Is KYC Safe? How ID Data Leaks and How Long It's Kept

KYC is not risk-free: ID images held by an exchange have leaked, and in the confirmed case the break was inside the company, with bribed support staff. In a May 2025 filing with the US Securities and Exchange Commission, Coinbase said contractors and employees in support roles outside the United States had been paid to collect customer information — government-ID images included — from internal systems they could reach for their jobs. A 2019 claim involving Binance is less certain. According to Binance’s statement as reported by The Block, someone demanded 300 BTC not to release photos resembling its KYC data; Binance said the images lacked its system’s watermark and appeared to date from a period when a third-party vendor handled its checks.

No channel can promise your file will never leak, and we do not vouch for any platform. The rules do fence in the copy you submit through the official flow: under the EU anti-money-laundering framework it may be used only for AML and counter-terrorist-financing checks, commercial use is expressly prohibited, and it is kept for five years after the business relationship ends, then deleted by default.

The part that is entirely yours is the route. Sending your ID photos and face video to an agent, a group chat or a lookalike site makes a copy that cannot be deleted and is hard to trace if it is misused.

So “what happens to my ID photo” is a fair thing to worry about, and it is usually asked as one question when it is four:

• How long that copy sits in a system;
• What it may be used for beyond the check itself — marketing, risk scoring, model training;
• Who has it: only the platform, or a vendor in the middle as well;
• What happens if it leaks: where past breaches actually happened, and whether anyone has to tell you.

The four answers come from different places and do not overlap. They only make sense apart.

How long: five years, and what happens after

The most-misread part first: retention is not a preference, it is an obligation. Article 40(1) of Directive (EU) 2015/849 requires obliged entities to keep a copy of the documents and information needed for customer due diligence “for a period of five years after the end of the business relationship with their customer or after the date of an occasional transaction”.

That single clause explains a frustration people read as stonewalling: while the relationship is live, “delete my ID photo” is not something the other side can agree to. Not unwilling — not permitted.

The rest of the same article is less quoted and works in your favour:

Upon expiry of the retention periods referred to in the first subparagraph, Member States shall ensure that obliged entities delete personal data, unless otherwise provided for by national law … That further retention period shall not exceed five additional years.

So this is not a permanent file. The default is deletion after five years; extending it requires a national-law basis and an assessment of necessity and proportionality, and it is capped at five more.

That is the rule today, set by a directive that each member state writes into its own law. From 10 July 2027 the same ground is covered by Regulation (EU) 2024/1624, which applies directly (its Article 90 sets that date). Article 77 keeps the five years but changes two details. The copy to be kept now expressly includes information obtained through electronic identification means. And the clock can start on a third date: besides the end of the relationship or an occasional transaction, it runs from the date the firm refused to take you on. Put plainly, if an application is turned down, the documents submitted with it are still held for five years from the refusal. On expiry, firms “shall delete personal data”; a competent authority may require longer retention on a case-by-case basis, and “that further retention period shall not exceed 5 years.”

What for: the purpose is locked by statute

This is the part worth carrying away, because it is far more concrete than “we store your data securely”. Article 41(2) of the same directive:

Personal data shall be processed by obliged entities on the basis of this Directive only for the purposes of the prevention of money laundering and terrorist financing … and shall not be further processed in a way that is incompatible with those purposes. The processing of personal data on the basis of this Directive for any other purposes, such as commercial purposes, shall be prohibited.

“Such as commercial purposes, shall be prohibited” is statutory text, not a promise in a privacy policy. The file you handed over to pass a check cannot, on this legal basis, be turned into marketing data or sold on — independently of how well any given policy is drafted.

Note the limit of the limit: it binds processing on the basis of this Directive. Other data processed on another legal basis sits outside it. So it is not a blanket shield — but for the KYC file specifically, the boundary is hard.

Who holds it: there is a layer past the platform

Most people assume the file stays with the platform. In practice the check is frequently outsourced, and you agreed to that in the terms. Clause 7.3 of Binance's terms of use puts it plainly: you authorise it to make enquiries directly or through third parties, and you acknowledge that your personal data may be disclosed to identity verification, compliance data recording, credit reference, fraud prevention or financial crime agencies — and that those agencies may respond to its enquiries in full.

Read the last part again: the pipe runs both ways.

That layer usually does not say who it is. A few platforms publish the list. Coinbase maintains a page naming the identity verification vendors it may use; on the day we read it the page showed a last-updated date of 9 December 2025 and named Jumio, Onfido, Au10tix, Shufti, Refinitiv, Unico and Persona. Three details on it are worth any user's time, whichever platform they are on:

• Vendors keep their own clocks. The page states that biometric information handled by Persona “will be stored for no more than 3 years”. That is not the same clock as the platform's five years. Your data is being timed on two chains at once.
• The same platform may use different vendors by region. The page notes Unico is used for Brazil users. So “it worked for me and not for them, on the same platform” has a mundane explanation: you were not judged by the same system.
• Vendors recognise returning faces. Of Onfido, Au10tix and Refinitiv the page says the same thing — facial scan data may be used to determine whether that vendor has previously verified your identity on the platform's behalf. The middle layer keeps its own memory of you.

That chain deserves its own piece: the vendor chain behind an identity check; which parts of it run automatically and which wait for a person is covered in what happens during those hours in the review queue.

Has KYC data actually leaked? Where it broke

Yes, at least once on the record. Coinbase confirmed a leak in a regulatory filing; a 2019 claim involving Binance was reported but disputed by Binance itself. The two point to different links in the chain.

Coinbase, 2025. On 15 May 2025 Coinbase Global filed a Form 8-K with the SEC. Under Item 1.05 it said that on 11 May an unknown threat actor had emailed the company claiming to hold information about certain customer accounts, and that the actor “appears to have obtained this information by paying multiple contractors or employees working in support roles outside the United States” to collect it from internal systems they could access to do their jobs. What the filing lists as taken includes name, address, phone and email; a masked Social Security number showing only the last four digits; government-ID images such as driver’s licences and passports; and account data including balance snapshots and transaction history. It also says passwords and private keys were not compromised, that none of the targeted staff could ever access customer funds, and that the company has not paid the demand.

Binance, 2019. On 7 August 2019 The Block reported Binance’s response to someone demanding 300 BTC in exchange for withholding 10,000 photos that “bear similarity to Binance KYC data”. In that statement Binance said the photos appeared to date from February 2018, when it had contracted a third-party vendor to handle the high volume of verification requests, and that “these images do not contain the digital watermark imprinted by our system”. So Binance itself questioned whether the images were genuine. We have not checked how the matter was later resolved, so this page stops at what the statement said.

The next point is our own reading of these sources. In the Coinbase case the file was already inside the system, with support staff, when it got out. If the Binance photos were genuine, their dates point to the period when a contractor did the checks, again a step after upload. Care at the upload screen would not have stopped either. What a leak sets up is the next risk, and the Coinbase filing names it, describing steps taken “to mitigate the risk that the compromised information could be used in social-engineering attempts”. A leaked ID image is most useful to someone who wants to sound like the platform when they contact you.

If the platform leaks, will you be told?

Not always. In the EU the GDPR sets out who has to be told, in what order, and only the last step points at you.

• The regulator first. Article 33(1): the controller “shall without undue delay and, where feasible, not later than 72 hours after having become aware of it” notify the supervisory authority — unless the breach is unlikely to result in a risk to people’s rights and freedoms.
• A vendor reports to the platform, not to you. Article 33(2): the processor notifies the controller without undue delay. If a leak happens at a verification vendor, the news reaches the exchange first.
• You, when the risk is high. Article 34(1) requires the controller to tell the data subject without undue delay when a breach is likely to result in a high risk to their rights and freedoms, and 34(2) says that notice must describe the nature of the breach in clear and plain language. Article 34(3) then lists conditions under which telling you individually is not required, for example when appropriate technical protection measures were in place.

So silence does not prove nothing happened, and a notice deserves action. If one arrives, the practical danger is the one Coinbase named: a caller or message that knows your real name, address and ID details and presents itself as “support”. Our own rule is blunt. After a breach notice, every unsolicited request for documents, a selfie, a code or a transfer is hostile until you have reached the platform through its own app or site. How to check a message asking for your ID is set out in what the hack notices said about KYC data; the “verification help” offers that tend to follow incidents like these are covered in why verification-for-hire is a trap.

Your rights, and the two places they give way

The GDPR gives you a set of rights. In this particular context two of them are expressly curtailed, and any honest account has to say so.

The second row surprises people. Anti-money-laundering regimes carry a no-tipping-off principle, and to make it work your right of access is lawfully trimmed. That is not a support agent brushing you off.

What survives is still useful: confirmation that your data is being processed, rectification of inaccurate fields, and erasure once the retention period has run. Rectification is the practical one — a misspelled name, a stale address, the wrong country of residence are all fixable through ordinary channels.

Why your face is treated differently

An ID number and a face are not the same class of thing in law. GDPR Article 4(14) defines biometric data as personal data resulting from specific technical processing relating to physical, physiological or behavioural characteristics “which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic data”.

Article 9(1) then says processing of biometric data for the purpose of uniquely identifying a natural person shall be prohibited — unless one of the exceptions in Article 9(2) applies.

Prohibited by default, permitted by exception. That structure explains two things you can observe: why a separate consent step appears before a face capture, and why retention and purpose language around face data tends to be more specific than for other fields. Not extra courtesy — a different starting point.

What you can do, and what you cannot

Worth doing:

1. Ask for the applicable retention period and its start date rather than asking whether data is kept forever.
2. Correct wrong fields. Name spelling, address, country of residence. This is routine, not a fight. The name field has its own traps: entering your name exactly as your ID shows it.
3. Hand the file to a chain you can trace — the official site or app, nothing routed through an intermediary. This matters more than anything you can do afterwards.
4. Close accounts you have finished with. The clock runs from the end of the relationship; a dormant open account never starts it.
5. Only climb as far as you need to. Every tier costs another file on the same retention clock — whether a tier is worth it is covered in why verification comes in tiers.

Not worth your time, because there is no footing for it: withdrawing a completed verification, demanding deletion inside the retention period, or requiring disclosure of the decision logic or of which vendor was used.

Questions people actually ask