KYC Requirements by Platform: What Each One Actually Asks For

Every platform runs the same broad checks, yet the paperwork they demand and the point at which they demand it varies enormously. This is a plain reference to what gets asked, when it gets asked, and why two exchanges can look at the same passport and reach opposite conclusions.

Last reviewed 30 July 2026 · by the KYC Rejected team

Why the requirements differ at all

It is tempting to assume that identity verification is one standard process that every company buys off the shelf. It is not. What actually happens is that each platform sits inside a particular regulatory perimeter, and that perimeter decides the floor. A licensed exchange operating under European anti money laundering rules has obligations that a freelance marketplace does not. A neobank holding customer deposits has obligations that a ride hailing app does not. The floor is set by law. Everything above the floor is a business decision about risk appetite.

That is the first thing worth internalising, because it explains a pattern that frustrates people constantly. You pass verification on one service in ninety seconds and fail on another for a week, using the same document, taken with the same phone, in the same room. The document was never the variable. The threshold was.

The second factor is the vendor. Almost no platform builds identity verification in house. They buy it, and the company they buy it from has its own model, its own training data, and its own tolerance for ambiguity. Coinbase, for example, publicly discloses that it works with a group of verification vendors including Onfido, Au10tix, Jumio, Refinitiv, Shufti, Persona, Prove and Sardine. A platform can route different users to different vendors depending on country, product and risk score. Two people submitting on the same day can be assessed by two different engines.

Once you understand that, the inconsistency stops looking random and starts looking like what it is: many different systems, each calibrated slightly differently, applied to the same underlying question.

What gets asked, and when

Rather than pretend every platform publishes a fixed rulebook, the table below sets out the pattern that holds across the categories. Use it to know what to have ready. Confirm the specifics with the platform, because these change quietly and often.

Reading the columns properly

Photo ID means a current, government issued document with your photograph on it. In practice that is a passport, a national identity card, or a driving licence. Student cards, workplace badges, medical cards, library cards and temporary paper permits are refused essentially everywhere, no matter how official they look. If a document was issued by anything other than a government, assume it will not be accepted.

Selfie or liveness covers two different things that often get confused. A selfie is a still photograph compared against the portrait on your document. A liveness check is a short interactive sequence, usually turning your head or following a prompt, whose purpose is to establish that a real person is physically present rather than a photograph, a printed mask, or a replayed video. Passing one does not guarantee passing the other. A great deal of failures happen at the liveness stage specifically because people move too quickly for the camera to track.

Proof of address is where a surprising number of otherwise clean applications collapse. The document usually has to be dated within the last three months, and it has to show your name and your address in the same form as your account profile. Bank statements, utility bills, and letters from a tax or council authority are generally accepted. Mobile phone bills are frequently refused, which catches people out because it feels like a utility bill. Capture the whole page including the letterhead and the date. A cropped screenshot showing only the address block is normally rejected outright.

Source of funds is the stage most people never reach, and it feels alarming when it arrives. It usually means the platform has applied enhanced due diligence, which is triggered by volume, by geography, or by a pattern their model considers unusual. It is not an accusation. It is a documentation request, and it is satisfied with payslips, investment statements, a contract of sale, or similar evidence showing where the money originated.

Typical decision assumes a clean submission. A clean submission means a sharp photograph, all four corners visible, no glare across printed fields, and profile details that match the document exactly. Once anything is ambiguous, the case leaves the automated path and joins a human queue, and the timeline stops being measured in minutes.

Why nobody tells you what actually failed

This is the single most infuriating part of the process, and it has a specific explanation that almost nobody gives you. Platforms are frequently constrained by rules against what regulators call tipping off. If a submission was flagged by a fraud model or by a sanctions screen, telling the applicant which signal fired would tell a genuine bad actor exactly what to change on the next attempt. So the message you get back is deliberately vague.

The practical consequence is that a generic rejection notice can mean radically different things. It might mean your photograph had glare across the date of birth. It might mean your profile spells your name differently from your passport. It might mean an automated model matched your device or address to an existing account. It might mean nothing about you at all, and everything about the jurisdiction attached to your document.

Because the message will not narrow it down for you, the only sensible strategy is to eliminate the categories you control before spending another attempt. Fix the photograph. Fix the profile spelling. Confirm the document is currently valid. Only then resubmit. Guessing is expensive, because attempts are finite.

Attempts are a budget, and you should treat them like one

Most platforms permit somewhere between three and five automated attempts before the route closes. What happens next varies. On some services the case simply moves to a human reviewer, which is slower but survivable. On others the account is restricted, and recovering it requires a support conversation that can take weeks. A few will lock the account entirely.

This changes the correct strategy completely. The instinct after a rejection is to immediately retake the photo and submit again, because it costs nothing and takes thirty seconds. In reality it costs one of a very small number of chances, and if you have not changed the thing that actually caused the failure, you have simply burned it.

There is also a subtler trap. Resubmitting while an existing review is still open can reset your position in the queue on some platforms, which means an impatient second attempt can genuinely make you wait longer than doing nothing would have. If the status says pending rather than rejected, waiting is usually the faster path. Our guide on retry limits and bans covers what happens once the budget is exhausted.

Which document to lead with

If you have a choice, lead with a passport. The reason is technical rather than aesthetic. A passport carries a machine readable zone, the two lines of monospaced characters at the bottom of the photo page. That zone encodes your name, document number, nationality, date of birth and expiry date in a format designed to be read by machines, and it includes check digits. When the reader parses it successfully, the system now has two independent readings of your details, one from the printed fields and one from the encoded zone, and it can confirm they agree.

That redundancy is why passports tend to sail through flows where a driving licence stalls. A licence usually has no equivalent structure, so the reader depends entirely on optical character recognition of the printed text. Any glare, blur or unusual font pushes it toward failure.

National identity cards sit in between. Many modern ones carry a machine readable zone on the reverse, which is exactly why platforms insist on both sides. If you photograph only the front of a card whose useful data is on the back, you have removed the very thing the system wanted.

There is a full breakdown of what each document type needs to show on our accepted documents page.

Stop guessing what went wrong A human specialist corrects the document for you and sends it back ready to submit, usually in under 10 minutes. $1.99, money back if it is not approved. Get my fix

The mismatch problem

A large share of rejections have nothing to do with photography. They happen because the text on the document and the text in the account profile are not identical, and the comparison is far less forgiving than people expect.

The usual causes are mundane. A middle name printed on the passport but omitted from the profile. A maiden name that was never updated after marriage. An accented character typed without its accent, so that Muñoz becomes Munoz. A transliterated spelling where the Latin rendering on the document differs from the version someone types by habit. A date entered in the American month first order on a form expecting day first.

The correct fix is always to change the profile so it matches the document, never the other way around. Altering a document is a different category of problem entirely and will end far worse than a rejected verification. If your legal name genuinely changed, most platforms have a documented process for that, and it involves showing the change certificate rather than quietly editing a field. See name mismatch and address mismatch for the specifics.

Rejections you cannot photograph your way out of

A category of failures exists that no amount of retaking will solve, and recognising them early saves enormous frustration.

An expired document is the cleanest example. It is an automatic refusal with no appeal, and many platforms additionally decline anything within about three months of its expiry date because they do not want to onboard someone whose identity evidence is about to lapse. There is no technique here. You need a currently valid document.

Jurisdiction is the second. Platforms restrict or refuse residents of sanctioned and high risk territories, and that screen runs against your address and the issuing authority of your document regardless of how good the image is. If this is the cause, the honest answer is that you need a platform that serves your country, and our guide on country based rejections explains how to tell.

Duplicate identity is the third. If the platform matches you to an account that already exists, whether one you opened years ago and forgot or one a family member created on a shared device, verifying the new account is the wrong objective. Recovering the original one through support is the route that actually works.

What to have ready before you start

Preparation costs ten minutes and routinely saves days. Before you open the verification flow, gather the following.

• A currently valid government issued photo document, ideally a passport, with at least six months left before expiry.
• Both sides of it if it is a card rather than a booklet.
• A proof of address dated within three months, downloaded as a full page rather than screenshotted.
• Your account profile open in another tab so you can compare the spelling of your name character by character against the document.
• A window with daylight, and your phone flash switched off.
• A dark, plain surface to lay the document on so the edges contrast clearly with the background.

If you would rather have the photograph itself checked before you spend an attempt, our free document checker looks at the same qualities the automated systems look at and tells you what would fail.

Enhanced due diligence, and why it feels like an accusation

At some point a proportion of users receive a message that reads very differently from the usual verification prompt. It asks for a bank statement, a payslip, a contract of sale, or an explanation of where a particular deposit came from. People find this genuinely alarming, and a lot of them abandon the account at that moment because it feels like being investigated.

It is worth understanding what has actually happened, because the emotional reading is usually wrong. Anti money laundering frameworks require regulated firms to apply a risk based approach. Ordinary customers get standard checks. Customers who fall into higher risk categories get deeper ones. The categories are not moral judgements. They are things like transaction volume relative to what the account initially declared, exposure to jurisdictions considered higher risk, being a politically exposed person or connected to one, or a pattern of activity the firm's model has not seen from that account before.

Crossing one of those lines does not mean anyone thinks you have done anything wrong. It means the firm now has a documentation obligation it did not have yesterday, and it cannot let the account continue until the obligation is met. The request is administrative, and it is satisfied administratively.

What satisfies it is evidence that connects the money to a lawful origin. Payslips showing salary. An employment contract. A statement from the account the funds arrived from. Completion documents from a property sale. A dividend or investment statement. An inheritance or gift letter. The common thread is that the document should be issued by a third party rather than written by you, should carry a date, and should be legible in full including any letterhead.

Two practical notes. First, respond rather than ignore, because unanswered requests frequently end in restriction. Second, send exactly what was asked for. Sending a large bundle of unrelated documents tends to slow the review down rather than speed it up, because a human now has to read all of it.

Where you live changes the process

The same platform can behave quite differently depending on the country attached to your account, and this catches out people who moved recently or who compare notes with friends abroad.

Part of the variation is legal. Different regulators impose different obligations, so the paperwork demanded in one market can be heavier than in another for reasons that have nothing to do with you. Part of it is infrastructure. In some countries a platform can query a government or credit database directly and confirm your identity electronically, which is why verification there can complete in seconds without a document at all. Where no such database access exists, everything falls back to document capture, which is slower and more failure prone.

Document coverage matters too. Verification vendors maintain template libraries describing the layout, fonts and security features of documents from each issuing authority. Coverage of major passports is excellent. Coverage of less common national identity cards, regional driving licences and recently redesigned documents can lag. If your document was reissued in a new format very recently, you are occasionally ahead of the library, and a passport is the safer choice until the template catches up.

If you have moved country recently, the mismatch between your document's issuing state and your current address is itself a common trigger for extra checks. Our guide for expats and nomads covers how to handle that without it turning into a loop.

Frequently asked questions