Know-your-customer checks are one part of the controls that many crypto exchanges use to comply with anti-money-laundering, counter-terrorist-financing, sanctions, fraud-prevention, and licensing obligations. The exact information requested depends on the country, product, customer type, transaction pattern, and risk assessment.

KYC and AML are related but not identical. KYC focuses on identifying and understanding the customer. AML is broader: it can include risk assessment, transaction monitoring, sanctions screening, recordkeeping, staff controls, regulatory reporting, and reviews of unusual activity. This article is general education, not legal advice.

Why exchanges verify customers

International standards from the Financial Action Task Force treat covered virtual asset service providers as entities that should apply risk-based AML and counter-terrorist-financing measures. Countries implement those standards through domestic law. In the United States, certain crypto business models can be money services businesses subject to Bank Secrecy Act obligations administered by FinCEN. In the UK, in-scope cryptoasset businesses must register with the FCA for AML and CTF supervision. EU rules likewise establish obligations for covered providers and transfers.

An exchange may also conduct checks to meet sanctions obligations, prevent account takeover, investigate fraud, comply with court orders, or satisfy banking and payment-partner requirements. A request does not necessarily mean the customer is accused of wrongdoing; many checks are routine or triggered by risk thresholds.

Information commonly requested from individuals

At account opening, a provider may ask for a legal name, date of birth, residential address, nationality, tax residency, telephone number, and email. Verification can involve a passport, national identity card, driving licence, residence document, or recent proof of address. Some firms use a selfie, short video, or liveness test to compare the applicant with the identity document.

Additional questions may cover occupation, employer, expected account activity, purpose of the relationship, source of funds, and source of wealth. “Source of funds” normally concerns the origin of money or crypto used in a particular transaction or account. “Source of wealth” concerns how the person accumulated overall wealth. Requirements and acceptable evidence vary.

Checks for companies and other legal entities

Business customers can expect broader documentation. An exchange may request formation records, registered address, tax number, operating licences, ownership chart, directors, authorised users, and the nature of the business. It may identify beneficial owners—the individuals who ultimately own or control the entity—and verify persons acting on its behalf.

Trusts, partnerships, funds, charities, and other structures can require documents tailored to their legal form. Providers may ask for governing documents, trustee or partner information, investor details, and evidence explaining complex ownership. Periodic updates are common when ownership or management changes.

Enhanced due diligence

Risk-based systems do not treat every customer or transaction identically. Enhanced due diligence may be applied where risk is higher—for example, because of geographic exposure, political prominence, unusual transaction patterns, high values, complex ownership, sanctions concerns, or links to higher-risk services.

An exchange may request bank statements, payslips, sale agreements, inheritance records, company accounts, tax documents, transaction hashes, wallet addresses, or an explanation of how assets were obtained. It may ask about the purpose and destination of a transfer. The relevant law and the exchange’s risk policy determine whether service continues while a review is open.

Transaction monitoring and blockchain analysis

AML controls usually continue after onboarding. Exchanges can monitor deposit, trading, and withdrawal activity for patterns that differ from the stated purpose of the account or match known risk indicators. Blockchain analytics can associate addresses with services or events, but attribution can be incomplete or wrong. Responsible reviews should consider context rather than treating an automated score as conclusive.

A provider may pause a transfer, restrict an account, or request evidence when a transaction triggers a rule. It may be legally restricted from explaining whether a suspicious-activity report was filed. Customers should use the official complaints process if they believe a restriction is mistaken, while preserving records of deposits, trades, communications, and ownership of external wallets.

The Travel Rule

FATF standards call for covered providers to obtain, hold, and transmit specified originator and beneficiary information with qualifying virtual-asset transfers. Domestic implementations are often called the Travel Rule. Thresholds, data fields, timing, and treatment of self-hosted wallets differ across jurisdictions.

As a result, an exchange may ask who owns the receiving wallet, which provider hosts it, or what the transfer is for. Transfers between two regulated providers can involve information exchange separate from the public blockchain transaction. A blockchain address alone may not satisfy the provider’s legal obligations.

Self-hosted wallets

Using a wallet controlled by its owner does not automatically make a transfer unlawful. However, a regulated exchange may need to assess the transfer and can ask the customer to confirm control, identify a beneficiary, or provide supporting information. Some providers use a signed message or a small verification transaction where technically appropriate; others use documentary or risk-based checks.

Customers should be cautious if anyone asks them to reveal a seed phrase or private key. Legitimate identity or wallet-control verification should not require surrendering credentials that allow assets to be spent. A seed phrase should never be entered into a link sent by purported support staff.

Privacy and data security

KYC creates a concentration of sensitive data. Before uploading documents, confirm the website or app is genuine, review the privacy notice, and understand which entity processes the information, why it is collected, how long it is retained, and with whom it may be shared. Applicable data-protection law can provide access, correction, or complaint rights, but AML recordkeeping duties may limit deletion requests.

Use strong unique credentials and phishing-resistant multi-factor authentication where available. Do not send identity documents through unofficial messaging accounts. If support requests new information, open the exchange independently rather than following an unsolicited link.

What customers should prepare

  • Current identity and address documents that match account information.
  • A clear explanation of expected account use and transaction purpose.
  • Records tracing funds from a bank, employer, sale, business, or prior wallet.
  • Transaction hashes and wallet records showing relevant transfers.
  • Corporate and beneficial-ownership documents for business accounts.
  • Copies of submissions and support correspondence, stored securely.

Important limits

Passing KYC does not make a customer’s transactions risk-free, and an exchange’s AML registration does not guarantee solvency, cybersecurity, or fair pricing. Identity checks can deter some misuse but cannot prevent every scam or account takeover. Conversely, a request for information is not proof that an exchange is legitimate: fraudulent platforms also collect identity documents.

Verify the provider through an official regulatory register, assess custody and withdrawal terms, and disclose only through authenticated channels. Where a request appears excessive or a restriction has serious consequences, use the formal complaint route and seek advice qualified for the relevant jurisdiction.

Related reading on CoinToday

Sources