Crypto KYC: What Exchanges Ask For and Why

What identity verification involves, why 'no KYC' exchanges usually mean 'no KYC until you withdraw', and what happens to the data you hand over.

Last reviewed 2026-09-14

What it is

Know Your Customer rules require financial businesses to verify who their customers are. Crypto exchanges fall under them in most jurisdictions, which means a government ID, a selfie, usually a proof of address, and sometimes a source-of-funds explanation for larger accounts.

The obligation is not the exchange’s choice. It comes from anti-money-laundering law, and the penalty for ignoring it is the loss of banking relationships — which ends the business.

What “no KYC” actually means

Several exchanges advertise trading without verification. Read the limits. The pattern is almost always:

• Trade freely, withdraw up to a small daily cap without verification.
• Verify to raise the cap.
• Verify, with additional documents, to use fiat at all.

There is also a second, less advertised trigger: risk review. An unverified account that behaves unusually gets frozen pending verification — and this happens at withdrawal, not at deposit. An account you cannot verify when asked is an account you cannot empty.

Plan on the assumption that verification will eventually be required. A strategy built on avoiding it tends to fail at the worst moment.

What happens to the data

You are handing a copy of your passport to a company that may be incorporated in a jurisdiction you have never visited. That data has leaked before — Ledger’s 2020 customer database breach led to years of targeted phishing and physical threats against named individuals, and that was a hardware wallet company, not even an exchange.

Reasonable precautions:

• Prefer exchanges regulated somewhere with real data-protection enforcement.
• Use a unique email address per exchange, so a leak tells you its source.
• Expect phishing that knows your name, address and holdings. Its convincingness is the point.
• Never reuse a password between an exchange and anything else.

Privacy coins and mixers

Using a privacy tool is not illegal in most places, but exchanges routinely flag deposits with any connection to a mixer, and some have frozen accounts over funds several transfers removed from one. Since the Tornado Cash sanctions this has become stricter rather than looser. If you use privacy tools, keep those funds entirely separate from accounts you need access to.

The reasonable position

KYC is a real cost — in privacy, in data risk, in friction. It is also unavoidable for anyone who wants to convert between crypto and bank money at meaningful size. The workable approach is to accept it where you must, minimise the number of places you do it, and hold long-term funds in self-custody where no verification applies at all.