Is Crypto Exchange KYC Safe? What Happens to Your ID After You Upload It

On an exchange’s own verification screens, your ID goes to the exchange and to the identity-verification companies it uses, and it stays on file after you close the account: five years or more on the notices that give a number. A deletion request can’t shorten what the law requires, and each privacy notice sets out who handles the files.

Who sees your ID, and how long exchanges keep it

The privacy notice is the document that answers this, and you may accept it in a single line on the sign-up screen, as in the screenshot below.

Here is what five exchanges’ notices and help pages say about the ID you upload.

The table follows the five exchanges’ privacy notices and help pages, as we read them in October 2026. Notices change, and one of the five was updated on 21 October 2026, so open the current version in the app or on the website before you rely on a figure.

A few things hold for all five:

• Your ID may pass through a verification company as well as the exchange. Two of the five name their providers in the notice, and the rest describe identity services, agencies or third parties without naming them. The vendor can also depend on the country you live in.
• The records outlast the account. In the UK, FCG 3.2.11 says firms “must keep copies of any documents and information obtained to meet CDD requirements” for five years after the business relationship ends. The same paragraph says the regulations require that data to be deleted after those periods, and that personal data collected under them should only be processed to prevent money laundering or terrorist financing. Other countries set their own periods, such as the seven-year minimum one exchange cites under Seychelles law.
• “Delete my data” has a legal floor. All five accept deletion requests in some cases and keep whatever the law makes them keep. Closing the account doesn’t change that, and two closure pages add a wait of 30 days or longer before the same ID can go on a new account.

Three of these exchanges describe software making the first call on your photos, and each describes a way to get a person to look again: self-service appeal options in the app or on the website that pass the case to KYC support staff for a manual review, human review that’s “Mandatory before final decision” when an automated identity check could delay, restrict or decline an account’s activation, or a request for a person to review the decision or contest it. If an automated check has got you wrong, that’s what to ask for.

The software can be wrong in ordinary ways. Binance’s privacy portal says its automated KYC checks aren’t perfect, and gives the example of twins opening separate accounts who are read as one person with two accounts.

Your data can also leave the country. Two of the notices place the exchange’s own processing in Seychelles and describe sending data abroad, either to verification providers in the UK and Singapore, which keep a copy of your document, your photograph and biometrics “Until cessation of agreement or earlier if requested”, or under adequacy decisions and safeguards such as standard contractual clauses. Refusing the overseas transfer, one of them says, means you can’t use the service. Two other promises appear in the notices: sensitive personal data encrypted in transit and at rest, and no sale of your personal data to third parties for their own commercial use.

Asking for a copy of your data, or for it to be deleted

Send the request to a contact point printed in a privacy notice you opened yourself, not one quoted in a message, and expect to prove who you are first. Two of the notices say they verify your identity before acting, one adding that it may refuse a request when it can’t, and those two are also the ones that set out the process in detail.

On Bybit, the notice lists access and portability, meaning certain data you gave it “in a structured, commonly used, machine-readable format”, requested through your account settings where available or through its support and data protection officer addresses. It accepts erasure requests, with legal exceptions, and promises a reply “within a reasonable period of time, but no later than the time period required by law.”

On Bitget, you can export an account ownership PDF from the website (not the app) with your KYC information and ID number, and the help page asks you to keep that file secure. Its notice accepts erasure requests with legal exceptions too, and its closure page says verified identity information is permanently deleted when you close, in line with that privacy policy and the regulations that apply; the policy is where its seven-year retention rule sits. After closing, you wait 30 days before registering again with the same mobile number, email address or ID. The notice aims to answer within one month of verifying you, extendable by up to two months where needed, and charges no fee unless a request is manifestly unfounded or excessive. For complaints it names the Information Commission of Seychelles or your local data protection authority.

Why do crypto exchanges need KYC?

The requirement comes from anti-money-laundering law. The UK Financial Conduct Authority’s Financial Crime Guide opens its customer due diligence section (FCG 3.2.4, dated 29 November 2024) with the line “Firms must identify their customers and, where applicable, their beneficial owners, and then verify their identities.” Where a firm can’t carry out those checks, the guide says “it must not enter into, or continue, the business relationship.” In the US, FinCEN’s Customer Due Diligence Rule puts “identify and verify the identity of customers” first among its four core requirements. Its page lists the US firms the rule covers, from banks and mutual funds to securities brokers. So the rule doesn’t reach every exchange everywhere, but the idea behind that first requirement is the same.

The exchanges’ own notices give the same reason. Four of the five tie identity checks to the law, whether they cite Know Your Customer and customer due diligence rules, “Compliance with a legal obligation”, anti-money-laundering and counter-terrorism financing laws, or anti-money-laundering regulations worldwide as the reason automated checks run on the documents, photo and live video you send. Two of the five require verification before you can use their products, deposits and trading included. The detail is in what each verification level asks for and opens, and the ID documents exchanges accept helps you pick one.

The same FCA section says an electronic ID check can count as a reliable source when the process is “independent of the person whose identity is being verified, secure from fraud and misuse” and gives enough assurance that you are who you say you are. We’d hold any upload screen you’re shown to that test. It should be the firm’s own process, with nobody standing in between.

Exchanges’ own FAQs answer this question too. Binance’s does it in two sentences: completing verification is safe, it says, and “Your documents are also confidential with us.” That’s the exchange vouching for itself, though. We’d put more weight on the privacy notices, because they’re where the detail is written down.

Three checks before each upload

A privacy notice binds the exchange, not someone copying its request, so run three checks before each upload:

1. You started from your own account. Begin the upload from the account you’re signed in to, not from a link in a text, an email, a direct message or an ad. Account matters are handled inside the exchange’s own app or website, not through a link someone sends you.
2. The same request is waiting when you sign in on your own. Kraken’s help centre says, “A genuine request will always be visible on your account after you log in.” So if someone contacted you about verification and your account shows nothing, treat the message as suspicious.
3. The photos go into the verification screens, not into a conversation. That rules out a support agent in a messaging app, an admin on Telegram and a reply to an email. OKX’s FAQ puts it in one line, “Do not submit sensitive identity documents in ordinary chat.”

Not sure whether an email address, phone number or account that contacted you belongs to the exchange? Look it up with the exchange’s own checker where it has one. Not every exchange does, so check which exchanges offer a lookup, and how each works. If a check fails and the photos have already gone, go straight to what to do after sending your ID to a fake.

Never send your ID or codes by chat, email or Telegram

The three checks all point your ID to the verification screens inside your own account. Keep these out of any chat, email or message thread, however official the other side looks:

• ID photos and selfies, including a photo of you holding the document.
• Your password, 2FA codes, recovery phrase, and any money or crypto. The exchanges’ own help pages list these among the things genuine staff never ask for. There’s more in what genuine support never needs from you, page by page.

An offer to pass verification for you, or to sell you an account that’s already verified, asks you to break the exchanges’ own rules. One identity FAQ says it plainly: you can’t transfer your account to another person or substitute another person’s ID for your own.

Sent your ID to a fake site or a chat?

Work out what went with it, then take these in order:

1. End the conversation. Send nothing more: no second photo, no selfie, no code, no payment.
2. If a password or a code went too, secure the account first. Open the real app yourself and follow the steps for a password or 2FA code you gave away.
3. Tell the exchange whose name was used, from inside its app or website. If you believe someone has used your identity document to verify an account, contact customer support; you may be asked to complete a live facial check, provide a valid identity document and explain why you believe the linked account isn’t yours.
4. Keep the messages and the fake site’s address, so you can show support what you sent and where.

In the US, the Federal Trade Commission’s page “What To Do if You Were Scammed” (June 2026) says to report a scammer at ReportFraud.ftc.gov, and to go to IdentityTheft.gov if a scammer used your Social Security number. Neither the FTC page nor the exchange pages we read list a scam-reporting service for other countries. For reporting a passport or driving licence to its issuer, see the breach steps.

If you later verify your own account and are told the ID is already linked to another one, that’s the situation step 3 is for. For Binance’s version of that message, see an “ID number has been used” message for an account you never opened.

If an exchange tells you your data was in a breach

Check that the message is real first. The UK Information Commissioner’s Office warns that “criminals can use information from data breaches to impersonate trusted organisations”, so look for the same notice inside your account rather than following a link in the email. A breach message that asks for a new ID photo or selfie through a link or a chat fails the same three checks as any other upload request.

One notice says that after a personal data breach it will “notify the competent Data Protection Authority and affected individuals without undue delay” where the law requires it. Once you know the message is genuine, take the steps that match what was exposed.

1. Ask the exchange what happened. The ICO says you can ask what information was affected and what the organisation plans to do to protect it. In the UK it has 30 days to acknowledge your complaint. Keep a record of each contact.
2. If a login was exposed, change that password and the same password anywhere else you use it, and consider two-factor authentication, as IdentityTheft.gov advises.
3. If your ID document was exposed, check what its issuer advises. The ICO’s steps after a breach include reporting lost or stolen passports and driving licences to whoever issued them. For US documents, IdentityTheft.gov says to report driving licence details to the nearest DMV branch and a lost or stolen passport to the State Department.
4. Watch your bank statements and credit report. In the US, IdentityTheft.gov adds a free credit freeze and a free one-year fraud alert. In the UK, the ICO mentions Cifas protective registration, for a fee.
5. If the exchange’s answer doesn’t settle it, the ICO takes UK complaints, and recommends letting the organisation investigate and respond first. Elsewhere, look in the exchange’s privacy notice for the authority it names.