What Is Riot Vanguard? Every Reason It Bans Players

Riot Vanguard is the anti-cheat Riot Games requires on PC for VALORANT, Teamfight Tactics and League of Legends, and it bans players for far more than aimbots. In a post dated June 24, 2026, Phillip Koskinas, who manages Riot's competitive integrity work, Vanguard included, put cheaters in about 0.7% of PC ranked matches across League and VALORANT. He named kernel-level cheating as the most popular method, with DMA hardware and screen-reading pixelbots as the other favorites of the past five years.

Cheating is only one route to a ban. Riot also bans for tampering with Vanguard, dodging an earlier ban, third-party tools that touch the game, abuse and threats, boosting and account trading, and League accounts get suspended over chargebacks. Each reason below names the Riot page that states it.

What Is Riot Vanguard?

Riot Vanguard is Riot Games' in-house anti-cheat: a client that runs while a Riot game is open, paired with a kernel mode driver. That's how Riot's support page What is Vanguard?, updated June 2, 2026, describes it, adding that the software goes through internal reviews and external security audits.

Riot's security and privacy post from April 17, 2020 splits Vanguard into three parts. The client runs the detections while you play. The driver checks memory and system state and makes sure nobody has tampered with the client. The client talks to the third part, the platform, to receive detections and to let you into a match, and it won't trust a PC unless it recognizes the driver.

Vanguard is mandatory for those games on PC. Riot's League of Legends Vanguard FAQ says it has to stay active during League games and whenever the League Client is open, which covers Teamfight Tactics on PC too. On consoles, Riot's anti-cheat team says the main threat is different: devices that pass a mouse and keyboard off as a controller.

Does Vanguard Still Run at Startup?

Riot Vanguard still starts with Windows by default, but since June 24, 2026 it can run on demand instead. Riot calls the requirements Vanguard Pre-Check. A PC that passes can switch to on-demand mode, where the driver stops loading at startup: Vanguard launches with a Riot game and shuts down once you stop playing. Riot's Vanguard Pre-Check page lists six requirements:

• Windows 11 version 25H2 or newer
• Secure Boot
• TPM 2.0
• IOMMU
• Virtualization-Based Security (VBS)
• Hypervisor-Protected Code Integrity (HVCI)

Pre-Check is optional. Riot's announcement said about 35% of players already met every requirement at launch, and the Vanguard tray app (VGTray) shows everyone else which settings are missing. Several live in the BIOS, where Riot tells players to follow the motherboard maker's documentation before changing anything.

Vanguard started at boot because of what Riot calls the "Who Loads First?" problem: a cheat could otherwise slip in through a vulnerable driver before the game launched, then unload and hide. Vanguard keeps a blocklist of the vulnerable drivers cheaters favor and unloads if one appears, so a Vanguard still running at launch proves nothing got in first. On-demand mode arrived once Microsoft, working with Riot, added a Runtime Driver Attestation report to Windows 11 25H2 that shows an anti-cheat which drivers loaded while it wasn't running.

Is Riot Vanguard Safe?

Riot Vanguard is signed, audited software that Riot says collects no more personal information than League's older anti-cheat did. It also runs a kernel driver, and that level of access is what critics object to. In the 2020 post, Riot's security and privacy leads made four commitments: the driver doesn't collect or send information about your computer back to Riot, it carries Riot's own EV certificate signed through Microsoft's process, it can be uninstalled at any time, and Vanguard flaws get their own higher-paying scope in Riot's HackerOne bug bounty.

Riot doesn't wave the worry away. The 2020 post says running the driver in kernel mode "can raise concerns," and the 2026 post concedes that Vanguard "has been known to raise eyebrows." On a PC set up for on-demand mode, Vanguard isn't running at all when no Riot game is open. If you'd rather not have it installed, Riot's guide to uninstalling Vanguard covers removing it; VALORANT and League won't start until it's back.

Why Does Vanguard Ban Players?

Riot Vanguard bans players for cheating software and cheat hardware, for tampering with Vanguard or getting around an earlier ban, for third-party programs that interact with the game and, through its anti-boost detection, for rank manipulation. Riot's penalty systems add bans for behavior, account trading and payment problems. Riot's Terms of Service (section 7.1, last updated December 1, 2024) list the measures available, from temporary bans and chat limits up to account termination and hardware bans.

Riot's VALORANT anti-cheat team wrote on September 20, 2024 that Vanguard had banned over 3.6 million accounts for cheating in its first four years, roughly one ban every 37 seconds, not counting bans for botting, boosting and queueing with cheaters. Riot doesn't always ban the moment it spots a cheat, either. Delaying bans stops cheat makers from testing which version got caught, which is why Vanguard's cheating bans tend to go out in Valorant ban waves.

Which Cheats Does Vanguard Catch?

Vanguard goes after six groups of cheats, based on Riot's June 2026 breakdown of ranked matches with a caught cheater (tampering gets its own section below):

• Kernel cheats. Code that exploits a vulnerability to run at the operating system's level, often loaded through a signed but vulnerable driver from a peripheral maker. Riot says this is still the most popular kind.
• DMA cheats. A PCIe card that copies game memory to a second PC, mostly for wallhacks. For the past year, Riot has put IOMMU restrictions on high-ranked VALORANT cheaters using DMA, which makes game memory unreadable to those cards.
• Pixelbots and triggerbots. Computer-vision cheats that read the screen, then aim or fire for you, as scripts or hardware microcontrollers. Koskinas's advice: "don't ask AI to make a VALORANT triggerbot." A triggerbot is one of the three core Valorant cheat settings, next to aimbot and ESP.
• Internal cheats. Libraries injected into the game client. Vanguard blocks or quickly detects them, and Riot puts them under 10% of infected matches.
• Bootkits. "Pre-OS" cheats that load before Windows through firmware weaknesses, more common in League, which doesn't require Secure Boot for Windows 11 players.
• Behavioral detection. VALORANT's server-side system bans on in-game performance alone, and it mostly catches ragehackers.

What Counts as Getting Around a Ban?

Trying to get around a ban, or around Vanguard itself, is a ban reason of its own. Koskinas's February 4, 2025 update calls messing with Vanguard "expressly forbidden" and lists "tampering" bans for it, alongside "hardware" bans for repeat offenders who tried to beat Riot's hardware fingerprinting and failed. Riot's rule pages describe three more:

• Playing on a banned PC. A sibling's or friend's account signed in on a hardware-banned PC loses access to Riot games there and gets banned for a while too, because Riot reads the login as an attempt to circumvent the original ban.
• Alternate accounts. Riot's Community Pact says owning several accounts is fine, but using one to evade a penalty isn't, and penalties follow the player rather than the account. Register player1alt at gmail the day after player1 at gmail gets suspended, and the suspension can be copied to the new account, though Riot doesn't publish how it links accounts.
• Changing what the PC reports. Swapping out the hardware ID a PC reports collides with the Terms clause against bypassing the technical measures Riot uses to protect access to its services.

Can Vanguard Ban You for Programs That Aren't Cheats?

Yes. Riot's rules reach any unauthorized program that touches its games, whether or not it helps you aim, and some recent penalties target tools you might not think of as cheats:

• Macros and scripts. The Community Pact defines scripting as third-party software or hardware that takes automated actions, such as auto-aiming or auto-dodging, or responds to in-game events for you.
• Instalock and stream-sniping tools. VALORANT Patch 13.05, released September 1, 2026, started penalizing both, with "temporary game bans that will escalate to permanent with repeated usage."
• Memory readers and packet tools. The Terms reach programs that "intercept, emulate, or redirect" communication with Riot's services and software that pulls information out of game memory. A memory scanner such as Cheat Engine pointed at VALORANT is exactly that.
• Reverse engineering. Section 3.1 of the Terms bars decompiling or reverse engineering Riot's software.
• Skin changers. They're game mods, which the Terms list right beside hacks and cheats, so a Valorant skin changer can get an account banned even though the skins only show on your screen.

Can You Get Banned for Behavior in Valorant?

Yes. Behavior bans come from Riot's penalty systems rather than Vanguard's cheat detection, and they grow with your history. The penalty table Riot keeps in its VALORANT penalties FAQ (June 2, 2026) climbs from warnings and XP denial to game bans for going AFK, queue dodging and friendly fire. The rest of Riot's behavior rules:

• Abuse in chat or voice. The Community Pact rules out slurs, harassment, threats, sharing private information and sexual harassment. Riot Voice Evaluation, Riot's voice comms technology, gained Spanish, Portuguese and Korean in Patch 13.06 on September 22, 2026.
• Threats and serial feeding. Riot's HWID ban article names three triggers for a hardware ban: the worst chat aggression or deliberate feeding across many permanently banned accounts, a verifiable threat of harm against players or Rioters, and flagged third-party tools. A ban issued for a threat won't be reconsidered, outside rare exceptions.
• Boosting and hitchhiking. Riot said in Patch 13.06 that its boosting detection was banning 1,600 accounts a day, over 90,000 since July 20. Deliberately queueing with a cheater to climb gets you banned for hitchhiking, and the Pact adds smurfing, deranking, win-trading and match-fixing.
• Account trading. Section 1.5 of the Terms says you can't share, sell or transfer your account or login, and the Pact repeats that trading accounts breaks the Terms.
• Streaming through a hardware ban. The HWID article says a hardware-banned player isn't allowed to play Riot's games publicly, streams included.

Do Chargebacks Get You Banned?

A chargeback doesn't get a VALORANT account banned under Riot's current policy, but it still suspends League of Legends and TFT accounts. Riot's chargeback policy, updated June 2, 2026, splits the games in two:

The VALORANT rule covers chargebacks after June 4, 2024, and removed content doesn't come back when you repay. On the League side, a gift chargeback suspends sender and receiver, fraud alerts can count as chargebacks, and several chargebacks on one account let Riot ban it permanently. If someone else made the purchases, Riot asks you to open a ticket.

Is It a Ban or Just a Vanguard Block?

Many Vanguard messages that feel like bans are blocks: they stop you playing until you change the setting they name, then they lift. The common ones:

• VAN: RESTRICTION. Riot's VAN: RESTRICTION article says the game can't launch until you install a pending Windows update or switch on a required protection: Memory Integrity, IOMMU, Secure Boot or TPM 2.0. One version asks for Windows build 26100, which means Windows 11.
• Error 138. Riot's VALORANT error list ties this code to running VALORANT or Vanguard inside a virtual machine, which isn't allowed. Install both on a regular copy of Windows.
• A vulnerable driver. Vanguard flags a vulnerable driver with a Windows notification, and updating or removing that driver clears it.
• A Vanguard Restriction on your account. Riot asks accounts it finds too "botty," "cheaty," or "speedy" to turn on security features, such as a firmware TPM, before they go further in competitive play.

Read any code with care for now: Riot flags its whole error list as outdated because of a known bug that shows the wrong error code. And if nothing appears at login but your matches feel off, that's a separate topic: the matchmaking penalties players call shadow bans.

How Long Does a Vanguard Ban Last?

A Vanguard ban lasts as long as the penalty behind it. VALORANT game bans have no single length, since Riot's table starts them at 7 days and allows permanent ones. A hardware ban runs on its own clock: the error list gives code 152, the HWID ban, as one that "typically lasts 4 months." The two work differently:

Hardware bans in Valorant aren't permanent by default. Riot's HWID article describes a set period, a re-evaluation that can end the ban early or extend it, and a catch: accounts banned during the hardware ban remain banned until it expires. A Valorant HWID ban shows up as error VAN 152 on every account that signs in on that PC. Riot anti-cheat lead Phillip Koskinas said on October 2, 2026 that hardware bans apply only to the game the cheats were detected in, and a League HWID ban shows the same code on the League side.

Riot doesn't publish the full list of hardware identifiers behind a ban, but its anti-cheat posts name one. The June 2026 post calls the TPM chip "a non-fungible form of hardware identity," because its endorsement key is burned in at the factory, and the 2024 post says Riot enforced TPM and Secure Boot on flagged players partly to gain "a better form of hardware ID."

Some players take the other route and rewrite the hardware details the PC hands to Riot's anti-cheat, the job a Vanguard HWID spoofer does. Saturn is one: one loader whose license sets which anti-cheats it covers. Spoofing doesn't touch Riot's records: the ban stays on file, banned accounts stay banned, and the Terms forbid getting around Riot's access controls, so ask Player Support for a review first.

How Does Vanguard Compare With Other Anti-Cheats?

Riot Vanguard's biggest difference from Easy Anti-Cheat and BattlEye is when it starts, not whether it has a kernel driver. Koskinas writes that Riot "definitely weren't the first studio to use an anti-cheat driver," and that most competitive games install one, because a cheat driver can blind any anti-cheat that only runs in user mode. BattlEye describes its own protection as kernel-based.

Riot calls one thing unique to Vanguard: its driver starts when the system does. Easy Anti-Cheat, part of Epic Online Services, starts protected games through a launcher when you open them. Since June 24, 2026 that gap has narrowed, because in on-demand mode Vanguard waits for the game too. Rules differ between anti-cheats as well, so don't assume Riot's rules on hardware bans carry over to other games.

Riot Vanguard FAQ

Do I need Riot Vanguard to play Valorant?

Yes, on PC. VALORANT, League and TFT won't launch while Vanguard is turned off or uninstalled. Section 9.2 of Riot's Terms also says Riot may require anti-cheat software that runs in the background of your device.

Is it safe to delete Riot Vanguard?

Yes. Riot's uninstall guide, updated May 30, 2026, offers two routes: the Advanced menu on the Vanguard tray icon, or the Add or Remove programs list in Windows. Riot games that need Vanguard stop working until it's back, and it reinstalls itself the next time you open the Riot Client or one of those games.

Can Vanguard ban you for Cheat Engine?

Riot doesn't name Cheat Engine anywhere we found, but using it on VALORANT breaks the Terms, which cover software that reads VALORANT's memory. Separately, Vanguard unloads when a driver from its blocklist appears, so some low-level tools stop Riot games from launching. That's a block, not a ban.

Does a Valorant ban carry over to League of Legends?

Usually not. A VALORANT game ban only covers VALORANT, and Riot anti-cheat lead Phillip Koskinas said on October 2, 2026 that hardware bans apply only to the game the cheats were detected in. Riot's HWID article still frames a hardware ban as keeping the banned person off every Riot platform and game, so the wider scope stays possible. The Community Pact also warns that serious or repeat offenders can face penalties in every Riot game.

Does Vanguard ban for macros?

It can. The Community Pact counts scripting, meaning software or hardware that takes automated actions for you, as cheating, and the Terms list automation programs among banned third-party tools. A macro that plays part of the game for you fits both.

Can you get a Vanguard ban lifted?

Sometimes. Riot reviews bans through Player Support tickets, the route every Valorant ban appeal takes. Riot's HWID article allows a hardware ban tied to in-game behavior or suspected cheating to be lifted after a re-evaluation, with no promise that it will be. A hardware ban that followed a verifiable threat of harm isn't reconsidered.

Why did Vanguard ban me if I didn't cheat?

The usual causes of a Valorant false ban are a secondhand or shared PC that was hardware banned before you, someone else playing your account, queueing with a cheater, or a third-party tool you didn't count as cheating. Riot's VALORANT anti-cheat team said in 2024 that 4% of cheating bans were later reversed because the account had been compromised, so turn on two-factor authentication.

Can Vanguard ban you for using a VPN?

No penalty on Riot's lists targets VPNs or IP addresses, so a VPN has no Valorant IP ban to get around, and it can't lift an account or hardware ban either. Riot does block some VPN services, though.