Verification isn't your broker being difficult — it's the law. Every regulated firm must confirm who you are before it moves your money. But "verification" is also the most common cover story for a withdrawal stall. This page covers both sides: what brokers are genuinely required to do, how long it should take, and the escalation ladder for when a check becomes an excuse.
Why brokers must verify you
The requirement comes from anti-money-laundering law, not broker policy. The international standard is FATF Recommendation 10: financial institutions must identify customers and verify that identity using reliable, independent documents or data. In the EU that standard currently applies through the 4th Anti-Money-Laundering Directive (as amended by the 5th), written into each country's national law; in the UK it's the Money Laundering Regulations 2017. A broker that never asks for documents isn't being friendly — it's telling you something about how seriously it takes the rules that also protect your money.
The documents they ask for
The laws name principles ("reliable, independent source"), not documents — the familiar list is industry practice built on top:
- Government photo ID — passport, national ID card or driving licence, current and unexpired.
- Proof of address — a utility bill, bank statement or government letter, usually dated within the last 3–6 months.
- Payment-method proof — sometimes a masked photo of the card you deposited with, or an e-wallet screenshot, to tie the funding source to you.
- Source of funds — for larger balances, evidence of where the money came from (payslips, statements). Legitimate, and increasingly common.
Send documents once, clean: uncropped, all four corners visible, legible, current. Half the "verification is taking forever" stories start with a blurry photo that guarantees a second round.
How long should it take?
Here's the uncomfortable truth: no regulator sets a general deadline for completing verification. FCA, CySEC and ASIC rules require firms to verify — none of them says "within X days." The number that matters is the broker's own published service level, typically anywhere from minutes (automated ID checks) to a few business days with manual review. Find that promise in their FAQ before you fund, and hold them to it in writing after.
One narrow exception worth knowing: Cyprus firms that onboard clients under a deferred-verification exception must complete verification within 15 days or terminate the relationship and return the funds to the account they came from (CySEC Circular C721). It applies to that onboarding scenario, not to withdrawals generally — but it shows regulators treat weeks-long verification as abnormal.
What legitimately restarts verification
A second round of checks is not automatically a stall. Real triggers include:
- Your ID document expired since you first verified.
- You changed your withdrawal or deposit method — the new one needs tying to you.
- Your name appeared in new sanctions screening, or your risk profile changed.
- Your activity looked unusual against your history.
- The firm has genuine doubts about documents supplied earlier — the standards-level trigger for re-checking.
What's not normal: being asked repeatedly for the same documents you already passed, with no explanation of what changed. That loop is the signature move of a platform that doesn't intend to pay — see broker red flags.
For the withdrawal-specific version of this — what brokers verify at payout, how long is too long, and what is never legitimate — see withdrawal verification delays.
The escalation ladder
When verification has genuinely become a stall, escalate in order — each step creates a record the next step uses:
- Complete everything they asked, once, in writing. One clean submission removes their easiest excuse.
- File a formal complaint with the broker. Use the word "complaint" — it starts a regulatory clock. UK-regulated firms must give a final response within 8 weeks; Cyprus firms must acknowledge within 5 business days and respond substantively within 2 months (3 at most); Australian firms have 30 calendar days.
- Go to the ombudsman for your entity. If the deadline passes or the answer is unsatisfactory: the UK's Financial Ombudsman Service is free and takes referrals up to six months after the firm's final response; the Cyprus Financial Ombudsman charges a €20 filing fee and requires you to have complained to the firm first; Australia's AFCA is free to consumers. Which ombudsman exists for you depends on which legal entity holds your account — a brand can run four entities with four different answers. Check yours with the entity decoder and read broker brand vs legal entity.
- Complain to the regulator too. CySEC says plainly that it cannot award you compensation — regulator complaints feed supervision, not redress. File one anyway: patterns of complaints are how warnings and inspections start.
- Know what an offshore entity means here. Many offshore jurisdictions offer no ombudsman at all. If your account sits with an offshore entity, the escalation ladder may end at step 2 — that's the real price of the offshore discount. See tier-1 vs offshore regulation.
If a broker stalled you, report it to us as well — reports are internal signals that help us catch patterns early.
Rules and deadlines above reflect the UK, Cyprus and Australia as commonly encountered; your entity's jurisdiction may differ. Educational content, not financial or legal advice.