KYC (Know Your Customer)

Know Your Customer (KYC) is the identity-verification process that regulated financial institutions and cryptocurrency exchanges are required to perform before they let a user transact. It is the operational front end of broader anti-money-laundering law: collecting and verifying a customer's legal name, address, date of birth, and government-issued identification so the institution can attest who actually controls an account. The Financial Action Task Force (FATF) frames KYC as part of customer due diligence (CDD) under its Recommendation 10, which asks institutions to identify and verify every customer, identify beneficial owners, and monitor activity on an ongoing basis.

Why exchanges require it

Custodial platforms hold customer funds and connect to the banking system, so they are treated as obligated entities under national AML regimes. Failing to verify customers exposes them to enforcement action, license loss, and being cut off from correspondent banks. As a result, virtually every regulated exchange now demands photo ID, a selfie, and sometimes proof of address before a withdrawal is permitted; many apply tiered verification, where higher limits require deeper documentation such as source-of-funds evidence. KYC data is also retained for years under record-keeping rules and may be shared with counterparties under the FATF Travel Rule.

The privacy cost of the database

The under-discussed half of KYC is what happens to the data after collection. Verified buy/sell records permanently tie a legal identity to on-chain addresses, which blockchain-analysis firms can then cluster and extend outward — a purchase made once can annotate a wallet's activity for years, since the ledger never forgets. And the databases themselves are honeypots: exchanges have suffered breaches leaking names, addresses, and ID documents, converting a compliance formality into a lasting physical-security and identity-theft exposure for customers. This is not an argument that verification is illegitimate; it is the sober observation that every identity record created is a record that can leak, be sold, or be subpoenaed, and the customer bears that risk indefinitely.

What it means for self-custody and miners

KYC applies at the on-ramp and off-ramp, not to Bitcoin itself. Holding your own keys in a self-hosted wallet requires identifying yourself to no one, and running a node or spending peer-to-peer creates no KYC obligation. Mining occupies a distinctive position here: coins earned as block rewards or pool payouts are acquired directly from the protocol, with no exchange purchase record attached — one reason home mining, including small-scale solo mining on devices like the Bitaxe, appeals to privacy-conscious Bitcoiners as an entirely legal way to accumulate without enlarging any database. Minimizing one's KYC footprint through lawful means — self-custody, mining, peer-to-peer trade where legal, and avoiding address reuse — is privacy preservation, not evasion, and the distinction matters.

The boundary of who must collect KYC is worth understanding precisely, because it is where personal choices operate. Custodial exchanges, brokers, and payment processors sit squarely inside the obligated perimeter. Genuinely non-custodial software — wallets that never hold your funds, nodes you run yourself, mining firmware on your own hardware — has historically sat outside it, though regulators in several jurisdictions keep probing that line and definitions shift with each guidance update. What this means practically: the moment of trading fiat for bitcoin through a business is where identity attaches, and everything downstream of your own keys is where it does not. Knowing which side of the line a given service occupies, before you use it, is basic operational literacy for anyone managing their privacy lawfully.

This entry is educational and not legal advice; obligations vary by jurisdiction and users should comply with the laws that apply to them. To understand how KYC fits into the wider compliance stack, see our entries on AML (Anti-Money Laundering) and the FATF Travel Rule.