What is KYC?
How it works
On a typical centralized exchange like Coinbase or Binance, KYC begins when a user creates an account and attempts to access features such as fiat deposits or higher withdrawal limits. The user must provide personal information: full name, date of birth, residential address, and nationality. Then they upload a photo of a government-issued ID (e.g., passport, driver's license, or national ID card). Some platforms also require a selfie or a short video for liveness detection. The submitted data is processed by automated verification services like Onfido or Jumio, which check the ID's authenticity and match it to the user's face. This process usually completes within minutes, but manual reviews may take longer for edge cases.
Once verified, the exchange assigns a KYC tier that determines the user's transaction limits. For example, a user with basic KYC may deposit up to $1,000 per day in fiat, while full KYC allows unlimited trading. The exchange retains the identity data in encrypted storage, often complying with local regulations like GDPR in Europe or FinCEN in the United States. Some exchanges use zero-knowledge proofs or privacy-preserving techniques to minimize data exposure, but standard KYC still requires centralized trust. Third-party verifiers do not permanently store the data unless agreed upon. The exchange may share data with regulators if legally required, such as in suspicious transaction reports.
In DeFi, KYC implementation is less common but growing. Regulated stablecoin issuers like Circle (USDC) require KYC for issuing and redeeming tokens directly. Some DeFi protocols use token-gated access, where only users who complete KYC with an identity provider (e.g., Civic or Worldcoin) can interact with certain pools. This is often achieved through on-chain attestations or zero-knowledge proofs that prove a user is verified without revealing their full identity. Fully non-custodial DEXs like Uniswap still operate without KYC, though frontends may voluntarily add checks. The distinction between requiring KYC at the protocol level versus the application level remains a key design choice in the DeFi space.
Why it matters
KYC matters because it bridges the pseudonymous nature of crypto with legal compliance in traditional finance. Regulated exchanges must verify user identities under anti-money laundering (AML) and counter-terrorism financing (CTF) laws in jurisdictions like the US, EU, and Japan. Without KYC, these platforms would face severe penalties or be shut down. However, KYC also introduces privacy risks and central points of failure, as data breaches can expose sensitive personal information. The tension between requiring KYC for compliance and preserving the ethos of decentralization is a defining debate in crypto. Ultimately, KYC enables wider institutional adoption and fiat on-ramps, but it challenges the ideal of permissionless finance.
Real-world examples
Coinbase, Kraken, and Binance are prominent centralized exchanges with mandatory KYC for fiat trading. Circle requires KYC for direct USDC minting and redemption. In DeFi, Aave has explored off-chain KYC via the Aave Arc product, where only verified institutions can access permissioned liquidity pools. Worldcoin uses iris scanning as a form of KYC for its identity protocol, linking unique biometrics to wallet addresses.
FAQ
Is KYC required on all crypto exchanges?
No. Centralized exchanges that operate in regulated markets typically require KYC. Decentralized exchanges (DEXs) like Uniswap often do not require KYC, though some frontends may voluntarily implement it.
What documents are needed for KYC?
Usually a government-issued photo ID (passport, driver's license, or national ID card) and a proof of address such as a utility bill or bank statement.
Is KYC safe? Can my data be leaked?
KYC data is sensitive; exchanges store it with encryption and rely on third-party verifiers with security measures. Data breaches have occurred in the past (e.g., Ledger's marketing database leak), so users should choose platforms with strong security practices and check their privacy policies.
Related terms
Go deeper
Browse the complete crypto glossary to explore related terms and concepts.
Browse Glossary