Know Your Customer

Verification exists because banking law treats an exchange as a financial institution, not because the exchange is curious about you. 21 of the 24 exchanges reviewed on this site require identity documents before your first purchase. The practical consequence is that a photograph of your passport now sits in a database you do not control, which is a security question as much as a privacy one.

How it works

Customer verification runs in three stages, and only the first one is visible to you.

Onboarding collects the evidence. A government photo identity document, a live selfie or short video to prove the document belongs to the person holding it, a date of birth, a residential address, and usually a tax residence. Most platforms do not do this themselves: specialist vendors run the document forensics and face matching in seconds, and a human reviews only the exceptions.

Risk rating happens immediately afterwards and silently. The platform scores you on country, expected volume, source of funds, and whether you appear on a sanctions or politically exposed person list. That score decides your limits, how often you are re-checked, and how quickly a future withdrawal gets held for review. Paxful is a clear example of the tiering that results, where verification level gates how much you can trade.

Ongoing monitoring never stops. Higher tiers ask for proof of income, a bank statement, or an explanation of where a large deposit came from. Re-verification is triggered by an expired document, a change of address, or simply time passing.

Then there is retention, which people rarely think about. European anti-money-laundering law requires records to be kept for five years after a business relationship ends, so closing your account does not remove your file. The documents outlive the relationship by design.

Why this matters when you buy bitcoin

Verification is not the price of privacy alone. It creates an asset with your name on it, held by a company whose security is not your decision.

The clearest illustration is Coinbase. Criminals paid overseas support contractors to copy customer records from tools they were allowed to use, running from around December 26, 2024 until an extortion email demanding 20 million dollars arrived on May 11, 2025. Coinbase refused to pay, disclosed the breach in a filing on May 14, 2025, and estimated the cost at 180 million to 400 million dollars. The stolen data covered fewer than one percent of monthly transacting users and included names, addresses, phone numbers, masked account identifiers, balance snapshots, and images of government identity documents.

That combination, a real name plus a real address plus a real balance, is what makes exchange data uniquely dangerous. It powers phishing calls that quote your correct holdings, and in a small number of cases it has preceded physical robbery of people known to hold bitcoin.

Four habits reduce the exposure without breaking any rules. Use a dedicated email address for each exchange, so a leak is traceable and does not unlock anything else. Turn on a hardware security key rather than SMS codes. Set a withdrawal whitelist, so a stolen session cannot send coins to a new address. And keep the coins off the platform entirely, because a breach of an account holding no balance is an inconvenience rather than a loss.

Be selective about who receives your documents. Changelly was added to the UK Financial Conduct Authority warning list in July 2024, and uploading a passport to a venue with that record is a worse decision than uploading it to a licensed one. Requirements also differ across the 231 country guides here: Yellow Card and Luno ask for different documents in different markets, several countries require a local tax number, and in a few the licensed venues cannot verify residents at all.

Finally, the direction of travel is one way. The European anti-money-laundering regulation bans anonymous crypto accounts at licensed providers when it applies from July 10, 2027, and licensing regimes elsewhere are converging on the same rule.

What a verified account actually asks for

Verification is more predictable than the anxiety around it suggests, and knowing the order helps.

You create the account with an email and a password, then enable two-factor authentication before anything else. You photograph an identity document, both sides, flat and without glare, and record a short liveness check. You supply an address, and if the platform wants proof it must usually be a bank or utility statement dated within the last three months. You answer a short questionnaire on employment, source of funds and expected monthly volume, and answering it honestly costs nothing while a nonsense answer creates a mismatch that surfaces later.

Approval takes minutes on a good day and several days when a document is unusual or a name transliterates differently from the account. Rejections are ordinary and mostly mechanical: an expired document, an address that does not match, or a nationality the platform does not serve.

The checks return later, too. A first large deposit, a transfer funded by someone else's bank account, or an incoming payment that analytics software associates with a risky source will each trigger a fresh request, and the account is usually restricted while it is open.

Know Your Customer vs Anti-Money Laundering

Know Your Customer is one component of a much larger obligation. The anti-money-laundering regime tells a firm to assess its risks, monitor transactions continuously, report suspicion to a financial intelligence unit, screen against sanctions, keep records, train staff, and submit to audit. Customer verification is simply the piece of that machine you can see, the part that touches you at signup. A platform can verify every customer perfectly and still fail its anti-money-laundering duties, which is what most enforcement actions against exchanges actually allege.

Know Your Customer vs sanctions screening

Verification establishes who you are; sanctions screening checks that identity against lists of people and places that a firm is forbidden to serve, such as the US Treasury's specially designated nationals list or the EU consolidated list. The two happen within the same minute at signup, but they answer different questions and carry different consequences. A verification failure means the platform cannot confirm you and asks for better documents. A sanctions match means the platform is legally prohibited from proceeding, and false positives on common names are resolved by a compliance team rather than by uploading another photograph.