Yes, although they can’t keep it without valid reasons. If an online casino suspects fraud, money laundering, or questions the validity of the player’s identity, they can elect not to pay out any winnings.