I have to say that at the moment i have no exact information on how any particular casino is dealing with their self-exclusion operations and monitorings, but i would strongly assume that basic level many are doing pretty much something like that (based on my experience as a player and some knowledge about casinos operations after been living quite many years in Malta, but as said, it's just my assumption in very basic level, many, most or all can do more or less things very differently, but to be able to follow compliance regulations, below is some quite logic steps which i beliewe might be steps in general in new players registration process and checks within first withdrawl) :
- When you sign up, your age is confirmed from some trusted and compliant database automatically (and if you add your date of birht to be under 18, registration process is not going even to point where this check is made).
- After getting Yes that you are over 18 (if can't be automatically verified, manual check needs to take place as UK players shouldn't be able to deposit or even access game lobby to play games with play money), check against Gamstop database is done, when certain amount of details (not going to exact what is checked and how many need to match as i don't remember for now, but somebody can add it, it been spoken in other threads several times but don't want to trust my bad memory and suggest totally wrong information, but many enough details need to match that SE reply is sent to casino) and getting green or red light to go ahead with your registration.
- If active SE in Gamstop, process should stop and advice you (this is totally up to casinos front end design what kind of message you get etc.. but process need to stop there) about self-exclution and your details get registered to casinos database as you entered them to complete these checks, so they also are able to advise you that you got automatically self-excluded because one existed.
- You are allowed to deposit and play. At some point even without withdrawal most of the casinos request manual verification (it's very much about casino which trigger it to them, usually some threshold met or some RG/AML/Fraud trigger or just randomly picked account).
Then when you manage to withdraw:
- Many casinos are asking you to verify yourself, mostly because of your payment method can't be verified during the registration process, you haven't use it and it most of the time needs picture of your card, bank statement, netwallet or what ever method you are using. Some casinos request it every single time upon first withdrawal from all players, some will pay them without until some amount or some other trigger like fraudulent pattern in your deposits and game play, use of anonymous payment method or any possible other triggers they might have in place.
- When manual process is completed, it most of the time find out that it's same player who have been having account and is self-excluded, afaik or have heard, no casino check Gamstop in this step as it's been done already and green light given to accept player.
- Then they usually end up to void your bets and refund your deposits. If it happen later than in your first withdrawal and you are all over winning, i haven't ever heard that casino would have asked to pay possible difference from your winnings as they agree you should be self-excluded.
It has been discussed a lot here and many other places (not last in casinos who need to build and document their processes to work together with regulations) that Gamstop self-exclusions have quite severe black holes, like this email and phone number only changed thing if it go through (again, i'm not 100% sure which are all checked details and how many of them give casino self-exclusion message, but somebody can confirm it). Casinos (most of them and who are not trying to play dirty and risk their license etc.. which i have not heard happening with purpose but as said, i have no exact processes of all casinos available anywhere) own self-exckusion system is in majority at least i strongly assume will not accept email address what is used another account as it should be unique as well as phone number because they are used for personal communication and two players can't share same (i think it's also against come compliance regulations not to allow same details twice, except something like your gender, dob, name etc.. where duplicates can exist).
I fully share same opinion that Gamstop should be improved a lot and there are simple things to do like already in this forum many times many different members have figured out to be much stronger to recognize these registration attempts. I don't either share any opinion about casinos different policies where some take all self-exclusions as permanent and not accept players back even their time in Gamstop is expired. I just tried to give my two cents about these processes based on experience and knowledge what i have gained from several sources. I don't work or be any how related or affiliated to any casino operator but has been, that's reason why i posted my at least bit educated guess about how this happen in practice but every casino make their own decision about exact processes, this was just rare example without too much details how it would be possible to be compliant and run operations. These manual checks upon withdrawals are up to casinos themselves to decide, i don't really agree to that opinion with these guys who ask verification always in first withdrawal even it would be very small, that IMO is just giving them more work and create worse user experience, when it comming to big amounts, i will understand it and also some AML regulations are there to be followed if non verified player make significant big transactions.
Sorry about long posts and there is no reason to correct me that casinos are doing something different as they are and they all are to decide their own operational details. This is just something in very high level without any details which they also have to have much better documented than my few words step by steps.
Edit:
@colinsunderland above gave great example how easy it would to make system much stronger and fully agreed to these kind of points in checks should be in place which would catch 99% sure any attempts, email and phone number should not be counted as anyhow strong verification details in Gamstop country wide database. Casinos themselves can find these from their own self-exclusion database (at least most of them, some might have some very weak checks but assume most don't want to get in trouble with purpose) when trying to sign up with these details matched but Gamstop don't stop them which is totally not right.