Safety · Trust explainer

A withdrawal pending for "KYC under review" affects a real player. Here is what to expect.

Safety on a rummy platform is not a single checkbox. It is a chain of independent checks — KYC, RNG certification, deposit handling, withdrawal handling and complaint pathway — each tied to a regulatory requirement. This explainer walks each link in plain language.

Updated: 11 Aug 2026 Reading time: 10 minutes Audience: adult Indian rummy readers
An editorial verification desk with a printed KYC checklist on a clipboard, a folded rulesheet, reading glasses and a closed leather notebook on a pale linen surface
Inside the explainer

Read in this order.

  1. Impact first: what a "KYC under review" actually does.
  2. The KYC walk-through.
  3. RNG certification, and why its absence matters.
  4. Deposit holds and the segregation question.
  5. Withdrawal processing windows.
  6. Counterfactual: state-licensed versus offshore.
  7. Complaint pathway, regulator name and the state fallback.
  8. Source transparency.
Impact first

What "KYC under review" actually does.

A withdrawal held under "KYC under review" blocks the transfer of your own money from a platform balance to your bank account. It is not a permanent hold; it is a processing window that can range from a few hours to several business days.

The sequence

You request a withdrawal. The platform flags the request because KYC documents are partial, expired, or under re-verification. The platform contacts you to resubmit. You resubmit. The platform reviews and either releases the withdrawal or escalates to a manual review.

The cost

The cost is the time you wait. For most platforms, the wait is hours to a day. For platforms with manual review, the wait can be a week. The published withdrawal window is the platform's commitment; the live experience may be longer.

KYC walk-through

What a KYC submission actually asks for.

A standard KYC submission on an Indian skill-game platform is four steps: PAN verification, masked Aadhaar verification, current address proof and a penny-drop verification of the bank account.

PAN verificationPermanent Account Number, ten characters, issued by the Income Tax Department. Used for identity and tax-withholding obligations under Indian law.KYC-01
Aadhaar maskedAadhaar number, twelve digits, with only the last four visible to the platform. UIDAI consent rules require masked storage; a platform that stores the full number is out of compliance.KYC-02
Address proofA current utility bill, bank statement or rental agreement, dated within the last three months. Some platforms skip this step when Aadhaar verification is sufficient.KYC-03
Penny-drop verificationA small credit (typically ₹1 to ₹10) posted to your bank account, with a unique reference number you type back into the platform. Confirms the bank account is yours end to end.KYC-04
A KYC document edge flat-lay on a pale linen surface with a printed PAN card, an Aadhaar card and a folded utility bill
RNG certification

Why the RNG certification disclosure matters.

The random number generator decides which cards you receive. A platform that does not publish its RNG certification cannot be independently audited by you or any reviewer.

What a published certification looks like

A named testing lab (iTech Labs, GLI, BMM Testlabs, eCOGRA are common) and a certificate number with a date. The certificate should be reachable from the platform's footer without an account login.

What the absence of one looks like

A platform with no footer link to a testing lab is missing one disclosure. The deck may still be fair, but the player has no way to verify it. Treat absence as a missing link, not as proof of unfairness.

Deposit handling

Deposit holds and the segregation question.

A deposit on a real-money platform enters a balance you can use to play. The question of whether your balance is segregated from the platform's operating funds is a regulatory question that depends on the platform's licence status.

What segregation means

A platform that holds player balances in a separate trust account, distinct from its operating funds, can still pay withdrawals even if the operating company runs into financial trouble. A platform that commingles player balances with operating funds cannot.

What to look for

The platform's published segregation policy. Most state-licensed platforms publish this. Most offshore platforms do not. The absence of a published segregation policy is not proof of commingling, but it is a missing disclosure.

A KYC verification checklist still life on a pale linen desk with a printed checklist, a pen and reading glasses
Withdrawal windows

What a published withdrawal window means in practice.

A published withdrawal window is a commitment. "Processed within 24 hours" means the platform commits to releasing the funds within 24 hours, barring KYC re-verification or manual review.

Common published windows

Hours for UPI and IMPS, one to three business days for NEFT, longer for cheque or bank draft. The window starts when the platform approves the withdrawal, not when you click the button.

What to do if the window slips

First, contact support with the withdrawal reference number. Second, ask for the specific reason for the delay in writing. Third, escalate to the platform's complaint pathway if the response is unsatisfactory. Keep the reference number and the support transcript.

Counterfactual

State-licensed versus offshore platforms.

If the platform holds a state-issued skill-game licence, the state regulator is the complaint pathway. If the platform operates from offshore under an international licence, the complaint pathway is the international licence holder.

What changes with a state licence

Player balance segregation is mandated. Withdrawal windows are published and audited. The complaint pathway includes the state regulator as a fallback. The RNG certification is reviewed by the state regulator.

What changes with an offshore licence

Player balance segregation may not be mandated. Withdrawal windows may be longer. The complaint pathway is the international licence holder, which may or may not respond to Indian-resident complaints. RNG certification is reviewed by the international body.

Complaint pathway

The complaint pathway, regulator name and the state fallback.

A complaint pathway has three layers: platform support, the regulator named in the platform's licence disclosure, and the state consumer forum if neither resolves the issue.

Layer 01Platform support email. The first stop. Most issues resolve at this layer if you keep the reference number.CP-01
Layer 02The regulator named in the platform's licence disclosure. State-licensed platforms name a state regulator; offshore platforms name an international regulator.CP-02
Layer 03The state consumer forum if the regulator does not resolve the issue. Filing fees are nominal. Hearings are public. Decisions are binding on registered businesses.CP-03
Source transparency

What to verify, where the desk's information came from, and what it does not cover.

What this desk verifies itself

The published licence status, the published withdrawal window, the published KYC method and the published responsible-play controls. These are read from the platform's own pages at the time of writing.

What the desk does not verify

Payout rates per format, sign-up bonuses, daily-login rewards, customer-care phone numbers, app-store ratings, ownership disclosure. These require direct contact with the platform and change frequently.

What you should verify yourself

Your own state's eligibility, the current withdrawal window as published today, the responsible-play controls page as it stands today, the support email response time from your own account.

Read the responsible-play framework Read the wallet and KYC explainer
Extended reference

How to read this reference.

The reference on this page is organised so a reader can scan the headline and decide whether to read the section. Use it as a working document: bookmark the sections you need to revisit, treat the platform's own pages as the primary source and treat this desk as a structured way to navigate that source.

What this desk claims

Every factual claim about licences, security, payments or responsible-play controls on this page is sourced to a public source — a platform's own published page, a regulator's register, a state gaming notice or a parliamentary bulletin. The reader can verify any claim against the named source.

What this desk does not claim

This desk does not publish payout rates per format, sign-up bonuses, daily-login rewards, customer-care phone numbers, app-store ratings or ownership data not published on the platform itself. Where a number is required, the page points to the platform's own page where the number is published.

How the desk revises

Editorial pages are revised at least quarterly to reflect regulatory changes. The last-revision date appears in the dateline at the top of the page. If the reader spots a factual error or a regulatory change the desk has missed, the contact page lists the editorial email.

Why the desk keeps this boundary

The boundary exists because the desk is read-first. It does not accept wagers, run tables or hold player balances. It does not advertise bonus offers. It does not fabricate customer-care phone numbers or ownership claims. The boundary is the reason the desk can serve as a working reference rather than as a marketing channel.

How the desk names platform products

Where this page references a platform, the desk uses the platform's published company name. Where the company name and the brand name differ, the desk names both. Where a brand token overlaps between skill-game and live-game products, the desk distinguishes them in the body copy rather than treating them as the same product.

How the desk handles verification gaps

Where a fact cannot be verified at the time of writing, the desk marks the cell as verification-needed. The reader is responsible for the final verification on the platform's own page or the relevant regulator's register. The desk does not omit a fact silently; it marks the gap and explains what to verify.

How the desk handles reader questions

The desk reads editorial corrections, regulatory clarifications and platform updates by email. The desk does not respond to commercial enquiries, partnership pitches or SEO solicitations. The contact page lists the editorial email and the response window.

Why the desk uses a publication format

A publication format — masthead, dateline, byline, lede, body, sidebar, colophon — is the most familiar reading structure for an adult reader. It signals that the content is reviewed, dated and revised, not generated automatically. The format is a way of saying that the content has been thought about.