The learning path
US exchanges ask for ID because federal anti money laundering rules require it. The data is kept for five years after you close the account, shared without telling you, and has leaked more than once in ways that put people in physical danger. Here is what to expect and what you can reasonably do.
Why an exchange wants your ID
Not because it wants to. A US exchange is a money services business under the Bank Secrecy Act, which means it must register with FinCEN, run a written anti money laundering program, and verify who its customers are. That obligation sits in federal regulation, and the penalties for ignoring it are the kind that close companies.
This is worth stating plainly because the usual framing is that exchanges are nosy. They are complying. Whether the underlying regime is proportionate is a fair argument to have, and it is an argument with Congress rather than with a support agent.
What they actually collect
| Stage | What is asked for | What triggers it |
|---|---|---|
| Account opening | Legal name, date of birth, residential address, and a government identification number, usually your Social Security number. | Everyone, before you can trade or deposit. |
| Document verification | A photo of a government ID, and usually a selfie or short video for liveness. | Standard at every major US exchange. |
| Proof of address | A utility bill or bank statement, typically within the last 90 days. | Address mismatch, a move, or a higher account tier. |
| Source of funds | Where the money came from. Pay stubs, sale documents, bank records. | Large deposits, unusual patterns, or a transfer from a flagged address. |
| Enhanced due diligence | Occupation, employer, expected activity, sometimes a call. | High volume, politically exposed persons, or higher risk jurisdictions. |
None of the major US exchanges let you skip this and still move dollars. The tiers differ, the requirement does not.
What happens to the data afterward
This is the part worth understanding, because it is where the real risk lives.
It is kept for years. Bank Secrecy Act recordkeeping requires retention of identifying records for five years after an account closes. Deleting your account does not delete the file.
It is shared without telling you. If an exchange files a suspicious activity report about you, it is legally prohibited from informing you that it did. You will not know, and there is no process to find out.
It moves with your transfers. Under the Travel Rule, transmittal orders at or above $3,000 carry identifying information between financial institutions. In crypto this means an exchange to exchange transfer carries name and account data alongside it.
It leaks. This is not hypothetical and it has hurt people.
The point is not that you should refuse. It is that the risk of a KYC dataset is not embarrassment, it is that it tells a stranger your name, your home address and that you own crypto. That is a different category of exposure from a leaked password, and it should change how you think about telling people what you hold.
What to actually expect
Verification usually takes minutes, sometimes days
Automated checks clear most people in under ten minutes. Manual review, triggered by a name mismatch or a poor document photo, takes one to three business days. A blurry ID is the single most common cause of delay.
Use the name exactly as printed on the ID
Middle names, hyphens, accents and married names cause more failed verifications than anything else. Match the document character for character.
Expect a hold on your first withdrawal
Most exchanges hold new accounts, new payment methods and new withdrawal addresses for a period, commonly 24 to 72 hours. This is anti fraud, not a problem with your account.
If your account is frozen, ask what is needed rather than what is wrong
Support usually cannot tell you why, and sometimes is legally forbidden from doing so. What they can tell you is which document would resolve it. Send that, calmly, once. Repeated tickets slow the queue.
Keep your own records regardless
Exchanges close, restrict jurisdictions and lose data. Export your transaction history at least once a year and keep it somewhere you control.
The "no KYC" question, answered straight
Decentralized exchanges do not ask for identity, because there is no company taking custody of your assets to ask. You connect a wallet and trade against a contract. That is a real architectural difference and not a loophole.
Two things follow that people routinely get wrong.
It is not privacy. Public blockchains are permanent and fully visible. The moment any address of yours touches an exchange where you are verified, that identity can be associated with your onchain history, backward and forward. Analysis firms do this as a commercial product. Not asking for your name is not the same as not knowing it.
It changes nothing about tax. US persons owe tax on gains wherever the trade happened. A decentralized exchange usually produces no tax form, which means the reporting burden is entirely yours, not that there is no burden. Trading without a form and without reporting is not a gray area.
What changed recently
Two things a US beginner should know as of September 2026.
Form 1099-DA is live. Custodial brokers report gross proceeds for transactions from January 2025, and cost basis for assets acquired from January 2026 and held with the same broker. Assets you transferred in from elsewhere arrive without basis, which means the form may show a large proceeds number and no record of what you paid. Keep your own records.
The DeFi broker rule was repealed. In April 2025 Congress nullified the regulations that would have required decentralized front ends to report like brokers. This removed a reporting requirement on those platforms. It did not change what is taxable, and it did not change your obligation to report.
Common questions
Why does a crypto exchange need my Social Security number?
Can I use a crypto exchange without ID?
How long do exchanges keep my documents?
Will I be told if my activity is reported?
Does the Travel Rule apply when I withdraw to my own wallet?
Is it dangerous to give an exchange my ID?
My account was frozen and support will not say why. What do I do?
Where to go next
Stuck on this one?
Some things click faster with someone walking you through them live. Orca sessions are one to one, screen shared, and paced for wherever you actually are.