KYC for Cryptocurrency: What Exchanges Require and Why

This guide explains the rules in plain terms. It is not legal advice, and requirements differ by country and by exchange.

What KYC means in crypto

KYC is short for “know your customer”. It answers one question: who is this customer? It is one part of a wider AML (anti-money-laundering) program, which also covers checking the money itself and reporting suspicious activity. The money side is KYT, or wallet screening — we compare the three terms in AML vs KYT vs KYC.

In crypto, KYC happens when you open an account at a centralized exchange, a broker or another custodial service. It does not happen on the blockchain, and it does not happen when you install a wallet app that only you control.

Why exchanges must do KYC

KYC is not a policy each exchange invents. It comes from anti-money-laundering law.

Global standard: FATF

The FATF, which sets the international AML standards, requires virtual asset service providers to apply the same preventive measures as financial institutions — including customer due diligence, record keeping and suspicious transaction reporting — and requires countries to license or register them.^[1] Countries then write these standards into their own law.

United States: FinCEN

FinCEN’s 2019 guidance says crypto exchangers generally qualify as money transmitters under the Bank Secrecy Act, while ordinary users do not.^[2] Money transmitters are money services businesses, and every MSB must keep an effective AML program.^[3] That program must include policies for verifying customer identification, filing reports, keeping records and responding to law enforcement.^[3][2]

Banks follow a stricter written rule, the Customer Identification Program (CIP). Before opening an account, a bank must collect at least a name, a date of birth for an individual, an address and an identification number, and then verify the customer’s identity.^[4] Many US crypto platforms ask for a similar set of data, as the exchange examples below show.

European Union: AMLR and the transfer rules

Crypto-asset service providers in the EU need authorisation under MiCA, whose rules for them apply from 30 December 2024.^[5] The new EU Anti-Money Laundering Regulation, (EU) 2024/1624, sets one rulebook for KYC. It applies from 10 July 2027;^[6] until then each country’s own AML law applies. Under the AMLR:

• Customer due diligence is required when a business relationship starts — for example, opening an exchange account.^[6]
• For a one-off (occasional) transaction, crypto-asset service providers must apply full due diligence from EUR 1,000, and must at least identify and verify the customer below that amount.^[6] For other businesses the general threshold for occasional transactions is EUR 10,000.^[6]
• For an individual, the provider must obtain at least all names and surnames, place and full date of birth, nationality and the usual place of residence.^[6]
• Anonymous crypto-asset accounts, and accounts that allow anonymity-enhancing coins, are banned.^[6]

Full due diligence is wider than an ID check. It also covers the purpose of the relationship, sanctions screening, whether you are a politically exposed person, and ongoing monitoring of your transactions, “including where necessary the source of funds”.^[6]

The cryptocurrency KYC process, step by step

Exchanges describe their process on their own help pages. The details differ, but the steps are similar.

Step	What you provide	Example from a help centre
1. Personal details	Name, date of birth, address, phone, sometimes occupation and a tax ID.	Kraken lists email, full name, date of birth, phone number, physical address, occupation and, for US clients, an SSN or tax ID.[7]
2. ID document	Passport, national ID card or driving licence.	Coinbase says the ID must be valid and fully visible and show your legal name, date of birth, address or country, and document number.[8]
3. Selfie or face check	A live photo matched against the ID.	Coinbase’s flow captures your ID and a selfie with the camera.[8] Kraken lists a face photo among its requirements.[7]
4. Proof of address	A recent bank statement or utility bill.	Coinbase accepts address documents issued within the last 3 months.[8] Kraken may ask for a face photo instead if your address cannot be confirmed automatically.[7]
5. Higher limits or higher risk	A questionnaire, source of funds or source of wealth.	Kraken adds a KYC questionnaire for higher limits[7] and may ask for payslips or bank and exchange statements.[9] Binance’s source-of-funds review accepts documents such as payslips, tax statements and bank statements.[10]

Coinbase says it requires verification “at account creation and periodically for recordkeeping”, and accounts have limited functions until it is done.^[8] So KYC is not always one-off: an exchange can ask again later.

Does a crypto wallet need KYC?

It depends on who holds the keys.

• Exchange (custodial) wallet: yes. The exchange holds the coins for you, so it must know who you are.
• Self-custody wallet (a wallet app or hardware wallet where only you hold the keys): no. FinCEN describes unhosted wallets as software that lets a person hold and move crypto without a third party, and says a person using one to buy goods or services for themselves is not a money transmitter.^[2]

The catch is the moment your coins meet an exchange. Under the EU transfer rules, the Travel Rule applies to transfers to or from a self-hosted address whenever a crypto-asset service provider is involved. The provider collects the details, usually from its own client. Above EUR 1,000, it should check that the self-hosted address is actually owned or controlled by that client.^[11] In the US, the Funds Travel Rule may apply to transfers of $3,000 or more.^[2]

In practice, OKX may lock a deposit until you provide the sender’s legal name and say whether it came from an exchange or a private wallet; its form has an “I’m the sender” option for your own wallet.^[12][13] See the Travel Rule explained and why exchanges hold deposits.

KYC vs AML wallet checks and KYT

KYC tells an exchange who you are. It says nothing about where your coins have been. That is why a fully verified customer can still have a deposit held: the exchange also screens the sending address for links to sanctions, scams, stolen funds or mixers. This is the KYT side of AML compliance in cryptocurrency.

	KYC	AML wallet check / KYT
Checks	The person	The address and the coins’ history
When	Sign-up, then periodically	Every deposit and withdrawal
Data	ID, selfie, address	Blockchain analytics labels
Can you do it yourself?	No	Yes, with a public address

How checkers flag risky coins is explained in what an AML risk score means and dirty crypto. Businesses comparing screening tools can start at crypto wallet screening and our business tools.

What this means for you: a checklist

1. Check the exchange is licensed where you live. In the EU, look for MiCA authorisation. A platform that promises “no KYC” may be a high-risk exchange.
2. Use your real details, matching your ID exactly. Mismatches are a common reason for failed checks and later restrictions.
3. Upload documents only inside the official app or site. Never send ID photos by email or chat.
4. Keep records of where your money came from: payslips, bank statements, exchange statements and trade history. You may be asked for them at higher limits.
5. When you withdraw to your own wallet, expect to confirm the wallet is yours. When you deposit from it, be ready to say so.
6. Before you receive coins from someone else, run a free AML check on their address. KYC protects the exchange from anonymous customers; a wallet check protects you from dirty coins that can get a deposit held.
7. If your account or deposit is held, answer through official support with your documents. Our freezes page tracks public cases.