KYC stands for know your customer. It is the identity verification a regulated exchange runs before letting you trade, usually requiring a government ID, a selfie, and proof of address. Having done this for decades, banks passed the obligation to crypto exchanges as regulators brought the industry inside the financial system.
Nobody enjoys it. Understanding what the process is actually checking, and why a platform without it should worry you more than one with it, makes the friction easier to read. The short version: verification exists because someone can be held responsible.
What KYC is checking
Three questions, in order.
- Are you who you say you are? Verified by matching a government-issued document against a live image of your face.
- Are you allowed to be a customer? Checked against sanctions lists, politically exposed person databases, and jurisdictional restrictions.
- Does your activity match your profile? Assessed on an ongoing basis, which is why a sudden change in behaviour can trigger a review months after you signed up.
People miss that third question. KYC is not a gate you pass once. It is the baseline against which everything you do afterwards gets compared.
What you will be asked for
| Stage | Typically required |
|---|---|
| Basic verification | Name, date of birth, address, nationality |
| Document check | Passport, national ID, or driving licence |
| Liveness check | A selfie or short video, to confirm a real person is present |
| Proof of address | Utility bill or bank statement, usually issued within the last three months |
| Enhanced due diligence | Source of funds documentation, for larger volumes or higher-risk profiles |
Since the document and face match are automated, most verifications complete in minutes. Manual review is what causes the delays, triggered by poor image quality, a name mismatch across documents, or an address that cannot be confirmed.
KYC vs AML
Used interchangeably, the two are not the same thing.
AML, or anti-money laundering, is the whole framework: the laws, the monitoring systems, the reporting obligations. KYC is one component of it, specifically the identity piece.
Put simply, KYC establishes who you are. AML is everything the platform does with that information afterwards.
Who requires it
Setting the global standards is the Financial Action Task Force (FATF), an intergovernmental body. It has no direct legal authority, but member countries write its recommendations into national law, which is how a worldwide baseline emerges without a worldwide regulator.
FATF extended its recommendations to cover virtual asset service providers in 2019. National implementation followed. Today the requirements sit inside frameworks like MiCA in the European Union, VARA's rules in Dubai, and AUSTRAC's regime in Australia.
Any exchange holding a licence in a major jurisdiction runs KYC. There is no version of a regulated platform that skips it.
What happens to your data
A legitimate concern, and one worth being specific about.
For a set period after an account closes, commonly five years, verified exchanges are generally required to retain identity records, so the data does not disappear when you leave. That information can be requested by regulators and law enforcement through proper legal channels.
Data protection law applies to regulated platforms too, which in most jurisdictions means the data must be held securely, used only for stated purposes, and disclosed only where legally required. Breaches do happen, and exchange data leaks have exposed customer identities before. Any platform holding your documents represents a real risk surface.
Weighed against that: an unregulated platform holding your funds with no licence, no audit, and no segregated accounts represents a different and generally larger risk.
Why "no KYC" is a warning sign, not a feature
Advertising no verification markets to two groups. One wants privacy. The other wants to move money that cannot survive scrutiny.
Practical consequences of using the second kind:
- No regulator to appeal to. If the platform freezes your account or vanishes, no licensing authority exists to complain to.
- Exit risk. Several of the largest crypto collapses, including those that deepened the 2022 bear market, involved platforms operating outside meaningful oversight.
- Tainted deposits. Funds sitting alongside proceeds of crime can be frozen when the platform is investigated, whatever your own conduct. Blockchain analytics trace a deposit back through the addresses it passed through.
- The withdrawal wall. Many no-KYC platforms demand full verification precisely when you try to withdraw a large sum, which is the worst possible moment to discover a documentation problem.
Genuinely different is the decentralized exchange case. Nobody onboards you because there is no company, and you keep your own keys throughout. Regulators have been steadily extending obligations toward the interfaces and developers involved, and the position varies by jurisdiction.
Where mb.io fits
Because the licences exist, so does verification. An exchange that can be held to account by a regulator is an exchange that has to know who its customers are.
mb.io is a regulated crypto spot exchange backed by MultiBank Group, a financial institution founded in 2005 that serves more than 2 million clients across 100+ countries.
- Regulated by VARA in the UAE and AUSTRAC in Australia
- 10/10 security score from Hacken, an independent blockchain security auditor
- Institutional-grade MPC custody powered by Fireblocks, with segregated client funds
- Verification in three steps, from sign-up to your first purchase
- Buy, sell, and swap in three steps, from sign-up to purchase
- 24/7 customer support, on web and on the iOS and Android apps
Open your account and start trading on mb.io.
Frequently asked questions
What does KYC stand for?
Know your customer. It refers to the identity verification a financial institution performs before providing services, and to the ongoing monitoring that follows.
How long does crypto KYC take?
Usually minutes, since document and face matching are automated. Manual review adds hours or days, and is commonly triggered by blurry images, name mismatches, or an address that cannot be verified.
Why does an exchange need my selfie?
To confirm a real person is present and that they match the submitted document. A stolen passport image alone will not pass, which is the point of the liveness check.
Can I trade crypto without KYC?
On decentralized exchanges, yes, since there is no company to onboard you. On any licensed centralized exchange, no. Platforms advertising no verification are operating outside the frameworks that would otherwise protect you.
Is my KYC data safe?
Regulated exchanges are bound by data protection law and generally must retain records for around five years after account closure. Breaches have occurred at exchanges before, so the risk is real rather than theoretical.
Why am I being asked for source of funds?
Because your deposit crossed a threshold or your activity changed in a way that triggered enhanced due diligence. A payslip, sale contract, or bank statement normally resolves it.
Does KYC mean my crypto is traceable?
Your exchange activity is linked to your identity on that platform's records. On-chain, addresses remain pseudonymous, though analytics firms routinely connect crypto addresses to identities using exchange data and transaction patterns.
