The operator’s side and your side
At Dukat.bet the security-related wording is spread across three documents. The AML policy covers customer due diligence, the T&C cover the account rules, and the privacy policy deals with encryption and data retention.
None is a technical spec: you won’t learn which servers run the platform or which protocol guards your connection.
What they do tell you is which data you will be asked for, when the account can be frozen and what to expect if there is a data breach. That is enough to plan around.
On your side sit the password, your devices and your email account. Our account protection guide covers those in detail.
Security checkpoints along the account’s path, with sources
| Step | What Dukat.bet says | Where it says so | What to watch |
|---|---|---|---|
| Opening the account | One account per person; the name must match your official name | T&C section 9 | If you hold several accounts, all of them can be closed and the money frozen |
| Due diligence | They check your name, date of birth, nationality and address, plus an official ID document | AML policy, section 2 | The check may be carried out by an external provider meeting FATF requirements |
| Ongoing screening | Customers are screened at sign-up and then daily against sanctions lists and PEP databases | AML policy, section 2 | This runs in the background and you get no notice of it |
| Connection and transactions | Encryption is used, but its type is not named | Privacy policy, section 8 | Check the padlock and the address in your browser yourself |
| Data retention | AML records for at least five years; other personal data for a further three years once the relationship is over | AML section 2, privacy policy section 7 | The two figures apply to two separate sets of data |
| Incident | The data protection authority is informed within 72 hours; you are told straight away if the risk is high | Privacy policy, section 6.4 | If you suspect something, report it to the Company too |
Every row comes from the texts available on 14 October 2026, when the dukat.bet pages loaded over https.
When they ask where your money comes from
Section 2 of the AML policy requires enhanced due diligence for high-risk customers. As examples it names politically exposed persons (PEPs) and people from high-risk countries.
In such cases the source of funds and of wealth can also be examined. Under section 4 you are obliged, on request, to submit to the check and show where the money you paid in came from.
If you don’t, the policy says the account may be restricted, suspended or closed. Section 5 adds that while a check remains unfinished, funds can be held back on the basis of a legal obligation.
It is no accusation, just standard anti-money-laundering routine.
The no-tipping-off rule: what nobody will tell you
Section 6 of the AML policy contains one sentence worth knowing about. The customer is not informed of an anti-money-laundering investigation, report or freeze.
In practice, a stuck withdrawal may have a reason that customer support is not allowed to share. Annoying as that is, it follows a legal template rather than being a Dukat.bet quirk.
If your payout has been sitting for days, rule out the ordinary causes first. Our page on withdrawal delays helps with that, sorted by symptom.
According to section 7 of the policy, compliance questions go to support@dukat.bet.
When you must prove your identity, and why there is no single answer
Three documents give three different moments. Section 2 of the AML policy ties the check to financial transactions above a certain amount, but it states that threshold with an ambiguous currency notation, so we are not repeating the figure.
Section 4 of the responsible gaming policy says your ID is checked before your first withdrawal at the latest. Section 9 of the T&C says documents can be requested at any time.
That is a contradiction, and we won’t decide for you which one prevails. The safe assumption: expect a request as early as your first deposit.
Hypothetical case with made-up details – not Dukat.bet data: Péter requests a withdrawal on Tuesday and on Wednesday gets an email asking him to upload his ID card. He puts it off until Thursday, then forgets. Here T&C section 9 allows two weeks: if he cannot be reached by email or phone within that time from submitting the withdrawal request, the account is locked because KYC counts as failed. One postponed email can cost more than he expects.
The full procedure is described on our KYC verification page.
Gaps in Dukat.bet’s security descriptions
Some things simply aren’t in the documents, and we don’t fill the gaps with guesses.
- Type of encryption: section 8 of the privacy policy promises ‘complete security’ but does not say which technology delivers it.
- Due diligence deadline: the AML policy doesn’t state how many days or hours it takes to review uploaded documents.
- Two-factor authentication: a setting of that kind appears in the interface text, but we have not tested it in a live account and no policy mentions it.
- Response time to data requests: the privacy policy sets no deadline.
- Contact addresses: the documents don’t all list the same email addresses. The only ones we consider reliable enough to publish are support@dukat.bet and dpo@dukat.bet.
If any of these matters to you, ask in writing and keep the reply.
Read the original, then sort out your own side
A summary is handy, but it doesn’t replace the source. Under T&C section 1 the English version prevails, and the Hungarian translation uses the same numbering.
You can open the original due diligence text on Dukat.bet’s own site: Dukat.bet security and KYC. Sections 2, 4, 5 and 6 deserve a read, because they decide when your money can be held up.
After that, three quick tasks. Get your documents ready using the document checklist. Set a unique password. Finally, learn how to spot fake emails on our fraud prevention page.
About fifteen minutes in total, and it saves plenty of hassle.
If a policy changes later, check the date shown at the top of this page and at the end of the T&C. According to the T&C text, it was last updated on 22 May 2025; we reread it on 14 October 2026.