What happens to your passport photo after you upload it.

The short version

• A verification is a copy, not a check. Your document image, every field extracted from it, your selfie and usually a facial template are stored — by the platform and, separately, by the identity vendor it bought the check from.
• You cannot delete it, and the refusal is lawful. Anti-money-laundering law requires the file to be retained, and privacy law explicitly exempts legally mandated retention from the right to erasure.
• Five years after you close the account is the floor. Closing an account does not begin a deletion. It begins a clock.
• The record has many custodians and only has to fail at one. Insider access, a vendor's exposed credentials, a bankruptcy docket and an ordinary breach have each produced real disclosures of crypto identity data.
• Crypto KYC is uniquely dangerous because it pairs an address with a balance. That is a targeting list, and it has been used as one.
• Most of the sharing is not a breach at all. Transfer-of-funds rules move your identity between institutions by design, and automatic tax reporting on crypto accounts begins with 2026 activity.
• The only lever with real leverage is the number of copies that get made. No-KYC infrastructure cannot delete the past. It can stop the next record from existing, which is worth more than it sounds, because exposure is cumulative and permanent.

Where the file actually goes

The mental model most people carry is that an exchange looks at your passport, decides you are real, and moves on. That is not what happens, and the gap between the two is where the entire risk lives.

What actually happens is that a copy is made and then distributed. Almost no exchange builds identity verification itself; it is a specialist product bought from a handful of vendors — the names you will encounter are Jumio, Onfido, Sumsub, Veriff, Persona and AU10TIX, among others. Your document is uploaded to that vendor's infrastructure, not the exchange's. The vendor performs authenticity checks on the document, runs optical character recognition to extract every field, compares your selfie against the document photograph, and returns a decision.

Each stage leaves residue, and the residue is the point:

• The exchange keeps its own copy in the customer due-diligence file it is legally required to be able to produce on demand. This is the copy that regulation is about.
• The vendor keeps a copy of the images and the extracted data, on its own retention schedule, governed by its contract with the exchange rather than by anything you agreed to.
• The vendor's sub-processors see it too. Document authentication, sanctions and politically-exposed-person screening, address validation and device-risk scoring are frequently separate services again, each receiving whichever fields it needs.
• Humans read the ones the machine declines. Escalated checks go to review teams, often outsourced and often in a different jurisdiction from either you or the exchange. This is not a hypothetical weakness: it is the exact mechanism behind the largest disclosed crypto identity incident to date.
• Everything above is in cloud storage with backups. Backups are, by design, copies that survive deletion, and they are on their own separate expiry schedule.

Count the custodians honestly and a single verification at a single exchange typically means your passport image exists in three to six organisations. You chose one of them. You will never be told the names of the others unless you specifically ask, which — as the section on access requests below explains — you are entitled to do and almost nobody does.

What the record actually contains

"KYC data" sounds like a passport scan. The file is considerably larger than that, and the parts nobody thinks about are frequently the more sensitive ones.

• The document itself — a full-colour image of a passport, national identity card or driving licence, with the machine-readable zone, the document number, the issuing authority and the expiry date.
• Every field, as structured text. Full legal name, date of birth, place of birth, nationality, document number. Extracted, indexed and searchable, which makes the record trivially joinable with any other database containing the same fields.
• Your face, as a template. The liveness selfie or video, and usually a derived biometric template. This is special-category data under the GDPR and covered by dedicated statutes in several US states, for a reason: it is the one field in the file that can never be reissued.
• Proof of address. A utility bill or bank statement, which is to say a second document that also contains an account number and a consumption or spending pattern.
• Financial identifiers. Bank account or card details used to fund the account, in full or masked depending on the platform.
• Source-of-funds and source-of-wealth narratives. Where enhanced due diligence applied, a free-text account of your employment, your assets and where your money came from — frequently the single most revealing item in the entire file.
• The technical envelope. IP addresses, device fingerprints, browser and operating system, geolocation at signup and at every subsequent login.
• Your complete activity. Every deposit, trade, withdrawal, balance snapshot and — critically — every blockchain address you ever deposited from or withdrew to.

That last line is what makes a crypto identity record different in kind from a leaked airline loyalty database. It is the join key between a legal identity and a public ledger. Anyone holding it does not merely know who you are; they can read your on-chain history from that point outward using entirely public data and the ordinary clustering techniques described in our guide to how crypto actually gets traced. One leaked record converts a pseudonymous chain history into a named one, permanently and retroactively.

Why you cannot delete it

This is the part that surprises people who assume a privacy law is a delete button, and it is worth understanding precisely, because the reasoning is not arbitrary and the workaround people imagine does not exist.

Anti-money-laundering regimes require obliged entities to retain customer due-diligence records so that a competent authority can reconstruct a relationship after the fact. The retention period converges on the same number nearly everywhere. The EU anti-money-laundering directives set five years from the end of the business relationship, with member states permitted to extend to ten; the 2024 EU anti-money-laundering package, which applies from mid-2027 and brings crypto-asset service providers fully into scope, keeps the same five-year rule. The UK Money Laundering Regulations specify five years. The US Bank Secrecy Act framework requires five years, with customer identification records held for five years after the account is closed.

Now place that next to the privacy law. The GDPR's right to erasure — the one usually described as the right to be forgotten — contains an explicit exception where processing is necessary for compliance with a legal obligation to which the controller is subject. Anti-money-laundering retention is the textbook case of such an obligation. The two laws do not conflict; the second yields to the first by design. When an exchange refuses to delete your identity documents, it is not being obstructive and it is not hiding behind a technicality. It is correctly applying the rule.

Three consequences follow, and none of them are widely understood:

1. Closing your account starts the clock rather than stopping it. The retention period runs from the end of the relationship. The day you close the account is day zero of five years, and you have now given up the login you would have needed to inspect what is held.
2. Over-retention is the rational business choice. A firm that destroys records too early faces a supervisory penalty. A firm that keeps them too long faces, realistically, very little. Deletion schedules are therefore generous, and "five years" is a floor rather than an expectation.
3. The vendor's clock is not the exchange's clock. Your contract, such as it is, is with the platform. The retention schedule of the identity vendor and its sub-processors is set by a commercial agreement you are not party to and have never read.

The single practical conclusion: the decision point is the upload, not anything afterwards. There is no later moment at which you get to change your mind. This is the same structure as the privacy decisions described in the chain-analysis guide — made at the time of the act or not available at all.

The four ways it actually gets out

It is tempting to read a list of incidents as a list of careless companies, and that framing leads to the wrong defence — picking a "better" exchange. The useful way to read them is as four structurally different failure modes, because a record held by six organisations is exposed to all four at each of them.

1. The insider, bribed or compromised

In May 2025 Coinbase disclosed that criminals had bribed overseas customer-support contractors to extract customer records. The categories the company listed are the reason this incident matters more than a larger-sounding number would: names, addresses, phone numbers, email addresses, masked social security numbers, masked bank-account identifiers, government-ID images, and account data including balance snapshots and transaction history. Coinbase said the affected population was under one percent of monthly transacting users, declined the extortion demand that followed, offered a bounty for information instead, and estimated the remediation cost in the hundreds of millions of dollars.

Note what defeated the controls here. Not encryption, not the security of the exchange's infrastructure, not any of the things a security page talks about. Support staff need to see customer records in order to do support, outsourced support is a normal cost decision at scale, and a person with legitimate access can be paid. There is no configuration that removes this risk, and the same structure exists at the identity vendor, whose escalated-review teams read documents by design.

The same shape appears elsewhere. In November 2021 Robinhood disclosed that an attacker had socially engineered a customer-support employee by telephone and obtained roughly five million email addresses and around two million names, with more detailed information for a smaller group. The technique required no vulnerability at all.

2. The vendor you never chose

The identity verification layer is a concentrated industry. A handful of vendors process documents for a very large share of the crypto sector plus large parts of fintech, ride-hailing and social media, which makes each of them a target holding a far bigger prize than any individual customer.

In 2024 security researchers reported that administrative credentials for AU10TIX, an identity-verification provider serving major platforms, had been exposed for an extended period — potentially permitting access to data about documents it had processed. In August 2019 an individual claiming to hold around ten thousand identity photographs attempted to extort Binance; the company disputed the provenance of the images, noting that they lacked its digital watermark, and pointed to a third-party vendor it had engaged during 2018. Whichever account of that episode is correct, the argument itself illustrates the structure: when documents surface, the platform and the vendor can each plausibly say the failure was on the other side, and the user has no way to establish which — nor any recourse against a company they never contracted with.

3. The lawful disclosure that is not a breach at all

In 2022, following Celsius's collapse, customer names were published alongside transaction histories in ordinary US bankruptcy filings. No attacker was involved. Bankruptcy proceedings are public, creditor schedules are part of the record, and a customer database is an asset of the estate. The data became permanently public through the correct operation of the legal system.

This generalises. When a platform is acquired, the customer file transfers with the business. When a platform fails, the file becomes an asset. When a court orders production, it is produced. Every custodial relationship you enter is a bet not only on that company's security but on its solvency, its ownership and its jurisdiction, over the full life of the record. That is a longer and stranger bet than most users think they are placing.

4. The ordinary breach, and the aggregation that follows

The conventional external compromise still happens, of course, and the crypto-adjacent list is long: Ledger's customer database in 2020, BlockFi and Gemini through third-party vendors, Nexo, Trezor's support portal in 2024, and many others. The individual incidents are unremarkable. What matters is what happens to the data afterwards.

Breached datasets do not stay separate. They are traded, combined and enriched, and a leak that contains only an email address becomes dangerous when it is joined to a different leak containing that email address and a home address, and a third containing a phone number. The Ledger case is the clearest illustration of what that produces in this sector specifically: roughly a million email addresses and around 272,000 records with names, postal addresses and phone numbers, dumped publicly, and every one of those records carried the same implicit fact — this person owns a hardware wallet. The result was years of highly credible phishing, and, in reported cases, threats made in person.

The non-crypto comparison worth keeping in mind is Optus in Australia in 2022, where the exposure of identity-document numbers for millions of customers forced a national conversation about reissuing passports and licences at scale. Document numbers can, at great cost and inconvenience, be reissued. Faces cannot.

What a leaked identity record is used for

The generic advice after a breach — watch your credit file — is aimed at a different threat. Here is what this particular combination of fields actually enables.

• Phishing that already knows the answer. An email that cites your real name, your real address, the platform you actually use and the approximate size of your balance defeats the heuristics most people rely on. The great majority of practical losses after a crypto data leak come from this, not from anything technical. Our guide on verifying a service before you send covers the routine that survives it.
• Targeted SIM swap. The record contains the phone number and enough personal detail to answer a mobile carrier's verification questions. That is the standard route into any account still protected by SMS codes.
• Credential stuffing with context. The email address is now known to belong to a crypto user with a specific platform and a specific balance, which moves it to the front of the queue for every reused-password attack.
• Extortion that does not need proof. The most effective threats are the ones the victim can immediately verify. A message quoting your address and your holdings is inherently credible, and the demand does not have to be large to be paid.
• Physical risk. This is the consequence that separates crypto data from most other leaked data, and it is not theoretical. The pairing of a home address with evidence of significant self-custodied holdings has, since 2020, been followed by documented threats, home invasions and abductions in several countries — enough that in 2025 the French authorities publicly extended protective measures to people in the industry following a series of attacks. A ledger balance cannot be frozen or reversed by a bank, which is precisely what makes its owner a target.
• Retrospective and cross-context harm. A record created in 2026 will still be readable in 2036. The person examining it may be an employer, an insurer, a border official, a family court, a journalist or a government whose posture toward your activity has changed in the interim. You are not only disclosing to today's reader.

The part that is not a breach: your data was always meant to travel

Focusing exclusively on breaches understates the exposure, because a large and growing share of the movement of your identity data is entirely lawful, automatic and invisible to you.

• The Travel Rule. The international standard extended to virtual assets in 2019 requires the originator's and beneficiary's identifying information to accompany transfers between regulated providers. In the EU the recast Transfer of Funds Regulation has applied since 30 December 2024 and, unlike the position in several other jurisdictions, sets no de minimis threshold for crypto-asset transfers. Your name is transmitted alongside the value, to a company you have no relationship with, as a matter of routine compliance.
• Automatic tax reporting. The OECD's Crypto-Asset Reporting Framework and the EU's corresponding directive begin collecting account and transaction data on 2026 activity, with the first automatic exchanges between tax administrations following in 2027. The mechanism mirrors the one already operating for bank accounts. We cover the implications for individuals in the crypto swap tax guide.
• Suspicious activity reporting. Reports filed with a financial intelligence unit are, in most regimes, legally prohibited from being disclosed to the subject. You are not told, and you cannot ask.
• Routine law-enforcement requests. Large platforms publish transparency reports showing thousands of government data requests per year, with high compliance rates.
• Commercial screening. Deposits and withdrawals are scored by chain-analysis vendors as a matter of course, which links your verified identity to a risk assessment maintained by yet another company. The chain-analysis guide explains how those scores are produced and why they are inherited rather than earned.

The point is not that any of this is illegitimate. It is that "has this exchange ever been breached" is the wrong question to be asking. The right one is how many organisations end up holding a record that identifies you, through mechanisms that are working exactly as intended.

The data-minimisation playbook

Given that deletion is largely unavailable, the entire game is limiting how many copies exist and what each one contains. Seven things, in order of leverage.

1. Inventory what already exists. Almost everyone underestimates this by a factor of several. Search your email archive for verification confirmations rather than trusting memory; the accounts you forgot about are the dangerous ones precisely because nobody is watching them, and a defunct platform's database is more likely to end up somewhere public than a live one's.
2. Request a copy before you close anything. A subject access request while you still have a login produces the only complete inventory of your exposure you will ever be handed, including — if you ask for it explicitly — the recipients your data was disclosed to. Close the account afterwards, never before.
3. Delete what is not legally retained. The AML carve-out protects the identity file. It does not protect the marketing profile, the support-ticket history, the analytics record or the advertising identifiers, all of which sit on a different legal basis and can genuinely be erased. Ask for those categories specifically rather than making a blanket request that is easy to refuse in full.
4. Stop verifying by default. The habit worth breaking is treating a verification form as a form. It is a permanent, irrevocable, distributed copy of your identity. Verify at as few venues as your actual needs require, and never upload a document to unlock a feature you have not decided to use.
5. Refuse the optional fields. Regulation prescribes a minimum. Employer details, source-of-wealth narratives, secondary documents, social media handles and marketing consents beyond that minimum are the platform asking rather than the law requiring, and free-text wealth narratives in particular are usually the most revealing thing in the whole file.
6. Separate the identified leg from the private leg. If some of your activity has to touch a verified venue — and for most people some of it does — keep it structurally apart from the activity you would not want indexed against your name, so that disclosure of the first does not automatically describe the second. This is a wallet-architecture question as much as a platform one, and the wallet hygiene guide is the practical companion to it.
7. Harden the identity you have already given away. Assume the record is public and act accordingly: move the phone number off SMS-based account recovery, use hardware-backed multi-factor authentication everywhere, use a unique address per service so you can tell which one leaked, be careful about publishing holdings, and treat any unsolicited message that already knows your balance as hostile by default.

The access request that works, and the erasure request that mostly does not

Two different rights, routinely confused, with very different success rates.

The right of access is the useful one. Under the GDPR it entitles you to a copy of your personal data plus the purposes of processing, the categories of data, the recipients or categories of recipients it has been disclosed to, the retention period, and the source if it was not collected from you. There is no AML carve-out. The controller has one month to respond, extendable by two for complex requests, and it is free. Comparable rights exist under California's privacy statutes and under the UK GDPR.

Make the request in writing, ask explicitly for the identity documents held, the retention period applied to them, and the named recipients rather than merely the categories. That last item is the one that reveals which identity vendor and which sub-processors hold your passport image, and it is the single most valuable sentence in the whole exercise.

The right to erasure is the one that usually fails, correctly. Expect a refusal for anything inside the AML file, citing the legal-obligation exception. That refusal is well founded and appealing it is not a good use of your time. What is worth pursuing is the perimeter: marketing lists, analytics profiles, support attachments, advertising identifiers and any documents collected beyond the regulatory minimum. Request those categories by name. A blanket "delete everything" invites a blanket refusal; a specific list forces a category-by-category answer, which is both more likely to succeed and more informative when it does not.

Two practical notes. Keep the responses — they are dated evidence of who held what, which matters if the data surfaces later. And expect the answer to be incomplete: many controllers will describe categories rather than name recipients unless you insist, and insisting is usually enough.

Where no-KYC actually helps, and where it does not

This site exists because we think the default of identifying everyone for every transaction is disproportionate. That belief does not entitle us to overstate what the alternative achieves, so here is the honest boundary.

What it does. It prevents the creation of a new record. No document is uploaded, so no vendor processes it, no reviewer reads it, no backup retains it and no bankruptcy docket can publish it. Because exposure is cumulative and permanent, avoiding one more copy is worth considerably more than it sounds — it is the only intervention in this entire subject that is fully effective, precisely because it acts before the record exists.

What it does not do. It does not delete anything. Records already created are governed by their retention schedules regardless of what you do next, and any service implying otherwise is misleading you. It does not make an inherently transparent blockchain private: if you receive a readable asset, chain analysis continues on the far side of any swap, which is the whole subject of is crypto swapping anonymous and of the chain-analysis guide. It does not change your tax position — the swap is a disposal in most jurisdictions whether anyone checked your passport or not, as set out in the tax guide. And it is not a licence to ignore sanctions or local law, which we cover jurisdiction by jurisdiction in is no-KYC swap legal where you live.

The framing we would defend: KYC exposure is a stock, not a flow. You cannot reduce the stock, so the only variable you control is how fast you add to it. Everything above is about that one variable.

What we hold, stated plainly

A guide about who holds your data is worthless unless it answers the same question about its author, so:

• We ask for no name, email address, phone number, or document, and there is no account to create. There is consequently no identity file, no vendor processing one, and no reviewer reading one.
• We forward what an order requires to the upstream liquidity router that fills it — the pair, the amount, the destination address and, if you provide one, the refund address. That party is the source of truth for order metadata and has its own retention policy, which we neither control nor pretend to. We would rather say this than imply the route ends with us.
• Order records are purged within thirty days, and sooner once an order settles or expires. Web server logs are the nginx default and rotate within twenty-four hours.
• No third-party analytics, no advertising scripts, no tracking cookies. The one cookie we set carries a CSRF token between the page and the API and is cleared when you close the browser. Fonts are self-hosted, so rendering a page contacts no font CDN.
• We could not action a deletion request about you even if you filed one, because we hold nothing that identifies you to delete. That is the honest flip side of the design, and it is stated on the privacy policy alongside the full detail. The infrastructure claims are itemised on the transparency page, and our disclosure process is on the security page.

What we cannot do is remove your documents from anywhere else. Nobody can. That is the entire reason the decision has to be made before the upload.

Related reading

For the broader case for and against identity checks, start with what is no-KYC crypto. For how a named record turns a public ledger into a biography, see blockchain analysis explained, and for what a swap does and does not conceal, is crypto swapping anonymous. The operational counterpart to this guide is wallet hygiene for privacy swaps. For the phishing that follows a leak, see how to verify a service before you send. For the legal backdrop, is no-KYC swap legal where you live and the tax guide. For acquiring an opaque asset without adding to the stock, how to buy Monero without KYC, and for the vocabulary used throughout, the glossary.

Frequently asked questions