What Is KYC? Crypto ID Checks in Australia (2026)

What is KYC?

KYC stands for “know your customer”. It is the process a financial business uses to identify a new customer and confirm they are who they say they are, before it lets them open an account, deposit money or trade. Banks have done it for decades. In crypto, it is the step where an exchange asks for your licence or passport and a selfie before you can buy your first Bitcoin.

Australian law uses a broader term, customer due diligence (CDD). AUSTRAC’s overview of initial customer due diligence says a business must take reasonable steps to establish that the customer is who they claim to be, collect know your customer (KYC) information, and verify that information using reliable and independent data. CDD also covers checking whether someone is acting on the customer’s behalf, who the beneficial owners are, whether the customer is a politically exposed person or subject to targeted financial sanctions, and the nature and purpose of the relationship.

So “KYC” in everyday use usually means the identity part: proving your name, date of birth and address. The rest of CDD happens mostly behind the scenes.

Why KYC exists

KYC is a tool against financial crime. Money laundering, terrorism financing, scams and sanctions evasion all depend on moving money without anyone knowing who is behind it. Requiring businesses to know their customers makes that harder and creates records that law enforcement can follow later.

In Australia, the rules sit in the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (AML/CTF Act) and the AML/CTF Rules, and AUSTRAC is the regulator. AUSTRAC’s guidance is direct: initial CDD must be completed before a business provides a designated service, and if the business cannot establish the required matters on reasonable grounds, it must not start providing the service.

Crypto is a particular focus because transfers are fast, cross borders easily and are hard to reverse. Moneysmart’s crypto scams page describes scammers recruiting people through fake jobs to set up multiple bank and crypto accounts and move funds, and warns that those people are actually money laundering and could be charged by police. Identity checks are one of the ways exchanges try to stop accounts being used like this.

Where you meet KYC in crypto

AUSTRAC’s virtual asset designated services guidance explains which crypto businesses are covered. Exchanging virtual assets for money, and money for virtual assets, has been regulated since 2018. The guidance also lists exchanging one virtual asset for another, safekeeping virtual assets for customers, transferring virtual assets on a customer’s behalf, and certain offer and sale services. It says businesses must complete the steps needed to know their customer before they start providing a designated service.

In practice, you are likely to go through KYC when you:

• open an account with an Australian crypto exchange or broker, covered in our Australian crypto exchange guide;
• buy at a Bitcoin ATM, explained in our Bitcoin ATM guide;
• follow the account set-up step in our how to buy Bitcoin in Australia guide.

All of these businesses must be registered. AUSTRAC’s announcement of the public register says all virtual asset businesses must be registered before they can offer these services in Australia. Our exchange guide explains how to search that register; the short version is that a registered business is required to run KYC, and one that skips it is a warning sign.

What happens during a KYC check

Every business designs its own process, but AUSTRAC’s guidance sets out the building blocks. A typical online sign-up looks something like this:

1. You fill in an onboarding form. AUSTRAC’s guidance on initial CDD for individuals lists the information usually collected: full name, any other names you are known by, date of birth, residential address, and a unique identifier such as your passport or driver licence number.
2. The business verifies it. Details are checked against reliable and independent sources, usually a photo of your ID document and electronic checks against government or other records.
3. You may be asked for a selfie or short video. AUSTRAC’s guidance says a business could match the customer’s appearance against their photographic identification, in person or online. Apps often call this a liveness check, because it is designed to confirm a real person is present rather than a photo of a photo.
4. Screening runs in the background. The business checks whether you are a politically exposed person or subject to targeted financial sanctions, and assigns a risk rating.
5. Extra questions for higher risk. If the risk is higher, the business applies enhanced due diligence, which can mean questions about your source of funds, your occupation or what you plan to do with the account. Lower-risk situations can get simplified checks.

Many checks finish in minutes. Others are referred to a person for manual review, especially if a photo is blurry, a name does not match exactly, or the risk rating is higher.

The ID documents exchanges ask for

AUSTRAC’s guidance for individuals describes two common ways to verify name and date of birth:

Proof of address. Some platforms also ask for a recent bank statement or utility bill, particularly if your address cannot be confirmed electronically or your ID shows an old address.

What about the “100-point check”? Many Australians know identity checks as a 100-point check. That points system came from the Financial Transaction Reports Act 1988 and its regulations, as Wikipedia’s summary explains. Today’s AML/CTF rules are risk-based rather than points-based, so an exchange may not use the 100-point label, but the documents are much the same.

Electronic checks. Your licence or passport details may be checked against the issuing agency’s records through the government’s Document Verification Service (DVS), which confirms whether the details match the official record. IDMatch’s guidance requires organisations to get your consent before running a DVS check.

After sign-up: ongoing checks, records and transfers

KYC is not one-and-done. AUSTRAC’s ongoing customer due diligence guidance requires businesses to keep monitoring customers and their transactions. That is why an exchange may ask you to update your details, re-verify, or explain a large or unusual deposit.

Records are kept for years. Section 111 of the AML/CTF Act requires CDD records to be kept for 7 years after the business relationship ends. AUSTRAC’s record keeping overview adds that businesses are not required to make copies of identity documents; they can record, for example, the passport details used to verify you instead. Some still keep copies for other legal reasons, so closing an account does not mean your data disappears straight away.

Transfers carry identity information. Under AUSTRAC’s travel rule, information about the payer and payee travels with virtual asset transfers between businesses. When you withdraw to your own hot wallet or cold wallet, the exchange may ask you to confirm the wallet is yours, because the rules include extra due diligence on self-hosted wallets. AUSTRAC says reporting of transfers involving unverified self-hosted wallets will start on 31 March 2029.

Tax data-matching. KYC details also connect your exchange account to you for tax purposes. The ATO’s crypto data-matching protocol lists client identification details, including identity verification document details, among the data it collects from crypto designated service providers. Our crypto tax guide for students covers record keeping.

Privacy and data security

Handing over a licence, passport and a video of your face is a big ask, and the risk does not end when you are approved. Data held for 7 years or more can be exposed if a business, or a verification provider it uses, is breached.

The Privacy Act applies. Australian Privacy Principle 11, summarised in the OAIC’s APP quick reference, requires organisations to take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, and to destroy or de-identify it in certain circumstances. The OAIC’s small business guidance notes that AML/CTF reporting entities must comply with the APPs for their AML/CTF activities, regardless of annual turnover.

Breaches must be notified. Under the Notifiable Data Breaches scheme, organisations covered by the Privacy Act must notify affected individuals and the OAIC when a data breach is likely to result in serious harm. The notice must recommend steps you should take.

If your ID is caught up in a breach, the OAIC’s guide to responding to a breach notification suggests acting quickly:

• change passwords, starting with your email, and turn on multi-factor authentication;
• check your bank and exchange accounts for activity you do not recognise;
• get your credit reports and consider a ban if you suspect fraud;
• contact the agency that issued your driver licence, passport or Medicare card for advice;
• expect personalised scam messages that use your real name and details.

IDCARE, which Scamwatch describes as Australia and New Zealand’s national identity and cyber support service, offers free help on 1800 595 160 or through its website.

KYC data is different from the keys to your crypto. A business never needs your seed phrase to verify you. Our crypto security guide covers passwords, two-factor authentication and other account protections.

Fake “KYC verification” scams

Because everyone with an exchange account has been through KYC, “please re-verify your identity” is a believable message, and scammers use it. Moneysmart’s crypto scams page warns that scammers are impersonating legitimate digital currency exchanges to trick people into giving personal information and login details, and that an exchange or platform will never ask you to share your password.

Scamwatch’s phishing guidance lists the warning signs. Watch for:

• a message claiming to be from a business you use, asking you to update or verify your details or saying there is a problem with your account;
• pressure to act urgently, for example before your account is “frozen” or “suspended”;
• a sender address or website address that is slightly different from the real one;
• requests for one-time codes, passwords, remote access to your device, or a new app downloaded from a link;
• anyone asking for your seed phrase, which no genuine verification process needs.

The safe habit is simple: never verify through a link. Open the exchange’s official app, or type its address yourself, and check for any genuine request there. Scamwatch also suggests searching the exact wording of a suspicious message with the word “scam”.

A second scam runs the other way: someone offers to pay you to open a verified account, or to “rent” or buy your already-verified account. As Moneysmart warns, people recruited to open accounts and move money for others can end up laundering money for scammers. Our crypto scams guide and rug pull guide cover other common patterns.

What about “no-KYC” crypto?

Search results are full of lists of “no-KYC” exchanges. For Australians, the regulator’s position is the starting point: AUSTRAC’s virtual asset service provider guidance says it is illegal to provide virtual asset services in Australia without being registered, and registered providers must identify their customers before providing a service.

A platform that serves Australians without any identity checks is therefore a red flag rather than a feature. If it disappears, freezes withdrawals or turns out to be a fake, there may be no registered business to complain to. Moneysmart notes that scammers target crypto because it is not easily recovered.

Holding crypto in your own self-custody wallet is a different matter: wallet software you control is not a business taking you on as a customer. But buying, selling or transferring crypto through a business is where KYC applies, and that includes the moments when crypto moves between your own wallet and an exchange.

A checklist before you upload your ID

1. Did I start the process myself, inside the official app or by typing the website address, rather than from a link in a message?
2. Is the business on AUSTRAC’s register of virtual asset service providers?
3. Have I read its privacy policy and collection notice, including who does the identity checks and how long data is kept?
4. Am I only being asked for identity documents, not my password, one-time codes or seed phrase?
5. Is my email account protected with a strong unique password and multi-factor authentication?
6. Do I know what I would do if this business told me it had been breached?

What this means for Australians

KYC is the price of using a regulated crypto business in Australia. It can feel intrusive, but it exists for clear legal reasons, it is required before the service starts, and the business holding your data has obligations under both the AML/CTF Act and the Privacy Act. The practical job for you is to verify only with businesses you have checked, through channels you opened yourself, and to know what to do if your data is ever exposed.

Regulation is still changing. Our Australian crypto exchange guide covers registration and the incoming licensing rules for digital asset platforms. For general crypto risks, Moneysmart’s crypto assets page says you must be prepared to lose what you invest and to be wary of scammers.

Eagle BTM Pty Ltd ACN 659 281 820 publishes this education site and is an AUSTRAC-registered DCE/VASP. AUSTRAC registration is not an Australian financial services licence, and nothing here recommends an exchange, service or platform or is a recommendation to buy, sell or hold any asset. Jittie is in pre-launch. Join the waitlist for launch updates. General information only — not financial, tax, or legal advice.

Frequently Asked Questions