What Is KYC in Crypto? Why Exchanges Verify Your Identity

Last updated: October 21, 2026.

Open an account on a crypto app and you’ll soon see a screen asking for your driver’s license and a selfie. That step is KYC, short for “know your customer.” Every regulated KYC exchange runs it, and it’s a common reason new users get stuck or worry about privacy.

This guide covers what KYC and AML mean, the US and Canadian rules behind them, the documents you’ll need, how long it takes, privacy risks, the travel rule, DEXs, and why “no-KYC exchanges” are riskier than they look.

What Is KYC in Crypto?

KYC is the process a financial company uses to confirm that you are who you say you are. Investopedia’s guide to know your client (KYC) describes it as the way financial institutions verify customer identities to comply with legal requirements and prevent financial crimes. It breaks KYC into three parts:

• Customer Identification Program (CIP): collecting basic facts such as your name, date of birth, address and an ID number.
• Customer Due Diligence (CDD): checking those details and understanding what the account will be used for.
• Enhanced Due Diligence (EDD): deeper checks for accounts the firm sees as higher risk.

AML (anti-money laundering) is the bigger umbrella; Investopedia notes KYC is one component of it. AML also covers monitoring transactions, reporting suspicious ones and keeping records. In crypto, KYC happens where regular money meets crypto, usually at a centralized crypto exchange or broker app.

Why Exchanges Require KYC

Exchanges are legally treated as financial businesses that move money, and those businesses must know their customers. The goals: stop criminals from turning illegal money into crypto (or back into cash), block sanctioned people, report suspicious activity, prevent accounts opened in someone else’s name, and support tax reporting.

Coinbase’s help page on verifying your identity sums it up: it requires identity verification at account creation, and periodically afterward, “for legal, compliance, and fraud-prevention purposes,” and accounts have limited functionality until verification is complete.

KYC Rules in the United States

The key law is the Bank Secrecy Act (BSA), enforced by the Treasury Department’s Financial Crimes Enforcement Network (FinCEN). Back in 2013, FinCEN’s guidance on persons administering, exchanging or using virtual currencies said that a business that exchanges virtual currency for real currency or other virtual currency is a money services business (MSB), specifically a money transmitter, unless an exemption applies. The same guidance says an ordinary user who buys crypto to pay for goods or services is not an MSB.

FinCEN’s 2019 guidance on convertible virtual currency business models adds that a money transmitter must register with FinCEN within 180 days of starting money transmission, and MSBs carry AML, recordkeeping and reporting duties.

Ignoring this is costly. In January 2025, the US Attorney’s Office for the Southern District of New York announced that KuCoin pleaded guilty to operating an unlicensed money transmitting business. Prosecutors said KuCoin failed to run effective AML and KYC programs, did not require customers to provide any identifying information until at least July 2023, never registered with FinCEN and never filed suspicious activity reports. Its operator agreed to pay more than $297 million and to exit the US market for at least two years.

Taxes are part of the picture too. The IRS digital assets page says brokers must report certain sales and exchanges on Form 1099-DA starting with transactions on or after January 1, 2025. That is a big reason US platforms ask for your Social Security number. Our guide to Form 1099-DA and digital asset tax reporting explains what lands in your mailbox.

KYC Rules in Canada

In Canada, the anti-money-laundering regulator is FINTRAC (the Financial Transactions and Reports Analysis Centre of Canada). Its page on money services businesses lists “dealing in virtual currency” (exchanging funds for crypto, crypto for funds, or one crypto for another, plus transferring crypto for clients) as an MSB service. MSBs must register with FINTRAC before operating in Canada, run a compliance program and verify client identities.

FINTRAC’s guidance on when MSBs must verify identity says they must verify the identity of anyone who asks them to exchange or transfer virtual currency worth C$1,000 or more, and anyone from whom they receive virtual currency worth C$10,000 or more. In practice, most platforms simply verify everyone at sign-up.

Platforms also answer to securities regulators. The Ontario Securities Commission keeps a list of registered crypto asset trading platforms (last updated October 15, 2026 when we checked), and the Canadian Securities Administrators (CSA) publish decisions for other provinces. Tax-wise, Canadian crypto gains and income still need to be reported; see our cryptocurrency tax guide for Canada.

What Documents a KYC Exchange Asks For

Each platform’s checklist is a little different, but most ask for the same core items. Here is what two large exchanges list on their own help pages (checked October 21, 2026):

Item	What it is	Example from official pages
Basic details	Legal name, date of birth, address, email, phone	Kraken requires email, full name, date of birth, phone number, physical address and occupation
Government photo ID	Passport, driver’s license or national ID card	Coinbase says your ID must be valid and show your legal name, date of birth, address/country and document number
Selfie / face photo	A live photo matched to your ID (a “liveness” check)	Coinbase’s flow captures your ID and a selfie; Kraken may ask for a face photo depending on where you live
Proof of address	Recent bank statement or utility bill	Coinbase accepts bank, credit card or utility statements issued within the last 3 months
Tax ID	SSN or ITIN in the US	Kraken lists a Social Security number or tax ID for US clients
Extra questions	Occupation, source of funds, purpose of account	Kraken adds a KYC questionnaire for higher limits

Sources: Kraken verification requirements and the Coinbase identity verification page linked above.

How the steps usually go

1. Sign up and turn on two-factor authentication.
2. Enter your details exactly as they appear on your ID.
3. Photograph your ID flat, in good light, on a plain background.
4. Take the selfie without sunglasses or a hat, facing the camera (Coinbase’s tips).
5. Add proof of address or answer extra questions if asked, then wait for review.

Our step-by-step guide on how to buy Bitcoin for the first time shows where KYC fits in the full buying process.

How Long KYC Verification Takes

Coinbase says that after you complete the identification process you’ll be notified of the review status within 24 hours. Kraken’s support pages currently carry a notice that it is facing delays processing new accounts and ask users not to submit multiple verification requests.

Common reasons for delays or rejections:

• blurry or glare-covered photos, or part of the ID cut off,
• a name or address that doesn’t match your ID or bank account,
• expired or unsupported documents (Coinbase says it does not accept temporary or expired IDs),
• repeated attempts in a short time (Coinbase suggests waiting at least 30 minutes between attempts),

Verification Levels and Limits

Many exchanges use tiered verification: the more you verify, the more you can do. Kraken’s verification levels explained page lists a standard “Verified” account with cash deposit and withdrawal limits under $100,000 per month, and a “Verified with higher limits” option above $100,000 per month, which needs a KYC questionnaire and sign-in two-factor authentication. Limits change, so check your platform’s settings.

Very large traders and institutions go through even deeper checks. Our explainer on how OTC crypto desks handle large trades covers that side.

Privacy and Data-Breach Risks

KYC’s real downside: a company stores your ID, face, address and sometimes tax number. If that leaks, criminals can impersonate you or target you with convincing scams.

This is not hypothetical. In a May 2025 SEC filing, Coinbase disclosed a cybersecurity incident in which a threat actor paid support contractors or employees outside the US to collect customer information. The affected data included names, addresses, phone numbers, emails, masked Social Security numbers (last 4 digits), masked bank account numbers, government ID images, and balance and transaction history. Coinbase said passwords and private keys were not compromised. Reuters reported that Coinbase estimated the hit at $180 million to $400 million and rejected a $20 million ransom demand.

How to protect yourself

• Use fewer platforms. Every extra account is one more copy of your ID on a server.
• Use strong, unique passwords and an authenticator app or security key, not SMS, where possible. The FTC’s phishing guide recommends multi-factor authentication because it makes it harder for scammers to log in even if they get your password.
• Expect fake “support” calls after a breach. Hang up and contact the company through its official app.
• If your SSN or ID may be exposed, the FTC points US victims to IdentityTheft.gov for step-by-step recovery.

The Travel Rule, Briefly

When crypto moves between regulated companies, sender and receiver details often have to travel with it. This is the travel rule.

• Globally: the Financial Action Task Force (FATF), which sets international AML standards, said in its June 2025 targeted update on virtual assets that 99 jurisdictions had passed or were in the process of passing travel rule legislation.
• US: FinCEN’s 2019 guidance says crypto transfers can fall under the Funds Travel Rule, which a transfer of $3,000 or more (or its equivalent in crypto) may trigger.
• Canada: FINTRAC’s travel rule guidance says MSBs must include the originator’s and beneficiary’s name, address and account or reference number when they send virtual currency transfers.

For you, this mostly means an exchange may ask who owns a wallet before you withdraw to it.

KYC vs DEXs and Self-Custody

A decentralized exchange (DEX) is a set of smart contracts, not a company that opens accounts, so most DEX websites don’t ask for ID. You just connect a wallet. Our guide on how a decentralized exchange works walks through swaps, fees and risks.

That doesn’t mean DEX use is anonymous. The FTC’s guide to cryptocurrency and scams notes that crypto transactions are typically recorded on a public blockchain, and that it’s sometimes possible to use transaction and wallet information to identify the people involved. And most people still pass through a KYC exchange first to turn dollars into crypto.

It also helps to separate two ideas:

• Custodial: the exchange holds the keys and your coins. A custodial wallet is convenient and comes with support, but you trust the company.
• Self-custody: you hold the keys. Self-custody of crypto removes exchange risk but puts all the security on you. Lose your recovery phrase and no one can help.

KYC duties fall on businesses that exchange or transfer crypto for customers. FinCEN’s 2013 guidance, for example, says a person who simply obtains crypto to buy goods or services is not an MSB.

What About No-KYC Exchanges?

Searches for “non KYC exchanges” are common. We don’t list or recommend any, and here’s why caution matters:

• Frozen or lost funds. A platform that skips KYC at sign-up may demand it later, when you try to withdraw. KuCoin, for example, made KYC mandatory only in August 2023, according to the Justice Department.
• Little or no legal protection. An offshore, unregistered platform is outside your local regulator’s reach. If it fails or gets hacked, you may have nowhere to complain. The FTC warns that if an online exchange platform goes out of business, you’re likely to find no one can step in to help you recover your funds.
• Scams dressed as exchanges. The FTC describes fake investment sites that look real but won’t let you withdraw unless you pay high fees.
• It may be illegal for them to serve you. A business serving US customers as a money transmitter must register with FinCEN, and platforms serving Canadians must register with FINTRAC and work with securities regulators. KuCoin’s guilty plea shows US authorities do pursue offshore platforms that serve Americans without registering.

If privacy is the worry, a safer approach is a registered exchange for buying, few accounts, and long-term coins in your own wallet.

Fake “KYC Verification” Scams

Scammers send fake “KYC” messages like “Your account will be suspended unless you re-verify within 24 hours,” linking to a look-alike site that steals your ID photos, login or recovery phrase.

The FTC’s phishing guide lists classic signs, such as messages that claim there’s a problem with your account or say you need to confirm personal or financial information. Coinbase also states that it will not ask you to complete identity verification or upload documents on non-Coinbase domains, that you should check the page URL ends in .coinbase.com before uploading your ID, and that you should not email ID photos to support.

Simple rules that work on any platform:

• Never click verification links in emails, texts or DMs. Open the official app or type the address yourself.
• Never send ID photos by email, Telegram or WhatsApp.
• No real exchange needs your wallet’s recovery phrase or private key for KYC. Anyone asking for it is a scammer.
• Report phishing to the FTC at ReportFraud.ftc.gov (US) or the Canadian Anti-Fraud Centre (Canada), and to the exchange.

FAQ

What does KYC mean on a crypto exchange?

KYC means “know your customer.” A KYC exchange checks your identity, usually with a government ID, a selfie and your personal details, before letting you fully trade, deposit or withdraw.

Is KYC required to buy crypto in the US and Canada?

On regulated exchanges and broker apps, yes, because they are money services businesses under FinCEN (US) or FINTRAC (Canada) rules.

Is it safe to give my ID to a crypto exchange?

It’s normal on regulated platforms but not risk-free, as breaches show. Upload documents only inside the official app or website and use strong two-factor authentication.

Are no-KYC exchanges legal?

It depends on the platform and where you live, but businesses serving US or Canadian customers generally must register and verify identities. Unregistered platforms can freeze funds, disappear, or face enforcement, and you may have little protection. This is not legal advice.

Sources

• Investopedia: Know Your Client (KYC)
• FinCEN: Application of FinCEN’s regulations to persons administering, exchanging, or using virtual currencies (2013)
• FinCEN: Application of FinCEN’s regulations to certain business models involving convertible virtual currencies (2019)
• US Department of Justice (SDNY): KuCoin pleads guilty to unlicensed money transmission charge
• IRS: Digital assets
• FINTRAC: Money services businesses
• FINTRAC: When to verify the identity of persons and entities (MSBs)
• FINTRAC: Travel rule for electronic funds and virtual currency transfers
• Ontario Securities Commission: Crypto businesses and registered platforms (checked October 21, 2026)
• Coinbase Help: Verify your identity on Coinbase (checked October 21, 2026)
• Kraken Support: Verification requirements and Verification explained (checked October 21, 2026)
• Coinbase Form 8-K: Material cybersecurity incident (May 2025)
• Reuters: Coinbase warns of up to $400 million hit from cyberattack
• FATF: Targeted update on virtual assets and VASPs (June 2025)
• FTC: How to recognize and avoid phishing scams
• FTC: What to know about cryptocurrency and scams

This article is for educational purposes only and is not financial, investment, tax or legal advice.