KYC, short for Know Your Customer, is the identity verification a crypto exchange runs on you before it will let you trade at full capacity, deposit dollars, or withdraw to a bank account. Federal law treats centralized crypto exchanges as money service businesses, so they have to check who their customers are the same way a bank or wire transfer company does.1FinCEN. Application of FinCENs Regulations to Persons Administering, Exchanging, or Using Virtual Currencies In practice, that means uploading a government photo ID and some personal details before your account is fully usable.
Why Crypto Exchanges Require KYC
The requirement comes from the Bank Secrecy Act, which pulls financial institutions into the government’s system for detecting money laundering and terrorist financing.2Office of the Law Revision Counsel. 31 USC 5311 – Declaration of Purpose FinCEN confirmed in 2013 that crypto exchangers fall inside that framework as money transmitters, and the USA PATRIOT Act layered on a specific mandate for verifying customer identity at account opening.3Office of the Law Revision Counsel. 31 USC 5318 – Compliance, Exemptions, and Summons Authority The exchange isn’t asking for your ID because it wants to. It’s asking because federal regulators will fine it heavily if it doesn’t.
What You Have to Provide
At a minimum, an exchange will collect four pieces of information: your full legal name, date of birth, residential address, and a taxpayer identification number (for U.S. persons, typically your Social Security Number). Non-U.S. customers can usually substitute a passport number or another government-issued document number showing nationality.4eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks
You’ll also upload supporting documents. Standard is an unexpired government-issued photo ID such as a driver’s license, passport, or national identity card. Most exchanges want a second document showing your current address, like a recent utility bill or bank statement. Upload them as clear JPEG or PDF files with all four edges of the document visible and no glare across the text. Blurry or cropped photos are the most common reason a submission gets kicked back.
How Verification Actually Works
Once you’ve created an account, the verification tool sits in your profile or account settings. The flow has three parts: entering your personal details, uploading document images, and completing a liveness check where the platform asks you to take a selfie or follow prompts through your camera. The liveness step exists to confirm you’re the person on the ID, not someone submitting stolen documents.
After submission, your account sits in a pending state. Automated systems can clear straightforward cases in minutes by matching your data against public databases and credit bureaus. If something gets flagged, a human compliance officer reviews it, and that can take several business days. You’ll get a notification either way.
If You Get Rejected
Rejections almost always come from something small. The document expired. The name in your profile doesn’t match the name on the ID exactly. A date of birth was mistyped. The photo is too blurry to read. Fix the mismatch or renew the document, then resubmit. For image quality problems, photograph the ID flat on a dark surface with even lighting rather than holding it up to a webcam.
What Verification Unlocks
Exchanges use tiered verification, so what you can do depends on how much identity information you’ve given them. At the lowest tier you may be limited to crypto-to-crypto trading with no ability to move dollars in or out. Completing basic photo ID verification typically opens fiat deposits and withdrawals through bank transfers. Higher tiers, sometimes requiring extra documentation, raise your daily and monthly withdrawal ceilings and unlock features like margin trading and futures.
Specific dollar limits vary by platform and change often. The withdrawal limits page inside your account will show your current tier and exactly what you’re allowed to move.
When Exchanges Ask for More
Standard KYC is a floor. If an exchange decides your account is higher risk, it will run enhanced due diligence (EDD). This can be triggered by unusually large transactions, activity connected to jurisdictions with weak anti-money-laundering controls, or a screening hit for a politically exposed person, meaning senior government officials, military figures, and their close associates or family members.
EDD looks at where your money comes from, not just who you are. Expect requests for pay stubs, tax returns, proof of inheritance, records of a business sale, or documentation of how you built up your crypto holdings. For funds that originated on-chain, the exchange may ask for blockchain analytics reports tracing where the money moved through your wallets. Reviews at this level often need senior management approval and take longer than routine verification.
What Happens to Your Data
KYC isn’t a one-time check. Once you’re verified, the exchange has an ongoing monitoring duty and must file a Suspicious Activity Report with FinCEN for any transaction of $2,000 or more that it suspects is tied to illegal activity, structured to evade reporting, or has no apparent lawful purpose.5eCFR. 31 CFR 1022.320 – Reports by Money Services Businesses of Suspicious Transactions The identity data you gave up front is what lets them name you in those reports.
Exchanges must keep your identification records for at least five years after your account closes, and records of how they verified you for five years after those records were created.6FFIEC. BSA Record Retention Requirements The Gramm-Leach-Bliley Act requires them to protect that data with a written information security program and to disclose how they share customer information.7Federal Trade Commission. Gramm-Leach-Bliley Act
How well that protection holds up in practice is another question. In late 2024, attackers bribed customer support agents at one of the largest U.S. exchanges and accessed personal data for roughly 70,000 users, including photos of identity documents and home addresses. Similar breaches have hit other exchanges. Because KYC concentrates your full name, photo, government ID number, and address in one place, a single breach can hand an identity thief everything at once. If you use a regulated exchange, this collection is unavoidable; the best defenses on your end are a strong unique password and two-factor authentication, along with the understanding that your documents will sit on the platform’s servers for years after you leave.
Penalties for Trying to Skip KYC
You can’t legally use a U.S.-facing exchange without going through verification, and the workarounds people try tend to be worse than the inconvenience they avoid. Deliberately breaking transactions into smaller pieces to stay under reporting thresholds is called structuring, and it’s a federal crime under 31 USC 5324 even when the underlying money is completely legitimate.8Office of the Law Revision Counsel. 31 USC 5324 – Structuring Transactions to Evade Reporting Requirement Prohibited Splitting a $15,000 deposit into three $4,900 transfers to avoid triggering a report is enough.
When structuring connects to money laundering, meaning the funds came from illegal activity and the transactions are meant to disguise that origin, the exposure grows sharply. Convictions under 18 USC 1956 can carry fines up to $500,000 or twice the value of the transaction (whichever is greater) and up to 20 years in prison.9Office of the Law Revision Counsel. 18 USC 1956 – Laundering of Monetary Instruments The same penalties reach transfers across borders designed to dodge reporting.
How KYC Connects to Your Taxes
The identity data you hand an exchange is also what it uses to report you to the IRS. Federal law now defines “broker” broadly enough to cover centralized crypto exchanges, requiring them to report customer transaction proceeds on Form 1099-DA the way a stock brokerage reports trades on a 1099-B.10Office of the Law Revision Counsel. 26 USC 6045 – Returns of Brokers
For 2025 and 2026 transactions, the IRS is providing transition relief: no penalties on brokers making a good-faith effort to file 1099-DA correctly, and relaxed backup withholding.11Internal Revenue Service (IRS). Digital Assets Once that window closes, crypto tax reporting will look much like brokerage reporting does today, and the KYC information on file is exactly what makes those forms possible.
Does KYC Apply to DeFi and Self-Custody Wallets?
Everything above concerns centralized exchanges, which is a company holding your funds and processing your trades. Decentralized protocols and self-custody wallets sit in a different regulatory space. Swap tokens through a decentralized exchange or hold crypto in a wallet you control, and there’s no company in the middle to run a check. The Financial Action Task Force has singled out peer-to-peer transactions through self-custody wallets as a gap for exactly that reason.12Financial Action Task Force (FATF). Targeted Report on Stablecoins and Unhosted Wallets – Peer-to-Peer Transactions
FinCEN has not finalized rules requiring DeFi protocols themselves to run KYC. Enforcement centers on the on-ramps and off-ramps: any time you convert between crypto and dollars through a centralized platform, verification kicks in. Self-custody buys you privacy on-chain, but it doesn’t buy you a way to cash out without eventually going through a platform that will ask for your ID.