Why Do Crypto Exchanges Need KYC? What the Law Asks For

Crypto exchanges need KYC because anti-money-laundering rules oblige them to carry out customer due diligence before they deal with you. That means identifying you, verifying the identity against a source that is independent of you, understanding what the account is for, and identifying anyone who really owns or controls it.

In the UK's Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLR 2017), regulation 14A gives crypto exchanges their own definition, “cryptoasset exchange provider”, and regulation 31 says that a firm unable to complete the checks must not start the relationship and must end an existing one.

The platform's own wording is shorter. Binance's English help page on individual identity verification opens with:

Identity verification or Know Your Customer (KYC) standards are designed to protect your account against fraud, corruption, money laundering, and terrorist financing.

That is a statement of purpose. The page does not cite a law, so the rest of this guide reads the law. We use the UK text because it is published clause by clause and names crypto exchanges explicitly.

The checks the regulation lists

Regulation 28(2) is the core of it:

The relevant person must— (a) identify the customer unless the identity of that customer is known to, and has been verified by, the relevant person; (b) verify the customer's identity unless the customer's identity has already been verified by the relevant person; and (c) assess, and where appropriate obtain information on, the purpose and intended nature of the business relationship or occasional transaction.

Regulation 28(4) adds a fourth item: where the customer is beneficially owned by another person, the firm must “identify the beneficial owner”.

If we had to point at one row, it would be the last. Opening an account for a relative, or lending yours to a friend, feels like lending a name. The regulation treats “who really benefits” as something the firm has to identify in its own right. We cover what goes wrong there in an account in someone else's name.

Higher-risk cases can also bring questions about where your money comes from. That clause is quoted in our source of funds guide, so we won't repeat it here.

Why typing your name is not enough

You filled in your real name. Why the photo of your passport as well? The answer is in how regulation 28(18) defines “verify”:

… “verify” means verify on the basis of documents or information in either case obtained from a reliable source which is independent of the person whose identity is being verified; (b) documents issued or made available by an official body are to be regarded as being independent of a person even if they are provided or made available to the relevant person by or on behalf of that person.

Your own statement of your name comes from you, so it is not independent. A passport or national ID card is issued by an official body, which makes it count as independent even though you are the one photographing and uploading it. That single definition is why a form alone never closes the check.

Regulation 28(19) allows a second route: information “obtained by means of an electronic identification process” may be regarded as coming from a reliable, independent source. Item (a) is joined to item (b) by “and”, so both must hold: the process also has to be secure from fraud and misuse and able to give assurance that the person claiming an identity is that person.

Keep the clause and the inference apart here. The regulation does not say “face scan required”. It says an electronic identification process meeting both conditions can count. Liveness checks and face matching are methods platforms choose to meet that standard, often through outside providers; that chain is in the vendor chain behind an identity check.

Read this way, a blurred or glare-covered ID photo that gets rejected is an independent source that could not be read. That is our interpretation; the rejection message may say something different.

Not only when you sign up

Regulation 27(1) lists when due diligence must be applied:

A relevant person must apply customer due diligence measures if the person— (a) establishes a business relationship; … (c) suspects money laundering or terrorist financing; or (d) doubts the veracity or adequacy of documents or information previously obtained for the purposes of identification or verification.

Item (b), left out above, covers one-off transfers above a set amount, which matters less when you are opening an account.

Only (a) is about opening the account. (c) and (d) can apply years later: an expired document, details that no longer match, or activity that raises a question can all bring the checks back, even on an account approved long ago (when verification comes back walks through that case). Binance's page also notes that, based on your region or selected payment channels, “you may need to increase your identity verification level”. That is regulation 27 seen from the platform side: your tier can move up, and sometimes drop, long after sign-up.

When the checks can't be completed

This is the “on what grounds?” question people ask when an account is restricted. Regulation 31 is headed “Requirement to cease transactions etc”:

(1) Where, in relation to any customer, a relevant person is unable to apply customer due diligence measures as required by regulation 28, that person— (a) must not carry out any transaction through a bank account with the customer or on behalf of the customer; (b) must not establish a business relationship or carry out a transaction with the customer otherwise than through a bank account; (c) must terminate any existing business relationship with the customer; …

Paragraph (2) leaves a narrow opening: paragraph (1)(a) “does not prevent money deposited in an account being repaid to the person who deposited it”. Item (d), cut from the quote above, requires the firm to consider whether it must make a disclosure under the Terrorism Act 2000 or the Proceeds of Crime Act 2002, and where a disclosure is required, the repayment in paragraph (2) needs the relevant consent under those Acts first. So read it as a conditional permission. It is not a promise that any platform will let you withdraw. What actually happens depends on the platform's own rules.

Binance's help page states its rules directly:

All new users are required to complete [Verified] to access Binance products and service offerings, including cryptocurrency deposits and trades.

Existing users who haven’t completed the [Verified] verification will have their account permissions temporarily changed to “Withdraw Only,” with services limited to fund withdrawal, order cancelation, position close, and redemption.

That points the same way as regulation 31: no new relationship without the checks, and a wind-down for existing ones. The details, such as which actions an unverified account keeps and the word “temporarily”, are the platform's own.

What regulation 14A does and doesn't tell you

Regulation 14A defines, under the UK regime, a business exchanging cryptoassets for money or money for cryptoassets as a “cryptoasset exchange provider”, a category the regulations single out by name. It does not tell you which law governs the particular exchange you use. That depends on where the platform is registered and where it operates, and this guide does not reach that conclusion for any platform.

Other countries have their own versions of these rules. We were not able to read their texts for this guide, so we quote none of them and make no claims about their contents.