KYC

Anna wants to buy bitcoin for the first time. She chooses an exchange, opens an account and, instead of a buy button, sees a request to verify her identity. This might involve an identity document, a facial check or questions about how she plans to use the account. She has just encountered KYC. The service is trying to establish who it is dealing with and fulfil its obligations. KYC sits within AML/CFT: measures against money laundering and terrorist financing. Checking an ID is only one part of that wider work, which also includes assessing risk, keeping records and reporting suspicious activity. This is not a requirement imposed by the Bitcoin network, nor evidence that Anna has done anything wrong. [1]

If Anna received bitcoin directly into her own wallet, network nodes would not examine her ID. A Full Node is a computer running software that independently checks Bitcoin transactions and blocks against the network’s rules. An exchange or a company holding customers' funds, however, operates as a separate provider with legal obligations of its own. International documents use the abbreviation VASP for certain virtual asset service providers. Holding her own keys does not, by itself, make Anna such a provider. A private key is secret data that a wallet uses to make a digital signature authorizing a payment. But Self-custody, meaning control of her own keys, does not remove an exchange's duties when she withdraws to that wallet. The exchange may therefore ask who the destination address belongs to, even when Anna controls the wallet herself. [2] [10]

The service checks customer information against reliable, independent sources. For a company, its name alone is not enough: the natural persons who ultimately own or control it, known as beneficial owners, also matter. The provider seeks to understand the purpose of the business relationship too. But successfully checking an ID does not establish the origin of every pound or who currently holds the private key for a Bitcoin address. Anna could have entered somebody else's address. A customer's identity, control of an address and the source of money are related but separate questions. [1] [5]

Anna might complete a short check at one service and face further questions at another. The difference may reflect applicable law, the product, country, amount or assessed risk. Higher risk can call for closer examination; lower risk may allow a simpler process where the conditions are met. There is no single worldwide list of required documents. FATF, the international body that sets anti-money-laundering standards, provides a framework that countries implement through their own rules. A FATF recommendation is not itself a law requiring every Bitcoin user to complete the same form. A service should be able to explain clearly what information it requests and why. [1]

Later, Anna sells her car and wants to use some of the proceeds to buy bitcoin. The exchange may ask her to explain an unusually large deposit. A source of funds question concerns the money for a particular transaction, such as this sale. Source of wealth, by contrast, concerns how someone accumulated their overall assets. These are different questions. A provider may also update previously collected information and compare transactions with the expected use of the account. A request should fit the circumstances and legal framework; it does not mean that every customer must document their whole life whenever they buy bitcoin. [1]

When Anna transfers bitcoin between providers, prescribed information about the sender and recipient may accompany the transfer separately. This is the area covered by the Travel Rule. It does not require names or copies of ID documents to be written to the public blockchain: services exchange or retain the information separately. In the EU, Regulation 2023/1113 is among the rules governing this area. It distinguishes transfers involving a provider from direct transfers between people without one. Exclusion from that regulation is not a general exemption from every law. A transfer between a personal wallet and an exchange still involves a service that may have checking obligations. [3] [4] [9]

Alongside customer details, a provider may use blockchain analysis. This analysis follows addresses and the connections between transactions. Each transaction output specifies an amount and the conditions for spending it. An output that has not been spent is called a UTXO; a later transaction can reference it through an input. An analyst may associate some of these traces with known services. Some conclusions rely on inference. CoinJoin, for example, allows several people to participate in one transaction, so inputs spent together need not have a single owner. A risk score alone therefore proves neither identity nor a criminal origin of funds. It matters to distinguish a technical trail from proof of what a person did, and to be able to supply context and request a review when an error occurs. [8] [10]

Anna gives a service sensitive information that can be linked to her account and withdrawal addresses. If it leaks, the consequences extend beyond an exposed email list: someone may gain clues about a particular person's financial activity. It is worth finding out who processes the data, who receives it, how it is protected and how long it is kept. In the EU, the principles of the General Data Protection Regulation (GDPR) also apply, including limiting processing to its purpose and collecting only necessary data. A legal duty to retain some records may continue after an account closes. Closing an account therefore does not automatically erase every document immediately; applicable law determines specific rights and time limits. [6] [1]

If a service cannot carry out the required checks, it may delay or refuse an account opening or transfer, or end the relationship. Depending on the circumstances, it may also have a duty to submit a confidential report or restrict access to funds. That is not, by itself, a finding of guilt. Equally, nobody can promise that every withdrawal request must be processed immediately, or that support staff may always explain every detail of a check. Anna needs to know the service's terms, complaints procedure and relevant supervisor. Rules, deadlines and remedies differ between countries and services. [1]

Before sending documents, Anna opens the familiar app or the service's official website and checks who is asking for her information. An urgent message carrying an exchange logo is not enough to establish trust. KYC is never a reason to disclose a Seed Phrase, the words used to restore a wallet, or a private key. Control of an address can be checked in other ways; before signing, you need to understand what your device is approving. For documents, distinguish required information from optional information and understand the consequences of refusing. Completing KYC, or a provider having a licence, does not by itself guarantee ability to meet financial obligations, deposit insurance, safe custody or a good price. KYC concerns checks on the customer, not proof that a service is risk-free. [7]