One dollar is the smallest amount a Canadian online casino will let a customer move. The record that dollar opens is not small, and it does not shrink to match the money. Deposit a dollar or deposit a thousand, and the same identity file, the same transaction log and the same retention clock apply, because almost nothing in the record is sized by the amount.
That asymmetry is the part worth studying. A dollar of value creates a personal record that has to survive for years, stay queryable, and be producible to a federal agency on demand. Most consumer products would call that a poor trade. Gambling regulation treats it as the price of being allowed to accept the dollar in the first place.
So the useful question is not how much gets collected. It is who asked for each field, because three different authorities write the requirements, they disagree about timing, and they disagree about how long an answer has to be kept.
The File Is Complete Before the Money Arrives
In Ontario the sequence runs backwards compared with most sign-up flows. Standard 3.04 of the Registrar’s Standards for Internet Gaming requires player information to be collected and saved at registration, then demonstrated to be complete, accurate and validated before the account is created at all.
The stated minimum is a name, a date of birth, an address, a log-on identifier, contact details, and whatever the federal anti money laundering rules add on top. A separate clause makes the player affirm that all of it is accurate before the account exists.
Federal law is looser about timing. FINTRAC’s casino guidance requires a casino to verify the identity of every person for whom it opens an account before any funds are disbursed, and bars it from opening an account for anyone it cannot verify under the regulations. Disbursed, not deposited. Money can go in against an unfinished file; it cannot come out.
Ontario closed that gap with a provincial rule rather than a federal one, and the province has had a competitive market to apply it to since 2022. Alberta opened its own in 2026, regulated by Alberta Gaming, Liquor and Cannabis, with a minimum age of 18 against Ontario’s 19. No national rule sets either number.
Eligibility is itself a data structure. Standard 3.03 says that when the list of prohibited and excluded individuals changes, every registered player’s information has to be re-verified against it. A self-exclusion request is therefore not a flag on one account. It is a key replayed across the whole register, on a schedule the player never sees.
Which Rule Asks For Which Field
Sorting these fields by how much money triggered them explains very little. Sorting them by the authority that demanded them explains almost everything, including which ones a deletion request can reach.
|
Data Held |
Why It Exists |
Which Rule Asks For It |
|
Legal Name And Date Of Birth |
Eligibility, age and identity matching |
Ontario Standard 3.04, plus federal identity rules |
|
Device And Network Location |
Keeping play inside the province |
Ontario Standard 3.02 |
|
Deposit Slip For Every Deposit |
Per transaction audit trail with no floor |
Federal record keeping regulations |
|
Source Of Funds Evidence |
Risk based escalation on unusual activity |
Ontario Standard 6.03 |
|
Session Totals And Balance History |
Player facing transparency |
Ontario Standard 3.15 |
|
Marketing And Behavioural Profile |
Promotion targeting and retention |
The operator’s own choice |
The last row is the one people assume a regulator wrote, and it is the only one nobody did. Behavioural profiling sits under ordinary Canadian privacy law, so consent and purpose limitation apply to it in the usual way. The rows above it barely move, because a statute rather than a privacy policy holds them in place.
That distinction decides what a complaint can achieve. Collection and governance belong to a single architectural plan, a point this site has made before, and in this case someone outside the building drew the plan.
A Dollar Still Produces a Deposit Slip
Federal record keeping guidance for casinos separates the records that carry a threshold from the records that carry none, and that split matters far more than the numbers do. A large cash transaction record begins at $10,000. A receipt of funds record begins at $3,000. Electronic funds transfer records begin at $1,000.
A deposit slip carries no threshold. Casinos have to keep one for every deposit into an account, holding the date, the name of the person who made it, the amount, the method used and the account number with each holder’s name attached. A $1 deposit qualifies. So does a single cent.
Reading those thresholds as a boundary gets the architecture backwards. They decide when an additional report goes on top of the record; they never decide whether the transaction is written down. Reports also aggregate across a 24 hour window, and a suspicious transaction report carries no minimum amount at all. The record is the constant. The report is the variable.
The account record underneath holds more than most customers would guess. Alongside a name, an address, a telephone number and a date of birth, it has to carry the holder’s occupation, and the federal note on that field asks for description rather than a job title. Hotel reservations manager, not manager.
The Payment Rail Becomes Part of the Identity
Nothing in the federal Act or the provincial standards sets a minimum deposit. That number is a commercial setting each operator picks for itself, and the only way to see who picked what is to read a published comparison.
gambling.com maintains a Canadian page for the casino 1$ deposit category, which names the sites accepting that minimum at the cashier and the year each of them launched, several of those years falling well before 2005.
What the rail adds is a second identity. Ontario lets a deposit through only once a financial services provider has authorized it, and rules cryptocurrency out on the ground that it is not legal tender. A withdrawal then has to land in an account of which the player is the legal holder.
Those two clauses bind a person to a bank or wallet account and keep the binding in place. On Interac e-Transfer, the player approves the payment inside their own banking app, so no bank credentials ever reach the casino. The casino still learns the institution and the name registered against it, and that pairing becomes a durable identifier.
Escalation Is Risk Based, So the File Grows Unevenly
The part of the record that varies most between two people who deposited the same dollar is source of funds. Ontario’s standard on the subject names no amount at all. It tells operators to write their own policies specifying the times and situations, judged by risk, when they will ascertain and reasonably corroborate where a player’s money came from.
The regulator’s guidance on those standards, published in 2021, is candid about what corroboration means in practice. Proof is not always required, and what a customer says may be checked against open source searches, corporate records or other publicly available resources.
The same document refuses to let one internal figure do the work. An operator that settles on a single threshold has to show the risk analysis behind it, and still has to hold policies for high risk situations that never reach it.
That is a collection event the customer never initiates and usually never learns about. Escalation from there runs as far as refusing a transaction or excluding the person, and the standard asks operators to share information about high risk activity with each other in a lawful manner. No shared database is required for that, only agreed protocols, with privacy legislation taken into account.
There is also a question of whose file it actually is. The application section of the Act names the province conducting and managing an internet lottery scheme, not the brand a customer signed up with.
In Ontario that role belongs to iGaming Ontario, a standalone corporation since 2025. Operators are told to align their internal controls with the designated reporting entity and pass copies of every federal report to the Registrar.
Two Retention Clocks, and the Longer One Wins
Ontario sets the shorter of the two. Its entity level standard requires information and logs tied to compliance to be retained for a minimum of three years unless something else states otherwise. Something else usually does.
Federal retention runs to at least five years, and for account records it counts from the far end. A deposit slip is held five years from the day it was created. The signature card, the record of the account’s intended use, the application and the account operating agreement are held five years from the date the account was closed. Closing the account starts that clock rather than stopping it.
Records also have to be producible to the federal centre within 30 days of a request, which rules out cold archival storage and forces the whole thing to stay live. The same guidance states that a provincial regulator may impose a longer period, and that a retention period can exceed the federal floor but never fall below it.
Canada’s private sector privacy law asks organizations to keep personal information only as long as the identified purpose requires. That is where the collision sits. Anti money laundering law supplies a purpose with a statutory duration attached, so the principle that normally limits how long a company keeps a customer’s data becomes the thing setting a floor under it.
None of this is concealed. The standards are published, the federal guidance is published, and every threshold in this piece came off a government page. What is easy to miss is the proportion.
A dollar is the smallest gesture the system will accept, and it opens a file that outlives the account by half a decade, assembled from fields that a federal statute, a provincial regulator and a commercial product team each specified for reasons entirely their own.