Why crypto exchanges ask for ID: KYC, AML and the EU travel rule

Crypto exchanges ask for ID because, in the EU, the UK and most other major jurisdictions, they are legally required to. Anti-money-laundering (AML) law treats crypto-asset service providers like banks and payment firms: they must verify each customer's identity (know your customer, or KYC), monitor transactions, and report suspicious activity. Since 30 December 2024, EU providers must also attach information about the sender and recipient to every crypto transfer they make to another provider, under what is known as the travel rule.

None of this is unique to crypto. Banks and CFD brokers carry out the same kind of checks. What is specific to crypto is the self-hosted wallet: a wallet that you control directly, with no firm behind it. This guide explains what providers must check, why they sometimes ask questions that feel intrusive, how transfers to and from your own wallet are treated, and how to tell a genuine verification request from a phishing attempt.

Risk warning: crypto assets are highly volatile and largely unregulated outside the scope of the EU's MiCA regulation. Verification by a provider does not make crypto safe, and crypto held with a provider is generally not covered by deposit or investor compensation schemes. You can lose all of the money you put in.

Where the rules come from

The obligations come from a chain of international standards and EU law.

• FATF standards. The Financial Action Task Force (FATF), the international body that sets anti-money-laundering standards, extended its recommendations to virtual assets and virtual asset service providers in 2018 and 2019. That included applying its "travel rule", originally written for bank wire transfers, to crypto transfers between providers.
• The EU's anti-money-laundering directives. The Fifth Anti-Money Laundering Directive brought firms exchanging crypto for fiat money, and custodian wallet providers, into the EU's AML framework, with national laws due by January 2020. Since then, these firms have had to register with or be supervised by national authorities for AML purposes.
• MiCA. The Markets in Crypto-Assets Regulation requires crypto-asset service providers (CASPs) to be authorised, and its rules for providers have applied since 30 December 2024. MiCA itself is mainly about authorisation, conduct and safeguarding, but authorised CASPs are also obliged entities for AML purposes. Our guide to MiCA regulation covers it in full.
• The Transfer of Funds Regulation. Regulation (EU) 2023/1113 extended the EU's rules on information accompanying fund transfers to crypto assets. It has applied since 30 December 2024, the same day as MiCA's provider rules.
• The EU AML package. The EU has also adopted a new Anti-Money Laundering Regulation, which applies from July 2027 and among other things prohibits providers from keeping anonymous accounts or handling crypto assets designed to hide transaction details, and has set up a new EU Anti-Money Laundering Authority (AMLA) based in Frankfurt.

In the UK, crypto firms must be registered with the FCA for AML purposes, and the UK applied its own version of the travel rule from 1 September 2023.

What KYC involves

KYC is the process of establishing who you are, and customer due diligence is the wider duty to understand your relationship with the provider. A typical onboarding asks for:

• Identity: a passport, national identity card or driving licence, often with a live selfie or short video to match your face to the document.
• Address: a recent utility bill, bank statement or official letter, or an electronic check against public records.
• Basic profile: date of birth, nationality, occupation, tax residence and the reason you are opening the account.
• Screening: behind the scenes, the provider checks you against sanctions lists and lists of politically exposed persons (people in prominent public roles and their close associates), who are subject to extra checks.

The glossary entry on KYC gives a short definition. The checks are not a one-off. Providers are expected to monitor activity on an ongoing basis and update what they know, so you may be asked to re-verify an expired document or update your details.

Enhanced due diligence and source of funds

Providers must apply more scrutiny where the risk is higher: large or unusual transactions, links to high-risk countries, complex ownership structures, or politically exposed persons. That is when you may be asked about the source of funds (where the money for this transaction came from) or the source of wealth (how you came to have your overall wealth).

These questions feel intrusive, and sometimes they are asked clumsily. But a provider that ignored a sudden large deposit from an unexplained source would be failing its legal obligations, and could be fined or lose its authorisation.

Worked example: a large deposit

An illustrative scenario. You have used an exchange for two years, depositing around 300 euros a month. You then deposit 60,000 euros from a bank account you have not used with the exchange before.

The exchange's monitoring flags the deposit as out of pattern. You receive a message in the app asking you to explain the source of the funds and provide evidence. Typical acceptable evidence might be:

• the completion statement from a property sale,
• a solicitor's letter showing an inheritance, or
• a payslip and bank statements showing savings built up over time.

Until the review is done, the provider may hold the funds or restrict withdrawals. That is frustrating, but it is how the system is designed. The quickest route is to provide clear documents through the official app, and keep copies.

The travel rule: information that follows the transfer

The travel rule is the part that most changes how crypto transfers feel in practice.

What it requires

Under the Transfer of Funds Regulation, when a CASP sends crypto on behalf of a customer to another CASP, it must send along with the transfer:

• the sender's name, their account or distributed ledger address, and their address (or official document number, customer number or date and place of birth), and
• the recipient's name and their account or distributed ledger address.

The receiving CASP must check that the information is present and handle transfers that arrive with missing or incomplete information, which can mean asking for it, delaying the transfer, returning it, or in some cases rejecting it.

There is no minimum amount for crypto transfers: the information must travel with every transfer between providers, whatever its value.

The information does not go on the blockchain. Providers exchange it through separate messaging systems, and the blockchain transaction itself looks exactly as it did before.

Worked example: sending to a friend's exchange account

An illustrative scenario. You want to send 200 euros' worth of a stablecoin from your account at one EU exchange to a friend's account at another.

1. When you enter the destination address, your exchange may ask whether it belongs to a person or a business, who the recipient is, and which provider holds it.
2. You enter your friend's full name as it appears on their account.
3. Your exchange sends your details and your friend's details to the receiving exchange through a travel-rule messaging system, and then sends the crypto.
4. The receiving exchange matches the name to your friend's verified account and credits the funds.

If you misspell your friend's name, or the receiving exchange cannot be reached through a compatible system, the transfer may be delayed, returned or held while one side asks for more information. This is the most common source of new friction since December 2024.

Self-hosted wallets

A self-hosted (or unhosted) wallet is one where you control the keys yourself, such as a hardware wallet or a wallet app, with no provider in between. Our guides to crypto wallets and custody and seed phrases and private keys explain how they work.

The travel rule does not apply to transfers directly between two self-hosted wallets with no provider involved. Using a self-hosted wallet is legal in the EU. But when a provider sends crypto to, or receives it from, a self-hosted wallet, it has extra duties:

• It must collect information about the sender and recipient, usually from its own customer.
• For transfers of more than 1,000 euros to or from a self-hosted wallet belonging to its own customer, it must verify that the customer actually owns or controls that wallet.
• It must assess the risk of the transfer, which can include checking the wallet's history using blockchain analytics.

How ownership is checked

Providers use different methods. Common ones include:

• Signing a message. You use the wallet to sign a short piece of text the provider gives you, proving you hold the key without moving any funds. Read the message carefully: it should not mention tokens, amounts or permissions. Our guide to crypto phishing and wallet drainers explains why.
• A small test transaction. You send a specific tiny amount from the wallet to the provider, showing you control it.
• A declaration or screenshot, for lower-risk cases, depending on the provider's approach.

Once a wallet is verified, many providers save it to an address book so you do not have to repeat the process.

Worked example: moving coins to your hardware wallet

Illustrative amounts.

• Withdrawing 800 euros' worth of bitcoin to your hardware wallet: the exchange asks you to confirm that the address is your own self-hosted wallet. It records the information but, being under 1,000 euros, does not have to verify ownership, though it may still choose to.
• Withdrawing 2,500 euros' worth: the amount is above 1,000 euros, so the exchange must verify that the wallet is yours. It asks you to sign a message with the wallet, or to send a small amount from it first. After verification, the withdrawal goes through and the address is saved.
• Depositing from a wallet the exchange has never seen: the exchange asks whose wallet it is. If it is yours and the deposit is over 1,000 euros, you may need to prove ownership before the funds are credited.

Planning ahead helps: verify your wallet with a small amount before you need to move a large one, and avoid splitting a transfer into many small pieces simply to stay under 1,000 euros. Structuring payments to avoid thresholds is itself a classic money-laundering red flag and can get an account restricted.

Why deposits get held or rejected

Providers screen incoming crypto against blockchain analytics tools that link addresses to known services and illicit activity. A deposit may be held for review, or rejected, if the coins can be traced to:

• sanctioned addresses or entities,
• darknet markets, hacks or known scams,
• mixing services designed to obscure where coins came from, or
• a counterparty that will not provide travel-rule information.

You may not know the history of coins you received from someone else, which is one reason to be careful about accepting crypto from strangers. If a deposit is held, respond through the official support channel and provide whatever context you have.

Data and privacy

Handing over a passport and selfie to a crypto firm is a real privacy risk, because data can be leaked or stolen. Some practical steps:

• Only verify with providers you have checked are authorised. In the EU, check national registers and ESMA's interim MiCA register; our regulator registers page links to the official sources.
• Upload documents only through the provider's own app or website, never by email or messaging app.
• Under the GDPR you can ask what personal data a provider holds about you. Providers must keep AML records for a period set by law even after you close your account, so a request to delete them may be refused until that period ends.

Fake KYC: a common phishing tactic

Because verification requests are routine, criminals imitate them. Watch for:

• Messages saying your account will be frozen unless you "complete verification" via a link.
• Requests to upload ID by email, messaging app or a link that does not go to the provider's real domain.
• "Wallet verification" pages that ask for your seed phrase. No legitimate verification ever needs it. Ownership is proved by signing or a small transfer, never by revealing the phrase.
• Recovery or "unlock" fees, where you are told you must pay a fee or a tax to release frozen funds. This is the hallmark of fake platforms and recovery scams, as our guide to crypto scams and regulation describes.

If in doubt, close the message, open the provider's app or type its web address yourself, and look for the same request there.

Common mistakes

• Using a provider that does not ask for ID. An EU-facing exchange that skips verification is either not authorised or not complying, and either way your funds are at greater risk.
• Entering the wrong recipient name. Travel-rule checks match names, so a mismatch can hold up a transfer.
• Splitting transfers to stay under 1,000 euros. It can look like structuring and invite more scrutiny.
• Leaving verification of your own wallet until the day you need it. Verify with a small amount first.
• Uploading documents through links in emails or messages. Use the official app or site only.
• Signing a "verification" message that includes token permissions. Real ownership checks are plain text.
• Treating a source-of-funds request as an accusation. It is a legal requirement; clear documents resolve most cases.
• Paying a fee to "unlock" funds. Authorised providers do not ask for this, and fake platforms always do.

Crypto CFDs and KYC

If you trade crypto through CFDs with a broker, you will go through very similar identity checks under AML law, plus an appropriateness assessment under MiFID II that asks about your trading knowledge and experience. Because you never send or receive actual coins, the travel rule and self-hosted wallet checks do not arise. Crypto CFDs carry their own risks: retail leverage in the EU is capped at 2:1 and most retail CFD accounts lose money. See crypto CFDs vs buying crypto and how crypto exchanges work for how the two routes compare.

Frequently asked questions

Why do crypto exchanges need my ID?

Because they are legally required to. In the EU, crypto-asset service providers are subject to anti-money-laundering law and must verify each customer's identity, screen against sanctions lists and monitor transactions, in the same way as banks and brokers. In the UK, crypto firms must be registered with the FCA for AML purposes and follow similar rules.

What is the crypto travel rule?

It is a requirement that information about the sender and recipient travels with a crypto transfer between providers, so that each side knows who is on the other end. In the EU it has applied since 30 December 2024 under the Transfer of Funds Regulation, with no minimum amount. The information is exchanged between providers, not written to the blockchain.

Can I still use a self-hosted wallet in the EU?

Yes. Holding crypto in your own wallet is legal, and transfers directly between self-hosted wallets are outside the travel rule. When you move crypto between a provider and a self-hosted wallet, the provider must collect information and, for transfers above 1,000 euros, verify that the wallet belongs to you.

How do exchanges verify that a wallet is mine?

Common methods are asking you to sign a short message with the wallet, which proves you control the key without moving funds, or asking you to send a small, specified amount from the wallet. A genuine check will never ask for your seed phrase.

Why is my crypto deposit on hold?

Usually because the provider's checks flagged something: missing travel-rule information, a deposit from an unverified wallet above 1,000 euros, unusual size compared with your history, or links in the coins' history to risky sources. Contact the provider through its official app or website and provide the information it asks for.

Is a crypto platform that does not require KYC a scam?

Not necessarily, but for a provider serving EU customers it is a serious warning sign that it is not authorised or not following the law. That leaves you with less protection if something goes wrong, and many fake platforms skip proper verification precisely because they are not real businesses.