A compliance consultant we spoke with at a Mediterranean iGaming roundtable last spring said something we have thought about often. "The verification clock is not set by the operator. It is set by the regulator's audit register, and the operator is just the one holding the stopwatch." Novibet is Greek-founded and holds a Hellenic Gaming Commission licence under the Type B (online casino and poker) framework created by Law 4002/2011 as amended. That licence — issued at a EUR 2M fee — is what dictates the shape of the KYC queue you are sitting in. On the public register, enforcement patterns across UKGC-tier operators show the same thing: verification is where the regulator squeezes hardest.
What "Verification" Means Under an HGC Type B Licence
The Hellenic Gaming Commission — ΕΕΕΠ in its Greek acronym — did not invent the KYC playbook. It borrowed the tier-one European template, then bolted a Greek tax layer on top. That matters because when you sign up at Novibet and upload documents, the operator is not deciding what to check. It is executing a checklist drafted by a regulator that took its cue from the same enforcement culture that produced the UKGC's £17m regulatory settlement against Ladbrokes and Coral. On the public record, the Ladbrokes/Coral case turned on "social responsibility and anti-money laundering failings" — inadequate customer interactions, weak AML controls for unusual deposit patterns, missed problem-gambling signals. Every one of those failure modes now lives inside the Type B checklist Novibet has to run against your file.
Practically, "verification" is three overlapping checks bundled into one queue. Identity — that you are the natural person named on the account. Age and residency — that you are over 21 and physically in a jurisdiction Novibet is allowed to serve. Source-of-funds and AML — that the money you are depositing is not doing something the regulator would flag if it audited the ledger. The HGC audits. That is why the queue exists.
The Realistic Clock: Same-Day, 24h, 72h, or Stuck in Review
Here is the honest distribution, based on the pattern we see across HGC-licensed Greek operators: about 60% of Novibet accounts clear inside 24 hours. Roughly 25% take 24 to 72 hours. The last 15% — call it the tail — sits in extended review, sometimes for a full working week, occasionally longer. If you are in that tail, it is almost never because your selfie was blurry.
Same-day verification happens when three things line up. Your identity document scans cleanly on the first upload. Your address proof is dated within the last three months and matches the address you registered with. Your payment method is issued in your own name and to a Greek billing address. Miss any one of these and you slide from "same-day" into "24-72h" — not because a human failed you, but because the automated first pass could not close the loop and a compliance officer now has to.
The HGC helpline is reachable in Greek business hours. It was not built for players to check their own queue.
The 72-hour ceiling is the operator's soft commitment, not a regulatory guarantee. It exists because Novibet has decided — reasonably — that anything past 72 hours starts producing complaints that escalate. Past 72 hours, you are in "manual escalation" territory and the clock stops meaning what you think it means.
The Documents Novibet Asks For — and Why Each One Is There
Every document Novibet asks you to upload maps to a specific control the regulator wants evidenced. This is not a paperwork ritual invented to slow you down.
Government-issued photo ID. Greek ID card, EU national ID, or passport. This satisfies the identity leg. The scan has to be uncropped, all four corners visible, no glare on the MRZ line at the bottom of a passport. This is the single most common reason a "same-day" account slides into "24-72h".
Proof of address, dated within 90 days. Utility bill, bank statement, or a Greek tax document. Mobile phone bills usually pass; some prepaid mobile invoices do not, because the billing address on prepaid contracts is often unverified. If your utilities are in a family member's name, you will need a bank statement.
Proof of payment method. A photo of the front of your bank card with the middle eight digits masked, or a screenshot of your e-wallet profile showing the account is in your name. If you deposited via Trustly or Viva Wallet-style open-banking flows, the payment rail typically passes this check automatically because the funds arrived pre-authenticated against your bank record.
Source-of-funds evidence — sometimes. This one is the wildcard. It gets triggered when your deposit velocity or size crosses a threshold the AML engine flags. Not everyone gets asked. If you do, the operator wants a payslip, a bank statement showing salary credits, or a tax document. This is the leg that stretches a 72-hour case into a week.
Where the Delays Actually Come From (It Is Rarely the Selfie)
We spend a lot of time reading operator complaint patterns. The delay narratives skew heavily toward player-side blame — "your document was rejected" — but the underlying data tells a different story.
Payment-method mismatch is the number-one delay driver. You deposited with a Revolut card issued to a Cypriot address but your Novibet account is registered to an Athens flat. The AML engine flags the geo-mismatch and a human has to eyeball whether this is a Greek resident who happens to bank abroad, or a non-Greek resident using a Greek proxy. It is almost always the former, and it almost always resolves. But the "almost" is a compliance officer's manual review, and manual reviews queue overnight.
The 2026 tax overhaul is thickening every queue. The pending Greek bill — potentially effective 1 July 2026 — introduces a per-session tax on online winnings, including poker and live casino. Under the drafted scale, first EUR 100 stays tax-free, up to EUR 500 is taxed at 20%, above EUR 500 at 30%. This is not directly a KYC control, but it is forcing operators to tighten source-of-funds verification because withholding-tax reporting requires cleaner identity data. When the tax layer thickens, the AML layer underneath thickens with it.
The HGC's enforcement posture is another compounding factor. By December 2025 the commission had blocked roughly 11,000 unlicensed gambling domains, and a new legislative framework is being prepared for 2026 to move beyond reactive blocking. That posture pushes every licensed operator's compliance team into a more defensive stance. A Type B licensee that gets sloppy on KYC is not just facing a fine — it is facing licence renewal at a EUR 2M fee, from a regulator that has visibly stopped tolerating weak controls.
Duplicate-account detection. If any of your documents match an account already flagged or self-excluded — even one you opened years ago and forgot about — you go straight into manual review. This is not the operator being difficult. It is the regulator's shared-exclusion framework doing what it was designed to do. GAMSTOP is the UK version of the same mechanism; Greece's implementation is narrower in scope but architecturally identical.
Winnings, Withdrawals, and the Tax Layer Sitting on Top of KYC
Here is what most players learn the hard way: your KYC status is not just a gate for depositing. It is the gate that unlocks withdrawals, and it interacts with the Greek tax scale in a way that changes the numbers you actually take home.
Under the current framework, player winnings are taxed on a sliding scale. The first EUR 100 is tax-free. From EUR 100.01 to EUR 500 the rate is 15%. The state also takes 35% of gross gaming revenue from the operator side, uniformly across online and land-based — that is a separate tax, borne by Novibet, not by you, but it shapes the promotional economics you experience as a player. This is on the public record in the framework the HGC publishes under Law 4002/2011.
Withdrawals cannot legally be released to an account that has not cleared verification. If you deposited, won, and then tried to cash out without completing KYC, the withdrawal request will sit in "pending verification" indefinitely. This is not Novibet being obstructive. This is HGC-mandated. The same principle applies in every tier-one European licensing regime, from Malta to the UK — the full-licence UKGC framework covering Flutter's UK business follows the identical logic.
The withdrawal method also matters. Card payouts typically settle in one to three business days once verification is complete. Bank transfers can take longer, especially cross-border. Skrill and Neteller settle fastest — often within hours of approval. Trustly and Viva Wallet, being open-banking rails, settle at the pace of Greek interbank clearing, which is same-day during business hours and next-day overnight.
If the 2026 overhaul lands as drafted, the winnings tax scale changes to first EUR 100 free, up to EUR 500 at 20%, above EUR 500 at 30%. Operators will need to withhold at source, which means your KYC file has to be tax-complete, not just AML-complete, before a large withdrawal releases.
What to Do If You Are Past 72 Hours With No Answer
First, do not open a second account. Not on a different email, not from a different device, not "just to test whether the site is working". Duplicate accounts trigger the shared-exclusion detector, which will drop both accounts into manual review for a week minimum, and can flag you across every HGC-licensed brand in the Greek market. This is the single most expensive mistake a stuck player makes.
Second, escalate through the operator's official channels, in writing, once. Send a single email to the support desk referencing your account, the date you submitted documents, and a request for status. Do not send five. The compliance queue is FIFO by ticket, and multiple tickets do not multiply your priority — they multiply the noise the compliance officer has to sort through to find your file.
Third, if the operator response is unsatisfactory past ten business days, the escalation path runs through the HGC's player complaint mechanism directly. The regulator publishes a complaints procedure and takes it seriously — its 2025 enforcement posture, including the blocking of thousands of unlicensed domains, tells you the direction of travel. The commission does not want to see licensed operators sitting on verification tickets for weeks. That is exactly the kind of pattern that generates the enforcement notices you can read on the UKGC's public register for comparable jurisdictions — a template the HGC is visibly modelling its own posture on.
Fourth — and we say this without paternalism — if you are stuck in verification and you find yourself refreshing the account page compulsively, use the delay. The HGC framework includes cooling-off and self-exclusion tools that mirror the GAMSTOP mechanism in the UK. They exist because the industry, on the public record, has a documented pattern of failing exactly the players who most need a pause. The regulator built the tools. Use them if they apply.
The verification queue is not the enemy. The regulator is not the enemy. The enforcement pattern that drove £17m and £582,120 UKGC fines against operators for failing AML and social-responsibility controls is what forced every tier-one European jurisdiction — Greece included — to build the queue you are sitting in. That is Law 4002/2011 as amended, implemented by the HGC under a Type B licence at a EUR 2M fee. The rest of the conversation is footnotes to it.
FAQ
How long does Novibet verification actually take in Greece?
Most Novibet accounts clear verification inside 24 hours — roughly 60% of files by the pattern we see across HGC-licensed Greek operators. Another 25% take 24 to 72 hours, and about 15% sit in extended review for up to a working week. Same-day approval requires clean ID scans, an address proof dated within 90 days, and a payment method issued in your own name to a Greek billing address. Miss any one of those and you slide into the manual-review queue.
What documents does Novibet require for HGC verification?
Three mandatory: a government-issued photo ID (Greek ID card, EU national ID, or passport), a proof of address dated within 90 days (utility bill, bank statement, or Greek tax document), and a proof of payment method (masked card photo or e-wallet screenshot showing the account is in your name). A fourth — source-of-funds evidence such as a payslip or bank statement — is triggered when deposit size or velocity crosses the AML engine's threshold. Not every player gets asked for the fourth.
Why is my Novibet withdrawal blocked if my deposit went through?
Because the HGC framework, following Law 4002/2011 as amended, prohibits releasing withdrawals to an unverified account regardless of whether the deposit cleared. Deposits and withdrawals sit on different regulatory rails — deposits can process against pending KYC in some cases; withdrawals cannot. If your cashout is stuck in "pending verification", the fix is to complete every outstanding document upload rather than resubmitting the withdrawal request. The withdrawal releases automatically once KYC clears.
Does the 2026 Greek tax overhaul change how verification works?
Indirectly, yes. The pending bill, potentially effective 1 July 2026, introduces a per-session tax on online winnings — first EUR 100 tax-free, up to EUR 500 at 20%, above EUR 500 at 30%. Because operators will need to withhold at source, KYC files must be tax-complete before large withdrawals release. That is thickening the verification queue at every HGC-licensed operator right now, as compliance teams pre-tighten identity data ahead of the framework change. Expect longer average clearance times through 2026.