KYC (Know Your Customer)

KYC - Know Your Customer - is the regulatory regime requiring financial service providers to verify the identity of their users. In the US it comes out of the Bank Secrecy Act: FinCEN said in its 2013 guidance that anyone exchanging bitcoin for dollars as a business is a money services business, which means registering, running an anti-money laundering program that verifies customer identity, keeping records, and filing reports. The EU reached the same place in 2018. For Bitcoin, this typically means centralized exchanges, custodial wallets, and on-ramp services collect government-issued ID, photos, addresses, and often more before letting you transact.

The official rationale: prevent money laundering and terrorism financing. The unofficial reality is more nuanced.

Two honest observations about KYC in practice:

• It raises the cost of casual fraud. A scammer who has to show a passport to cash out has one more thing to lose.
• It is weak against serious crime. Sophisticated criminals route around it. When the US Treasury sanctioned the Tornado Cash mixer in 2022, it said the service had laundered more than $7 billion since 2019, including over $455 million stolen by North Korea's Lazarus Group - money that never passed through a verified account in the thieves' own names. Meanwhile, KYC databases become honeypots. In May 2025 Coinbase disclosed that criminals had bribed overseas support agents to pull customer names, addresses, phone numbers, partial Social Security numbers, government ID images, and account balances, then used the data in social-engineering attacks that tricked customers into sending funds to the attackers; the company put the cleanup cost at up to $400 million. A name, a home address, and a balance is also the shopping list for an in-person robbery, the so-called wrench attack.

For ordinary users, KYC creates several real costs:

• Surveillance. Your on-chain history becomes linked to your real-world identity at the moment you withdraw from a KYC venue, and the venue is required to keep the records. Once linked, it stays linked.
• Censorship vector. A KYC-bound exchange can freeze your account, demand additional verification on withdrawal, refuse to release funds, or close your account for any reason.
• Data risk. Your ID photos sit on servers, and on the screens of support contractors, that get breached.
• Geographic asymmetry. KYC rules differ from country to country and change over time. The US regime dates from 2013, the EU's from 2018, and the thresholds and paperwork vary with them.

Non-KYC ways to get bitcoin exist: mining it, earning it as payment for your work or goods, and buying it from another person directly. FinCEN's own guidance keeps the small cases outside the regulated zone: a person who obtains bitcoin and spends it on goods and services is a "user", not a money transmitter, and so is someone who sells a little on an infrequent basis and not for profit. Peer-to-peer marketplaces that put buyers and sellers in direct contact are the organized form of that last option. They're more friction than the giants but preserve the properties most people came to Bitcoin for.

A defensible Bitcoiner approach: KYC is sometimes the only available on-ramp, and that's fine to use deliberately. But minimize how much of your stack ever touches it, and avoid making KYC venues the long-term custody point.

See Privacy on Bitcoin for how the exchange record becomes the anchor that names an entire address cluster.