What is KYC in crypto? What you hand over and who keeps it

KYC stands for "know your customer". In crypto it is the identity check a service runs before it lets you trade or withdraw: a photo of your passport or ID card, a selfie or a short video, and often a document that shows where you live. Below is what the check involves, where the files go afterwards, and how to tell in advance whether a service will ask for them.

Where does KYC come from?

From anti-money-laundering law. The Financial Action Task Force, an intergovernmental body whose forty Recommendations most countries copy into national law, tells financial institutions to identify each customer and verify that identity. Since 2019 the same standard covers what it calls virtual asset service providers: exchanges, brokers, custodial wallets.

The duty sits on the company. No rule obliges a person to use a company that performs the check, which is why self-custody wallets and peer-to-peer trades can exist next to it.

What do you hand over?

A first-tier check usually takes your legal name, date of birth and home address, both sides of a government ID, and a selfie or liveness video matched against that ID. Higher tiers add proof of address, such as a utility bill or bank statement, and proof of where the money came from: payslips, bank statements, a contract of sale.

Then there is what you hand over without being asked. Your IP address, your device details and every wallet address you deposit from or withdraw to end up attached to the same file.

Who actually keeps the files?

Usually two companies. Most exchanges do not build identity checks themselves. Your upload goes to a verification vendor — Sumsub, Onfido, Jumio, Veriff and Persona are common names — which examines the document and returns a verdict. The exchange stores the result and, in most cases, the images. The vendor keeps its own records for as long as its contract says.

So the question "do I trust this exchange with my passport" has a second half: do you trust a company whose name you may never see.

How long is it kept?

At least five years after you stop being a customer. FATF Recommendation 11 sets that minimum for identification records, and both EU and US law follow it. Closing the account does not delete the file. A deletion request under privacy law does not either, until the retention period has run out. What happens when such an archive leaks is covered in an earlier note.

Is KYC the same thing as AML?

No. AML is the whole regime: transaction monitoring, sanctions screening, reports to the authorities, record keeping. KYC is the identification step inside it. The difference matters in practice, because a service can stop a transfer on AML grounds without ever having asked who you are. That is how a swap advertised as no-KYC ends up requesting a passport in the middle of a trade.

What did the travel rule change?

Identity now moves with the coins. In the EU, since 30 December 2024, a crypto transfer sent from one provider to another has to carry the names of the sender and the recipient. When more than €1,000 goes to or from a wallet you hold yourself, the provider must check that the wallet is really yours.

How to tell in advance whether a service will ask

Reading the landing page is not enough; the answer is in the terms of service. This catalogue reads them for you and files every service under one of five levels:

• 0 — guaranteed no KYC: the terms rule documents out.
• 1 — no KYC: no documents in the normal course of use.
• 2 — rare KYC: possible by law, on a refund or on an AML flag.
• 3 — shotgun KYC: can be demanded suddenly, with your funds already deposited.
• 4 — mandatory KYC: no documents, no service.

Of the 54 listings a moderator has inspected so far, 23 are at level 0, 17 at level 1, 9 at level 2 and 5 at level 3. The level is derived from confirmed attributes, each with a link to the evidence, and cannot be set by hand. The method is public, and the catalogue can be filtered by level.

One caveat belongs here. Using a service that does not ask for documents changes who holds a file on you. It does not change what you owe in tax or which laws apply to you.

Sources: FATF — The FATF Recommendations, EBA — travel rule guidance, 4 July 2024