KYC and AML checks: what exchanges ask and why

Know Your Customer checks are the identity verification a regulated exchange performs before letting you trade, and Anti-Money Laundering rules are the wider obligations those checks serve. They exist because financial regulators require intermediaries to know who their customers are and to report suspicious activity. For a user, this means uploading identity documents, waiting for review, and occasionally answering questions about where funds came from.

What do exchanges actually collect?

• Identity: full name, date of birth, nationality and a government-issued photo ID.
• Address: a recent utility bill, bank statement or equivalent proof of residence.
• Liveness: a selfie or short video to match your face to the document.
• Purpose: expected activity, occupation, and sometimes source of wealth.
• Ongoing signals: device, IP and transaction patterns, monitored continuously rather than once.

Tiered verification is common: a basic level unlocks small deposits and trading, and higher limits require more documentation. Corporate accounts require significantly more, including ownership structure.

Why do checks get escalated?

Automated systems compare your activity against risk models. The triggers that most often cause a manual review are ordinary in isolation: a first large deposit, a sudden change in trading pattern, logins from a new country, or receiving funds from an address associated with a sanctioned entity, a mixer or a known exploit.

The uncomfortable part for users is that the platform is often prohibited from explaining a report in detail. That is a feature of the regime rather than the platform being obstructive, and it is why documentation on your side matters.

How long does verification take?

Most applications clear automatically within minutes when documents are legible and details match exactly. Delays cluster around avoidable causes: a glare-obscured document photo, a name that differs from the ID because of a middle name or a marriage, an address document older than the platform's window, or a VPN that places you in a jurisdiction the platform does not serve.

What about privacy and data risk?

Handing identity documents to a company creates a risk that has materialised more than once: verification data has been exposed in breaches, sometimes at third-party providers rather than the exchange itself. This is a genuine cost of using regulated venues, and it is not fully avoidable if you want fiat rails.

• Prefer platforms with a track record of security and clear data-retention policies.
• Use a unique email address and strong two-factor authentication, as covered in our guide to crypto 2FA.
• Do not spread full identity documents across many small platforms for marginal benefit.
• Assume anything you upload persists after account closure, subject to retention obligations.

Are there alternatives?

Decentralised exchanges do not perform identity checks because there is no intermediary holding your funds, but they also cannot convert to bank money, and the regulatory picture for on-ramps continues to develop. Peer-to-peer trading carries counterparty risk that KYC-ed platforms absorb for you. For most people the practical answer is a verified account at a reputable venue for fiat conversion, and self-custody for holding — which is the arrangement our guide to buying Bitcoin safely describes.

If you are choosing a first platform, our best exchanges for beginners ranking compares them on verification friction alongside fees and support.

What is the travel rule, and how does it affect withdrawals?

International standards require that identifying information about the sender and recipient travels alongside transfers above certain thresholds between regulated providers — the same principle long applied to bank wires. In crypto this has shaped how withdrawals work at compliant venues.

• You may be asked who owns the destination address, and whether it is your own self-custody wallet or an account at another provider.
• Some jurisdictions require proof of control over a self-custodied address, often via a signed message or a screenshot.
• Transfers to another regulated platform may carry your name and account details to that platform.
• Thresholds and implementation vary by country, which is why the same withdrawal is frictionless at one venue and questioned at another.

None of this prevents self-custody. It does mean that withdrawing to your own wallet occasionally involves a verification step, and that having the wallet ready to prove control saves a delay when the request arrives.

It is also worth knowing what verification does not do. Passing checks at a platform says nothing about whether that platform is solvent, whether your assets are segregated, or whether the business is well run. Identity verification protects the financial system from misuse; it is not a consumer-protection guarantee, and treating a verified account as a safe one confuses two very different things.