Crypto exchanges without KYC: under MiCA, every licensed exchange asks for your ID

There is no crypto exchange without KYC that is licensed in Germany. Every provider that runs an account for crypto assets for you in the EU has to identify you first, which means checking your ID and address. Without ID you can only trade outside this framework: on decentralised exchanges (DEX) directly from your wallet, on perp DEXs for derivatives, in trading between private individuals (P2P) or via the swap function of a software wallet. Each of these routes has limits, and almost all of them start with a step where you do have to identify yourself: buying with euros.

This guide explains why the requirement has applied without exception since MiCA, which routes without ID exist, what they cost and where the risks lie. It is expressly not a guide to circumventing obligations. If you stay with a regulated provider, the overview of MiCA licensing and obligations sets out the rules licensed exchanges have to follow.

KYC at crypto exchanges: identity checks as part of anti-money laundering

KYC stands for “Know Your Customer”. It means the identity check a financial service provider carries out before entering into a business relationship with you. At crypto exchanges it usually happens digitally: you photograph your ID card or passport, take a selfie or a short video and confirm your address.

KYC is part of anti-money laundering, AML for short. AML is the umbrella term for all obligations against money laundering and terrorist financing. Besides identification, these include ongoing transaction monitoring, suspicious activity reports and record keeping.

In Germany, the basic obligation is set out in the Money Laundering Act (GwG). Under Section 10 GwG, the general due diligence obligations start with “the identification of the contracting party”. Crypto-asset service providers are among the obliged entities. An exchange that lets you trade without ID therefore breaks the law in force, provided it falls under German or European supervision at all.

What data an exchange requests for KYC

Typically name, date of birth, place of birth, nationality, home address and the details of your ID document. Many providers also ask about your occupation and source of funds. For larger amounts the exchange can request evidence, such as a payslip, a bank statement or records of earlier crypto gains. This extended check is called source of funds.

MiCA and the Money Laundering Act: why licensed exchanges may not onboard you without ID

MiCA is the European regulation on markets in crypto-assets (Regulation (EU) 2023/1114). For crypto-asset service providers, CASPs for short, it has applied since December 30, 2024. The transition periods, during which existing providers could keep operating without a new licence, ended earlier depending on the member state, but no later than July 1, 2026. Since then, every exchange serving customers in the EU needs a MiCA licence from a member state.

MiCA itself governs authorisation, custody, capital and consumer protection. The identification requirement comes from anti-money laundering law, which applies alongside MiCA. A MiCA licence and an account without KYC are therefore mutually exclusive. Anyone promising you both either has no licence or is not telling you the whole truth.

You can check the licence yourself. German providers are listed in BaFin's company database, providers from other EU states in the register of the European Securities and Markets Authority, ESMA. According to our analysis of October 28, 2026, BaFin listed 98 crypto-asset service providers at that time. Our guide to checking MiCA authorisation shows how to read an entry and how to spot fake licence numbers. You can find the register itself on ESMA's MiCA page.

What MiCA prescribes for anonymising coins

MiCA already stipulates in Article 76(3) that trading platforms may not admit crypto assets with a built-in anonymisation function to trading unless their holders and transaction history can be identified. That is why several regulated exchanges have delisted so-called privacy coins.

Transfer of Funds Regulation: the travel rule from the first euro and the €1,000 threshold

The second pillar is the Transfer of Funds Regulation (Regulation (EU) 2023/1113), TFR for short. It implements the so-called travel rule: the obligation to send information on the originator and beneficiary with every transfer of crypto assets, much as with a bank transfer.

Since December 30, 2024 this has applied between two providers with no lower limit, so from the first euro. More relevant for you is the case of a self-hosted wallet: if you send more than €1,000 to your own address or receive such an amount from it, the exchange must check whether the address belongs to you or is controlled by you. Common methods are a signed message from the wallet, a screenshot or a small test transfer. We describe the process in detail in our guide on withdrawing crypto to your own wallet.

For the no-KYC route this means: the link between your regulated account and your private wallet is documented. If you buy bitcoin on a licensed exchange and then move it to your own wallet, you leave a traceable trail, even if you only trade on decentralised venues afterwards.

What the exchange does with this information

The exchange stores the information, checks it against sanctions lists and reports anything unusual to the Financial Intelligence Unit. If information is missing, it may hold back or reject a transfer. That is not the exchange being arbitrary; the law requires it.

Offshore exchanges without ID: the risks of providers without a MiCA licence

If you search for a crypto exchange without KYC, you will mainly find platforms based outside the EU. Many advertise that you only sign up with an email address and can withdraw up to a certain amount per day. For users in Germany this model has several catches.

First, there is no supervision. A provider that actively targets customers in the EU without a MiCA licence has not been allowed to do so since the transition periods ended. The only exception, in Article 61 MiCA, covers the case where you approach a provider on your own initiative without it having solicited you. This so-called reverse solicitation is narrowly defined. The rule only determines when the provider does not need a licence; it contains no protection for you.

Second, such platforms regularly reserve the right in their terms of use to demand identification at any time. That often happens precisely when you want to withdraw. Until you submit the documents, your balance stays frozen.

Third, there is no legal recourse. In the event of a hack, an account freeze or insolvency, the law of the country of incorporation applies. There is no deposit guarantee for crypto assets anyway, and a German consumer protection body can hardly help you with a platform that has no European licence.

Decentralised exchanges (DEX): swapping without an account, straight from your wallet

A decentralised exchange, or DEX, is a program on a blockchain that settles token swaps without a central operator. Instead of an order book with an account, most DEXs use so-called liquidity pools: users deposit token pairs, and a smart contract calculates the price from the ratio of the holdings. You connect your wallet, confirm the swap, and the tokens land straight back with you.

Because there is no account, there is no KYC either. Recital 22 of MiCA excludes services provided in a fully decentralised manner without an intermediary. Where the line lies in individual cases is not yet conclusively settled in law, for example with websites through which a company offers access to a DEX.

Where the DEX reaches its limits

The most important limit is the on-ramp. A DEX swaps tokens for tokens. It does not accept euros. To get crypto assets into your wallet in the first place, you almost always go through a regulated exchange, a broker or a payment service, and there you are identified. In practice, the no-KYC route therefore usually begins with a purchase with KYC.

Then there are technical risks. Network fees can rise sharply when the network is busy, the price can shift between order and execution (slippage), and faulty or fake smart contracts have already cost many users money. Particularly dangerous are approvals with which you allow a contract to move tokens out of your wallet. Fake websites exploit exactly these approvals for theft.

Perp DEX: derivatives trading without an account, and with leverage risk

A perp DEX is a decentralised platform for perpetual futures, futures contracts with no expiry date. You post collateral, usually stablecoins, and use leverage to bet on rising or falling prices. You do not need an account with ID for this; the wallet is enough.

This is where the biggest risk in this guide lies. Regulated providers may offer retail clients leverage of no more than 2 to 1 on contracts for difference on crypto assets. Much higher leverage is possible on a perp DEX. If the price moves against you, the position is liquidated automatically and the collateral is lost. Our perp DEX comparison explains how funding rates, liquidation and fees work and which platforms exist.

Nor is trading any simpler for tax purposes. In Germany, gains from futures transactions are treated differently from gains on selling coins, and a perp DEX does not issue a tax certificate. Recording every position remains your job.

P2P bitcoin trading: private individuals, Bisq and the limits of anonymity

P2P stands for peer-to-peer: direct trading between two private individuals with no exchange in between. You sell or buy Bitcoin and pay by bank transfer, cash or another agreed method. Decentralised programs such as Bisq broker such deals and secure them with a deposit that both sides put up.

Anyone who occasionally sells their own coins to another private individual is not a crypto-asset service provider within the meaning of MiCA. That changes when someone buys and sells commercially and regularly. A licensing requirement can then arise, and anyone trading without a licence risks criminal proceedings.

Why P2P is rarely truly anonymous

If you pay by SEPA transfer, your trading partner sees your name and bank details, and your bank sees the recipient. With cash meetings the trail disappears, but the personal risk rises. There are also well-known fraud patterns in which a transfer comes from a third-party source and is later reversed. The seller has then lost the coins and may have to explain to the bank where the money came from.

Swaps in the wallet: swap function, fees and third-party providers

Many software wallets have a built-in swap function. You choose two tokens, the wallet fetches a quote and executes the swap. Technically, behind it sits either a DEX, an aggregator that compares several DEXs, or a centralised instant swap service.

It is convenient, but rarely cheap. On top of the network fee there is often a wallet service fee, which can be hidden in the quoted rate. So compare the amount that actually arrives, not just the stated fee. If a centralised swap service is behind it, its terms of use apply. Many of these services reserve the right to halt unusual swaps and request evidence. A swap without ID thus remains an offer with strings attached.

Privacy coins and AMLR: what changes from July 2027

The EU is tightening anti-money laundering law further. Regulation (EU) 2024/1624, AMLR for short, applies from July 10, 2027. Its Article 79 prohibits banks, financial institutions and crypto-asset service providers from keeping anonymous accounts or accounts that allow transactions to be anonymised. This expressly includes anonymous crypto accounts.

Holding privacy coins in your own wallet remains permitted according to the prevailing reading. The ban is aimed at providers. For you this means: regulated exchanges will no longer trade such coins, and swapping will shift even more towards decentralised routes. Our article on privacy coins and EU anti-money laundering law assesses the consequences for individual coins.

Crypto tax without KYC: holding period, exemption limit and proof for the tax office

Going without ID does not change your tax obligations. In Germany, gains from selling or swapping crypto assets are private disposal transactions under Section 23 of the Income Tax Act (EStG). They remain tax-free if more than one year passes between purchase and sale. Within the holding period, gains are tax-free if total gains from private disposal transactions in the calendar year are below €1,000. That is an exemption limit: if the gain is higher, it is taxable in full.

A swap on a DEX is, for tax purposes, a sale and a new purchase. If you swap a lot, you start a new holding period for the token received each time. The burden of proof for purchase date and price lies with you. Without an exchange account there is no tax certificate, so you have to document transaction IDs, prices and fees yourself.

DAC8: what licensed exchanges have reported since 2026

Since January 1, 2026, crypto-asset service providers in the EU have been collecting data on their customers and their transactions for the tax authorities. The basis is the EU directive DAC8, implemented in Germany through the Crypto-Asset Tax Transparency Act. The first report for 2026 goes to the Federal Central Tax Office by July 31, 2027. If you enter through a regulated exchange, the tax office already knows about you. Later activity on a DEX makes this data patchy at most, and if in doubt, you are the one who explains the gaps.

Data protection in KYC: what data exchanges store and for how long

A common reason for looking for an exchange without KYC is not tax avoidance but data protection. The concern is justified: ID images, selfies and address data are valuable, and there have been several data leaks at exchanges and their service providers.

The Money Laundering Act prescribes how long the documents are kept. Under Section 8(4) GwG, they must be retained for five years and destroyed after ten years at the latest. The period starts at the end of the calendar year in which the business relationship ends. If you no longer use an account, you should therefore actively close it rather than leave it dormant.

You can limit how much of your data is out there: verify yourself only with a few providers holding a European licence, use a separate email address for the exchange and enable two-factor login with an app rather than SMS. Under the General Data Protection Regulation you can request information at any time about what data is stored about you.

What an ID leak means for you

If your ID data falls into the wrong hands, the main threat is targeted fraud attempts: fake support calls, phishing emails containing real data and identity misuse. Under the General Data Protection Regulation, an exchange based in the EU must inform you of such a leak. With a platform without a European licence, you may never find out.

Crypto exchanges without KYC: above €1,000 the exchange checks your wallet

The situation is clear. Licensed exchanges require your ID, offshore platforms without a licence shift the risk onto you, and the decentralised routes only work once you already own crypto assets. If you want to protect your data and still trade safely, you combine both deliberately:

1. Enter through an exchange with a MiCA licence: Buy with euros where supervision and legal recourse apply, and check the entry in the register. You will find a selection in the comparison of regulated crypto exchanges.
2. Self-custody and prepare the proof of ownership: If you transfer more than €1,000 to your wallet, the exchange will ask for proof. A hardware wallet protects the keys offline; models and prices are in the hardware wallet comparison.
3. Document every transaction: Swaps on a DEX also count towards the holding period and the exemption limit. A tax tool reads wallet addresses and produces the report for the tax office; our overview of crypto tax tools compares providers.

If you are specifically interested in Bitcoin, our earlier guide buying Bitcoin without KYC from June 2026 covers the practical routes and their costs. The legal situation has tightened further since then with the end of the transition periods.

(As of November 4, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)