What is KYC in crypto? Rules, process and data

Which topics should we dive deeper into?

Select what genuinely interests you. Your picks feed directly into our editorial planning.

Crypto news that's actually worth your time.

Weekly. 60 seconds. Carefully curated by our editors: no hype, no promo flood, no spam.

KYC stands for “Know Your Customer” and describes the identity check every licensed crypto exchange carries out before your first purchase. You provide your name, date of birth, place of birth, nationality and residential address, and the exchange matches these details against an official ID document. In Germany, no provider may open an account for you without this check, not even if you only want to swap 20 euros into Bitcoin.

The obligation comes from the German Anti-Money Laundering Act (Geldwäschegesetz, GwG). Since the European crypto regulation MiCA took effect, the act explicitly names crypto-asset service providers as obliged entities, putting them on a par with banks, payment institutions and investment firms. In practice, the ID check is neither the exchange’s business model nor harassment; it is a legal requirement. If you are looking for a properly licensed exchange, the comparison of regulated crypto exchanges lists providers with a licence, and every one of them requires KYC.

This guide explains which data you hand over, which verification methods exist, what is checked after your account is opened and what will still change by July 2027. If you are just starting out, the overview What is a cryptocurrency? is a good place to begin.

KYC explained: Know Your Customer under anti-money laundering law

KYC is the umbrella term for all the steps a financial company takes to establish who its customer is and whether the business relationship fits that person. In German law these steps are called “general due diligence obligations” and are set out in Section 10 of the act. They cover four core tasks:

Identification: The exchange collects your personal details and verifies them against a document.
Beneficial owner: The exchange establishes whether you are acting for yourself or for someone else. The beneficial owner is the person to whom the money ultimately belongs.
Purpose of the business relationship: You state what you intend to use the account for, for example a savings plan or occasional purchases.
PEP check: The exchange checks whether you are a politically exposed person. The term covers people holding a prominent public office, along with their family members and close associates.

On top of this comes ongoing monitoring. KYC therefore does not end with a photo of your ID. The check accompanies your account for as long as it exists. Section 10(9) draws a clear line: if the exchange cannot meet these obligations, it may not enter into the business relationship, or it must end it.

Five mandatory KYC details under Section 11 and which IDs are accepted

Exactly which data the exchange must collect is laid down in Section 11(4) of the Anti-Money Laundering Act. For a natural person there are five details:

First name and last name
Place of birth
Date of birth
Nationality
Residential address

Under Section 12, the exchange verifies these details against a valid official photo ID, which in practice means your national identity card or passport. A driving licence is not enough, because it does not satisfy the domestic ID requirement. Under Section 8, the exchange also records which document it is, its number and the authority that issued it. It makes a copy of the ID you present or captures it digitally; the law expressly gives it both the right and the duty to do so.

Many exchanges ask for more than these five points: phone number, email address, occupation, the amount you plan to invest or the source of your money. Some of this serves the risk assessment, some of it communication with you. Strictly speaking, only the five details and the check against the document are mandatory.

Video ident, online ID and signature: the methods of KYC verification

The law allows several ways to verify your identity. Each exchange decides for itself which of them it offers. The three most common at a glance:

Video identification

With video ident, you hold your ID up to the camera of your smartphone or laptop, tilt it on request so that the security features become visible, and show your face so it can be compared with the photo. The minimum requirements for this method were set by the German financial regulator BaFin in its Circular 3/2017 (GW) on video identification. Many providers work with specialised service companies for this, whose names you will see during the process.

Online ID function (eID)

The electronic proof of identity under Section 18 of the German Identity Card Act reads the data directly from the chip in your identity card. You need an NFC-enabled smartphone and your six-digit PIN. The advantage: there is no video call, and because the data comes straight from the chip, typing errors are ruled out.

Qualified electronic signature

Less common is verification via a qualified electronic signature under the European eIDAS regulation. In this case, the first transaction must also come from a payment account in your name. That is why some providers ask for a first transfer from your own current account.

KYC and AML: where the identity check ends and the money laundering check begins

The terms KYC and AML are often confused. AML stands for “Anti-Money Laundering”, the fight against money laundering. AML is the goal, and KYC is one of the tools for reaching it. The identity check answers the question of who you are. The money laundering check answers the question of whether your transactions match what the exchange knows about you.

That is why the exchange keeps watching after your account is opened. Section 10 requires continuous monitoring of the business relationship, including its transactions. If you buy 50 euros’ worth every month for years and suddenly deposit 80,000 euros, that stands out. It does not mean anything is wrong; it simply means the exchange has to ask.

Source of funds and PEP status: when the exchange asks for more proof

If the exchange identifies a higher risk, the enhanced due diligence obligations under Section 15 apply. Typical triggers are large deposits, PEP status or transfers from countries with an elevated money laundering risk. The exchange then asks where the money comes from, known in the trade as “source of funds”. This is proof of where the specific money you are depositing originated.

Depending on the case, suitable evidence includes payslips, a sales contract for a property you sold, a certificate of inheritance or account statements from another provider where you sold crypto assets. Have such documents ready before you move larger sums. An exchange that freezes a deposit until the matter is cleared up is acting in line with the law, not arbitrarily.

Travel Rule since December 2024: KYC data travels with every crypto transfer

Since December 30, 2024, Regulation (EU) 2023/1113 on information accompanying transfers of funds and certain crypto-assets, known as the TFR or Travel Rule, has applied in the EU. The regulation carries a rule from traditional payments over to crypto assets: anyone sending coins from one exchange to another passes along details of the sender and the recipient. These include the name, the wallet address or account number and, depending on the case, the address or date of birth.

Unlike bank transfers, transfers between two crypto service providers have no minimum amount. The details therefore travel even with a transfer of 30 euros. That is why your exchange often asks, before a withdrawal to another platform, who the recipient is and with which provider they hold their account. If the details do not match, the receiving exchange can hold back the incoming funds until the data has been supplied.

Own wallet and the 1,000-euro threshold: proof for self-hosted addresses

A self-hosted address is a wallet whose private keys you keep yourself, for example on a hardware wallet or in a wallet app without an exchange account behind it. Transfers to such addresses follow their own rules. Under Article 14 of the regulation, when a transfer to a self-hosted address exceeds 1,000 euros, the exchange must take appropriate measures to establish whether the address belongs to you or is under your control.

How the exchange checks this is up to the exchange. Common methods are a confirmation in the app, a message signed with the private key, or proof taken directly from the wallet software. The practical point: do not leave your first large withdrawal to your hardware wallet until the last minute, because the check can take some time. Self-custody itself remains permitted; the rule only requires the proof.

Tax ID and DAC8: what exchanges have reported to the Federal Central Tax Office since 2026

Since this year, KYC has included one more detail that has nothing to do with money laundering. On January 1, 2026, Germany’s Crypto-Asset Tax Transparency Act (KStTG) came into force. It implements the European directive DAC8, the eighth version of the directive on administrative cooperation between tax authorities. Under it, crypto service providers report their customers’ transactions to the Federal Central Tax Office. The first reporting period is calendar year 2026, and according to an overview by the audit firm KPMG, the report is due by July 31, 2027.

So that the report can be matched to your tax account, exchanges ask for your tax identification number. If you opened your account before 2026, the exchange has to obtain this detail retrospectively. The basic rules for your tax return do not change: under current law, gains from private disposals of crypto assets within one year of purchase are taxable, and tax-free once this holding period has passed. What is new is that the tax office will be able to compare the exchange’s data with your own figures.

Data protection in KYC: five years of retention and the risk of data leaks

Many readers ask what happens to the ID copy and the video recording after the check. The answer is in Section 8(4) of the Anti-Money Laundering Act: the exchange must keep the records for five years. The period starts at the end of the calendar year in which the business relationship ends. If you close your account in June 2027, your data will therefore be stored until the end of 2032. It must be destroyed after ten years at the latest.

The exchange may use KYC data only for the purposes of the anti-money laundering law and its statutory reporting obligations. The General Data Protection Regulation applies as well, so you have a right of access. You cannot, however, demand deletion before the period expires, because the statutory retention obligation takes precedence.

A residual risk remains: ID data is valuable to fraudsters, and data leaks at financial service providers do happen. How such a case can unfold is shown in our report on the Revolut data breach, after which the bank is paying for new IDs for 680 affected customers. You can reduce the risk by opening accounts only with providers holding an EU licence, closing accounts you no longer need and never sending your ID by email or messenger when someone supposedly asks for it on behalf of an exchange.

Is there a MiCA exchange without an ID check?

Under MiCA, crypto-asset service providers in the EU need a licence, and with the licence come the obligations of anti-money laundering law. What the regulation requires of companies is explained in our overview of the MiCA licence and the obligations for crypto companies. A licensed exchange without KYC therefore does not exist. A provider that promises you an account with no ID at all while advertising an EU licence deserves suspicion.

There are still routes without ID, just not through a licensed exchange: decentralised exchanges, where you trade directly from your wallet, peer-to-peer trading or swaps in a wallet app. Which options remain under MiCA and where their limits lie is covered in the guide Crypto exchanges without KYC. The route for buying Bitcoin in particular is described in Buying Bitcoin without KYC. Bear in mind that without a regulated provider you also have no one to turn to if something goes wrong.

What happens if KYC fails?

If the exchange rejects your verification, it is usually down to formalities: an expired ID, a residential address that does not match the document, a blurred photo or a name spelled differently from the one on your current account. Go through these points before you make a second attempt. You will not always get a detailed explanation, because in the event of a suspicion of money laundering the act forbids the exchange from telling you.

AMLR from July 2027: the EU will then explicitly ban anonymous crypto accounts

The next stage has already been published in the Official Journal. The EU Anti-Money Laundering Regulation, AMLR for short, Regulation (EU) 2024/1624, will apply directly in all member states from July 10, 2027, replacing large parts of national anti-money laundering law. Article 79 will then prohibit credit institutions, financial institutions and crypto-asset service providers from keeping anonymous crypto-asset accounts or accounts that allow transactions to be obscured to a high degree, including through anonymity-enhancing cryptocurrencies. This refers to privacy coins, whose transactions cannot be traced on the blockchain.

For holders of a normal exchange account, little changes as a result, because their KYC is already complete today. The AMLR will be felt mainly in two respects: the rules will be the same across the EU, and the new European anti-money laundering authority AMLA in Frankfurt am Main will directly supervise selected large providers in future. A KYC completed at an exchange in France or the Netherlands will then follow the same requirements as one at a German provider.

KYC check: keep your ID, registered address and tax ID to hand

Before you register with an exchange, it is worth taking a quick look at your documents. It saves you an aborted video call and days in the queue.

Choose a licensed exchange: Compare providers with an EU licence, fees and verification methods in the comparison of the best crypto exchanges. Check whether the exchange offers the online ID function if you would rather not do a video call.
Prepare the withdrawal to your own wallet: If you want to hold your coins yourself later, set up the hardware wallet before the first large transfer. Devices and prices are listed in the hardware wallet comparison.
Keep clean tax records: Because the exchange has reported your transactions to the Federal Central Tax Office since 2026, your own records should match. Suitable software can be found among the crypto tax tools and portfolio trackers.

(As of November 5, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)

Frequently asked questions about KYC

KYC stands for Know Your Customer and describes the identity check that a licensed crypto exchange must carry out under the German Anti-Money Laundering Act before opening an account. The exchange collects your personal details and verifies them against an official photo ID.

Under Section 11(4) of the German Anti-Money Laundering Act there are five mandatory details: first and last name, place of birth, date of birth, nationality and residential address. Since January 1, 2026, exchanges also ask for your tax identification number for reporting to the Federal Central Tax Office.

Under Section 8 of the Anti-Money Laundering Act, the exchange must keep KYC records for five years, counted from the end of the calendar year in which your account is closed. The data must be destroyed after ten years at the latest.

There is no MiCA-licensed crypto exchange without KYC, because crypto-asset service providers fall under anti-money laundering law. Without ID, the only routes are decentralised exchanges, peer-to-peer trading or swaps in a wallet app, and then without a regulated point of contact.

AML stands for Anti-Money Laundering and describes the fight against money laundering as a whole. KYC is one of its tools: it establishes who the customer is, while ongoing AML monitoring checks whether their transactions fit that profile.

Transparency note: This article was produced with the assistance of artificial intelligence and reviewed by our editorial team before publication. All figures and claims were checked against the primary sources linked in the text. The feature image was generated with AI.

Which topics should we dive deeper into?

Select what genuinely interests you. Your picks feed directly into our editorial planning.

Crypto news that's actually worth your time.

Weekly. 60 seconds. Carefully curated by our editors: no hype, no promo flood, no spam.

What is an issuer? Meaning, examples and issuer risk

Context: who the issuer is in the case of a share, an ETF, an ETN, a certificate, a stablecoin and a stock token, what MiCA and prospectus law understand by it, and what an issuer insolvency leaves of 10,000 euros. With tables and a worked example.

June 7, 2026 11:00 AM

How to Buy Bitcoin with No KYC in 2026: 3 Ways to Do It

Protect your data and maintain privacy. Here are the three most secure ways to buy Bitcoin without identity verification (KYC) in 2026.

June 23, 2019 9:51 PM

FATF: All Global Crypto Exchanges Must Now Share Customer Data

FATF (Financial Action Task Force), an intergovernmental organization whose role is to combat money laundering and terrorism financing has presented their recommendations on regulating cryptocurrencies for its 37 member countries. However, the FATF standards released Friday includes a very controversial […]

October 23, 2026 1:35 PM

What is Tether (USDT)? The stablecoin explained: 182 billion tokens without EU authorisation

With 182.8 billion tokens in circulation, Tether is the largest stablecoin in the world and settles two out of every three crypto dollars traded. In the EU it lacks authorisation as an e-money token, and from January 8, 2027 authorised providers may no longer offer services around it.

October 16, 2026 4:19 PM

NEAR gains 15.9 percent as the confidential SOL vault cites a 5.12 percent yield: what to watch now

NEAR trades at $5.27, 15.87 percent above yesterday's level. The day before, NEAR launched a deposit service for Solana that hides the wallet address and cites an example yield of 5.12 percent. What of it is substantiated, and which EU rules apply to investors in Germany.

October 2, 2026 1:42 PM

Arkham Intelligence: who does this wallet address really belong to?

The analytics platform attaches names to blockchain addresses and has been paying bounties for unmasking wallets since July 2023. What comes out of it, where the assignment goes wrong, and how you keep your own trail shorter.

September 30, 2026 4:15 PM

Zcash today: 2,746 ZEC from the Bitget hack vanish into the Ironwood pool

Wallets from the Bitget break-in pushed 2,746 ZEC into Zcash's Ironwood pool on Wednesday morning, roughly $3.9 million. What the shielding means for tracing, and what applies to your exchange account from July 2027.

September 20, 2026 4:13 AM

Zcash Above $1,500: What ZEC Holders Should Check on Tax and Custody

Zcash rose above $1,500 on September 19 for the first time since 2016 and, after an intraday high of $1,590.80, trades back at around $1,474. For German holders three questions hang on that jump: the one-year holding period, the planned year-end cut-off and the EU anti-money-laundering regulation from July 2027.

August 19, 2026 10:24 AM

Privacy Coins and EU Anti-Money-Laundering Law: An Assessment of the Ban From July 2027

Article 79 of the EU anti-money-laundering regulation bars crypto service providers from keeping accounts that obscure transactions, and it names anonymity-enhancing cryptocurrencies explicitly. This assessment separates the documented wording, including the 10 July 2027 application date, from what follows for individual coins.

December 5, 2024 11:00 PM

BGB Price Prediction: Bitget Token Price UP by more than 25%

Bitget is a top crypto exchange, with its native token BGB surging over 24% in the last 24 hours. Learn why Bitget stands out, what BGB offers, and how you can get started.

August 20, 2024 11:07 AM

China Labels Crypto Transactions as Money Laundering in New AML Law

China has just updated its anti-money laundering laws to classify crypto transactions as money laundering. Find out what this means for the crypto world!

October 1, 2020 6:37 PM

Bitcoin Dumps As CFTC Indicts BitMEX Founder Arthur Hayes

U.S. prosecutors have filed criminal charges citing four founders and managers of the BitMEX cryptocurrency exchange of neglecting to take adequate steps to prevent money laundering. According to the U.S. Department of Justice and the Commodity Futures Trading Commission (CFTC), […]

August 21, 2026 4:17 PM

Crypto Withdrawals to Your Own Wallet: Why Exchanges Demand Proof of Address Ownership Above €1,000

Above €1,000 your provider has to establish whether the destination address really belongs to you. Article 14(5) of the transfer of funds regulation, five permitted methods, and the reason a withdrawal stalls without this step.

February 13, 2025 11:00 PM

Breaking News: Bitget Secures Virtual Asset Service Provider license in Bulgaria

Bitget, the leading cryptocurrency exchange and Web3 company, has obtained a Virtual Asset Service Provider (VASP) license from Bulgaria's National Revenue Agency.

May 15, 2024 12:04 PM

Crypto Scams: How to Protect Your Cryptos?

With the rise of crypto scams, and while international efforts are still working to combat these threats and protect investors, some recent tactics have been identified, and here is your full guide.

November 1, 2026 3:36 PM

Instant transfer to a crypto exchange: the bank matches the payee name

Since October 2025 every bank in the euro area has had to offer instant transfers and to match the payee name before releasing them. On deposits to trading venues that is exactly what produces warnings, even though the account details are correct.

October 20, 2026 10:27 PM

Ethereum from the Drift hack: the attacker moves up to $61 million into Tornado Cash

Wallets attributed to the Drift attacker forwarded between 13,400 and 25,700 ether to Tornado Cash on October 20 after two quiet months. Around 81,500 ether still sit with the attacker.

August 21, 2026 7:46 AM

Crypto Job Offers Using Your Own Bank Account: How the Money Mule Scheme Works and Why Money Laundering Starts With Negligence

On August 18, 2026 BaFin warned about job offers in which applicants are to pass third-party payments through their own account and exchange them into crypto-assets. Anyone taking part risks criminal proceedings for money laundering, and gross negligence is already enough.

August 21, 2026 4:14 AM

Euro Deposit to a Crypto Exchange Rejected: Why the Transfer Fails and What You Can Do

Since October 9, 2025 your payment service provider matches the payee name against the IBAN on every euro transfer. On deposits to an exchange account that is precisely where the payment most often comes to a halt.

March 5, 2026 8:11 PM

What are AI Agents? Why the Machine Economy Needs Crypto in 2026

AI agents are evolving from chatbots to autonomous employees. Discover why crypto and the x402 protocol are essential for the future of the machine economy.

September 19, 2024 7:15 AM

Breaking Insights from Token2049: Monad’s Vision for the Future of Blockchain Scalability

One standout presentation at Token2049 was by Keone Hon, the co-founder of Monad, during a panel discussion on the future of blockchain scalability.

June 1, 2024 11:00 PM

Bitget Wallet Token (BWB) makes debut on the Bitget Launchpad

Bitget, the world's leading cryptocurrency exchange and Web3 company, has announced the launch of Bitget Wallet's BWB token on its Launchpad.

May 19, 2024 1:23 PM

Will Tether (USDT) Get Delisted In Europe?

With growing concerns revolving around the reliability and compliance regulations of stablecoins, some crypto exchanges opt to delist some of them. Will this be the case for Tether in Europe?

October 31, 2026 12:37 PM

Floin Cyberattack: MiCA Crypto Platform From Liechtenstein Goes Offline

Liechtenstein-based crypto platform Floin reports a cyberattack, remains offline and has now confirmed a data breach. What is known about the MiCA-licensed company, which customer data may be affected and what investors should do now.

October 29, 2026 9:08 PM

Best Crypto to Buy Now: 5 Coins to Watch in November 2026

The best crypto to buy now, updated every month: five coins for November 2026 with price, catalyst and main risk, how we pick them and how last month's list performed.