The median KYC check at a licensed European operator now completes in about 90 seconds. That figure only counts the users who finish. Somewhere between 55% and 61% of players who start verification never reach the end, and the drop-off clusters around one step: the live selfie.

That number comes from onboarding-funnel data several gambling compliance teams have compared quietly at industry events over the past year. It's not a public benchmark, because operators don't publish funnel attrition. But the pattern is consistent enough to treat as directional: document upload loses maybe 10–15% of starters, liveness detection loses far more.

Why the selfie breaks the funnel

A passport photo page is a known task. People have scanned or photographed documents before. Holding your phone at arm's length, rotating your head on command, blinking when prompted — that is a new behaviour, and it fails in ways users can't diagnose.

The failure modes are mundane. Poor front lighting in a kitchen at 11pm. A phone camera that auto-focuses on the background. A user wearing glasses that reflect the screen prompt back at the sensor. A liveness model that flags a genuine face because the user moved too fast.

Then comes the retry. And the second retry. At roughly the third attempt, a meaningful share of users close the app and don't come back that session. Some never do.

The 90-second figure is doing quiet work

That median of 90 seconds is real, but it describes a survivor. If you measure from account creation to verified status across all starters, including the ones who bail, the effective completion time is closer to several hours or never. Presenting the 90-second number without the attrition rate is the compliance equivalent of quoting RTP on a bonus round nobody triggers.

What operators actually control

Most of the selfie drop-off is fixable, and it doesn't require weakening the check.

• Move the camera prompt earlier. Users who hit the selfie step before they've invested five minutes in a deposit flow convert better. Front-load it.
• Explain the retry. "This didn't work — try facing a window" beats a generic error. Users who understand why they failed retry at roughly double the rate of users who don't.
• Offer a fallback. A short video call with a human agent costs more per verification but recovers users who would otherwise be lost entirely. At a €200 average first deposit, the maths usually works.
• Check the device mix. Liveness models trained on flagship phones behave differently on a three-year-old mid-range Android. Segment your failure data before blaming users.

Where the line sits

Regulators want liveness detection because static photo spoofing is trivial. Nobody serious is arguing for removing it. The argument is about how it's implemented — passive liveness that runs during a normal selfie versus an active challenge that asks the user to perform. Passive models have improved enough that some operators now run them as the primary check and reserve active challenges for flagged cases.

The question nobody wants to answer

If 61% of would-be players abandon at verification, what happens to them? Some try a competitor. Some give up on regulated gambling and use an unlicensed site that asks for nothing but a card number. That second group is the uncomfortable part of the story: strict KYC, applied clumsily, doesn't just cost operators revenue. It pushes a slice of the market toward the venues that offer no consumer protection at all.

The compliance teams that solve this won't be the ones with the strictest checks. They'll be the ones whose checks are strict and finishable.