Why do crypto platforms ask for ID?

KYC and AML in plain terms

Money laundering is making money obtained through crime look as though it was earned legally. The money is moved between accounts, countries and assets until its origin is hard to trace. Any fast way to move value across borders can be misused for this, crypto included.

Anti-money launderingAnti-money laundering (AML)Rules and measures meant to stop the financial system, including crypto, from being used for money laundering or terrorist financing. (AML) rules are there to prevent it. KYC is one part of those rules: the provider confirms who you are and assesses what you intend to use the service for.

It is the same process as opening a bank account. The bank asks for ID and asks what the account will be used for. Crypto providers follow the same law.

What does Icelandic law say?

Act No. 140/2018 came into force on 1 January 2019. Under it, crypto-asset service providers are "obliged entities", alongside financial institutions, pension funds, auditors and estate agents. The purpose of the act is for these firms to know who their customers are and to report to the authorities if money laundering is suspected.

Before a business relationship begins, the provider must, among other things, confirm who you are with recognised ID and assess the purpose and nature of the business. After that, it must monitor the relationship regularly, confirm the source of funds where appropriate and keep the information up to date. If customer due diligence can't be completed, the provider may not do business with you. The Central Bank of Iceland supervises crypto-asset service providers' compliance with the act.

Since 1 July 2026, crypto-asset service providers in Iceland have also needed a licence under Act No. 101/2025 on markets in crypto-assets, which implements MiCAMiCAThe EU regulation on markets in crypto-assets, in force in Iceland since 1 January 2026, which sets the same rules for crypto services across the EEA.. Read more in What is MiCA and what does it mean for you?

At Myntkaup, you sign up with Icelandic electronic ID (rafræn skilríki) or the Auðkenni app, and an Icelandic kennitala is required. When a company opens an account, Myntkaup identifies its beneficial ownersBeneficial ownerThe individual who ultimately owns or controls a company, for example through a stake of more than 25%, held directly or through other companies. and carries out due diligence before the account is opened.

What are you asked?

The questions vary between providers, because the law requires due diligence to be based on a risk assessment. You will commonly be asked about:

• who you are: your name, kennitala, address and ID,
• what you will use the service for: for example long-term saving, and roughly how much you expect to deposit,
• political exposure: whether you or someone close to you holds or has held a senior public position,
• beneficial owners: when a company is involved.

Why are you asked about the source of funds?

The law requires providers to confirm, where appropriate, where the money comes from. In some cases enhanced due diligence is required, for example when transactions are unusually large or complex, when the pattern of activity is unusual, or when a customer is linked to a high-risk country or is a politically exposed person.

The question isn't an accusation. It is part of standard procedure, in the same way your bank asks when you deposit a large sum. Common documents that show where money came from include payslips, a sale agreement for a property, inheritance papers or a statement showing a sale of securities. It can pay to keep such documents to hand.

Sometimes the provider can't explain everything. The law prohibits obliged entities from telling a customer if a report has been sent to the police Financial Intelligence Unit. Most of the time, though, it is just a routine check.

The travel rule

The travel ruleTravel ruleA rule requiring crypto-asset service providers to send information about the sender and recipient with every crypto transfer. requires information about the sender and the recipient to "travel" with a transfer. You know this from your bank: when you transfer money, it shows who sent it and who received it.

In the EEA, the travel rule is based on Regulation (EU) 2023/1113 of 31 May 2023, which has applied in the EU since 30 December 2024. In Iceland, the regulation has the force of law under Article 57a of Act No. 140/2018. The article was added by Act No. 101/2025, which came into force on 1 January 2026.

In practice, this means:

• When a provider sends crypto on your behalf, information about you, such as your name and wallet addressWallet addressA string of letters and numbers you give out to receive crypto, much like a bank account number., and about the recipient must go with it. There is no minimum amount.
• When more than EUR 1,000 goes to or from a wallet in Self-custodySelf-custodyHolding the private keys to your crypto in your own wallet, so nobody else controls it but all the responsibility for the keys is yours., the provider must assess whether that wallet is owned or controlled by its customer. That is why a provider may ask you to show that a wallet is yours.

More on sending crypto in How to send crypto to another wallet.

What happens to your information?

The law sets a clear framework for how the data is handled:

• The purpose is limited. Personal data processed under the act may only be used to prevent money laundering and terrorist financing. Any other processing, use or disclosure on the basis of the act is prohibited.
• You have a right to be informed. The provider must tell you about the processing before the business relationship begins.
• Storage has limits. The data is kept for at least five years after the business relationship ends. Supervisors and the police Financial Intelligence Unit can require it to be kept longer, but by no more than five extra years. It must then be deleted once there is no longer a legitimate reason to keep it.
• Data protection law applies. Processing must comply with Act No. 90/2018 on data protection, Iceland's implementation of the GDPR, and the Icelandic Data Protection Authority (Persónuvernd) supervises it. Your right to access your own data can, however, be limited if it would interfere with anti-money laundering work.

It protects you too

It is easy to see KYC as a nuisance. But it also works in your favour:

• Your identity is harder to misuse. The Icelandic police point out that scammers go after card details and ID documents to open accounts in other people's names and hide the money trail. Proper identity checks make that harder.
• Unusual transactions get checked. At Myntkaup, unusually large withdrawals may need a manual security check before funds are sent.
• Transfers are easier to trace. The travel rule makes it easier for the authorities to trace transfers between providers.
• A warning sign. If a crypto platform doesn't ask for ID at all, that suggests it operates outside the rules. Since 1 July 2026, only licensed firms may provide services involving crypto-assetsCrypto-assetThe legal term for cryptocurrencies and tokens, meaning a digital representation of value or rights that can be transferred and stored on a blockchain. in Iceland. See How to check if a crypto provider is licensed.

Closing thoughts

KYC is a legal requirement that every licensed crypto provider must meet, just like banks. It is about knowing who the customer is and where the money comes from, not about suspecting you of anything.

The information may only be used for a defined purpose, and it is protected by data protection law. And the same rules that ask for your ID make life harder for scammers and thieves.