Why your crypto exchange wants your ID: KYC and the travel rule explained

Opening an account on a crypto exchange usually starts the same way: upload a photo ID, confirm your address, answer a few questions. Later, when you withdraw crypto, you may be asked who you’re sending it to. It can feel intrusive for a technology that promised to cut out the middlemen. But these checks aren’t optional extras: they’re required by anti-money-laundering laws.

This guide explains why platforms verify identity, what the travel rule is, what the rules say in the US, the UK and Canada, and how to avoid scams that imitate these checks.

What KYC means

KYC stands for know your customer. Financial businesses, including crypto platforms, must verify who their customers are, understand their risk and keep records. The aim is to make it harder to use the financial system for money laundering, fraud, sanctions evasion and terrorist financing.

United States

FinCEN’s 2019 guidance on convertible virtual currencies explains that businesses that accept and transmit crypto are money transmitters. They must:

• Register with FinCEN as a money services business.
• Run an anti-money-laundering program and meet recordkeeping, monitoring and reporting duties, including filing suspicious activity reports.
• Know enough about their customers to determine the risk level they represent.

FinCEN says these requirements apply equally to foreign-located crypto money transmitters doing business in whole or in substantial part in the US, even without a physical presence there. See how to check if an exchange is registered.

The US travel rule

FinCEN confirms that crypto transfers can be transmittals of funds, so they fall under the Funds Travel Rule. A transmittal of $3,000 or more (or its equivalent in crypto) can trigger requirements to obtain or pass on information about the transfer, before or at the time it’s sent.

United Kingdom

Crypto businesses providing in-scope services in the UK must be registered with the FCA under the Money Laundering Regulations, which include customer due diligence.

The UK travel rule

From 1 September 2023, UK cryptoasset businesses must collect, verify and share information about cryptoasset transfers, under Part 7A of the Money Laundering Regulations. The FCA says the travel rule helps businesses detect suspicious transactions and carry out sanctions screening. Firms must comply fully when sending to or receiving from a firm in the UK or in another country that has implemented the rule, and must take reasonable steps to establish whether the other firm can receive the information.

What the UK rules require

The regulations set out what has to travel with a transfer between two crypto businesses:

• Every transfer must carry the names of the sender and the recipient, and their account numbers or a unique transaction identifier.
• If the transfer involves a business outside the UK and is worth £800 or more, counting any transfers that appear to be linked, it must also carry one extra detail about the sender: for an individual, their customer number, address, ID document number, or date and place of birth. This threshold was set at £800 by amending regulations that took effect on 30 June 2026.
• If every business involved is in the UK, the sender’s business must provide that extra detail on request, within three working days.

Transfers to and from your own wallet

The UK rules also cover unhosted wallet transfers: moving crypto between an exchange and a wallet where you hold the private keys yourself.

• The exchange may ask its customer for information about the transfer, depending on its risk assessment, which takes into account the value, the purpose, how often you make transfers and how long you’ve been a customer.
• For incoming transfers of £800 or more, it can ask for details about the sender.
• If it asks and doesn’t receive the information, it must not make the crypto available to the recipient.

In practice, that’s why an exchange may ask you to confirm details when you deposit from, or withdraw to, a personal wallet. See hot vs cold wallets.

Canada

Crypto platforms that deal in virtual currency must register with FINTRAC as money services businesses. FINTRAC sets out when they must verify identity, including:

• Virtual currency exchanges of $1,000 or more: buying or selling crypto for money, or swapping one crypto for another.
• Virtual currency transfers of $1,000 or more.
• Receiving $10,000 or more in virtual currency in a single large transaction.

For transfers of $1,000 or more, FINTRAC requires detailed records: the date, the amount and type of crypto, the client’s name, address, date of birth and occupation, each beneficiary’s name and address, transaction hashes, and the sending and receiving addresses. Records must be kept for at least five years.

The Canadian travel rule

FINTRAC’s travel rule guidance has applied since 1 June 2021. For virtual currency transfers, the platform must include the name, address and account or reference number of the person requesting the transfer, and the name, address and account or reference number of the beneficiary. When information is missing, it must take reasonable measures to obtain it, and follow risk-based policies to decide whether to allow, suspend or reject the transaction.

The rules side by side

KYC and tax reporting

Identity checks increasingly feed into tax reporting too. Under the OECD’s Crypto-Asset Reporting Framework (CARF), UK platforms have had to collect information about their users, including tax residence, since 1 January 2026, and report it to HMRC from 2027. HMRC’s manual says a person who deliberately fails to provide a valid self-certification can face a penalty of up to £300. Canada’s rules are due to apply from 2027. See CARF: what HMRC and the CRA will see.

What you’ll be asked for

Requirements vary by platform and country, but expect:

• When you open an account: your name, address and date of birth, a government ID, and sometimes your occupation.
• When you withdraw crypto: the recipient’s name, and whether the destination is another platform or a wallet, especially for larger amounts.
• Now and then: updated details, or questions about larger transactions.

Answer accurately. Inconsistent or false answers can get transfers delayed or accounts restricted.

“No-KYC” platforms

Platforms that advertise no identity checks to customers in the US, the UK or Canada are, at best, operating outside the rules that apply where you live. That usually means:

• Less protection if the platform fails or freezes withdrawals.
• Fewer ways to complain or recover funds.
• A higher chance of being caught up in enforcement action against the platform.

Watch out for fake KYC requests

Scammers imitate verification requests to steal identity documents, logins or crypto. Be suspicious of:

• Emails or texts saying your account will be closed unless you “verify” now, with a link.
• “Support” agents on social media asking for documents, selfies or remote access.
• Any request for your seed phrase: no genuine platform ever needs it.

Always open your exchange’s app or type its address yourself. See fake crypto apps and phishing and seed phrase security.