Writing sample by Saransh Rayguru. Kestrel is a fictional crypto app, and the policies below are invented for illustration. It shows how I'd write a compliance page for a help centre.

Quick version? The law makes us, and as it turns out it protects you as well. We get this question a lot, and fair enough. Handing a passport scan to an app feels odd. Longer version below, with the complete list of what we ask for. No ambushes halfway through sign-up.

KYC stands for "know your customer". Opened a bank account lately? Then you've done KYC, even if nobody called it that. Any regulated business that moves money has to check three things before you can use it: you exist, you're you, and your name isn't on a sanctions list.

KYC belongs to a bigger family called AML, anti-money laundering, which is basically every rule written to stop criminals cleaning cash through ordinary financial firms. KYC is the bouncer. Everything after that is less visible. We notice odd activity. When the law says report it, we do.

There's an old idea that crypto lives outside the rules. Maybe it did in 2013. Today, in most big markets, if you exchange crypto for cash or hold it on someone's behalf, a regulator supervises you for anti-money laundering, much like a bank. FATF (the Financial Action Task Force) sets the global standards here, and it's been nudging every country that way for years. Ever heard of the "travel rule"? That's theirs. It says certain transfers between two providers must carry basic sender and recipient details, a bit like a bank wire.

If we skipped these checks we would lose our licence. Nobody wants that, least of all the people with money in their account.

There is a selfish upside for you as well. Picture someone trying to open an account in your name. With ID and a live selfie required, that gets a lot harder. Lose your phone? A verified identity is how we prove the account is yours and hand it back.

Allow about five minutes. Have these to hand:

Photo ID, in date. Passport, national ID card or driving licence are all fine. Get all four corners in shot and keep the glare off your name and date of birth. No photocopies, no screenshots.

A few seconds of selfie video. You'll be asked to blink or turn your head. Feels silly, but it's how we tell the ID's owner apart from someone who just found it on a bus.

Proof of address (only sometimes). Your ID shows an old address, or none at all? Then we'll want a utility bill, bank statement or tenancy contract no older than three months. Heads up: a mobile phone bill usually isn't accepted. That trips people up constantly.

The basics. Legal name spelled as on the ID, date of birth, nationality, where you live.

Now and then we come back with more questions. Please don't read that as suspicion. Most of the time a big deposit set it off, or your activity looks different from what you described when signing up.

In that case we may ask where the money came from. A payslip, a sale agreement for a property or car, or an exchange statement showing where crypto was bought earlier are typical. Send whatever you've got. Missing something? Say so in the ticket. A real human on our team reads those.

Encrypted on the way up and encrypted at rest. Only a handful of people on our compliance team can open them. Retention depends on the law where we're licensed. Five years after closing the account is common, sometimes longer. Then they're deleted. Selling them is off the table, and your selfie is used for this check and nothing else.

Bounced uploads are nearly always one of three: blur, expiry, or a name that doesn't match. Retake it near a window. Check the expiry. And look at how you typed your name, because "Mohd" on the account and "Mohammed" on the passport is enough to fail.

Failed twice? Go to Help → Verification and someone will review it manually.

No. Any regulated business that moves money has to check that you exist, that you're you and that your name isn't on a sanctions list before you can use it. If we skipped these checks we would lose our licence.

Usually not, and that trips people up constantly. Send a utility bill, bank statement or tenancy contract no older than three months. We only ask for proof of address when your ID shows an old address or none at all.

It comes from FATF, the body that sets the global standards here. Certain transfers between two providers must carry basic sender and recipient details, a bit like a bank wire.

A name that doesn't match is one of the three usual reasons an upload bounces. Type your legal name exactly as it's spelled on the ID. "Mohd" on the account and "Mohammed" on the passport is enough to fail.