KYC and 2FA on crypto exchanges.
KYC, short for know your customer, is the identity check an exchange runs before you can deposit, trade or withdraw, usually with an ID document and a selfie. 2FA, two-factor authentication, asks for a second proof at login and withdrawal, such as an app code or a hardware security key. KYC protects the financial system; 2FA protects your account.
You sign up for a crypto exchange. Before you can deposit, it asks for a passport photo and a short video of your face. Then it asks you to scan a QR code with an authenticator app.
The first request is KYC and the second is 2FA. They protect different things, and you want both in place before real money goes in.
Why exchanges check who you are
Know your customer (KYC) is the process a financial business uses to confirm who its customers are. Licensed or registered crypto exchanges generally fall under anti-money-laundering (AML) rules, which require them to verify customers and report suspicious activity.
KYC also helps you. An account tied to your verified identity can be recovered if you lose your phone, and stolen coins that land in a verified account are easier for police to trace.
In many places, a rule often called the travel rule also requires exchanges to pass the sender's and receiver's details along with transfers to other exchanges.
Where it applies, a withdrawal may ask who owns the receiving address, even when it is your own wallet. Check how it works in your country.
What a KYC check involves
Most exchanges verify in levels, with higher limits for each step you complete. The exact levels and limits differ by exchange and country, but the pattern looks like this:
| Level | What you provide | What it usually allows |
|---|---|---|
| Basic | Name, date of birth, country, phone or email | Browsing, sometimes very small amounts |
| Verified | ID document and a selfie or short video | Deposits, trading and withdrawals up to a limit |
| Advanced | Proof of address, source of funds | Higher limits |
The selfie check compares your face with the photo on the ID and confirms that a live person is in front of the camera. Proof of address is usually a recent bank statement or utility bill.
Checks often fail on small things: a blurry or cropped photo, an expired document, a selfie in poor light, or a name that differs from your bank account. Fixing those first saves days of back and forth.
Protecting your identity documents
Once you complete KYC, the exchange stores copies of your documents. That data can leak in a breach, and leaked details make phishing messages more convincing, because the sender knows your name and address.
Scammers also fake the KYC process. A message says your account is frozen and links to a "verification" page that asks for your login, your 2FA code or your wallet seed phrase.
Start verification only inside the exchange's app or on a site address you typed yourself. A real exchange never needs your seed phrase or remote access to your computer. The scam spotting lesson covers more of these tricks.
What 2FA adds and which kind to use
Two-factor authentication (2FA) asks for a second proof besides your password, usually something you physically hold. A thief with your password still cannot log in or withdraw without it. Exchanges commonly offer three kinds.
SMS codes are sent to your phone number. They fail against a SIM swap, where an attacker talks your mobile carrier into moving your number to their SIM card.
Authenticator app codes come from a secret the app and the exchange share once, through a QR code. Each side turns that secret plus the current time into a 6-digit code that changes every 30 seconds.
A 6-digit code has 1,000,000 possible values, from 000000 to 999999. If an exchange locks the account after 5 wrong tries (an illustrative limit), a guesser's chance is 5 ÷ 1,000,000 = 0.0005%.
So attackers try to get the real code instead. A fake login page can ask for your app code and use it within the short window it stays valid.
Hardware security keys and passkeys resist that trick. Each one is tied to the real website address, so a fake login page gets nothing it can use.
Setting up account security that holds
- Use a unique password, stored in a password manager.
- Secure your email account first, since password resets go there.
- Turn on app or security key 2FA, and remove SMS as a fallback if the exchange allows it.
- Save the backup codes on paper, somewhere safe and offline.
- Turn on the withdrawal allowlist, so coins can only go to addresses you approved in advance. Many exchanges add a waiting period before a new address can be used.
- If the exchange offers one, set an anti-phishing code, a phrase of your choice that appears in every genuine email from it.
These settings matter most at the moment of withdrawal, because coins that leave the exchange cannot be pulled back. The lesson on protecting yourself from crypto scams goes further.
Questions
Can I use a crypto exchange without KYC?
Some exchanges allow limited use without it, and the rules vary by country and change over time. An unverified account can be limited or frozen when the exchange later asks for verification, sometimes with your money still inside.
Is SMS 2FA safe enough?
It stops someone who only has your password, but not someone who takes over your phone number through a SIM swap. An authenticator app or a security key is stronger where the exchange offers one.
What happens if I lose the phone with my 2FA app?
Use the backup codes you saved when you set up 2FA. Without them, the exchange will usually check your identity again before it resets 2FA, which can take days.
Will an exchange ever ask for my seed phrase?
No. The exchange controls its own keys for your balance and has no use for your personal wallet's seed phrase, so anyone who asks for it is trying to take your coins.
Keep learning
Chapter 1What is a crypto exchange?A crypto exchange is a marketplace where you swap government money for coins, or one coin for another. It lists trading pairs, matches buy and sell orders, and charges a fee on each trade. Most exchanges also hold the coins you deposit, so the exchange is your custodian as well as your market.
Chapter 1Centralized vs decentralized crypto exchanges.A centralized exchange (CEX) is a company that holds your deposits, checks your identity and matches orders on its own servers. A decentralized exchange (DEX) is a set of smart contracts that swaps tokens straight from your own wallet. With a CEX you trust a company; with a DEX you rely on the code and on your own care.
Chapter 1How to choose a crypto exchange.Check five things in order: that the exchange is allowed to serve people where you live, how it holds customer funds, the full cost of buying and withdrawing under your own plan, whether its order books are deep enough for your trade size, and how a small test deposit and withdrawal go before you move larger sums.
Chapter 1What are fiat on-ramps and off-ramps?A fiat on-ramp is any service that turns government money, such as dollars or euros, into crypto. An off-ramp does the reverse and pays the money back to your bank account. Exchanges, card payment providers and peer-to-peer markets all do this job, and each one charges its fees in different places.
