Crypto exchange KYC is the process through which an exchange identifies its customers, verifies their identity, assesses financial-crime risk and decides which accounts, transactions and products they may use. On a regulated exchange, passing KYC is a precondition for normal use.
The requirements differ. One exchange asks for a passport and a selfie. Another also asks for proof of address, occupation, tax residence or source-of-funds evidence, depending on the country and the product.
KYC also overlaps with access restrictions. A person can live in a country where owning crypto is legal and still be unable to use a given exchange because of residence rules, sanctions controls, licensing boundaries or the exchange’s own policy. Use the restriction explorer to check a platform in a country.
What is crypto exchange KYC?
Know Your Customer (KYC) refers to the identity and customer due diligence procedures that financial businesses use to establish who their customers are and what risk they carry. For crypto exchanges it forms part of anti-money laundering and counter-terrorist financing (AML/CFT) compliance. Exchanges also use the same data for sanctions screening, fraud prevention, tax reporting and transaction monitoring.
The international baseline comes from the Financial Action Task Force (FATF), which extended its standards to virtual assets and virtual asset service providers (VASPs) through Recommendation 15. According to the FATF’s July 2026 update, 83 percent of surveyed jurisdictions have passed Travel Rule legislation, up from 73 percent in 2025, and 11 more report that implementation is under way. Each country then writes its own rules, which is why the same exchange asks different things in different places.
KYC is broader than ID verification
Identity verification is one element of KYC. An exchange can confirm that a passport belongs to a person and still need more information before it decides whether to serve them.
The EU Anti-Money Laundering Regulation shows how wide the legal list is. Article 20(1) of Regulation (EU) 2024/1624 requires obliged entities to apply all of these measures:
- Identify the customer and verify their identity
- Identify the beneficial owners of a customer that is a company
- Assess the purpose and intended nature of the business relationship
- Check whether the customer is subject to targeted financial sanctions
- Assess the customer’s occupation, or the nature of their business
- Monitor the relationship on an ongoing basis, including the source of funds where necessary
- Determine whether the customer is a politically exposed person (PEP), or a family member or close associate of one
Exchanges add their own mechanics on top, such as selfies, liveness checks and tax identification numbers.
KYC does not guarantee access
Completing verification does not open every service. An exchange can verify a customer and still limit derivatives, staking, fiat deposits or individual tokens because of where the customer lives. Kraken says so directly: depending on the country of residence, an account may not be eligible to trade on Kraken Derivatives.
For that reason, we record restrictions at the level where they apply: account, product, transfer or country. A failed ID check and an unsupported country are different problems. Our dataset holds 16 product-level rows for Coinbase, Kraken and Binance that differ from the exchange’s overall status in the same market: Kraken, for example, is recorded as limited in Canada, where its spot trading is available and its derivatives are restricted.
What information do exchanges collect?
Large centralised exchanges start with basic personal data and a government-issued ID. Depending on the country and the risk level, the process can extend further. A typical sequence looks like this:
- Personal data: name, date of birth, email, phone number and residential address.
- Identity document: passport, national identity card or driving licence, where accepted.
- Biometric check: a selfie or liveness check, where required.
- Residence check: proof of address or an automated address check.
- Financial profile: occupation, tax residence or expected activity.
- Screening: sanctions and PEP checks.
- Ongoing monitoring after onboarding.
Kraken’s verification requirements, last updated on 1 October 2026, give a concrete list. To register, a user must be at least 18 and live in a supported area. Standard verification asks for:
- Full name and date of birth
- Phone number
- Physical address
- Occupation (employed, or unemployed)
- A Social Security Number or Tax ID, for US clients
- A valid ID
- Proof of address and a face photo, subject to country rules: the page says a face photo can replace proof of address when the address is not automatically confirmed, and that other situations can also require one
Kraken lists a KYC questionnaire and sign-in two-factor authentication as additional items for the higher-limits level. Its verification overview says verification status determines the features, products and funding limits of an account.
Why exchanges ask again
KYC is not a one-time event. Records go out of date, rules change, activity can trigger a review, and new information can conflict with old details.
Coinbase says it requires identity verification at account creation and periodically for recordkeeping, and that accounts have limited functionality until verification is complete. Binance says users may be asked to re-verify “from time to time”, for example after it upgrades its compliance standards (details below).
How do KYC rules differ?
There is no single worldwide crypto KYC law. FATF sets the standard and national law decides the details.
European Union
Two EU regulations matter, and they work at different levels.
Regulation (EU) 2023/1113 covers transfers. Article 14 requires the crypto-asset service provider (CASP) of the sender to make sure a transfer is accompanied by information on the originator and the beneficiary, and to verify the accuracy of the originator information “on the basis of documents, data or information obtained from a reliable and independent source” before the transfer. The provider may not initiate or execute a transfer before it complies in full. The rules also cover transfers to and from self-hosted addresses. See the Travel Rule guide for the full mechanics, including the check on wallet ownership or control above 1,000 euros.
Regulation (EU) 2024/1624, the Anti-Money Laundering Regulation, sets the customer due diligence rules. It is not yet in application: Article 90 states that it applies from 10 July 2027. Three provisions are specific to CASPs:
- Article 19(1)(a) requires customer due diligence when a business relationship is established.
- Article 19(3)(a) requires CASPs to apply customer due diligence when carrying out an occasional transaction of at least 1,000 euros, in a single operation or through linked transactions.
- Article 19(3)(b) requires CASPs, for an occasional transaction below 1,000 euros, to apply at least the identification and verification of the customer under Article 20(1)(a).
Both rules set a 1,000 euro figure, and they mean different things. The 1,000 euro figure in the Transfer of Funds Regulation concerns the ownership of a self-hosted address. The figure in the Anti-Money Laundering Regulation concerns occasional transactions. Neither makes “KYC starts at 1,000 euros in Europe” accurate: an exchange account is opened through a business relationship, and Article 19(1)(a) requires due diligence from the start. See the Germany page for an EU member state.
Canada
Canada ties identity verification to specific transactions. FINTRAC’s guidance for money services businesses (page dated 9 September 2025) says a money services business must verify the identity of:
- every person who requests that it transfer virtual currency worth C$1,000 or more
- every person who requests that it exchange virtual currency for funds, funds for virtual currency, or one virtual currency for another, in an amount equivalent to C$1,000 or more
- every person it remits virtual currency to as the beneficiary of a transfer equivalent to C$1,000 or more
The same page sets a separate rule for large receipts. A money services business must verify the identity of every person or entity from which it receives virtual currency equivalent to C$10,000 or more. That obligation is subject to the 24-hour rule. A money services business must also take reasonable measures to verify identity for a suspicious transaction, whatever the amount.
These figures describe the legal minimum for a transaction. They do not mean a person can trade anonymously below C$1,000. An exchange can require account-level KYC under its own policy. See the Canada page.
United Kingdom
The Financial Conduct Authority (FCA) supervises UK cryptoasset businesses for AML/CFT under the Money Laundering Regulations. According to the FCA, a business must register before it starts any in-scope service in the course of business carried on in the UK. The FCA adds that registration “is a legal requirement to carry on business. It is not a recommendation or endorsement of your business.” Registration also does not give customers access to the Financial Ombudsman Service or the Financial Services Compensation Scheme.
On risk, the FCA’s registration guidance (updated 30 June 2026) asks a firm to run a business-wide risk assessment that covers customers, products and services, geography, transactions and delivery channel. A separate customer risk assessment produces a rating that drives the level of due diligence applied to each customer. The same page states that the FCA’s new regulatory regime for cryptoasset firms starts on 25 October 2027. See the United Kingdom page.
United States
US sanctions rules are not a KYC statute, but they shape what exchanges collect. OFAC’s Sanctions Compliance Guidance for the Virtual Currency Industry (15 October 2021) recommends a risk-based approach and suggests that firms obtain customer information at onboarding, during periodic reviews and when processing transactions. For individuals the guidance lists:
- legal name and date of birth
- physical and email address
- nationality
- IP addresses associated with transactions and logins
- bank information
- government identification and residency documents
It also recommends geolocation tools and IP address blocking, so that addresses in sanctioned jurisdictions cannot reach a platform for prohibited activity. Analytic tools can identify IP misattribution by screening addresses against known VPN IP addresses and by flagging improbable logins. This is why an exchange can accept an ID document and still restrict an account on location data. See our sanctions guide and the United States page.
How major exchanges apply KYC
Coinbase, Kraken and Binance all require identity verification for full account use. The details vary by country and account type, so “KYC exchange” says little on its own. The useful questions are what is collected, when more is requested and what stays restricted after verification.
Coinbase
Coinbase says it requires identity verification for legal, compliance and fraud-prevention purposes, and that an account has limited functionality until verification is complete. Its help page also tells users not to email ID photos to support and to upload documents only on Coinbase-owned domains.
The requirements vary by country. For customers living in the countries listed on its EU customer page, Coinbase says verification includes ID verification and a live selfie. The list covers EU member states plus Gibraltar, Guernsey, Liechtenstein and Norway.
Since 1 January 2026, Coinbase also asks certain customers for tax details. Its account-creation guide says this applies to non-US customers living in Andorra, Brazil, the EU/EEA, Gibraltar, Guernsey, the Isle of Man, Jersey, Monaco, San Marino, Switzerland and the United Kingdom. They must enter the countries where they pay taxes and their Tax Identification Number (TIN) or regional equivalent. EU customers without a TIN must obtain one and provide it within 60 days of creating the account.
Kraken
Kraken requires users to be at least 18 and to live in a supported area. It collects a government-issued ID and the fields listed above.
Face-photo and proof-of-address rules vary by country. Kraken’s ID confirmation photo page says South African and US residents will be required to submit a face photo. The face photo instructions explain that the check may be required depending on country of residence or the products used, and that the photo must be captured in real time by the device camera: it cannot be uploaded from a camera roll. Kraken sends the photos to its verification partner, Persona.
Kraken’s verification overview says a verified account can buy and sell crypto, deposit cash and crypto, trade on margin and use the OTC desk, and that the higher-limits level raises deposit and withdrawal limits and API limits. Staking, rewards, margin and derivatives remain subject to eligibility criteria, including geographic restrictions. Our dataset records Kraken as limited in the United States, Canada and the United Kingdom, where derivatives are limited or restricted, and as available in Germany.
Binance
Binance states on its personal account verification page (updated 5 June 2026) that all new users must complete Verified status to access its products and services, including deposits and trades. The flow asks for the country of residence, the document issuing country and document type, photos of the front and back of the ID, a liveness check and personal information that matches the ID.
The same page says existing users who have not completed verification have their permissions changed to Withdraw Only, which limits services to fund withdrawal, order cancellation, closing positions and redemption.
For the EEA, Binance’s verification guide (updated 12 March 2026) adds a residential address step and compliance questions, and its re-verification page (updated 13 March 2026) says existing EEA users were asked to verify again after Binance upgraded its compliance standards to align with the latest EU Anti-Money Laundering Directives. The page lists the triggers: verification done before the new standards, no proof of address or enhanced due diligence questionnaire on file, the old ID verification vendor, or a verification that falls short of the new standards. Users who miss the deadline are restricted to Withdrawal Only.
Both EEA pages date from before the 1 July 2026 MiCA deadline. Our dataset records Binance as limited in 29 of the 30 EEA countries since that date, including Germany and France: new sign-ups, deposits and trading are closed, while existing users can still withdraw. The Netherlands is the exception, recorded as restricted since Binance left the Dutch market in July 2023. The EEA pages therefore describe the verification process, not whether Binance is open to new users in a given country.
Why do KYC checks fail?
A rejected check does not mean the user broke a law. Verification can fail for technical, documentary, geographic, compliance or risk reasons. Some failures can be fixed with clearer or updated documents. Others, such as an unsupported country, cannot. Common causes are:
- The name on the account differs from the name on the ID
- The ID is expired, unsupported or not fully visible
- A blurred or cropped photo
- The address cannot be confirmed
- Proof of address is too old
- The country of residence is unsupported
- Tax or residence details conflict with earlier account data
- A selfie or liveness check cannot be matched
- A sanctions or PEP screening hit
- Account activity that triggers a review
- Network location that conflicts with the declared residence
Proof of address has age limits. Kraken’s document requirements (updated 28 October 2026) say the document must contain the user’s name and address, be dated less than three months before submission, and not be a P.O. box address. Accepted examples include bank and credit card statements, landline and internet bills, tax documents, residence certificates and signed rental agreements, while mobile phone bills are not accepted. Coinbase’s document table likewise lists proof-of-address documents issued within the last 3 months, and shows none available for some countries.
Technical failure versus eligibility failure
A technical failure happens because an image is unreadable or the data does not match. The user can often fix it. An eligibility restriction happens because the platform does not serve the user’s location, customer type or requested product. Passing a face match does not override it.
When a platform looks unavailable, check which of the two applies before assuming the verification was the problem.
How does the Travel Rule affect KYC?
The Travel Rule requires regulated providers to collect, keep and in many cases pass on information about the parties to certain crypto transfers. It links account-level KYC to deposits and withdrawals: the information collected at onboarding is what a provider uses to meet transfer-level obligations. Implementation and enforcement remain uneven across countries. The Travel Rule guide covers the thresholds, the EU rules and the self-hosted wallet checks in detail.
For users the effect is practical. An exchange can ask whether a destination wallet belongs to the user, who operates a destination exchange, or for another verification step, even when account KYC is complete.
How does KYC restrict access?
Identity verification is one layer of access control. Six questions separate the layers:
- Jurisdiction: does the platform serve residents of the country?
- Identity: can the user complete the required KYC?
- Sanctions: is the user or the location subject to sanctions controls?
- Product: is the requested service permitted for that customer and residence?
- Transaction: does a deposit or withdrawal need additional information?
- Risk review: has the exchange applied enhanced due diligence or an account-specific restriction?
A pass at one layer does not resolve the others. Kraken’s own pages show the point: verification status determines what an account can do, while derivatives stay subject to geographic eligibility. Binance’s EEA guide says the verification level a user needs can depend on region and payment channel.
Residence is different from nationality
Platforms usually key eligibility on residence. Coinbase’s identity document tables are organised by signup country, and Kraken eligibility depends on the supported area where the user lives. Nationality still matters for other checks: the OFAC guidance lists nationality among the data a firm may collect for sanctions screening. A user should check a platform’s rules for the country where they live, not only the country of citizenship.
Exchange policy can be stricter than the law
“Crypto is legal in this country” and “this exchange serves residents of this country” are different questions. Our dataset shows the gap: Coinbase is recorded as available in Canada and Kraken as limited, with its derivatives restricted, while Binance is recorded as restricted there because Canada appears on Binance’s list of prohibited countries. Each row in the dataset carries its own source, date and confidence level. Our methodology explains how. Across the 195 countries we cover, Coinbase is recorded as restricted in 4, Kraken in 13 and Binance in 10. Binance is limited in a further 34, most of them EEA countries where it has no MiCA authorization.
What are the privacy tradeoffs?
KYC means a centralised exchange holds sensitive data: government ID, address records, financial information and, where a selfie or liveness check is used, biometric data. The compliance reasons are clear. Exchanges need the data to verify customers, assess risk, screen for sanctions and meet reporting duties.
The cost is also real. Holding identity and financial data in one place creates data-security considerations that do not arise when a person uses a self-custodied wallet directly. A self-hosted wallet is not a safer or riskier choice in the abstract: the risks differ.
Users can reduce exposure in practical ways. Check which legal entity operates the account, which jurisdiction governs it and what data it collects. Submit documents only through the platform’s own verification flow: Coinbase says it will not ask for identity documents on non-Coinbase domains and that documents sent by email are not accepted.
Common questions about crypto KYC
Can you use an exchange without KYC?
Some services allow limited activity without full verification, but the exchanges in this guide do not offer normal use without it. Coinbase limits an account until verification is complete. Binance requires Verified status from new users. Kraken’s verification overview describes a verified account as the one that can access all essential functions. Whether a service can lawfully run without KYC depends on its jurisdiction, business model and the type of transaction.
Does KYC mean crypto is regulated?
No. KYC shows that an exchange is subject to, or has adopted, identity and compliance controls. It does not show that every product the exchange offers is licensed in the user’s country. The FCA states that registration under the UK Money Laundering Regulations is not an endorsement of the business. Check the legal status of the specific entity and product.
Can an exchange ask for KYC again?
Yes. Re-verification can follow expired documents, changed customer details, updated compliance standards, account activity that triggers a review, or a need for further evidence. Coinbase says verification can recur periodically, and Binance has asked existing EEA users to verify again after changing its standards.
Does a VPN change KYC restrictions?
No. A VPN changes the apparent network location. It does not change legal residence, citizenship, identity documents, sanctions status, tax residence or an exchange’s eligibility rules. It can also make things worse. OFAC’s guidance treats an attempt to access an exchange from an IP address or VPN connected to a sanctioned jurisdiction as a risk indicator, and recommends screening IP addresses against known VPN addresses and flagging improbable logins. A mismatch between declared residence and network location can therefore trigger a review.
Is a self-hosted wallet exempt from KYC?
A self-hosted wallet does not itself identify its owner. A transfer between such a wallet and a regulated exchange can still trigger information or ownership checks. In the EU, Regulation (EU) 2023/1113 applies transfer-information requirements when a CASP is involved, including transfers to or from self-hosted addresses, with an ownership or control assessment above 1,000 euros.
How should KYC be classified in restriction data?
KYC requirements and access restrictions are separate facts. In our dataset a restriction is recorded by what actually applies: residence, licensing, product, sanctions exposure, transfer type or platform policy. A failed verification is not a country-level restriction, and a completed verification is not proof of availability.
Related guides: crypto sanctions, MiCA regulation, stablecoin regulation and Binance alternatives.
