What Is KYC and Why Do Exchanges Require It
KYC, or know your customer, is the identity verification an exchange performs before letting you deposit or trade, and exchanges require it because anti-money-laundering law treats a business that swaps ordinary money for crypto as a regulated financial institution.
Updated · By RampAtlas Research
Key takeaways
- KYC is the identity verification an exchange performs before letting you deposit or trade, and anti-money-laundering law is what requires it.
- In guidance issued on March 18, 2013, FinCEN stated that a business exchanging virtual currency for real currency is a money transmitter.
- Expect to supply your legal name, date of birth, residential address, a government photo identification document, and often a selfie.
- Exchanges run verification in tiers, so the limit shown in an exchange's marketing is the limit at full verification.
- Platforms advertising no verification do not accept fiat, which makes them unusable as a first on-ramp.
In this guide
KYC, or know your customer, is the identity verification an exchange performs before letting you deposit or trade, and exchanges require it because anti-money-laundering law treats a business that swaps ordinary money for crypto as a regulated financial institution.
That is the whole answer. The rest of this guide covers what the law actually says, what documents you will be asked for, why limits are tiered, what happens to the data, and why platforms advertising no verification usually cannot touch a bank account.
The legal basis, not a company policy
kyc is not something exchanges invented to be inconvenient. It follows from aml law, and in the United States the relevant framework is the Bank Secrecy Act as administered by the Financial Crimes Enforcement Network.
In guidance issued on March 18, 2013, FinCEN stated that a person engaged as a business in exchanging virtual currency for real currency, funds, or other virtual currency is a money transmitter and therefore a money services business under its regulations, unless an exemption applies (source: FinCEN guidance FIN-2013-G001). Money services businesses have to register with FinCEN, maintain an anti-money-laundering program, keep records, and report suspicious activity. Identity verification is how a business meets those obligations at the point of account opening.
Two recordkeeping rules explain why exchanges also collect information about transfers, not just about you.
| Rule | Threshold | What it requires |
|---|---|---|
| FinCEN funds travel rule | $3,000 or more | Collect, retain, and transmit information about the sender and the recipient (source: FinCEN, "Funds 'Travel' Regulations: Questions & Answers") |
| Financial Action Task Force Recommendation 16 | USD/EUR 1,000 for virtual asset transfers | Providers must obtain, hold, and transmit originator and beneficiary information (source: FATF, Updated Guidance for a Risk-Based Approach to Virtual Assets and VASPs, October 2021) |
$3,000
FinCEN travel rule threshold
FinCEN funds travel regulations
USD/EUR 1,000
FATF virtual asset transfer threshold
FATF Recommendation 16, October 2021 guidance
at least 5 years
Record retention
FinCEN recordkeeping rules
The Financial Action Task Force sets standards rather than law, and member jurisdictions implement them in their own statutes, which is why the details differ from country to country while the shape stays the same.
What you will be asked for
Expect a common core, in roughly this order.
- Your legal name, date of birth, and residential address.
- A government-issued photo identification document, usually a passport, national ID card, or driver's license, uploaded or photographed in the app.
- A liveness check, typically a selfie or a short video, matched against the ID photo.
- Often a tax identification number, and sometimes a proof of address such as a recent utility bill or bank statement.
Higher tiers ask more. Requests for source of funds, employment information, or bank statements are standard at larger deposit levels.
Most checks are automated and complete within minutes. Manual review happens when the document is hard to read, the name does not match the payment method, or the address falls into a category the exchange treats as higher risk.
Tiers and limits
Exchanges commonly run verification in levels, and each level unlocks more. A basic tier might allow crypto deposits and small trades. A full tier unlocks bank transfers, card payments, and higher withdrawal ceilings.
Limits also vary by jurisdiction for the same exchange, because the local licensing regime, not the exchange's global policy, sets the floor.
Where you live changes what is required
Verification requirements are set jurisdiction by jurisdiction. In the United States, an exchange has to satisfy federal money services business obligations and, separately, state-level money transmitter licensing, which is why an exchange can serve most of the country and still not open accounts in a particular state. Our United States page covers the federal and state layers, and the Jurisdictions hub covers the other countries we track.
Because the requirement attaches to the operator rather than to the asset, the same exchange can ask for different documents in different countries and can offer different products in each. The Exchanges hub shows which exchanges we track and where each one is available.
What happens to your data
An exchange holds your identity documents because record retention is part of the obligation. Under the FinCEN recordkeeping rules described above, covered information must be retained for at least five years, so closing an account does not delete the file.
That has a real privacy cost, and it is fair to weigh it. The concentration of identity documents at exchanges makes them targets, and breaches of verification vendors have exposed customer records in the past. Reasonable precautions on your side are to use an exchange that is licensed where you live, enable strong two-factor authentication so a compromised password does not expose the account, and be alert to phishing messages that reference a real exchange relationship.
Why "no-KYC" platforms cannot take your bank transfer
Platforms advertising no verification exist, but note what they have in common: they do not accept fiat. A business that moves ordinary money in and out is inside the regulated perimeter, which brings registration, an anti-money-laundering program, and identity verification with it. A platform that only ever swaps one crypto asset for another avoids the banking system entirely, which is how it avoids the obligation.
That makes such platforms unusable as a first on-ramp. You cannot fund one with a bank transfer or a card, so the crypto has to come from somewhere else, and the somewhere else is almost always a verified exchange. A dex has the same constraint for the same reason.
Frequently Asked Questions
Can I use an exchange without KYC?
Not for buying crypto with ordinary money. Fiat on-ramps require verification everywhere the operator is licensed. Crypto-to-crypto platforms may not require it, but they cannot get you your first coins.
How long does verification take?
Usually minutes, because the checks are automated. Manual review adds hours or days, and enhanced due diligence at higher tiers can take longer.
Why is the exchange asking about my source of funds?
Enhanced due diligence applies above certain thresholds and in higher-risk categories. It is a standard regulatory step at larger deposit sizes, not a sign that anything is wrong with your account.
Does completing KYC mean my transactions are reported to the tax authority?
Verification and tax reporting are separate obligations, and reporting rules differ by jurisdiction. Verified accounts do make it straightforward for an exchange to report where the law requires it. Treat your trading records as reportable and keep them.
Can I verify with a different name than my bank account?
No. Name mismatches between the exchange account and the funding account are one of the most common causes of held deposits and rejected withdrawals.