KYC on Crypto Exchanges: What You Hand Over and How Revolut Leaked It

In September the British fintech Revolut sent scans of passports and driving licences, verification selfies and full bitcoin transaction histories of 680 customers to criminals. There was no hack in the usual sense. The requests for the data came from a genuine mailbox on an Italian government domain, passed every technical authenticity check, and staff treated them as a lawful demand from the authorities.

The story shows the other side of a procedure every new customer goes through. Below we look at how crypto exchange KYC works, which documents and data you are asked for, why, and how to reduce the chance that your details end up with fraudsters.

What KYC is

KYC stands for Know Your Customer. In plain terms, it is the rule that obliges a financial company to establish who is opening an account and to make sure that person really is who they claim to be.

For the user, KYC comes down to verification. You upload documents, take a photo of your face and give your residential address, and the service checks all of it against itself and against external databases. Identification is the first step: you say who you are, then you prove it with paperwork.

KYC almost always comes paired with AML, anti-money laundering. It is the second half of the same system. First the exchange works out who you are, then it watches where your money comes from and where it goes.

Why an exchange asks for your passport

The requirement comes from regulators, not from the platform itself. In almost every major jurisdiction crypto exchanges are treated as financial institutions and are bound by laws against money laundering and terrorist financing. A company that does not verify its customers risks its licence, its banking partners and heavy fines.

The global rules are set by the FATF, the international body that writes standards in this area. Its recommendations require crypto services to identify customers and to pass sender and recipient details along with transfers between platforms. This is known as the travel rule: information about the people travels together with the transaction.

Verification serves three practical purposes:

• to confirm that a real person stands behind the account, not a bot or a front;
• to screen the customer against sanctions lists and lists of people linked to money laundering;
• to give the exchange grounds to refuse service if financial activity looks suspicious.

There is a benefit for the user too. A verified account is easier to recover if you lose access, and in a dispute with the platform you have proof that the account and the crypto in it belong to you.

Which documents exchanges ask for

The exact set varies from platform to platform, but the basic list is much the same everywhere.

1. Proof of identity. A national ID or passport, an international passport or a driving licence. The page is photographed in full, without glare or cropped edges.
2. A photo of your face. Most services ask for a live selfie: the camera checks that a living person is in front of it, not a printout. Some platforms want the photo taken with the document in your hand.
3. Proof of address. Usually a bank statement or a utility bill no older than three months.
4. Source of funds. At higher levels the exchange asks where the money comes from: a payslip, a property sale agreement, an account statement.

Companies have to provide more: incorporation documents, details of beneficial owners, information on the director. They are also asked about the nature of the business and expected turnover.

Verification levels and limits

Most platforms split verification into tiers. Checks escalate step by step, from simple email confirmation to a review of your source of funds. The higher the tier, the more you hand over and the more the account can do. For large amounts or questionable documents some platforms also schedule a video call with a staff member.

Every exchange sets its own limits. Check them before you sign up, not after your first large deposit, when a withdrawal suddenly hits a ceiling.

How to pass verification on an exchange

The whole process takes anywhere from a few minutes to a couple of days. The steps are similar everywhere:

1. Register and confirm your email and phone number.
2. Open the verification section in your profile settings.
3. Choose your country and the type of document.
4. Photograph both sides of it in good light.
5. Take a photo of your face following the on-screen instructions.
6. Wait for the decision. Automated checks usually take minutes, manual review a day or two.

To get through on the first attempt, use the original document rather than a photocopy, and make sure the details on the form match your passport letter for letter, including the Latin spelling of your name. Upload files only through the official app or website: that is a matter of security, not convenience.

Why verification gets rejected

Rejections are usually about small things rather than suspicion:

• a blurry photo or glare on the image;
• an expired passport;
• a mismatch in how your name is spelled;
• a country of residence the exchange does not serve;
• an attempt to pass off someone else's documents as your own.

The last point deserves a closer look. Identity verification services compare the face in the selfie with the photo in the document and catch substitutions. An account opened in someone else's name can be blocked at any moment together with all the funds in it, and there is no way to contest that.

What happens after verification

Verification is not a one-off event. The exchange keeps watching your activity afterwards, and this stage is the one people underestimate.

The AML system scores every incoming transaction. If crypto arrives from an address linked to fraud, a mixer or a sanctioned service, the transfer gets a high risk score. The platform may then ask for an explanation, freeze the amount until things are cleared up or close the account. Checking the sender's address in advance helps, but AML checks have their own pitfalls, which we covered in our piece on crypto AML checks.

Sharp changes in behaviour also trigger a fresh review: large sums after months of silence, logins from another country, frequent transfers to new addresses. These are the classic signals used to look for money laundering. The practical takeaway for customers is to keep proof of where their funds came from ready in advance, not to start gathering it once the amount is already frozen.

How long exchanges keep your data

Deleting your account does not delete your ID from the platform's archive. Anti-money laundering laws oblige financial companies to keep copies of documents and records of transactions for at least five years after the relationship with a customer ends. Russia's law 115-FZ and the EU AML directives both set that minimum.

In practice, personal data uploaded once stays with the company for years, sometimes with several companies at once. Many crypto exchanges do not run the checks themselves but hand them to an external KYC provider, in which case copies are stored there too. Every extra link in that chain adds to the risk of a leak.

Before signing up it is worth opening the privacy policy and finding three things: who processes the data, where it is stored and who it may be shared with. If the platform does not answer those questions, that is a reason for caution before you upload a single file.

What happened at Revolut

The Revolut case stands out because the data did not leak through a software vulnerability but through a procedure that regulators consider protective.

According to the Financial Times and specialist outlets, the operation ran for months. The attackers gained access to a mailbox in Italy's certified email system PEC, linked to the Ministry of the Interior. Messages from that address passed every sender authentication check - SPF, DKIM and DMARC - so to the compliance team they looked like genuine requests from the authorities. Staff responded by exporting customer files.

What the attackers got:

• scans of passports and driving licences;
• selfies taken during verification;
• account statements, IBANs and withdrawal histories;
• full bitcoin transaction histories.

The group first demanded 10,000 BTC, around $780 million, then cut the figure to roughly $3 million in Monero and threatened to sell the files to other criminal groups. Revolut described the incident as a sophisticated external impersonation scam and said its systems and customer funds were unaffected. The UK data protection regulator is assessing a report of the breach, the Financial Conduct Authority is engaging with the company, and Italian authorities are investigating the compromise of the government mailbox.

Why stolen documents are dangerous

A scan on its own does not steal money. The danger is that leaked files come as a set: name, address, phone number, a photo of the face, transaction history and a rough idea of how much the person holds. For a fraudster that is a ready-made victim profile.

What can be done with it:

• open an account in your name on a platform with weak checks and push someone else's money through it;
• call you posing as a security team and quote the exact amounts of your transactions to win your trust;
• find the owner of a large crypto portfolio at their home address.

The last one is not theoretical. France alone has recorded more than 70 kidnappings and attacks aimed at extorting crypto in the first eight months of this year, as we described in our piece on wrench attacks in France. Photos of a face holding a document fetch more on the black market than plain scans, because they are used to get past verification on other services.

Crypto exchanges without verification: worth it?

Platforms and exchangers that do not ask for documents do exist, and the demand for anonymous purchases is understandable. But the choice comes with its own risks:

• withdrawal limits, after which the service asks for documents anyway, at a point when your money is already with it;
• funds frozen on an AML alert with no way to challenge the decision;
• no legal entity you can hold to account;
• a high share of scam clones among such services.

A separate risk arises when you sell crypto to private buyers outside any platform. If the buyer pays with money obtained through fraud, your bank may block your card as the recipient, and it will be up to you to prove your good faith. Keep the counterparty's details and your correspondence even for a one-off deal.

Put simply, skipping verification does not protect your data - it moves the risk somewhere else. Instead of a document leak, you take on the chance of losing the money itself.

How to protect your data during verification

You cannot rule out a leak completely, but you can limit the damage. The basic security rules are the same as for any financial service.

1. Check the website address. Phishing copies of exchanges collect documents exactly like the originals. We covered these schemes in our guide to crypto phishing scams.
2. Never send documents through messengers. No platform asks you to send a photo of your ID on Telegram or by replying to an email.
3. Mark copies you send by email. A note such as "for verification on platform X only" with a date makes the copy harder to reuse. This does not work for automated camera checks: the system will reject an edited image.
4. Turn on two-factor authentication. Stolen copies will not get anyone into your account if every login has to be confirmed in an authenticator app. It is the single most important security setting to enable on day one.
5. Do not talk about your portfolio in public. Showing off on social media remains the main way criminals pick their targets.

Also keep in mind the personal data you leave outside the exchange. A phone number linked to your crypto wallet and an email address on a public profile give an attacker the same thread to pull as a leaked scan. The fewer such traces, the better your overall security, and no amount of verification changes that.

KYC for users in Russia

Users in Russia face some specifics. Since September 1, 2026 crypto operations in the country have to go through licensed intermediaries, and Rosfinmonitoring, the financial intelligence unit, has announced that a taxpayer number (INN) will become mandatory for an account at a digital depository. Depositories report transactions above 60,000 rubles, about $700, to the regulator. We explain these rules in detail in our guide on how to open a crypto account in Russia.

Foreign platforms are a different story. Some do not accept Russian documents or restrict features for residents, so check the terms for your country before you register.

One more point. An exchange can hand over customer data in response to a lawful request - what that looks like in practice is covered in our piece on what exchanges hand over in data requests. The Revolut case adds an unpleasant twist: a request indistinguishable from a lawful one may turn out to be forged.