of Good Practice for Prize Draw Operators

Key official guidance and primary sources to consult

For anyone running or entering a UK competition, a handful of primary sources cover almost everything above in more depth. The Gambling Commission’s age and ID verification guidance sets the baseline for licensed activity, while the Voluntary Code of Good Practice covers free prize draws specifically. The ICO’s age-assurance expectations explain the data protection side in detail, and the Commission’s own consumer landscape research shows how entrants actually behave. For comparing live raffles against these standards in practice, our raffle comparison platform remains a useful starting point.

Recommended

• Are UK raffle sites legit? What to check before you enter
• UK prize competition operators compared: BOTB, Raffall, Premier Prize, Seven Days Performance and Raffle House
• How to Find the Best UK Prize Raffles: A Complete Operator Comparison Guide