Know Your Customer (KYC)
Last Updated: October 30, 2026
Quick Answer: KYC (Know Your Customer) is the process a regulated financial business, including a crypto exchange, uses to confirm a customer’s identity and assess the money laundering risk that customer poses before and during the business relationship. In crypto, KYC usually means submitting a government ID, proof of address and sometimes a selfie or source of funds information before you can deposit, trade or withdraw.
Key Takeaways
- KYC is part of the anti money laundering (AML) standards that the Financial Action Task Force (FATF) sets, including for virtual asset service providers (VASPs)
- According to the FATF’s July 16, 2026 update, 83% of surveyed jurisdictions have passed laws implementing the crypto Travel Rule, up from 73% in 2025
- In the EU, the Anti Money Laundering Regulation applies from July 10, 2027 and requires crypto firms to run due diligence on occasional transactions of EUR 1,000 or more
- Weak KYC is expensive: on February 24, 2025, according to the US Justice Department, OKX pleaded guilty to one count of operating an unlicensed money transmitting business and agreed to pay penalties of more than $504 million
- KYC protects the platform and the financial system; it does not guarantee that a platform is safe or solvent
How KYC Works
KYC is usually described in three layers, which come from banking rules and now apply to most centralized crypto platforms:
| Layer | What happens | Typical crypto example |
|---|---|---|
| Customer identification | The platform collects and verifies name, date of birth, address and an ID number | Uploading a passport and a selfie when you open an account |
| Customer due diligence (CDD) | The platform assesses risk, the purpose of the account and, for companies, the beneficial owners | Questions about employment, expected volume and source of funds |
| Enhanced due diligence (EDD) | Extra checks for higher risk customers, such as politically exposed persons or high risk countries | Bank statements, proof of source of wealth, manual review |
KYC does not stop at sign up: platforms keep monitoring transactions, screen sanctions lists and report suspicious activity where the law requires. When you send crypto to another platform, the Travel Rule also requires the sending provider to pass on information about the sender and the recipient, much like a bank wire.
The global baseline comes from the FATF, whose Recommendation 10 covers customer due diligence and Recommendation 15 extends AML duties to VASPs. National regulators turn these standards into law:
- United States: FinCEN guidance FIN-2019-G001, issued May 9, 2019, adds no new requirements but consolidates FinCEN rules and rulings since 2011. It says persons who accept and transmit convertible virtual currency are money transmitters that must register with FinCEN as money services businesses and meet AML program, recordkeeping, monitoring and reporting duties, including foreign firms doing business wholly or substantially in the United States.
- European Union: The AML Regulation (Regulation (EU) 2024/1624) applies from July 10, 2027 and requires crypto asset service providers to run customer due diligence on occasional transactions of at least EUR 1,000, according to the European Parliament’s summary.
Examples of KYC in Crypto (2026)
Travel Rule adoption keeps rising. In its July 16, 2026 targeted update on virtual assets, the FATF said 83% of surveyed jurisdictions had passed Travel Rule legislation, up from 73% in 2025, with a further 11 reporting implementation under way. It also said most identified on chain illicit activity now involves stablecoins, and listed stablecoins, offshore VASPs, unhosted wallets and DeFi arrangements among risks still to address.
Enforcement against weak KYC. On February 24, 2025, the US Attorney’s Office for the Southern District of New York announced that OKX had pleaded guilty to one count of operating an unlicensed money transmitting business and agreed to pay more than $504 million: a $420.3 million forfeiture and a criminal fine of approximately $84.4 million. According to the Justice Department, from about 2017 through about November 2022 OKX gave retail customers the option to open an account, transfer funds and trade “without completing a KYC process.” The Acting US Attorney said that, as a result, OKX “was used to facilitate over five billion dollars’ worth of suspicious transactions and criminal proceeds.”
Are There Exchanges Without KYC?
Regulated exchanges cannot open accounts without identity checks. FATF standards require virtual asset service providers to carry out customer due diligence, FinCEN treats exchanges serving US customers as money transmitters with anti money laundering duties, and in the EU crypto asset service providers need authorization under MiCA, whose longest transition period for existing firms ended on July 1, 2026, according to ESMA. Platforms that advertise trading without KYC are therefore usually operating without a license in the markets they serve.
That carries risks for users:
- Legal exposure. Using an unlicensed service may breach local rules, and funds can be frozen if authorities act against the platform.
- Enforcement history. On November 21, 2023, the US Justice Department said Binance had agreed to pay over $4 billion after pleading guilty to charges including failure to register as a money transmitting business, and that it let users who had not provided KYC keep trading until May 2022.
- Fraud and no recourse. Anonymous platforms offer little protection if withdrawals stop or the site disappears.
Risks and Common Misconceptions
- “KYC means the exchange is safe.” KYC is a compliance duty, not a guarantee of solvency or security. Check licensing, proof of reserves and how the platform stores assets.
- “No KYC exchanges are a legal shortcut.” Platforms that skip KYC while serving regulated markets may lack the required license, and users can lose access to funds if regulators act.
- Data exposure. KYC creates large stores of identity documents. Upload documents only through the official app or website, never by chat or email.
- Fake KYC requests. Scammers pose as exchange support and ask you to “verify” your account. A real platform never needs your password, 2FA codes or wallet recovery phrase for KYC.
Related Terms
- Customer Due Diligence (CDD)
- Politically Exposed Person (PEP)
- Centralized Exchange (CEX)
- Initial Coin Offering (ICO)
- The Crypto Travel Rule
- Best Crypto Exchanges
Frequently Asked Questions
What does KYC mean in crypto?
KYC stands for Know Your Customer. In crypto it is the identity check that exchanges, brokers and other regulated service providers run before letting you deposit, trade or withdraw. You usually provide a government ID, proof of address and a selfie. The platform also assesses your risk and keeps monitoring your account activity under anti money laundering rules.
Why do crypto exchanges require KYC?
Exchanges require KYC because anti money laundering laws in most countries treat them as financial institutions. The FATF standards ask countries to make virtual asset service providers verify customers, monitor transactions and share sender and recipient data on transfers. Skipping these checks can lead to license loss, large fines and criminal charges, as recent enforcement cases against major exchanges show.
How long does KYC verification take?
Automated checks on major exchanges often finish within minutes when the documents are clear and the details match. Manual review can take from several hours to a few days, especially for higher account tiers, business accounts or customers from higher risk countries. Blurry photos, expired documents and name mismatches are the most common reasons for delays or rejection.
Is it safe to give my ID to a crypto exchange?
It is generally safe with a licensed, established platform that protects personal data under privacy laws, but no database is risk free. Upload documents only through the official app or website, enable two factor authentication and be wary of any message asking you to resend documents. Real platforms never ask for your password or wallet recovery phrase.
Can I buy crypto without KYC?
Some decentralized exchanges and peer to peer methods do not run KYC themselves, and small amounts may be possible in some places. However, most ways to convert between crypto and bank money require verification, and unlicensed no KYC services carry legal and counterparty risks. Rules differ by country, so check what applies where you live before using such services.
Data sources: FATF (Targeted Update on Virtual Assets and VASPs, July 16, 2026), European Parliament Legislative Observatory (Regulation (EU) 2024/1624), FinCEN (FIN-2019-G001, May 9, 2019), US Department of Justice, SDNY (OKX plea, February 24, 2025), US Department of Justice (Binance plea, November 21, 2023), ESMA (MiCA transitional period).