Do I need ID to buy crypto?

This question is usually asked with mild embarrassment, as though wanting privacy were suspicious. It is not. Handing a passport photograph and a selfie to a company you have never dealt with is a reasonable thing to hesitate over, and “because you have to” is not an answer that helps anyone decide.

So here is what is actually happening, what is done with the documents, and what the alternatives really cost.

Why the requirement exists

Exchanges that let you move between ordinary money and crypto are money service businesses in most jurisdictions. That puts them under anti-money-laundering rules, and those rules have a standard shape almost everywhere: know who your customer is, keep records, and report activity that looks like laundering.

The industry name for it is KYC — know your customer. It is the same body of regulation that makes a bank ask for a passport when you open an account, applied to a newer kind of business. The Financial Action Task Force, the intergovernmental body that sets these standards, extended them explicitly to crypto service providers, and national regulators implemented that in local law.

What follows from this is worth stating plainly: no legitimate platform can opt out. An exchange that skipped it would lose its banking relationships, its licences, and its ability to send your money back to you. The requirement is not a preference you can shop around.

What the check actually does

Understanding this makes the process less opaque and, incidentally, makes it much easier to pass.

• Document authenticity. The machine-readable strip on a passport or the equivalent fields on an ID card are read and checked for internal consistency, and the image is examined for signs of tampering or of being a photograph of a screen.
• Face match and liveness. Your selfie is compared to the document photograph, and the movement prompts confirm a live person is present rather than a still image or a video.
• Sanctions and PEP screening. Your name and date of birth are checked against sanctions lists and databases of politically exposed persons. This is a legal obligation, not a judgement, and it is why the exact spelling of your name matters.
• Jurisdiction. Where you live determines which products are available to you and which local entity you are dealing with.

Most of it is automated and finishes in minutes. Anything that scores poorly goes to a human queue, which is where the waiting comes from.

What happens to your documents

The honest answer has two halves, and skipping either would be dishonest.

The reassuring half: major exchanges hold this data under the same regulatory regimes as banks. Documents are typically processed by specialist identity-verification providers, stored encrypted, and retained for a legally mandated period — often five years after the account closes, because record-keeping is itself a legal requirement. In the EU and UK you retain the usual data-protection rights of access and correction, though not the right to have records deleted while the retention obligation runs.

The half nobody enjoys: a stored copy of your passport and face is a permanent liability. Exchanges and their verification providers have been breached before, and identity documents are among the most valuable things a breach can yield. That risk does not go away because a company is large and careful. It is a genuine cost of participating, and you should weigh it rather than dismiss it.

What you can do about it: use one reputable platform rather than opening accounts on five, and never send documents through email or chat, only through the platform's own upload flow after logging in yourself. A request arriving by message with a link attached is phishing, regardless of how official it looks.

Reducing what you expose, without avoiding the requirement

The useful response to a privacy concern here is not evasion — it is limiting how many copies of your identity exist and how easily they can be reached. Several things are within your control.

• Verify on one platform, not five. Every additional account is another full copy of your passport and face held by another company with its own security posture. People open accounts to compare fee schedules and then leave four dormant, verified, and forgotten. Compare on the published fee pages instead, which requires no account at all.
• Only ever upload inside the platform, after logging in yourself. Never by email, never by chat, never through a link that arrived in a message. A document request with a link attached is phishing in essentially every case, and it is most convincing when you are genuinely waiting for a verification result.
• Do not upgrade to a tier you have not been asked for. Address and source-of-funds documents are additional exposure. Submit them when a limit you actually need requires it, not pre-emptively.
• Use an email address that is not your everyday one, with its own strong password and its own two-factor. It is the recovery route for the account, and it is also the thing an attacker goes after first.
• Close accounts you have stopped using, and ask for deletion of what can legally be deleted. Retention obligations will keep the core records for a period, but a closed account is one fewer live login attached to your documents.

What none of this changes: the documents you have already provided exist, and a data breach at a platform or its verification provider would expose them. That risk is real and permanent, and pretending otherwise would be dishonest. What the list above does is stop you multiplying it by five for no benefit — which is what most people do in their first month, comparing platforms by signing up to them.

One further point, since it comes up in the same breath: identity verification is not the same thing as your transactions being public. Blockchain activity is public by design regardless of any verification, and an exchange account links your identity to the coins you withdraw. That is a separate topic from whether you had to show a passport, and it surprises people who assumed the two were the same question.

The routes people find, and what they actually cost

Search for a way around this and you will find four. Each one is worth understanding rather than simply being warned about.

If you genuinely cannot verify

Some people are not avoiding this out of preference. A few situations make verification genuinely difficult, and the advice for them is different from the advice for someone who simply dislikes the idea.

You have no accepted document

Accepted lists vary by country and some exclude the documents people actually hold — provisional licences, older card designs, certain residence permits. If nothing you own appears on the list, that is a support conversation rather than something to keep resubmitting into. Occasionally another platform operating under a different local licence accepts a document type this one does not.

Your document is in a different name

After a marriage, a legal name change, or a transliteration difference between scripts, the name on your document may not match the name you use. Verification will fail on the mismatch. The route through is to use the name exactly as printed on the document you are submitting, and to have the supporting paperwork available if a human asks.

You live somewhere the platform does not serve

This is a jurisdiction decision, not a document problem, and no amount of resubmitting changes it. Selecting a different country to get past the form is the worst available response: your documents have to agree with it later, and the mismatch surfaces at withdrawal, after your money is inside.

You have no fixed address to prove

Where address verification is required, this is a real obstacle with no clean workaround. Some platforms accept a wider range of documents than their initial screen suggests, and support can say which.

What none of these justify is moving to an unverified service. The situations above make the legitimate route harder; they do not make the unregulated route safer, and a platform with no identity checks also has no obligation to give your money back.

What buying legitimately actually gives you

The verified route is not merely the compliant option; it is the one with recourse. A regulated platform has a complaints process, an ombudsman or regulator behind it in many countries, published terms, and an interest in not losing its licence. None of that exists on a service whose selling point is that nobody knows who runs it.

And the everyday version of that matters more than the dramatic version: when a deposit goes missing, when an account is restricted, when a withdrawal fails — on a regulated platform there is somebody obliged to answer. That is what the ten minutes of paperwork is buying.

If you have decided to go ahead, the sign-up and verification flow is walked field by field here, and the next practical question is what makes the check pass first time. The rejection guide covers that in detail, and the timing page explains why nobody can honestly promise you a duration.