KYC Upload Rejects JPGs 1 Format Before the License Says So

A growing number of licensed operators now reject JPEG uploads for identity verification even though their own license conditions don't require it. The pattern shows up across at least three jurisdictions: the player submits a passport photo as a .jpg, the automated check fails, and support tells them to "re-upload in the correct format" — without saying which formats qualify. In most cases the license text names no image format at all, only that documents must be "legible" and "unmodified."

The gap between what regulators wrote and what compliance teams enforce has widened since 2023, when several vendors started pushing liveness-detection pipelines that only accept PNG or PDF. The result is a rejection loop that costs players days and generates support tickets the operator could have avoided with one line of copy on the upload page.

Where the format rule actually comes from

Regulators rarely specify file types. The UK Gambling Commission's remote gambling and software technical standards reference document authenticity and clarity, not MIME types. Malta's licence conditions are similarly silent. Curacao's new licensing framework, in force since September 2024, mentions "certified copies" without touching file extensions.

The format restriction is almost always a vendor artifact. Third-party KYC providers like the ones behind many mid-tier operators run OCR and document-tampering checks that perform better on lossless formats. JPEG compression can smear the microprint on a passport's data page, which trips a fraud flag. Rather than tune the threshold, some providers hard-block JPEG outright.

That's a defensible engineering choice. What isn't defensible is surfacing it to players as a vague error.

The rejection loop, step by step

1. Player uploads a 2.4 MB JPEG of their driving licence.
2. Automated system returns "document quality insufficient."
3. Player re-uploads the same file, slightly cropped.
4. Same error. Support chat suggests "a clearer photo."
5. Player gives up, or opens a complaint.

Each cycle burns hours. Under the UK's 24-hour verification window for withdrawals, a two-day format fight can push a legitimate payout past the deadline the operator is supposed to meet.

Why support scripts don't name the format

Two reasons come up repeatedly in operator forums. First, the vendor's API returns a generic error code, and support agents genuinely don't know the underlying cause. Second, naming PNG or PDF invites players to convert files — and a converted JPEG is still a compressed source image, so it fails again. Operators would rather keep the message vague than promise a fix that doesn't work.

The cleaner solution is upstream: tell players at the point of upload. "Accepted: PNG, PDF, HEIC. Do not photograph a printed photo." That single line cuts repeat submissions measurably — one compliance manager at a mid-size EU operator reported a 31% drop in second-attempt uploads after adding format guidance in early 2025.

The license says legible, the system says PNG

There's a real tension here. A player who submits a perfectly legible JPEG has met the standard the regulator set. The operator's vendor has imposed a stricter one. If that player escalates to an ADR service, the operator has to argue that "legible" implicitly means "in a format our software accepts" — a position that gets shakier the more you read it aloud.

Responsible gambling frameworks already require operators to remove unnecessary friction from legitimate withdrawals. A format rule that exists for vendor convenience, not regulatory necessity, sits awkwardly against that principle.

What happens when the vendor changes its mind

KYC providers update their pipelines every few quarters. A format that's blocked today might be fine in six months, or a new one — WebP, say — might get added and break things again. Players have no way to know, and operators rarely announce it.

So the open question isn't whether JPEG should be allowed. It's whether a private vendor's technical preference should ever override the plain text of a licence — and who, exactly, is accountable when it does.