KYC: Why You're Asked for Your ID

KYC, the travel rule, data collected, fake verification emails: what the law requires of crypto platforms and how to protect yourself.

First steps · Débutant · 8 min read · Publié le September 28, 2026

The essentials

What exactly is KYC?

When you open an account on a crypto platform, you are asked for an ID document, sometimes proof of address and a selfie. That is KYC: the procedure by which a professional verifies who its customer is.

This is not a commercial whim. It is an obligation imposed by anti-money-laundering and counter-terrorist-financing regulation, often abbreviated LCB-FT in France (or AML/CFT in English). The same rules already apply to banks when you open a current account.

This guide is general information: it is not legal advice.

The legal basis: why the platform has no choice

"Obligated" professionals

In France, the Monetary and Financial Code lists the professionals subject to anti-money-laundering obligations. Crypto-asset service providers are among them, just like banks or insurers. According to Tracfin, more than 230,000 professionals, spread across more than 50 professions, are concerned.

These professionals must notably:

identify their customers and verify their identity;
understand the nature of the relationship (what the account will be used for);
monitor transactions throughout the relationship;
report their suspicions to Tracfin when a transaction seems suspicious to them.

Tracfin, the recipient of reports

Tracfin is the French financial intelligence unit, attached to the Ministry of the Economy. It receives "suspicious transaction reports" from professionals and passes information on, where appropriate, to the justice system or the competent services. In 2025, Tracfin says it received 278,484 suspicious transaction reports, about 93% of them from financial professionals.

The link with MiCA

Since July 1, 2026, platforms must be authorized under the European MiCA regulation to operate in France. ESMA, the European markets regulator, has reminded us that authorized providers must have robust onboarding processes that comply with anti-money-laundering requirements. If you move your account to a new authorized platform, expect to redo a full KYC.

What data is collected?

The exact content varies by platform, your country and the amount of your transactions. Here is what you most often encounter:

Data	Why
Last name, first name, date of birth, nationality	Identify the person
ID document (passport, ID card, driver's license)	Verify identity against an official document
Recent proof of address	Verify the declared address
Selfie or short video	Check that the person is the document's holder
Questionnaire (occupation, source of funds, intended use)	Assess risk and profile

By way of illustration, Kraken's help page says it accepts a passport, driver's license or ID card (front and back), and requires proof of address dated within the last three months. Mobile phone bills are not accepted there, unlike landline bills. Other platforms have different rules: read their official help page.

For large amounts or unusual transactions, the platform may ask you for proof of the source of funds: pay slip, sale deed, bank statement. This is enhanced vigilance, not an accusation.

The travel rule: when your transfers carry your name

The principle

European Regulation (EU) 2023/1113, often called the TFR (Transfer of Funds Regulation), applies to crypto-assets a rule that already existed for bank transfers: the travel rule. It has applied since December 30, 2024.

In concrete terms, when a platform sends crypto for you, it must pass certain information to the receiving platform, before or at the time of the transfer:

the sender's name, blockchain address and, where applicable, account number, as well as additional identifying details;
the beneficiary's name and blockchain address.

What this changes for you

On a withdrawal, the platform may ask you for the beneficiary's name and country, and whether it is a wallet hosted by a platform or a personal wallet. On a deposit coming from another platform, it may ask who the sender is.

If information is missing, the regulation provides that the receiving platform can reject the transfer, send it back or request the missing information before crediting the funds.

The case of personal wallets

For a transfer of more than 1,000 euros to a self-hosted address (a wallet whose keys you hold), the platform must assess whether this address belongs to you or is controlled by you. Some platforms use a "satoshi test" for this: you send a tiny amount from that wallet to prove you control it. The exact method depends on the platform.

How to protect yourself from fake KYC

Verification requests have become a classic pretext for phishing. The Cybermalveillance.gouv.fr website warned in 2026 about personal data leaks affecting the crypto sector, followed by scam attempts: fraudsters pose as platforms or anti-fraud services to push victims into transferring their assets to fraudulent wallets. In the most serious cases, threats and physical assaults have been reported.

The habits to adopt

Only do KYC from the official app or by typing the site's address yourself, never via a link received by email, SMS or private message.
No legitimate platform will ask for your recovery phrase (seed phrase) or your passwords for an identity verification.
An unsolicited call announcing a "compliance problem" or a "suspended account" should raise your guard. Hang up and contact the platform through its official channels.
Beware of urgency: "verify within 24 hours or your funds will be blocked" is a typical scam marker.
Never send a copy of your documents through a messaging app to an "advisor."
Limit what you expose: avoid publicly showing that you hold crypto, especially with amounts.

If you've been a victim

According to Cybermalveillance.gouv.fr: file a complaint, report the data leak to the CNIL, and stay especially vigilant toward the contacts that follow, because scammers reuse stolen data.

A concrete example

Thomas receives a text message: "Your account is restricted following the new MiCA regulation. Update your KYC here: [link]." The message uses the name of his platform.

He doesn't click. He opens the official app already installed on his phone.
There is no alert in it. He checks in the security settings: no verification request pending.
He consults the official help page, which reminds him that the platform never asks for data by SMS.
He reports the message as fraudulent and deletes it.

A few weeks later, Thomas wants to withdraw crypto to his personal wallet. The app asks him to confirm that he owns the address. This time, the request appears inside the app, in the withdrawal flow: this is the normal application of the travel rule.

What "no-KYC" really implies

You'll see platforms promising to trade "without KYC." Here is what to understand:

A platform authorized in the Union cannot exempt you from KYC. If a service targets customers in France without verifying their identity, it is a strong sign that it is not MiCA-authorized.
No authorization, no MiCA protection. ESMA reminds us that the regulation's protections apply only to entities authorized in the Union. In case of bankruptcy, a hack or an account freeze, your recourse is very limited.
"No KYC" is often temporary. Some platforms let you open an account and then demand verification at the time of a withdrawal, with funds blocked in the meantime.
The link often ends up being made. When you send that crypto on to an authorized platform, it applies its due-diligence obligations and may ask you about the source of funds.

Conversely, holding crypto in your own wallet requires no KYC: you have no intermediary then. It is when you go through a professional to buy, sell or transfer that these obligations apply.

Mistakes to avoid

Clicking on a "KYC update" link received by email, SMS or social network.
Sharing your seed phrase with anyone, under any pretext.
Lying in the questionnaire about the source of funds: an inconsistency can lead to a block or the closure of the account.
Using a relative's documents to open an account: it is against the terms of use and can cause legal problems.
Choosing a platform because it is "no-KYC" without weighing the lack of protection.
Ignoring travel rule requests on a deposit: your transfer risks being rejected or sent back.

Key takeaways

KYC is a legal anti-money-laundering obligation that applies to all authorized crypto platforms in Europe, just as to banks.
The data requested serves to identify you, verify your address and, if needed, the source of your funds.
Since December 30, 2024, the travel rule requires the sender's and beneficiary's names to be passed along in transfers between platforms.
A legitimate KYC is done only in the official app or on the official website; never a seed phrase, never a link received by message.
"No-KYC" generally means no authorization and no MiCA protection.

Sources

Compare services related to this topic

Crypto exchange comparison