What Is KYC in Crypto? Meaning, Checks and Your Data

KYC in crypto means "know your customer": the identity checks a crypto exchange, broker or custodial wallet must run before it lets you trade, deposit or withdraw. In practice you upload a government ID, take a live selfie, and give your address and, increasingly, your tax number, and the platform screens you against sanctions and politically-exposed-person lists. Exchanges do it because anti-money-laundering law requires it, not because they choose to.

This is a plain explainer of what KYC is and how it works: why platforms ask, what they ask for, how the checks run behind the scenes, what happens to your data afterwards, and where DeFi, KYB and no-KYC exchanges fit. If you run a platform and want to compare verification vendors, our separate guide to the best crypto KYC software providers in 2026 covers that.

What KYC means

KYC is the customer-facing part of a broader legal duty called customer due diligence (CDD). Banks have done it for decades. A regulated business has to establish who its customer is, verify that identity against reliable sources, understand what the relationship is for, and keep monitoring it afterwards. In crypto, the "customer" is whoever opens an account with a centralised service: an exchange, a broker app, a custodial wallet, a crypto card issuer or a fiat on-ramp.

The EU's new Anti-Money Laundering Regulation, Regulation (EU) 2024/1624, which applies from 10 July 2027, gives a clear picture of the minimum. For an individual, Article 22 requires at least:

• all names and surnames;
• place and full date of birth;
• nationalities and, where applicable, a national identification number;
• usual place of residence and, where available, a tax identification number.

The business must also verify this information, typically against an identity document, and understand the purpose of the relationship. That last part is why exchanges ask about your occupation, expected volumes and source of funds.

Why crypto exchanges require KYC

Three layers of rules make KYC unavoidable for regulated crypto businesses.

Global standards. The Financial Action Task Force (FATF) sets the anti-money-laundering standards most countries follow. In October 2018 it updated Recommendation 15 to cover virtual assets, and in June 2019 it issued guidance that brought virtual asset service providers (VASPs) under the same customer due diligence logic as banks and extended Recommendation 16, the "travel rule", to them (Wikipedia, citing FATF). Adoption is uneven but rising: FATF's targeted update of 15 July 2026 found that 83% of the jurisdictions surveyed on the point had Travel Rule legislation in force (Notabene summary, 17 July 2026).

The Travel Rule. When you send crypto from one exchange to another, the sending platform must pass your identifying details to the receiving one. In the EU this is the Transfer of Funds Regulation, applying since 30 December 2024, and it covers crypto transfers regardless of amount. A platform can only send verified data if it verified you first. See the crypto Travel Rule explained.

Licensing. In the EU, crypto businesses need a licence under MiCA, and authorised crypto-asset service providers are obliged entities under AML law. Since the MiCA transitional period ended on 1 July 2026, a firm serving EU clients needs that authorisation. From 10 July 2027, the AMLR requires crypto-asset service providers to run full due diligence even on occasional transactions of EUR 1,000 or more (Article 19(3)) and bans anonymous crypto accounts (Article 79). Our pillar guide, what is MiCA, explains the licensing side.

What you will be asked for

Requirements vary by platform and country, but a standard individual onboarding in 2026 usually includes:

• Personal details: full name, date of birth, nationality, residential address.
• An identity document: passport, national ID card or, in some countries, a driving licence, photographed front and back.
• A live selfie or short video for a biometric match against the document photo.
• Proof of address such as a recent utility bill or bank statement, at some platforms or higher tiers.
• A tax residence declaration and tax identification number (TIN). In the EU this is now standard because of the DAC8 tax-reporting directive, which has applied since 1 January 2026. See DAC8 crypto reporting explained.
• Questions about the account's purpose, occupation, expected activity and sometimes source of funds or source of wealth.

Our practical guide to ID verification tips for crypto exchanges covers the common reasons a check fails, such as glare on the document, a cropped photo or a name mismatch.

How the checks work behind the scenes

Most exchanges do not build verification in-house. They plug in a specialist identity verification provider, such as iDenfy, whose software runs a sequence of checks in a few minutes. The details differ by vendor, but the steps are broadly the same:

1. Document verification. The software reads the document, including the machine-readable zone and, where present, the chip, and checks security features, fonts, templates and data consistency for signs of tampering or forgery.
2. Liveness detection. It checks that the selfie comes from a live person in front of the camera rather than a printed photo, a screen replay, a mask or a deepfake injected into the video feed.
3. Face matching. It compares the live face with the photo on the document and produces a similarity score.
4. Screening. Your name and date of birth are checked against sanctions lists, politically exposed person (PEP) lists and adverse media. See crypto watchlist and PEP screening.
5. Risk scoring and review. The results feed a risk score. Clear passes are approved automatically; borderline or high-risk cases go to a human compliance analyst.

KYC does not stop once you are approved. Under the AMLR, from July 2027 customer information must be kept up to date at intervals that depend on risk and never exceed one year for higher-risk customers or five years for everyone else (Article 26). Exchanges also monitor transactions and screen the wallets you deposit from and withdraw to. Under the Transfer of Funds Regulation, for a transfer of more than EUR 1,000 to or from your own self-hosted wallet, the exchange should verify that the address is owned or controlled by you, which is why some platforms ask you to sign a message or make a small test transfer.

KYC tiers and limits

Many platforms split verification into tiers. The law sets the duty to verify customers; how a platform stages that process is a business decision, so tier names and limits differ from one exchange to the next. A typical structure looks like this:

• Basic: email, phone and personal details. Often enough to browse or, at some platforms, to make small purchases. In the EU that room is shrinking: from 10 July 2027 the AMLR requires CASPs to identify and verify the customer even on occasional transactions below EUR 1,000 (Article 19(3)).
• Standard: ID document, selfie and liveness check. Unlocks trading, deposits and withdrawals up to the platform's limits.
• Enhanced: proof of address, source of funds or source of wealth documents, sometimes a video call. Required for higher limits, larger withdrawals, OTC desks, or when the platform's risk system flags something.

Enhanced due diligence can also be triggered by events rather than by your choice: a large deposit, a transfer from a high-risk wallet, a match on a PEP list, or a change in your activity. If a platform asks for more documents later, that is usually the reason.

What happens to your KYC data

This is the part most users never think about. Your documents and selfie are usually processed by the verification vendor and stored by the exchange, and AML law requires the exchange to keep them. Under the AMLR, which applies from 10 July 2027, due diligence records must be retained for five years after the business relationship ends, and regulators can require up to five years more in specific cases (Article 77). Closing your account does not delete your passport scan the next day.

That retention creates risk. Identity data has leaked from exchanges and their suppliers, and when an exchange shuts down, your data does not disappear with it. We cover this in detail in what happens to your KYC data, what happens to your passport when an exchange shuts down and the Revolut data leak and self-custody. Under the GDPR you can ask any EU platform what it holds about you and on what legal basis; you cannot make it delete records that AML law requires it to keep.

KYC in DeFi

Decentralised finance works differently. When you use a non-custodial protocol, you interact with smart contracts from your own wallet. No company takes custody of your funds or opens an account in your name, so there is usually no onboarding step where KYC would happen. That is a structural difference, not a loophole: the rules attach to intermediaries that provide services to customers.

The picture is not black and white. Some front ends screen connecting wallets against sanctions lists and block flagged addresses. Some protocols, especially those dealing in tokenised securities or real-world assets, use permissioned pools where only verified wallets can take part. Where an identifiable company provides or controls a service, regulators may treat it as an intermediary. And the moment you move funds between DeFi and a regulated exchange, the exchange's KYC and Travel Rule obligations apply to that transfer. Our explainer on KYC in DeFi covers the debate in more depth.

JewelSwap is non-custodial DeFi software on MultiversX, Sui and Radix. It is not a crypto-asset service provider and is not regulated, it does not hold user funds, and its money markets are currently paused.

KYC vs KYB

KYC verifies individuals. KYB, "know your business", verifies companies: a firm opening an exchange account, a market maker, an OTC counterparty or a payment partner. KYB checks that the company exists and is in good standing in the company register, who its directors are, and, above all, who its ultimate beneficial owners are, meaning the natural persons who own or control it. Those beneficial owners then go through KYC themselves.

KYB is slower and more document-heavy because corporate structures can hide ownership behind layers of holding companies. Our KYB compliance checklist explains the process step by step, and KYB in crypto covers the tooling.

No-KYC exchanges and their risks

Some centralised platforms advertise trading without identity checks. Before using one, it is worth understanding what that actually means:

• They are usually unlicensed where you live. A centralised exchange that skips KYC cannot hold an EU MiCA authorisation, because authorised CASPs are bound by AML law. ESMA keeps a public list of entities that national regulators have flagged for providing crypto services without authorisation; it had 173 entries in the version downloaded on 5 October 2026 (ESMA interim MiCA register, last updated 30 September 2026).
• "No KYC" often means "KYC later". Many such platforms reserve the right to demand verification at withdrawal, or when a transaction trips a risk rule. Funds can be frozen until you comply.
• No investor protection. An unlicensed custodian is not subject to the segregation, capital and conduct rules that MiCA imposes, and there is no regulator to complain to if it fails or disappears. See why crypto exchanges are closing.
• Higher exposure to illicit funds. Platforms without screening attract flows that regulated exchanges reject, so withdrawing from one to a regulated exchange may trigger extra checks or a frozen deposit.
• Your tax obligations do not change. Gains are taxable whether or not a platform reports them.

None of this is a recommendation for or against any platform, and you should not try to get around a platform's verification requirements. If privacy is the concern, self-custody of your own assets and careful choice of which regulated platforms you share data with are lawful routes. Our self-custody guide covers the first.

Frequently asked questions

What does KYC mean in crypto?

KYC means "know your customer". It is the identity verification a regulated crypto business, such as an exchange or custodial wallet, must carry out before serving you: collecting your personal details, checking an ID document and a live selfie, and screening you against sanctions and PEP lists.

Why do crypto exchanges require KYC?

Because anti-money-laundering law requires it. FATF standards have covered virtual asset service providers since 2018 and 2019, the EU's Transfer of Funds Regulation requires identifying data to travel with crypto transfers, and licensed EU crypto firms are obliged entities under AML law.

What documents do I need for crypto KYC?

Usually a passport, national ID card or driving licence, plus a live selfie. Some platforms or higher tiers also ask for proof of address and source-of-funds documents, and EU platforms now ask for your tax residence and tax identification number.

How long do exchanges keep KYC data?

Under the EU Anti-Money Laundering Regulation, which applies from 10 July 2027, due diligence records must be kept for five years after the business relationship ends, and regulators can require up to five more years in specific cases.

Do DeFi protocols require KYC?

Most non-custodial DeFi protocols do not, because there is no intermediary opening an account for you. Some front ends screen wallets against sanctions lists, some pools are permissioned, and moving funds to or from a regulated exchange brings its KYC rules into play.

What is the difference between KYC and KYB?

KYC verifies individual customers. KYB verifies businesses: that the company exists, who runs it and who its ultimate beneficial owners are. Those beneficial owners are then verified with KYC.

Keep reading

• Best crypto KYC software providers in 2026
• What happens to your KYC data
• KYC in DeFi explained
• What is MiCA?
• DAC8 crypto reporting explained

This article is educational and is not legal or financial advice. Legal references are to Regulation (EU) 2024/1624 and Regulation (EU) 2023/1113 as published in the Official Journal, checked on 5 October 2026. Register counts come from ESMA's interim MiCA register as downloaded on 5 October 2026. Other sources are linked inline, including EUR-Lex and Notabene.