KYC stands for “Know Your Customer” and describes the identity check every licensed crypto exchange carries out before your first purchase. You provide your name, date of birth, place of birt
KYC stands for “Know Your Customer” and describes the identity check every licensed crypto exchange carries out before your first purchase. You provide your name, date of birth, place of birth, nationality and residential address, and the exchange matches these details against an official ID document. In Germany, no provider may open an account for you without this check, not even if you only want to swap 20 euros into Bitcoin.
The obligation comes from the German Anti-Money Laundering Act (Geldwäschegesetz, GwG). Since the European crypto regulation MiCA took effect, the act explicitly names crypto-asset service providers as obliged entities, putting them on a par with banks, payment institutions and investment firms. In practice, the ID check is neither the exchange’s business model nor harassment; it is a legal requirement. If you are looking for a properly licensed exchange, the comparison of regulated crypto exchanges lists providers with a licence, and every one of them requires KYC.
This guide explains which data you hand over, which verification methods exist, what is checked after your account is opened and what will still change by July 2027. If you are just starting out, the overview What is a cryptocurrency? is a good place to begin.
KYC is the umbrella term for all the steps a financial company takes to establish who its customer is and whether the business relationship fits that person. In German law these steps are called “general due diligence obligations” and are set out in Section 10 of the act. They cover four core tasks:
On top of this comes ongoing monitoring. KYC therefore does not end with a photo of your ID. The check accompanies your account for as long as it exists. Section 10(9) draws a clear line: if the exchange cannot meet these obligations, it may not enter into the business relationship, or it must end it.
Exactly which data the exchange must collect is laid down in Section 11(4) of the Anti-Money Laundering Act. For a natural person there are five details:
Under Section 12, the exchange verifies these details against a valid official photo ID, which in practice means your national identity card or passport. A driving licence is not enough, because it does not satisfy the domestic ID requirement. Under Section 8, the exchange also records which document it is, its number and the authority that issued it. It makes a copy of the ID you present or captures it digitally; the law expressly gives it both the right and the duty to do so.
Many exchanges ask for more than these five points: phone number, email address, occupation, the amount you plan to invest or the source of your money. Some of this serves the risk assessment, some of it communication with you. Strictly speaking, only the five details and the check against the document are mandatory.
The law allows several ways to verify your identity. Each exchange decides for itself which of them it offers. The three most common at a glance:
With video ident, you hold your ID up to the camera of your smartphone or laptop, tilt it on request so that the security features become visible, and show your face so it can be compared with the photo. The minimum requirements for this method were set by the German financial regulator BaFin in its Circular 3/2017 (GW) on video identification. Many providers work with specialised service companies for this, whose names you will see during the process.
The electronic proof of identity under Section 18 of the German Identity Card Act reads the data directly from the chip in your identity card. You need an NFC-enabled smartphone and your six-digit PIN. The advantage: there is no video call, and because the data comes straight from the chip, typing errors are ruled out.
Less common is verification via a qualified electronic signature under the European eIDAS regulation. In this case, the first transaction must also come from a payment account in your name. That is why some providers ask for a first transfer from your own current account.
The terms KYC and AML are often confused. AML stands for “Anti-Money Laundering”, the fight against money laundering. AML is the goal, and KYC is one of the tools for reaching it. The identity check answers the question of who you are. The money laundering check answers the question of whether your transactions match what the exchange knows about you.
That is why the exchange keeps watching after your account is opened. Section 10 requires continuous monitoring of the business relationship, including its transactions. If you buy 50 euros’ worth every month for years and suddenly deposit 80,000 euros, that stands out. It does not mean anything is wrong; it simply means the exchange has to ask.
If the exchange identifies a higher risk, the enhanced due diligence obligations under Section 15 apply. Typical triggers are large deposits, PEP status or transfers from countries with an elevated money laundering risk. The exchange then asks where the money comes from, known in the trade as “source of funds”. This is proof of where the specific money you are depositing originated.
Depending on the case, suitable evidence includes payslips, a sales contract for a property you sold, a certificate of inheritance or account statements from another provider where you sold crypto assets. Have such documents ready before you move larger sums. An exchange that freezes a deposit until the matter is cleared up is acting in line with the law, not arbitrarily.
Since the Travel Rule, anyone moving coins from an exchange to their own wallet must prove the address is theirs once the amount exceeds 1,000 euros.
Since December 30, 2024, Regulation (EU) 2023/1113 on information accompanying transfers of funds and certain crypto-assets, known as the TFR or Travel Rule, has applied in the EU. The regulation carries a rule from traditional payments over to crypto assets: anyone sending coins from one exchange to another passes along details of the sender and the recipient. These include the name, the wallet address or account number and, depending on the case, the address or date of birth.
Unlike bank transfers, transfers between two crypto service providers have no minimum amount. The details therefore travel even with a transfer of 30 euros. That is why your exchange often asks, before a withdrawal to another platform, who the recipient is and with which provider they hold their account. If the details do not match, the receiving exchange can hold back the incoming funds until the data has been supplied.
A self-hosted address is a wallet whose private keys you keep yourself, for example on a hardware wallet or in a wallet app without an exchange account behind it. Transfers to such addresses follow their own rules. Under Article 14 of the regulation, when a transfer to a self-hosted address exceeds 1,000 euros, the exchange must take appropriate measures to establish whether the address belongs to you or is under your control.
How the exchange checks this is up to the exchange. Common methods are a confirmation in the app, a message signed with the private key, or proof taken directly from the wallet software. The practical point: do not leave your first large withdrawal to your hardware wallet until the last minute, because the check can take some time. Self-custody itself remains permitted; the rule only requires the proof.
Since this year, KYC has included one more detail that has nothing to do with money laundering. On January 1, 2026, Germany’s Crypto-Asset Tax Transparency Act (KStTG) came into force. It implements the European directive DAC8, the eighth version of the directive on administrative cooperation between tax authorities. Under it, crypto service providers report their customers’ transactions to the Federal Central Tax Office. The first reporting period is calendar year 2026, and according to an overview by the audit firm KPMG, the report is due by July 31, 2027.
So that the report can be matched to your tax account, exchanges ask for your tax identification number. If you opened your account before 2026, the exchange has to obtain this detail retrospectively. The basic rules for your tax return do not change: under current law, gains from private disposals of crypto assets within one year of purchase are taxable, and tax-free once this holding period has passed. What is new is that the tax office will be able to compare the exchange’s data with your own figures.
KYC records stay in the exchange’s archive for years after the customer relationship ends.
Many readers ask what happens to the ID copy and the video recording after the check. The answer is in Section 8(4) of the Anti-Money Laundering Act: the exchange must keep the records for five years. The period starts at the end of the calendar year in which the business relationship ends. If you close your account in June 2027, your data will therefore be stored until the end of 2032. It must be destroyed after ten years at the latest.
The exchange may use KYC data only for the purposes of the anti-money laundering law and its statutory reporting obligations. The General Data Protection Regulation applies as well, so you have a right of access. You cannot, however, demand deletion before the period expires, because the statutory retention obligation takes precedence.
A residual risk remains: ID data is valuable to fraudsters, and data leaks at financial service providers do happen. How such a case can unfold is shown in our report on the Revolut data breach, after which the bank is paying for new IDs for 680 affected customers. You can reduce the risk by opening accounts only with providers holding an EU licence, closing accounts you no longer need and never sending your ID by email or messenger when someone supposedly asks for it on behalf of an exchange.
Under MiCA, crypto-asset service providers in the EU need a licence, and with the licence come the obligations of anti-money laundering law. What the regulation requires of companies is explained in our overview of the MiCA licence and the obligations for crypto companies. A licensed exchange without KYC therefore does not exist. A provider that promises you an account with no ID at all while advertising an EU licence deserves suspicion.
There are still routes without ID, just not through a licensed exchange: decentralised exchanges, where you trade directly from your wallet, peer-to-peer trading or swaps in a wallet app. Which options remain under MiCA and where their limits lie is covered in the guide Crypto exchanges without KYC. The route for buying Bitcoin in particular is described in Buying Bitcoin without KYC. Bear in mind that without a regulated provider you also have no one to turn to if something goes wrong.
If the exchange rejects your verification, it is usually down to formalities: an expired ID, a residential address that does not match the document, a blurred photo or a name spelled differently from the one on your current account. Go through these points before you make a second attempt. You will not always get a detailed explanation, because in the event of a suspicion of money laundering the act forbids the exchange from telling you.
The next stage has already been published in the Official Journal. The EU Anti-Money Laundering Regulation, AMLR for short, Regulation (EU) 2024/1624, will apply directly in all member states from July 10, 2027, replacing large parts of national anti-money laundering law. Article 79 will then prohibit credit institutions, financial institutions and crypto-asset service providers from keeping anonymous crypto-asset accounts or accounts that allow transactions to be obscured to a high degree, including through anonymity-enhancing cryptocurrencies. This refers to privacy coins, whose transactions cannot be traced on the blockchain.
For holders of a normal exchange account, little changes as a result, because their KYC is already complete today. The AMLR will be felt mainly in two respects: the rules will be the same across the EU, and the new European anti-money laundering authority AMLA in Frankfurt am Main will directly supervise selected large providers in future. A KYC completed at an exchange in France or the Netherlands will then follow the same requirements as one at a German provider.
Before you register with an exchange, it is worth taking a quick look at your documents. It saves you an aborted video call and days in the queue.
(As of November 5, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)
