You asked for your money, and instead of a payment you got a request for documents. Sometimes that is exactly what a regulated broker is obliged to do. Sometimes it is a stall dressed up as compliance. The difference is visible if you know what a verification step is for, what a legitimate one looks like, and how long it can reasonably take.
What "verification" means at withdrawal
Three separate checks get called verification, and a broker can run any of them when you ask for money out.
- Identity and address (KYC). Passport or ID card plus a recent proof of address. If you never completed this at signup, the first withdrawal is where it becomes mandatory. Regulated brokers cannot pay out to an unverified account, so this pause is legitimate, though it should have been requested earlier.
- Source of funds or source of wealth. Bank statements, payslips, a sale contract. Anti-money-laundering rules oblige firms to understand where larger or unusual sums came from, and a withdrawal that does not match your deposit pattern can trigger the question. It is lawful. It is also the request most often used as a delay tactic, because it is open-ended.
- Payment-method matching. Regulated brokers return money to the method it arrived from, up to the amount deposited, before paying profits elsewhere. A request to prove that the receiving bank account or card is yours, in your name, is part of the same rule. See the same-method rule for the mechanics.
None of these is a red flag in itself. The pattern around them is what matters.
What a legitimate request looks like
A genuine compliance request is specific and finite. It names the document (a bank statement covering a stated period, a payslip, a photo of the card with the middle digits hidden), it says why (the rule it satisfies), it comes from the broker's own domain and portal, and once you supply it the case moves. Many brokers publish the list in their help centre before you ever ask; if yours does, that page is your yardstick.
A stall looks different. The requests arrive one at a time, each after you satisfied the last. The document asked for is impossible or irrelevant (a bank letter confirming a card you closed years ago). No rule is cited. The tone shifts to what you could do instead: trade a little more, take a bonus, "reactivate" the account with a deposit. Or the verification demand appears only after a withdrawal request, on an account that has been trading unverified for months.
How long is too long
There is no statutory clock for the verification itself, which is why it is the favourite place to lose time. What exists instead:
- The broker's own published processing time. Most state one to three business days once a request is approved. That figure is in the terms or the help centre, and you should hold the broker to it from the moment your documents are accepted, not from the moment you asked.
- The payment rail. Card refunds and international transfers add days on the bank's side. That delay starts after the broker has sent the money, and a broker that has sent it can give you a reference.
- A reasonable review window. A source-of-funds check on a straightforward account should take days, not weeks. Beyond ten business days with documents supplied and no specific outstanding request, treat it as a complaint, not a wait.
The ladder, in order
- Ask exactly what is outstanding. In writing, through the portal or support email: "Please list every document still required and the rule it satisfies." A legitimate team answers with a list. A stalling one answers with a delay.
- Supply precisely what is listed, once. Do not send more than was asked. Keep copies and the timestamp.
- Put a date on it. "Documents supplied on [date]; your published processing time is [N] days; please confirm the withdrawal will be paid by [date]." This converts a vague wait into a commitment you can quote.
- Escalate inside the firm. Every regulated broker must have a complaints procedure with its own deadlines. Use the word "complaint"; it starts clocks a support ticket never does. How to complain about a broker lists the deadlines for the FCA, CySEC and ASIC regimes, and where the ladder ends offshore.
- Go outside the firm. After the final response, or when the deadline lapses, the ombudsman for your legal entity (not the brand) takes the case. Which entity that is decides everything, which is why our entity checker exists.
What is never legitimate
- A fee to "release" a withdrawal: tax, insurance, anti-money-laundering clearance, account upgrade. Regulated brokers deduct any genuine charge from the balance; they never ask you to send money to receive money.
- A requirement to deposit more, or to reach a trading volume, before a withdrawal of your own funds can be processed, unless you accepted a bonus whose terms said so in advance. Read how bonus terms trap withdrawals.
- Verification requests from a different domain, a messaging app or a personal email address. Those are either a breach or a scam; use only the portal.
- A "recovery service" that contacts you afterwards. Recovery scams follow withdrawal problems the way clone firms follow real ones.
Before you deposit next time
Verification friction is largely decided before you fund. Complete KYC on day one, deposit by a method in your own name that you still control, keep the deposit trail, and read the withdrawal section of the terms for the entity that opens your account. Our broker pages record the withdrawal terms we could read first-hand and mark the ones we could not; the pre-deposit checklist runs the same questions on any broker before the money moves.