KYC and AML on Crypto Exchanges: Why Verification Exists and What Triggers It

Why exchanges verify identity at all

Every registered exchange is legally an AML-obligated business, the same category as banks and money transmitters. The law requires it to know who its customers are, monitor what they do, and report anything suspicious to a financial intelligence unit. An exchange that skips this is not being friendly. It is being non-compliant, and non-compliant venues get their banking cut off.

This is why the "no-KYC exchange" pitch should worry you rather than attract you. A venue willing to ignore AML law in your favor is equally willing to ignore laws that protect you. In our dataset, thin or optional KYC correlates tightly with the weakest regulation subscores.

Tiered limits and how they work

Most exchanges run tiered verification. A basic tier with name, date of birth and address checks unlocks small limits. Adding a government ID and a liveness selfie unlocks normal trading and withdrawal limits. A top tier, often with proof of address or income, unlocks high limits and OTC desks.

The tiers exist because AML rules are risk-based: more money moving means more diligence required. Our practical advice is to complete full verification before you need it, not during a withdrawal. Upgrading tiers mid-withdrawal while a review is pending is the slowest possible path.

What triggers a review

Reviews are mostly automated flags, not humans watching you. Common triggers include a sudden jump in deposit size versus your history, deposits from a mixer or a sanctioned address cluster, rapid pass-through where funds arrive and leave within minutes, logins from high-risk jurisdictions, mismatches between your declared profile and your activity, and structuring patterns like repeated just-under-threshold transfers.

Chain analytics run in the background of every major venue. If your incoming coins touched a darknet market or a hacked-exchange cluster within a few hops, expect questions even though you did nothing wrong. Coins carry history, and compliance software reads it.

Source-of-funds requests on large withdrawals

The request that generates the angriest support tickets we see: you try to withdraw a large amount and the exchange freezes the transaction pending proof of where the money came from. This is enhanced due diligence, and regulated venues are obligated to perform it above certain thresholds or risk scores.

What satisfies it is boring documentation: bank statements showing the fiat you deposited, trade history, payslips or a tax return if the sums are large, records from another exchange if you transferred coins in. Screenshots rarely suffice. Keep records from day one, especially for coins you bought years ago, because proving 2017 purchases in 2026 without records is genuinely painful.

The trade-off, honestly stated

KYC is a privacy cost, and pretending otherwise would be dishonest. You hand identity documents to a company that may be breached; exchange data leaks have happened and will happen again. That is a real argument for keeping long-term holdings in self-custody and using exchanges as a trading venue, not a vault.

But within the exchange world, strong KYC is a marker of a venue that intends to keep its banking, its licenses and its longevity. The venues at the top of our regulation subscore, Coinbase at 9.8, Gemini at 9.5, Kraken at 9.1, all run strict programs. The bottom tier does not. That is not a coincidence.

FAQ