A crypto exchange can know your passport before it knows where one particular bitcoin came from.
That distinction explains why KYC can return years after an account was opened.
The exchange is not maintaining one identity checkbox. It is maintaining an evidence dossier that can grow from who you are to where you live, who owns the payment method, where a specific transfer came from and, in higher-risk cases, how the broader wealth was accumulated.
This article is about that dossier.
Evidence boundary: KYC, AML and source-of-funds requirements depend on jurisdiction, legal entity, product and risk profile. This is operational education, not legal advice.
File one: identity
The first file answers a narrow question: is this account attached to the person or entity it claims to represent?
Typical evidence can include:
- government-issued identity document;
- date of birth;
- selfie or liveness check;
- legal name and contact information;
- business registration and beneficial owners for an entity account.
Passing this file does not prove that every future transaction is low risk. It establishes the customer identity against which later activity can be evaluated.
File two: residence and legal eligibility
An exchange brand can operate through several legal entities. Residence determines which one can serve the user and which products are available.
That is why a move, expired document or country change can trigger a new verification request even when the passport has not changed.
The useful record is not merely “KYC passed.” Keep:
| Field | Why it matters |
|---|---|
| Verified residence | Determines legal entity and product eligibility |
| Verification date | Shows when the information was last current |
| Document used | Explains future expiry or refresh |
| Contracting entity | Determines terms, complaint path and local rules |
A review triggered by residence is not the same problem as a review triggered by suspicious transaction history.
File three: payment ownership
Now suppose the verified user deposits cash.
The exchange can ask whether the sending bank account or payment method belongs to the verified customer. Name mismatches, third-party processors and pooled accounts can create a second evidence problem.
Kraken’s current documentation, for example, says deposits should clearly originate from an account in the customer’s name; some third-party payment processors can be accepted when the source can be verified, while withdrawals to third-party processors are not supported under that route.
The evidence chain is:
verified person → owned bank/payment account → deposit reference → exchange cash balance.
Keep the bank statement and transfer reference when the amount is material.
File four: source of funds
This is where many users answer the wrong question.
Source of funds asks where the value for a specific transaction came from.
Kraken’s current guidance gives the distinction directly: if the money came from salary, investments, inheritance or another source, the user may need evidence showing both how the money was obtained and that it was actually received. For crypto already moved into the account, the evidence can include the external exchange or wallet transfer as well.
For a crypto transfer, the file might look like:
- original fiat purchase on Exchange A;
- Exchange A statement showing the purchase;
- withdrawal transaction hash;
- self-custody address history;
- subsequent swaps or bridges;
- transaction into the reviewing exchange.
The blockchain proves movement. It does not prove where the original economic value came from unless the off-chain records connect to it.
File five: source of wealth
Source of wealth is broader.
It asks how the person or business accumulated the overall wealth associated with the account: employment, business ownership, investments, property, inheritance or another long-term source.
A bank statement showing one transfer can be excellent source-of-funds evidence and weak source-of-wealth evidence.
| Question | Source of funds | Source of wealth |
|---|---|---|
| Scope | Specific transaction or funding stream | Overall accumulation of wealth |
| Typical evidence | Bank transfer, exchange statement, asset sale receipt | Income history, business records, investment/property history, inheritance |
| Common mistake | Showing that money exists without showing where it came from | Showing one deposit instead of the broader accumulation story |
File six: transaction purpose and counterparty
A valid identity and documented wealth source do not explain every wallet transfer.
Exchanges can investigate:
- rapid deposits and withdrawals;
- unusual size or frequency;
- new wallets or counterparties;
- exposure to addresses labelled as high risk;
- third-party payments;
- activity inconsistent with the stated account purpose.
A request can therefore become transaction-specific: who owns the destination, what was the payment for, why did the funds move through those wallets, and how does the transaction fit the account profile?
This is AML/KYT territory layered on top of KYC identity.
File seven: Travel Rule information
Some exchange-to-exchange transfers can require originator and beneficiary information under applicable Travel Rule regimes.
The user may be asked whether the destination is:
- another regulated service;
- a self-hosted wallet;
- a wallet belonging to another person;
- an account whose beneficiary information must accompany the transfer.
This is not necessarily a fresh identity verification. It is transaction information attached to the payment route.
Why KYC can reappear after a quiet account history
The dossier is time-sensitive.
A review can reappear because:
- an identity document expired;
- the user moved country;
- the exchange migrated accounts to another legal entity;
- transaction size changed;
- a new funding source appeared;
- the user accessed a new regulated product;
- risk rules or law changed;
- a counterparty or wallet triggered further review.
So the operational model is not:
KYC passed once → account permanently verified.
It is:
identity + residence + funding + transaction evidence are refreshed when the exchange’s current obligations and risk assessment require it.
The privacy cost is the combined dossier
The privacy concern is not one passport image in isolation.
A mature exchange account can link:
- legal identity;
- face/liveness data;
- home address;
- bank accounts;
- devices and login history;
- public blockchain addresses;
- transaction counterparties;
- income or investment evidence;
- source-of-wealth documents.
That dataset can support fraud prevention, recovery and compliance. It is also highly sensitive.
Read the privacy notice of the exact legal entity and understand retention, identity-verification vendors, regulatory disclosure and deletion limits before concentrating unnecessary information in one account.
A self-custody wallet removes the account dossier—not the public trail
Creating and using an ordinary self-custody wallet normally does not require an exchange KYC account.
That does not make the activity anonymous.
The blockchain can still expose addresses, balances and counterparties. A fiat on-ramp, exchange cash-out, regulated wallet service, RPC provider or other intermediary can add identity and network metadata.
No KYC is therefore not the same statement as no traceability.
How I would prepare for a source-of-funds review before it happens
For any large exchange funding event:
- Save the original acquisition record.
- Preserve bank or exchange statements.
- Record every material self-custody address used.
- Keep transaction hashes for transfers between those records.
- Document bridges and swaps that change the asset form.
- Keep the current legal entity and account reference.
- Do not edit source documents.
A clean evidence chain is much easier to provide under review than to reconstruct after an old exchange account has closed.
How to submit sensitive documents
Use only the exchange’s authenticated website or app and the official case route.
Do not give anyone:
- a seed phrase;
- private keys;
- 2FA codes;
- remote desktop access;
- an extra crypto payment to “unlock” verification.
Source-of-funds evidence may need wallet statements or ownership evidence. It does not require giving the exchange spending authority over a self-custody wallet.
The question to ask when a review arrives
Before uploading a pile of documents, identify which file the exchange is trying to complete:
Identity, residence, payment ownership, source of funds, source of wealth, transaction purpose or beneficiary information?
Answer that question with the narrowest complete evidence set.
That produces a better record than treating every review as “KYC again.”
For an account already restricted, use Crypto Exchange Account Restricted?. For moving assets after verification, use the pending withdrawal guide.
Primary sources
- Kraken: source of wealth and source of funds
- Kraken: third-party deposits and withdrawals
- FATF: virtual assets and VASPs
This article is operational education, not legal advice.
