Crypto KYC Explained: Why Platforms Verify ID

Being asked to photograph your passport to use a financial service feels intrusive, and the instinct to hesitate is reasonable. This guide explains why platforms ask, what the obligation actually is, what should happen to the image afterwards, and how to get verified on the first attempt instead of the third.

What KYC is

KYC — "know your customer" — is the process of establishing that a customer is a real, identifiable person. It exists because anonymous financial accounts are extremely useful for moving the proceeds of crime, and the regulatory response worldwide has been to require businesses handling money to identify who they are dealing with.

In the UK that obligation sits in the Money Laundering Regulations, which require customer due diligence, record-keeping and the reporting of suspicious activity. Similar frameworks exist in essentially every major jurisdiction. The practical result is the same everywhere: an identity document, checked against the person presenting it.

Why a platform cannot simply skip it

This is worth stating plainly, because "we respect your privacy, no KYC required" is a common marketing line and it should make you more suspicious rather than less. A platform that handles customer funds and performs no identity checks is either operating outside the rules that apply to it, or it has no intention of being around long enough for that to matter.

Verification is also in your interest in a way that is easy to miss. It is what allows a platform to refuse a withdrawal to an attacker who has compromised your email, and it is what makes account recovery possible at all.

What should happen to your document

This is the question that deserves a specific answer rather than reassurance. What you should expect:

• Private storage. The file should not be reachable from the public web — no URL that returns it, guessable or otherwise. Documents stored in a public bucket are a recurring source of breaches.
• Access control. Only reviewers who need to see it should be able to, and access should be logged.
• A stated retention period. AML rules require records to be kept for a defined period, typically five years after the relationship ends. "Indefinitely" is not an acceptable answer.
• A deletion path. You should be able to find out what is held and request erasure once the retention obligation has lapsed.

On Bullish UK, documents are written to a private disk outside the web root and streamed to authorised reviewers through an access-controlled route. Text extraction runs in your browser before upload, so the fields are read on your device rather than by a third-party service. Our security page walks through the full lifecycle, and the privacy policy states the retention period.

Which documents work

Most platforms, including this one, accept three types:

• Passport. Usually the most reliable, because the machine-readable zone at the bottom of the photo page encodes the details in a standard format that software can read accurately.
• National ID card. Widely accepted; newer cards also carry a machine-readable zone.
• Driving licence. Accepted, but layouts vary enormously by country, so automatic extraction is less reliable and more fields usually need correcting by hand.

Getting it right first time

Most rejections come down to the photograph, not the person. The common causes, in rough order of frequency:

• Glare. Direct light on a laminated surface wipes out whole lines of text. Photograph in bright, indirect light — near a window, not under a ceiling spotlight.
• Cropping. All four corners must be inside the frame, including the machine-readable zone on a passport.
• Blur. Rest the device or the document on something solid. Autofocus struggles at close range on a handheld shot.
• Expiry. An expired document cannot be accepted, no matter how clear the image.
• Name mismatch. The name on your account should match the document. If you have married, changed your name or routinely use a shortened form, use the document version and mention it.
• Photographs of screens. A picture of a scan displayed on a monitor will usually be rejected. Photograph the physical document.

Automatic extraction is a convenience, not a verdict

When software reads your document, it is saving you typing — it is not deciding anything. OCR confuses 0 with O and 1 with I, and date formats are ambiguous across countries. Every field should remain editable, and you should check each one before submitting.

That is deliberately how our flow works: the fields are pre-filled, you correct anything that was misread, and a human reviews the submission afterwards. A mismatch between the typed fields and the visible document is the most common reason a submission is sent back.

Timescales

Expect a decision within one business day here. Elsewhere it varies from minutes to a week depending on whether review is automated. If a submission is rejected you should be told which field or image was the problem, so the second attempt is not guesswork.

Related: protecting your account covers the other half of account security, and our AML and KYC policy sets out our obligations in full.