What KYC is and why every legitimate exchange needs it
KYC feels invasive and slow. It also exists for real reasons. Here is what your data is used for, what the risk is, and why "no-KYC" platforms tend to die badly.
10/05/2026 · 10 min de leitura · KYC · Compliance · Regulation
What KYC actually is
Know Your Customer is the regulatory requirement that financial institutions verify who their customers are. In the US, the BSA requires it. In the EU, AMLD5/6 requires it. In Brazil, the CVM and Receita Federal require it through specific instructions. Every legitimate exchange follows some version.
What you typically submit: government-issued ID (passport, national ID), proof of address (utility bill or bank statement under 90 days old), selfie holding the ID. The exchange runs this through a verification provider (Sumsub, Onfido, Veriff are the major ones) that does liveness detection and document forensics.
The result is a tiered account. Tier 1 (basic): low limits, mostly local payment rails. Tier 2 (verified): higher limits, full feature access. Tier 3 (institutional): often involves additional source-of-funds documentation.
Why exchanges actually need it
Banking access. Every exchange needs banking partners to convert crypto to fiat. Banks will not deal with exchanges that don't enforce KYC. The penalty for the bank exceeds any conceivable benefit, so exchanges without KYC get cut off.
Regulatory licenses. Money transmitter licenses, e-money licenses, virtual asset service provider registrations — all require KYC enforcement. Without these licenses, the exchange can't legally operate in most jurisdictions.
Tax reporting. In Brazil, the IN 1.888 requires exchanges to report user transactions to the Receita Federal monthly. In the US, the IRS Form 1099-DA requires similar reporting. Without KYC, the exchange can't comply.
What "no-KYC" actually means
Decentralized exchanges (Uniswap, Curve, dYdX) don't have KYC because they don't have user accounts. They are smart contracts that anyone with a wallet can interact with. This is real, and it works.
Centralized exchanges that advertise "no-KYC" almost always have hidden caveats: small withdrawal limits, exclusion of US/EU users, deplatform risk at any moment. They survive in legal grey zones that close eventually.
Many "no-KYC" platforms turned out to be exit scams (the funds disappeared) or were seized (Bitzlato, Garantex). When you trade off a regulator's blocklist, you are taking on operational risk that few retail users can price.
The real risk of submitting KYC
Data breaches. If an exchange leaks its KYC database, your full identity package is exposed: name, ID number, address, photo, sometimes selfies. This has happened multiple times historically (Coinbase 2023 partial leak; smaller exchanges leak more often).
Government access. Exchanges respond to subpoenas. If you live in a jurisdiction that targets crypto users, your trading activity is visible. This is a real consideration for journalists, activists, or anyone whose government is hostile to financial privacy.
Friction. KYC review can take hours to weeks. Bad documents get rejected. Account locks happen. The convenience cost is real.
How to think about it
For most users, the KYC tradeoff is favorable: you submit your identity once, get access to a regulated exchange with fiat rails, deep liquidity, and recourse if something breaks. The risk is data breach exposure, which is real but manageable.
For users in repressive jurisdictions or with specific privacy needs, the tradeoff is different. Self-custody plus DEX usage is the alternative. It has higher operational complexity and lower liquidity, but no government has an identity database tied to your wallet.
Most professional crypto users do both: regulated exchange for fiat on-ramp and most trading, self-custody plus DEX for sovereignty over long-term holdings.
What OFFCODE does with your KYC data
Stored encrypted at rest. The selfie and document images live in object storage with server-side encryption; access is logged. KYC review staff see decoded images only during active review.
Used for: AML monitoring (matching against sanctions lists), tax reporting (Receita Federal IN 1.888), regulatory inquiries when received via legal process. Not used for marketing.
Retained for as long as you have an account, plus a regulatory retention period after closure (typically 5 years). If you close your account, the data is anonymized after that window.
Bottom line
KYC is not optional for any exchange you'd trust with real money. The question is not whether to submit it; the question is which exchange has the best operational security around the data.
Pick an exchange with a clean track record, segregated infrastructure, and clear policies. Submit clean documents. Don't recycle the same selfie across 12 platforms. Treat your KYC package as a credential that has been issued to that institution alone.