What is KYC in crypto?
KYC stands for “know your customer”: the identity verification that crypto exchanges, brokers and banks must carry out before they let you trade or withdraw money. On a crypto exchange it usually means uploading a passport or ID card, taking a selfie, and answering a few questions about where your money comes from. It exists to stop money laundering, fraud and identity theft, and in the EU it is the law for every licensed crypto platform.
What is KYC in crypto, in plain words?
Crypto KYC is the same customer check a bank does, applied to crypto exchanges and other crypto platforms. Before you can buy, sell or move crypto, the platform must confirm that you are a real person, that you are who you say you are, and that you are not on a sanctions list.
Know your customer (KYC) is one part of a wider set of anti money laundering (AML) rules. KYC covers who you are; AML compliance covers what you do afterwards, such as transaction monitoring for unusual payments. Together they make it much harder to use crypto transactions to hide stolen money or finance crime.
Why do crypto exchanges require KYC?
Crypto exchanges require KYC because regulators make them. In the EU, crypto companies became “obliged entities” under the anti-money laundering directive in 2020, which means they must verify customers just like a bank. Since 30 December 2024, every crypto exchange that wants to serve EU residents also needs a licence under MiCA, the EU’s crypto law, and a MiCA licence comes with strict regulatory compliance on identity verification.
There are three practical reasons behind the rules:
- Prevent money laundering and terrorist financing. Anonymous accounts are an easy way to move criminal money. A verified account leaves a trail.
- Security and fraud prevention. Knowing who owns an account helps platforms spot account takeovers and stolen identities, and helps you recover access if you lose your password.
- Access to banks. Exchanges need bank partners for euro deposits through SEPA or iDEAL. Banks only work with crypto businesses that run robust KYC processes.
In the United States the basis is the Bank Secrecy Act, which requires money services businesses such as crypto exchanges to run a customer identification program. Other countries apply the international standards set by the FATF, which treats crypto platforms as virtual asset service providers (VASPs).
How the crypto KYC process works
The crypto KYC process follows roughly the same steps on every major crypto exchange. Expect it to take between a few minutes and a couple of days, depending on how busy the platform is and whether your documents are clear.
- Personal details. Your full name, date of birth, address and nationality. Some platforms also ask for your tax residence.
- Document verification. A photo of your passport, identity card or driving licence. The platform checks that the document is genuine and not expired.
- Biometric verification. A selfie or short video (“liveness check”) so software can match your face to the photo in your identity documents.
- Questions about your money. Where your money comes from, what you plan to do, and roughly how much. For larger amounts you may be asked for a bank statement or payslip.
- Screening and approval. The platform checks sanctions lists and lists of politically exposed persons, then approves your account. After that comes ongoing monitoring: unusual activity can trigger new questions later.
What documents do you need?
For most crypto platforms in Europe you need one valid photo ID (passport or national identity card), a phone with a camera for the selfie, and sometimes proof of address such as a recent utility bill or bank statement. Brokers and exchanges based in a country may also ask for a local tax number.
Is KYC mandatory everywhere?
KYC is mandatory for every licensed crypto exchange in the EU, the UK and the US, and for most large platforms elsewhere. Some offshore crypto exchanges let you trade small amounts without verification, but they usually require KYC before you can withdraw larger sums, and they are not licensed to serve EU residents.
KYC requirements differ by service:
| Service | KYC required? |
|---|---|
| Crypto exchanges and brokers (custodial) | Yes, before trading or withdrawing |
| Custodial wallets inside an exchange app | Yes, it’s part of your exchange account |
| Self-custody (non-custodial) crypto wallets | No, you hold the keys yourself |
| Bitcoin ATMs and payment cards | Usually yes, above small amounts |
So do crypto wallets require KYC? Self-custody crypto wallets such as a hardware wallet don’t, because nobody else holds your coins. But the moment you move crypto between that wallet and an exchange, the exchange’s KYC rules apply to the transfer.
The crypto travel rule
The crypto travel rule is the reason exchanges now ask who you are sending crypto to. Since 30 December 2024, EU crypto platforms must transmit counterparty data (names of sender and receiver) with every crypto transfer between providers, with no minimum amount. If you send more than €1,000 to your own self-custody wallet, the exchange must check that the wallet really belongs to you, for example with a small test transaction or a signed message.
For you this means a few extra clicks when you withdraw. For criminals it means crypto transactions are much easier to trace.
Is crypto KYC safe for your data?
KYC is as safe as the platform that stores your identity data. Licensed exchanges must protect personal data under the GDPR and are supervised by a regulator, but data breaches do happen across the crypto industry, and a leaked passport scan can be misused for years.
To limit your regulatory risk and privacy risk:
- Only verify with exchanges that are licensed where you live. You can check MiCA licences in the ESMA register.
- Use a strong, unique password and app-based two-factor authentication.
- Be wary of “no KYC” platforms. Skipping verification often means skipping consumer protection too, and your account can be frozen without warning.
What happens if you don’t complete KYC?
If you don’t complete KYC on a licensed crypto exchange, you can usually sign up and look around, but you can’t deposit euros, buy crypto or withdraw. If a platform later asks you to update your details and you don’t, it can restrict your account until you do.
Where KYC is heading
KYC rules are getting tighter, not looser. The EU’s new anti-money laundering regulation applies from July 2027 and bans anonymous crypto accounts at regulated platforms, while a new EU authority (AMLA) supervises the biggest players. On the other side, self sovereign identity and reusable digital IDs could make verification faster: you prove who you are once and share that proof with the next platform.
The bottom line
KYC is the price of using a licensed crypto exchange: ten minutes of verifying identities in exchange for legal protection, euro deposits and a platform you can hold to account. If an exchange doesn’t ask who you are, ask yourself who is protecting your money.
Related terms
Questions people ask
Which crypto exchanges don't require KYC?
No crypto exchange licensed in the EU lets you trade without KYC. Platforms that advertise "no KYC" are usually offshore and not allowed to serve EU residents, which means no regulator to complain to if something goes wrong.
Can I buy crypto without KYC?
You can buy small amounts of crypto peer to peer or at some offshore platforms, but in the EU every licensed route requires verification. Self-custody crypto wallets don't need KYC, but you need an exchange to buy crypto with euros first.
Does Coinbase require KYC?
Yes. Coinbase verifies your identity with an ID document and a selfie before you can buy or sell, like every licensed crypto exchange in Europe.
How long does crypto KYC take?
Most crypto KYC checks are approved within minutes to a few hours. If your documents are unclear or the platform needs extra checks, it can take a few days.
What is the difference between KYC and AML?
KYC is the check on who you are when you open an account. AML is the wider set of rules that includes KYC plus ongoing transaction monitoring and reporting suspicious activity.