Rafræn Skilríki and Online Casinos: How Icelandic Players Prove Who They Are

Ask an Icelander how they log in to their bank, the tax portal or their health records and the answer is almost always the same: rafræn skilríki, the national electronic ID issued by Auðkenni. Ask how they prove who they are to an online casino and the answer gets messy. Some sites want a passport photo and a selfie, some want a utility bill, a few support eID through an identity broker, and plenty of offshore sites ask for nothing until the moment a player tries to withdraw.

This piece looks at the security engineering on both sides of that gap: how Icelandic eID works at the certificate level, what EEA-licensed casinos are obliged to check, why sites that skip verification are a risk rather than a convenience, and which controls actually protect an account and the money moving through it.

Key takeaways

• Rafræn skilríki are PKI certificates chained to Íslandsrót, the Icelandic state root, with private keys held in a SIM chip, a smartcard or split between an app and a hardware security module.
• EEA casinos must verify identity under EU anti-money-laundering rules; Malta’s FIAU applies a EUR 2,000 deposit threshold, counted over a customer’s lifetime or a 180-day rolling window.
• “No KYC” usually means “KYC later”, often at withdrawal, with the operator holding the balance while documents are reviewed.
• The main eID threat is relayed phishing, not broken cryptography: a fake site passes a real verification code to the victim.
• Card payments use 3-D Secure for strong customer authentication under PSD2, which Iceland applies as an EEA state.

What rafræn skilríki actually are

Strip away the branding and rafræn skilríki are X.509 certificates in a public key infrastructure. At the top sits Íslandsrót, the root certificate authority created by the Icelandic government. Below it, Auðkenni operates an issuing CA called Fullgilt auðkenni, which signs certificates for individuals after their identity has been checked in person or against a valid Icelandic passport or ID card. Auðkenni’s certification practice statement describes these as qualified certificates for electronic signatures plus authentication certificates at the high assurance level defined in the EU eIDAS Regulation.

Each person typically holds two key pairs: one for authentication (logging in) and one for signing (committing to a transaction or a document). The distinction matters. Logging in proves you were present; signing proves you agreed to something specific.

Auðkenni issues those keys in three form factors, and the differences are mostly about where the private key lives. The details below come from Auðkenni’s security guide for relying parties.

Form factor	Where the private key lives	PIN rules	Lockout
Auðkenni card (smartcard)	Secure chip certified as a qualified signature creation device (QSCD)	4-digit PIN1 for login, 6-digit PIN2 for signing	Blocked permanently after 5 wrong tries
Mobile certificate (SIM)	Generated and stored in the SIM chip, also a QSCD	One PIN of 4 to 8 digits for both uses	Blocked permanently after 5 wrong tries
Auðkenni App	Never exists whole: split into shares held by the app (PIN-protected) and a server HSM	PIN1 of 4 to 12 digits, PIN2 of 5 to 12 digits	3-hour block after 3 tries, 24 hours after 6, certificate revoked after 9

The app design is worth a second look. Because the private key is generated as separate components and the complete key is never assembled, stealing the phone alone is not enough, and compromising the server alone is not enough either. An attacker needs the device, its stored share and the PIN. The SIM version relies instead on tamper-resistant hardware: the keys are generated inside the chip, so a cloned or swapped SIM does not carry them.

How an eID login works under the hood

When a service (the relying party) wants to authenticate a user, it starts a session with Auðkenni, usually over OpenID Connect, either directly or through an identity broker such as Signicat, which lists the Auðkenni App among the European eIDs it supports. The user types a phone number (mobile certificate) or kennitala (app). Auðkenni pushes a consent screen to the phone showing the service name, a short display text and a verification code. The website shows the same code. The user compares the two, enters PIN1, and the phone signs a challenge with the private key. Auðkenni returns a signed assertion to the service with the person’s name and kennitala.

For a casino, that assertion is unusually strong evidence. A passport scan proves someone had access to a passport image; an eID authentication proves the certificate holder was present and entered a PIN that only they should know, on hardware bound to their identity. That is why bank ID schemes are the default way to verify gambling accounts in much of the Nordic region, and why the 2022 Icelandic Ministry of Justice working group on lottery reform proposed player cards linked to electronic ID.

KYC and AML at EEA-licensed casinos

Under the EU’s anti-money-laundering directives, which apply across the EEA, providers of gambling services are obliged entities. They must identify customers, assess risk and monitor transactions. Malta, home to many operators that accept Nordic players, sets the detail through the Financial Intelligence Analysis Unit’s implementing procedures for remote gaming.

The core trigger is a EUR 2,000 deposit threshold. A March 2026 FIAU enforcement notice spells out that operators must calculate it either on a customer’s lifetime deposits or over a 180-day rolling period, and fined one licensee EUR 225,730, plus a periodic penalty of EUR 2,000 per day, partly because it could not link a customer’s deposits together to detect when the threshold was crossed. Once the threshold is reached, the operator must apply customer due diligence, complete a customer risk assessment and build a profile that covers source of funds and source of wealth where relevant.

In practice, most operators collect documents earlier than the law requires, often before the first withdrawal, because releasing funds to an unverified person is where money laundering and fraud risk concentrates. Verification usually means a photo ID, a liveness selfie and sometimes proof of address. Very few international sites accept Icelandic eID directly, although broker platforms now make it technically straightforward to add.

Why offshore sites skip it, and what that costs you

Sites licensed in lighter-touch jurisdictions, or not licensed at all, often advertise instant sign-up with no documents. For a player, that sounds like privacy. From a security standpoint it usually means three things.

First, verification is deferred rather than removed. Terms commonly reserve the right to request documents at any time, and that time tends to be the first large withdrawal. The balance sits frozen while a support team with no regulator watching decides what counts as sufficient proof. Our breakdown of how long casino withdrawals take shows how much of the delay comes from this review step rather than from the payment rail.

Second, accounts are easier to take over. A site that never bound the account to a verified identity has fewer ways to tell the owner from an attacker who has the password, and fewer reasons to care.

Third, your documents may end up somewhere worse. When an unregulated site does demand ID, nobody audits how it stores those scans. A regulated operator in the EEA is subject to GDPR and to a supervisor; an offshore operator may be neither.

Icelandic players also face an unusual legal backdrop. Iceland licenses only a few domestic organizations for money games, foreign operators hold no Icelandic license, and there is no local regulator to complain to about an offshore site. For a plain-language overview of the online gambling rules in Iceland, including how the advertising ban and the state lotteries fit together, that guide is a reasonable starting point. The security point is narrower: when no Icelandic authority can intervene, the operator’s own licensing and verification standards are the only protection a player has.

Account takeover: the attacks that matter

Auðkenni’s guidance to relying parties is candid about how eID-based logins get abused, and none of the main attacks involve breaking the cryptography.

Relayed phishing. A phishing email leads to a convincing copy of a real site. When the victim enters a phone number, the fake site starts a genuine login at the real service and shows the victim the real verification code. The phone displays the correct service name and code, so the victim enters PIN1. The attacker now holds the session. If the service also asks for a signature, the attacker can alter the transaction on the fly before the victim enters PIN2.

Login by mistake. A user mistypes a phone number or kennitala that happens to belong to someone else. That person receives a push, approves it without reading, and logs the first user into the wrong account.

Push harassment. Attackers repeatedly start sessions in a victim’s name to flood their phone with prompts, hoping for an accidental approval or simply to cause disruption.

Casino accounts without eID face the classic set instead: password reuse and credential stuffing, SIM-swap attacks against SMS codes, and session theft by malware. The defenses are well known. Use a unique password from a manager, prefer an authenticator app or passkey over SMS, and read every push prompt before approving it. If a prompt arrives that you did not trigger, reject it.

Payment security: 3-D Secure and SCA under PSD2

Card deposits from Icelandic cards fall under the EU’s second Payment Services Directive, which Iceland implemented as an EEA state through Act 114/2021. PSD2 requires strong customer authentication for most online card payments: two independent factors from knowledge (a PIN), possession (a phone) and inherence (a fingerprint). The detailed rules sit in the EBA regulatory technical standards, which also define exemptions such as low-value payments under EUR 30, capped at EUR 100 cumulative or five consecutive transactions before authentication is required again.

The technical vehicle is EMV 3-D Secure. When a casino’s processor submits a card payment, the issuer receives device and transaction data, scores the risk, and either approves silently or steps up to a challenge in the bank’s app. For players, the value is simple: a stolen card number alone should not be enough to fund an account, and an approval request you did not expect is a signal to call your bank.

Gambling transactions carry their own merchant category code, so issuers can see them for what they are and apply their own risk rules, including outright declines. That is a bank policy decision, not an Icelandic legal requirement.

Crypto: privacy trade-offs

Crypto deposits are often chosen for privacy, but the privacy is thinner than it looks. Public blockchains are permanent, searchable ledgers. The exchange where the coins were bought holds a verified identity linked to the withdrawal address, and EU travel-rule requirements oblige crypto service providers to pass originator and beneficiary information along with transfers. Anyone who learns one of your addresses can trace funds forward and backward.

Operational security matters more than anonymity claims. Send a small test amount first, verify the full deposit address character by character, beware of clipboard malware that swaps addresses, and never reuse a casino-issued address after it rotates. Our analysis of crypto payment links versus wallet addresses covers where the substitution risks sit. Remember too that crypto transfers are irreversible: there is no chargeback and no 3-D Secure step to stop a mistake.

A practical security checklist

• Check who licenses the operator and whether that regulator offers a complaint route.
• Complete verification early, before you have a balance worth withdrawing.
• If a site offers Icelandic eID, compare the verification code on screen and phone, and read the service name before entering any PIN.
• Never enter PIN2 unless you started a signing action yourself.
• Use a unique password and app-based or passkey 2FA; avoid SMS codes where you can.
• Keep 3-D Secure enabled and treat unexpected approval prompts as fraud.
• For crypto, test with a small amount and confirm every address.
• Set deposit limits on day one. If gambling stops being fun, Hjálparsíminn 1717 is free, confidential and open at all hours, and SÁÁ offers treatment.

Frequently asked questions

Can I use rafræn skilríki to verify a casino account?

Only where the operator has integrated Auðkenni, directly or through an identity broker. Most international casinos still rely on document upload and a selfie check.

Is the Auðkenni App less secure than the SIM certificate?

Not in a simple sense. The SIM keeps the key in tamper-resistant hardware; the app splits the key between the device and a server HSM so it never exists whole. Both fail mainly through phishing, not cryptography.

When must an EEA casino verify my identity?

Under Maltese rules, by the EUR 2,000 deposit threshold, measured over your lifetime deposits or a 180-day rolling window. Many operators verify sooner, typically before the first withdrawal.

Does 3-D Secure apply to casino deposits?

Yes. Card deposits from EEA cards are subject to strong customer authentication, usually through 3-D Secure in your bank’s app, unless an exemption applies.

Sources

• Auðkenni, Security Guide: Guidelines for Relying Parties, skrar.audkenni.is/security/SecurityGuide.pdf
• Financial Intelligence Analysis Unit (Malta), Publication Notice of 23 March 2026, fiaumalta.org/app/uploads/2026/04/Publication-Notice-23032026-2.pdf
• European Banking Authority, Payment services and electronic money: RTS on strong customer authentication, eba.europa.eu
• EMVCo, EMV 3-D Secure, emvco.com/emv-technologies/3-d-secure/