Every trader has handed a photograph of their passport to a company they had never heard of a week earlier, and very few have thought about what happens next. The requirement is real and it exists for reasons that have nothing to do with protecting the customer, which is worth knowing before deciding how to feel about it.
Identity verification exists because financial regulators in most jurisdictions require institutions handling other people's money to know who those people are, and to be able to say so afterwards. The obligation is placed on the institution, enforced against the institution, and satisfied by the institution collecting information from you.
That framing explains almost everything about how it feels. The process is designed around what the platform must be able to demonstrate to a regulator rather than around what is convenient for you, which is why the requests seem arbitrary, why they repeat, and why the person handling your case cannot make exceptions. They are not administering a service; they are producing a record.
It also explains why it is not optional and not negotiable. A platform that skipped it would be exposed to penalties large enough to end it, and the individuals responsible can be personally liable in several jurisdictions. Whatever a support agent's sympathy, the constraint they are operating under is not one they can set aside for a customer.
Verification protects the platform from a regulator. Any benefit to you is a side effect, and there are several, but that is not what the process was designed to produce.
The standard set is an identity document, a photograph matching it, an address, and increasingly a check that the person is present and not a recording. Each element answers a specific question the institution has to be able to answer: that you exist, that the document is yours, where you are subject to rules, and that somebody did not simply upload a stolen image.
Beyond that, higher tiers or larger amounts trigger additional requests, and these are the ones that surprise people. Proof of the source of funds, employment information, and explanations of specific transfers are all standard at certain thresholds, and they are not accusations. They are the institution assembling a file that shows it asked, because being unable to show that it asked is the failure a regulator penalises.
The document requirements themselves are more particular than they look. A rejected upload is usually rejected by an automated system checking edges, glare, expiry dates and the machine-readable strip, not by a person deciding you look suspicious. Reading the specific reason given, rather than resubmitting the same image, resolves the large majority of these on the second attempt.
Most platforms do not perform verification themselves. They use one of a small number of specialist providers, which means the documents are processed and frequently stored by a third company you did not choose and whose name you may never see. That is standard practice across the financial industry and it is worth knowing, because the security of your identity documents is that provider's security rather than the platform's.
The data is also retained for a period set by regulation rather than by preference, typically years after an account closes, because the institution has to be able to produce records if asked later. Closing an account does not delete the file, and requesting deletion generally cannot override a retention obligation, which is a limit on data protection rights that surprises people who exercise them.
The practical consequence is a concentration worth being aware of. A handful of verification providers hold identity documents for a large share of the sector's customers, and a breach at one of them exposes documents submitted to many platforms at once. This has happened, the documents concerned are not revocable the way a password is, and that asymmetry is the strongest argument for caring which platforms you open accounts with at all.
Repeat verification is one of the most common frustrations and it usually has a mechanical cause. Regulations require periodic refresh, more often for accounts classified as higher risk. A change in your circumstances, your country of access, or the platform's own licensing can move you into a category with different requirements. And a document that has expired invalidates the file regardless of how long you have held the account.
There is also a category that has nothing to do with you. When a platform obtains a new licence or changes jurisdiction, it frequently has to re-verify its entire customer base under the new framework, and the request arrives without explanation because the explanation is a corporate one.
Knowing the cause changes the response. A refresh request during an ordinary period is administrative and answering it promptly costs nothing. A request that arrives alongside a withdrawal you initiated is a different situation, and it is worth reading carefully what specifically is being asked before providing more than that.
Above certain amounts, or on certain patterns, a platform will ask where the money came from, and the request reliably feels like a suspicion. It is a documentation requirement: the institution must hold a plausible explanation for the funds it processes, and the absence of one is a defect in its file rather than a judgement about you.
What satisfies it is ordinary evidence, and the difficulty is usually that people do not have it to hand. Payslips, a contract of sale, bank statements showing the transfer in, a tax return, or in the case of crypto acquired years ago, records of the original purchase. That last one is the hard case, and it is the reason keeping purchase records from the beginning is worth more than it appears at the time.
The response that makes it worse is providing less than asked or arguing about the principle. The file has to be completed for the account to function, the person asking cannot waive the requirement, and each incomplete response restarts a process that a complete one would have ended.
A source of funds request is a hole in a file, not an allegation. It is closed by documents, and the documents are much easier to produce before you need them.
It is worth stating plainly because the reassurance is implied and unearned. Verification does not mean the platform is solvent, does not mean client assets are segregated, does not mean a regulator has examined its books, and does not mean anybody will return your funds if it fails. It establishes who its customers are, which is a different subject entirely.
It also does not protect you from the most common losses in this sector. An account compromised through your own email, a signature you were tricked into providing, or a platform that fails owing you money are all unaffected by how thoroughly your identity was checked. The correlation people assume between verification and safety does not exist.
What it does do, genuinely, is establish a relationship in which you have recourse. A verified account with an identified counterparty in a known jurisdiction gives you somebody to complain to and a framework to complain under, which an anonymous relationship does not. That is a real benefit and it is narrower than the one people infer.
A rule adopted across most jurisdictions requires that identifying information about the sender and the recipient accompany transfers above a threshold between regulated institutions. In practice this means that when you withdraw to another platform, information about you is transmitted to it, and when you receive, information about the sender arrives with the funds.
The consequences show up as friction that is otherwise inexplicable. Withdrawals to certain destinations require naming the recipient. Transfers to an address held by an individual rather than an institution may require a declaration. And funds arriving from a source the receiving platform cannot identify are sometimes held pending questions, which is the mechanism behind a substantial share of deposits that appear stuck.
None of this is discretionary at the platform level and all of it is worth anticipating. A withdrawal that will require information you have to gather is a withdrawal that takes days rather than minutes, and knowing which of your destinations trigger that is the difference between planning around it and discovering it during a move.
Every question in this area has a different answer depending on where the platform is licensed and where you are resident, and those two are frequently not the same place. The licence determines what the platform must collect, how long it retains it, what it must report and to whom. Your residence determines what applies to you.
This is why comparing platforms on their verification requirements is comparing their regulators rather than their attitudes. A platform asking for more is usually licensed somewhere with stricter requirements, which is a fact about its supervision rather than about its suspicion of you, and it frequently correlates with the protections that matter.
It also means the answer to almost every specific question is that it depends on your jurisdiction, and that anybody giving you a general answer is giving you an answer to a question they have not asked. Rules on reporting, on thresholds and on what records you must keep vary enough that the only reliable source is somebody qualified where you live.
Accounts get restricted for reasons that feel identical and are not, and the distinction determines what to do. A verification hold pauses activity until a document is provided, resolves when it is, and is the most common by a wide margin. A compliance review is an internal examination of specific activity, takes longer, and cannot be hurried by contacting support more often.
The third is a legal order, which is a freeze the platform has no discretion over and frequently cannot explain to you. It is rare, it is the only one where the platform genuinely cannot help, and it is distinguishable because the explanations become notably less specific rather than more.
The practical guidance for the first two is the same and unglamorous. Answer exactly what was asked, completely, in one response. Keep the correspondence. Do not open parallel tickets, which restarts queues. And if funds are involved and time matters, ask specifically what document would close the request, which is a question support can usually answer directly.
Three things, each of which takes an evening and none of which can be done under pressure. Assemble a folder containing a current identity document, a recent proof of address, and records of how you acquired your holdings, including purchases made years ago. That last is the one people cannot reconstruct, and it is the one most often requested at the moment it matters.
Second, verify accounts to the tier you will eventually need rather than the minimum, while nothing is urgent. Verification requested during a withdrawal is the same process performed under time pressure, and the failure mode is discovering that a document has expired at the worst possible moment.
Third, know which jurisdiction each of your platforms is licensed in, because that determines what they will ask for and what recourse exists if something goes wrong. It takes a minute per platform, it is on their website, and almost nobody has done it for the accounts they already hold.
Because regulators in most jurisdictions require institutions handling other people's money to know who those people are and to be able to demonstrate it afterwards. The obligation sits on the platform and is enforced against the platform, which is why the process is shaped around what it must prove rather than around your convenience.
Usually a specialist verification provider rather than the platform itself, meaning a third company you did not choose processes and often stores them. A small number of these providers serve much of the sector, so a breach at one exposes documents submitted to many platforms, and identity documents cannot be changed the way a password can.
Regulations require periodic refresh, more often for accounts classified as higher risk. A change in your circumstances or your country of access can move you into a different category, an expired document invalidates the file, and a platform that obtains a new licence frequently has to re-verify everybody under the new framework.
No, it is a documentation requirement. The institution must hold a plausible explanation for the funds it processes, and the absence of one is a gap in its file. It is closed with ordinary evidence such as payslips, a contract of sale, bank statements, or records of an original purchase.
No. It establishes who its customers are and says nothing about solvency, whether client assets are segregated, or whether anybody would return your funds if it failed. What it does provide is an identified counterparty in a known jurisdiction, which gives you recourse that an anonymous relationship does not.
Because rules adopted across most jurisdictions require identifying information to accompany transfers above a threshold between regulated institutions. Withdrawals to certain destinations therefore require naming the recipient, and funds arriving from an unidentifiable source are sometimes held pending questions.
Generally not in full, because retention periods are set by regulation rather than by preference and typically run for years after closure. The institution must be able to produce records if asked later, and that obligation overrides a deletion request in most frameworks.
A folder with a current identity document, a recent proof of address, and records of how you acquired your holdings including old purchases, which is the item people cannot reconstruct. Then verify to the tier you will eventually need while nothing is urgent, and check which jurisdiction each platform is licensed in.