You sign up to buy some crypto. Email, password, done. Then the site wants your driver’s license. Then a selfie. Now you’re turning your head in front of your phone, wondering when buying fifty bucks of something became a background check.
What is KYC?
That’s KYC: Know Your Customer. Banks, exchanges, and payment services use it to check who’s opening an account. Depending on the service, you might provide your name, birthday, address, identification number, document photos, and a selfie.
Many financial businesses have legal obligations to identify customers. The details depend on the country and the service. Those checks support efforts to detect money laundering and other financial crime. They also leave businesses holding sensitive records about ordinary customers. FATF’s recommendations.
Your ID is hard to replace
Once you upload your ID, you’re trusting people you’ll never meet to look after it. You don’t choose their contractors. You don’t decide which support workers can open your records.
Collecting sensitive IDs and then ignoring obvious security failures could raise questions of gross negligence. That’s a legal finding requiring evidence, though; a breach alone doesn’t establish it.
And you can’t fix a leaked identity the way you fix a leaked password.
You can change a password this afternoon. Your birthday stays the same. Replacing a driver’s license may change its number, but it won’t erase the copy someone already downloaded. Your name, face, and address can remain useful to them.
A stolen document isn’t a guaranteed way into every account. Good verification systems have other checks. But it gives someone material to impersonate you, attempt fraud, or make a convincing story when contacting support.
What a crypto data breach exposes
Not every crypto data leak is a KYC leak. Ledger’s 2020 incident involved its shopping and marketing database. Ledger reported more than a million email addresses and roughly 272,000 records containing names, addresses, and phone numbers in the public dump. It wasn’t a leak of wallet recovery phrases or KYC passports. Ledger’s update.
The risk can reach your front door. In 2024, a U.S. jury convicted a man whose crew kidnapped crypto owners in their homes and forced them to drain their accounts. Investigators documented hacked email accounts and physical surveillance, not a proven KYC leak. Still, it shows why connecting someone’s identity, address, and crypto holdings deserves care. DOJ case report.
Don’t put crypto stickers on your laptop or wear that sick Monero hoodie you got off XMR Bazaar if you’re trying to keep your holdings private. Neither proves you own much, but both advertise an interest strangers don’t need to know about. You can support a project without wearing its logo.
What happens to your KYC documents?
Before closing an account, ask what happens to the documents you uploaded. Does closing it trigger deletion? What remains, for how long, and with which companies? Look for a written answer in the privacy policy. If the answer is vague, don’t fill in the blanks with what you hope it means. Check the verification provider’s policy too, if a separate company handled your documents.
This is why opening five exchange accounts to compare signup bonuses isn’t a free experiment. You may leave five sets of identity records behind, even if you only use one account.
KYC also joins things you may have kept separate. A nickname, a shopping email, and a crypto account can all become attached to your legal identity. Withdrawing your funds doesn’t make the exchange forget your account history.
Before you upload your ID
There are practical limits to avoiding this. You may need a service that requires verification.
Before uploading, find out who handles the check, what they keep, and how long they keep it. Ask whether another verification method is available. Decide whether you actually need the account. A small discount is a poor reason to rush that decision.
Use the official app or website. If a message suddenly says your verification has expired, open the service yourself and check. Don’t follow a stranger’s link to a passport-upload form.
Keep using email aliases, unique passwords, and stronger account protection. They help with other parts of the problem. They won’t hide your identity from a company holding your ID.
Finding alternatives with KYCnot.me
For places to start looking, KYCnot.me lists services that advertise no-KYC options, alongside service details, reviews, and listing statuses. Use it to make a shortlist, then read the provider’s current terms yourself. The directory says even approved listings aren’t a guarantee against future problems or exit scams.
And “no KYC” doesn’t automatically mean trustworthy. A service can collect less information and still steal your money. Check who controls the funds, how withdrawals work, and whether the operator deserves your business.
My objection to KYC is the amount of lasting risk customers are expected to accept as routine. The company gets its verification checkmark. You get another copy of your identity sitting somewhere outside your control.
Sometimes you’ll accept that trade. Make it a decision, rather than another box you click through.