What is KYC in crypto? What you hand over, why, and who keeps it after you leave.

01What KYC means, in the rules themselves

KYC stands for know your customer. Most guides stop at "it's an ID check". The rules say more.

The FATF, the global body that sets anti-money-laundering standards, calls it customer due diligence and breaks it into four measures:

1. Identify and verify you, using reliable, independent documents or data.
2. Identify the real owner when you act for a company or someone else.
3. Understand why you're here: the purpose of the relationship.
4. Keep watching: ongoing checks for as long as you're a customer.

That last one matters. KYC isn't a one-time upload. It's a file that stays open, and grows, for as long as you use the exchange.

02Why every regulated exchange must do it

It isn't the exchange's idea. It's a chain that starts far above it.

The FATF standard bans anonymous accounts, and if a firm can't complete its checks, it must not open the account at all. Since 2019, crypto firms carry the same duties as other financial institutions.

Countries then write it into law. In the US, exchanges are money services businesses, and FinCEN's guidance makes verifying customer identification part of their required program. In the EU, the Anti-Money Laundering Regulation spells out the checks in Article 20.

Here's the key point: the duty sits on the exchange, not on you. Our main guide on buying crypto without KYC explains what that means for your options.

03What exchanges ask for: the law versus the app

Here's where most guides blur two different things: what the rules list, and what apps add on top.

US banks have a fixed list: name, date of birth, address and an ID number, enough to form "a reasonable belief" they know who you are.

US crypto exchanges are different. As money services businesses, they run a risk-based program with no fixed list of documents. Each firm decides what it checks.

In the EU, the list is in the law: all your names, place and date of birth, nationality, ID number and where you live, verified with an ID document or a high-assurance electronic ID.

Selfies, video checks and proof-of-address uploads are the method a firm picks to verify you, not a separate legal requirement you can point to.

04KYC levels: the firm's design on top of fixed lines

Most exchanges sell KYC as "levels": level 1, level 2, level 3, each unlocking higher limits. Those levels are the exchange's own design. What sits underneath them is fixed:

• USD/EUR 1,000: the FATF line for checks on one-off crypto transactions.
• $3,000: US firms keep records on transfers of this size and send sender details along with them.
• Over $10,000 in cash: a currency transaction report.

And when something looks wrong, a US firm files a suspicious activity report on transactions from $2,000. You're not told.

05KYC vs AML: one room in a bigger house

People use the two words as if they mean the same thing. They don't.

AML, anti-money-laundering, is the whole program a firm must run. FinCEN lists verifying customer identification as one part of it. The rest: watching transactions, reporting what looks wrong, keeping records, and training staff.

So when an exchange freezes a withdrawal and asks where your money came from, that's not "KYC failing". That's the monitoring part of AML doing its job.

06How long they keep your data, and why deleting your account doesn't delete it

This is the part almost nobody tells you.

• US: records required by the anti-money-laundering rules are kept for five years.
• EU: five years from the end of the relationship, or from a refused application. After that, firms must delete the personal data, unless authorities extend the period by up to five more years.

Can you ask for deletion sooner? EU data law gives you a right to erasure, but it gives way to a legal obligation. While the retention period runs, the law wins.

07Is KYC safe? What a leaked file actually holds

Your KYC file is only as safe as the company holding it. Here's what one real file held when it leaked.

In May 2025, Coinbase told the SEC that an attacker got customer data "by paying multiple contractors or employees" in support roles outside the US. Here's what its filing lists as taken:

"Government-ID images (e.g., driver's license, passport)"Coinbase Global, Form 8-K, May 2025

It estimated the cost at about $180 million to $400 million. Notice what made the file valuable: your name and home address, next to the fact that you own crypto.

Every exchange you've passed KYC with holds a copy like that, for at least five years.

08What would an exchange have to ask you?

The rules depend on where the exchange is, what you're doing and how much. Try it:

The EU has also applied the travel rule to crypto since 30 December 2024, for transfers of any size: your name goes along with every withdrawal between firms.

09When you don't need KYC at all

KYC binds firms, not people. It doesn't follow you into your own wallet:

• Holding coins in your own wallet. No one to verify you.
• Sending coins from your own wallet. FinCEN says people using crypto on their own behalf aren't money transmitters. More on whether buying without KYC is legal.

Where KYC bites hardest is the first coin, the moment cash or a bank becomes crypto. Our guides on every route to a first coin and Bitcoin ATMs without ID cover that door.