What the KYC step actually verifies
KYC verifies the reader's age, identity, and address. The desk's rule: a platform that lists its documents on the help center is meeting the KYC criterion. A platform that does not is failing it.
Safety desk · Edition 011
Verify the platform.
Verify the platform.
Read the red flags.
Set the controls.
A safety-first reader treats KYC as a privacy question, RNG as a verification question, jurisdiction as a local-compliance question, and red flags as a leave-the-lobby question. Each of the four has a verifiable answer on this page.
The desk is published for adult readers in jurisdictions where skill-game play is permitted. Where the rules differ across states, the desk says so; where the desk does not have a verified source, it says so too.
01
Four pillars
K
KYC
R
RNG
J
Jurisdiction
F
Red flags
The four pillars every adult rummy reader should understand before the first stake.
The desk organises safety into four pillars rather than a single checklist. Each pillar is a category of verifiable fact; each one comes with a what-to-look-for question the reader can answer from the platform's public pages.
Why an RNG certificate matters
The random number generator is the engine of the deal. A platform must publish a certificate from a recognised lab, dated within 24 months, in the footer or the trust page.
Where the rules differ across states
Skill-game legality varies across Indian states. The desk marks the state with the strictest published rules, then says "to be verified locally" for every reader outside that state.
The four most common clone-app red flags
An app that asks for SMS permissions, an app that cannot name its operator on the help page, an app with no RNG certificate, and an app that promises a guaranteed win are the four most common red flags the desk records.
What KYC actually does
The KYC step verifies who the reader is, not whether the reader should play.
The KYC step is the platform's verification that the reader is an adult whose name matches a government-issued identity document. The KYC step is not a credit check. The KYC step is not a tax filing. The KYC step is not a marketing step. It is one specific check: identity, age, address.
The documents requested are commonly PAN, Aadhaar, or a similar government-issued ID. The retention window is what the desk reads most closely. A platform that publishes a short retention window with a hard-delete commitment is one the desk scores favourably. A platform that retains documents indefinitely without a published policy is one the desk marks as failing.
Source photograph: KYC paperwork on a wooden desk next to an Aadhaar-style identity card. The photograph is editorial; the desk has no relationship with any verifier.
02
Red flags
01
Permissions
02
Operator
03
RNG
04
Promises
The four red flags the desk records most often across the platforms it reviews.
Each red flag is a single observation. A platform that triggers one red flag is not a platform to deposit on; a platform that triggers two is not a platform to sit at. The desk records all four.
An app that requests SMS or contacts permission
An app that requests SMS permission is reading the reader's text messages. An app that requests contacts permission is reading the reader's address book. Neither permission is required to deal a rummy hand. Either request is a fail.
An app that cannot name its operator
The app's help page must list the operating company, the regulator (where one applies), and the registered office. An app that lists only a generic support email is failing the trust pillar.
An app without an RNG certificate
An app without a published RNG certificate cannot prove that the deal is fair. The desk's rule: no certificate, no deposit. A link to a PDF on the footer is the standard form.
An app that promises guaranteed wins
"Guaranteed win" is the rarest red flag but the most damaging when present. A rummy skill edge is a long-run property. Any short-run guarantee is a marketing claim, not a verifiable fact. Treat it as a fail.
Jurisdiction and state caveats
Where the rules differ across Indian states, and where the desk's "verify locally" caveat applies.
The Public Gambling Act, 1867 distinguishes games of skill from games of chance. State-level rules vary. The desk reads the public-facing policy of each platform and notes the state-by-state caveats a reader should verify locally.
Skill-game framing
What the Public Gambling Act framing actually says
Skill vs chance
The Public Gambling Act distinguishes games of skill (not prohibited) from games of chance. Rummy has been treated as a game of skill in multiple High Court rulings. The framing is not universal, however, and readers should verify locally.
State law
Some Indian states have additional restrictions on real-money skill games. State law overrides the federal framing where the two differ. The desk records state-by-state caveats as "to be verified locally" rather than asserting permission or prohibition.
States with stricter rules
States where the desk's caveat applies most strongly
Andhra Pradesh, Assam, Odisha, Sikkim, Telangana, Nagaland, Meghalaya
These states have published rules that restrict or prohibit real-money skill-game play. The desk lists them as states where the reader should verify locally before assuming the platform's lobby is open.
PROG Act 2025
The proposed PROG Act 2025 has been discussed in Parliament and reported in the press. The desk does not assert its provisions as law; readers should verify the latest state of the bill in primary sources before relying on it.
One-time password and account security
Why the OTP step matters as a safety tool, not just as a login gate.
The one-time password is the second factor in the platform's login flow. It is sent by SMS or generated by an authenticator app. The OTP step exists to confirm that the person entering the password also controls the registered phone number or the authenticator device. That confirmation is the platform's main defence against account takeover.
The desk's reading rule: a reader who loses access to the registered phone must reset the account through the platform's support flow, never by sharing the OTP with a third party. Sharing an OTP is the single most common route to a compromised account in the desk's evidence folder.
Source frame: thumb on a phone screen typing an OTP. Editorial illustration only; the desk has no operator relationship.
Signals, bots and "no-loss" claims
Why the desk does not publish tipster signals or "no-loss scheme" content.
Some external channels sell "rummy signals" or "guaranteed no-loss scheme" services. These services are not affiliated with this desk. The desk does not publish or endorse them.
| Claim | What the desk records | Reader rule |
|---|---|---|
| Tipster signals | Cannot be verified against an audit trail; common scam vector | Do not pay for, do not subscribe to, do not install |
| Bot-assisted play | Against platform terms on every operator the desk reviews | Treated as account-closure behaviour on the platforms in scope |
| "No-loss" scheme | No verifiable evidence; financial-product language | Treat as marketing claim, never as a fact |
| Inside information | No legitimate source exists for rummy hand outcomes | Any such claim is a phishing vector |
Withdrawal and dispute path
The five steps of a contested withdrawal, from the reader's first email to a platform verdict.
A reader who faces a delayed or failed withdrawal has a structured dispute path. The desk records the path on the platform's terms page and treats the published window as the desk's verification target.
If your reader intent is real, the verification route is on the desk's adjacent pages.
The wallet and KYC flow, the official app verification path, and the responsible-play controls are linked below. The list is updated when a platform's policy window changes.
Helpline caveat
A reader in distress should verify the helpline locally before relying on any number on this page.
The desk does not publish unverified helpline numbers. National and regional helplines that operate 24 hours are listed on the responsible-play hub; readers should confirm the number on the operator's website before calling.
Helpline verification
Local
Verify the number on the platform's website, the responsible-play hub, and the regulator's public register before relying on it.
National helpline
Verify
The desk lists national helpline numbers only when they are confirmed through a primary source. Where the number is not confirmed, the desk marks the row "to be verified locally".
State helpline
Verify
State helplines vary across the country. The desk does not assert a state-specific number without primary-source confirmation; readers should verify locally.
Platform helpline
Operator
A platform's support email or chat is the operator-confirmed route. The desk records only the routes the platform publishes on its help page.
Reader questions on safety
Cited answers on what readers most often ask the safety desk.
Is a real-money rummy app legal in my state?
The desk cannot answer that question for every reader. State law varies. Andhra Pradesh, Assam, Odisha, Sikkim, Telangana, Nagaland, and Meghalaya have published rules that restrict or prohibit real-money skill-game play. Readers in other states should verify locally through the operator's published policy.
What does an RNG certificate actually prove?
An RNG certificate from a recognised testing laboratory proves that the random number generator was tested for statistical fairness. It does not prove that the platform operates the RNG correctly in production; that is a separate audit. A platform without the certificate cannot demonstrate fairness; the desk marks the absence as a fail.
My account was suspended after I requested a withdrawal. What should I do?
Open a support ticket in writing, provide the transaction reference and timestamp, and ask for the suspension reason in writing. If the platform does not respond within 48 business hours, escalate through the platform's regulator (where one applies) and through the responsible-play hub.
Can I share my account with a family member?
Account sharing is against the platform's terms on every operator the desk reviews. The KYC document matches one individual, and the anti-money-laundering rules require one identity per account. The reader rule: one person, one account, one identity.
Stop check
Three controls every adult rummy reader should set on day one
Set these once. They are the most effective single intervention in the responsible-play research and they reduce the safety risk of a session.
Deposit limit
Set a daily deposit limit during sign-up. Lowering it takes effect immediately; raising it has a 24-hour cool-off on most platforms.
Read the deposit-limit guide →Session time
Set a session timer. After 90 minutes the platform reminds you; after 120 minutes most platforms log you out automatically.
Read the session-time guide →Self-exclusion
Self-exclusion ranges from 24 hours to permanent. The decision is reversible only after the chosen window; the platform will not let you back in early.
Read the self-exclusion guide →Correction policy
The desk publishes corrections when an observation is found to be inaccurate. Each correction is dated and cross-references the original entry.
Reader corrections can be sent through the contact page. The desk reviews each submission and tracks the response in the evidence folder.
Editorial code
The desk does not assert any operator's policies as fact without a primary source. Where a primary source is not available, the desk marks the row "to be verified locally".
The desk does not publish helpline numbers without primary-source confirmation. Readers should verify helpline numbers locally before relying on them.
Adult reader notice
Age 18+. The safety desk is published for adult readers. Real-money rummy play is restricted to adults in every state that regulates it.
Read the responsible-play controls. The helpline caveat on this desk extends to all numbers; verify locally before relying on any one route.