Quick Answer
KYC (Know Your Customer) and AML (Anti-Money Laundering) are the checks a regulated broker or crypto exchange must run before and after you open an account. KYC confirms who you are: your name, date of birth, address and identity documents. AML is the wider framework that uses that information to detect and report money laundering, terrorist financing and sanctions breaches, including screening against sanctions lists and monitoring unusual deposits and withdrawals. For traders, KYC is a short onboarding step, usually ID plus proof of address, and a strong sign that you are dealing with a legitimate, supervised firm.
Readers often ask me why a broker wants a passport scan, a utility bill and a selfie just to open a $200 account. It can feel intrusive. But after years in this industry, I see it the other way round: a broker or exchange that lets you deposit and trade with no identity checks at all is telling you something important about how it is run, and who else it lets in.
This guide explains what KYC and AML mean, where the rules come from, what documents to expect, why withdrawals sometimes trigger extra checks, and how to get verified quickly. It sits alongside our guide on how to choose the right broker.
What Is KYC?
Know Your Customer is the process a financial firm uses to establish and verify the identity of its clients. In regulation it is usually called customer due diligence (CDD). The global standard comes from the Financial Action Task Force (FATF), the intergovernmental body that sets anti-money laundering rules. FATF Recommendation 10 requires financial institutions to identify and verify their customers using reliable, independent sources, identify any beneficial owner, understand the purpose of the business relationship and carry out ongoing due diligence.
In practice, KYC at a broker answers three questions. Are you who you say you are? Are you allowed to use this service, given your country, age and any sanctions? And does the activity on your account make sense for someone with your profile?
What Is AML?
Anti-Money Laundering is the broader set of laws, controls and reporting duties designed to stop criminals from using the financial system to disguise illegal money or fund terrorism. KYC is one part of AML. The rest includes sanctions and politically exposed person (PEP) screening, transaction monitoring, record keeping, staff training and reporting suspicious activity to the authorities.
| KYC | AML | |
|---|---|---|
| Main question | Who is this client? | Is this money or activity legitimate? |
| When it happens | Mainly at account opening, refreshed periodically | Continuously, for the life of the account |
| What it involves | ID documents, proof of address, identity verification | Screening, monitoring, source of funds checks, suspicious activity reports |
| What you notice as a trader | Upload documents, take a selfie | Occasional requests for extra information, especially on withdrawals |
Where Do KYC and AML Rules Come From?
The FATF sets the international standard, and countries turn it into national law. That is why the process looks similar whether you open an account in London, Limassol or Sydney, even though the details differ.
In the United States, the Bank Secrecy Act and its customer identification program rules require firms such as futures commission merchants to collect, at a minimum, name, date of birth, address and an identification number such as a taxpayer ID or passport number. In the UK, the Money Laundering Regulations apply to firms supervised by the Financial Conduct Authority. In the European Union, a new single rulebook is on the way: the EU Anti-Money Laundering Authority (AMLA), based in Frankfurt, began operating in summer 2025, the new EU AML Regulation applies from 10 July 2027, and from 2028 AMLA will directly supervise up to 40 high-risk financial institutions.
Crypto platforms are covered too. FATF standards extend AML duties to virtual asset service providers, and the so-called Travel Rule requires them to obtain, hold and transmit originator and beneficiary information on transfers. That is why exchanges increasingly ask who owns the wallet you are withdrawing to. Our guide to forex, crypto and stock market regulators covers which bodies supervise which markets.
How the KYC and AML Process Works When You Open an Account
Most brokers and exchanges follow the same sequence, even if the screens look different.
1. Identify
You enter your personal details: full legal name, date of birth, residential address, nationality and usually a tax identification number. Some firms also ask about your employment and income at this stage.
2. Verify
You prove those details with documents. Most firms now use automated identity verification that reads your ID, checks its security features and compares your face with a short live selfie or video. Proof of address is usually a recent bank statement or utility bill.
3. Screen
Your details are checked against international sanctions lists and databases of politically exposed persons, meaning people in prominent public positions and their close associates. A PEP match does not mean you cannot open an account, but it usually triggers enhanced checks.
4. Assess
The firm assigns you a risk rating. For leveraged products, regulated brokers in the UK, EU and Australia also run an appropriateness test covering your trading knowledge and experience. That is not strictly AML, but it is part of the same onboarding and explains why you are asked how often you have traded CFDs or forex before.
5. Monitor
Once your account is open, AML continues in the background. Systems flag unusual patterns, such as large deposits that do not match your stated income, frequent deposits followed by quick withdrawals with little trading, or payments from third-party accounts.
What Documents Do Brokers and Exchanges Ask For?
Requirements vary by country and firm, but most will accept the following.
| Purpose | Commonly accepted documents | Tips |
|---|---|---|
| Proof of identity | Passport, national ID card, driving licence | Must be valid, in colour, with all four corners visible |
| Proof of address | Bank or card statement, utility bill, tax letter, residence certificate | Usually dated within the last three to six months; name and address must match your application |
| Liveness check | Selfie or short video in the app | Good lighting, no glasses or hats, follow the on-screen prompts |
| Source of funds (if requested) | Payslips, bank statements, sale contracts, tax returns | Usually triggered by larger deposits or higher risk ratings |
| Payment method ownership | Card photo with middle digits covered, bank statement showing your name | Withdrawals usually go back to the same method in your own name |
Why Withdrawals Can Trigger Extra Checks
The most common complaint I hear is “the broker let me deposit instantly, but now my withdrawal is on hold for verification.” There are legitimate reasons for this. Many firms allow limited deposits before full verification, then require completed KYC before any money leaves. AML rules also require firms to send withdrawals back to the original funding source where possible, so funds cannot be laundered by depositing from one account and withdrawing to another.
Large withdrawals, withdrawals soon after a large deposit with little trading, or a change of bank details can all trigger a source of funds request. Frustrating, yes, but at a well-regulated firm this is routine. The red flag is different: a firm that invents new “fees” or “taxes” you must pay before it releases a withdrawal. That is a classic scam pattern, not an AML check. We cover these warning signs in our guide to offshore brokers.
Why KYC Protects Traders Too
It is easy to see KYC as a burden that only serves regulators. It also protects you in practical ways:
- It makes it much harder for someone to open an account in your name or withdraw your money to their own bank.
- It keeps platforms cleaner, which reduces the chance of a sudden freeze or shutdown by authorities.
- It is a reliable signal of supervision. Firms that skip KYC are almost always operating outside strong regulation, as we explain in our guide on forex trading risks.
- Verified accounts are easier to recover if you lose access or need to prove ownership in a dispute.
KYC on Crypto Exchanges
Regulated crypto exchanges now apply KYC in much the same way as brokers, often with tiers. A basic tier might allow limited deposits, while full verification unlocks higher limits and fiat withdrawals. Because of the Travel Rule, you may also be asked to confirm whether a withdrawal address is your own wallet or belongs to another exchange or person.
Platforms advertising “no KYC” trading usually do so because they are not licensed where you live. That can mean no recourse if funds go missing. If you are new to crypto, our guides on how to buy cryptocurrency and crypto brokers versus exchanges explain how to choose a platform.
How to Pass KYC Quickly
Most delays come from small, avoidable mistakes. A few habits make verification faster:
- Use your full legal name exactly as it appears on your ID.
- Upload clear colour photos with all edges visible, not screenshots or black-and-white copies.
- Make sure your proof of address is recent and shows the same address you typed in the form.
- Fund the account from a bank account or card in your own name.
- Answer the experience and income questions honestly. Inconsistent answers are a common reason for manual review.
- Keep documents updated when your ID expires or you move.
Privacy and Data Security
Handing over a passport scan is a reasonable thing to worry about. Regulated firms in the UK and EU must protect personal data under data protection law and keep KYC records for set periods required by AML rules. Before uploading documents, check that you are on the firm’s genuine website or app, that the firm is licensed by a regulator you can verify, and that its privacy policy explains how long it keeps your data. Never send ID documents by email or messaging apps to someone claiming to be an “account manager.”
My View: Treat KYC as a Filter, Not an Obstacle
My view is that KYC is one of the simplest quality filters a trader has. A firm that verifies you properly, explains why it needs each document and processes verification in a day or two is behaving like a supervised financial institution. A firm that skips verification entirely, or only remembers it when you try to withdraw, is not. What would change my view of a specific broker is friction that does not match the rules: repeated document requests with no clear reason, or verification used as a reason to delay withdrawals indefinitely. That pattern deserves a complaint to the regulator, not patience.
Frequently Asked Questions
What is the difference between KYC and AML?
KYC is the process of identifying and verifying a customer. AML is the wider framework of laws and controls to prevent money laundering and terrorist financing, which includes KYC plus sanctions screening, transaction monitoring and suspicious activity reporting.
Why do brokers need my ID and proof of address?
Regulated brokers are legally required to verify the identity of their clients under anti-money laundering rules based on FATF standards. Proof of identity confirms who you are, and proof of address confirms where you live, which also determines which rules and protections apply to your account.
How long does KYC verification take?
With automated identity checks it often takes minutes to a few hours. Manual reviews, unclear documents or enhanced checks can take longer, sometimes a few business days.
Can I trade without KYC?
Not with a well-regulated broker or exchange. Platforms that allow trading without verification are usually unlicensed in your jurisdiction, which means fewer protections and more risk if something goes wrong.
Why is my withdrawal pending KYC?
Many firms require full verification before releasing withdrawals, and AML rules require them to return funds to the original payment source where possible. Larger or unusual withdrawals can also trigger source of funds checks.
Is it safe to upload my passport to a broker?
It is generally reasonable with a regulated firm that you have verified on the regulator’s register, using its official website or app. Never send identity documents through email or messaging apps to individuals claiming to represent a broker.
Risk warning: Trading forex, CFDs and cryptocurrencies carries a high level of risk and may not be suitable for all investors. You can lose some or all of your capital. This guide is for educational purposes only and is not legal, tax or investment advice.
Sources & Methodology
Primary-source standard: Market-moving facts should link to original data releases, regulator notices, company filings or official project announcements whenever available. Secondary reporting is used for additional context, not as a substitute for original evidence.
Page last reviewed: