Why does the exchange want my ID?

The full answer

Which Canadian rules make a platform ask for ID?

The Ontario Securities Commission’s investor site, GetSmarterAboutMoney, set out the Canadian position on September 8, 2025 [1]. Before a customer can open an account, the trading platform must comply with Know Your Client requirements under securities law. It must also satisfy anti-money-laundering regulations and FINTRAC guidelines and requirements [1]. Two sets of rules are named there, and both sit behind the request for ID.

The same page says crypto trading platforms have a legal obligation to keep this information private and confidential. It also tells readers to always work with a registered crypto asset trading platform [1]. Looking a platform up is covered in how to check that a crypto platform is registered.

Registration has limits. The OSC page says CIPF does not cover losses of crypto assets if a crypto asset trading platform goes insolvent [1].

Do platforms report my transactions to the tax authority?

In the US, yes. The IRS says brokers must report gross proceeds on Form 1099-DA for transactions on or after January 1, 2025, and must report basis on certain transactions on or after January 1, 2026 [2].

Canada’s federal budget of November 4, 2025 said the government intends to proceed with the Crypto-Asset Reporting Framework, subject to a deferred application date of January 1, 2027 [3]. That date is still ahead as of October 1, 2026.

The Canada Revenue Agency, on a page dated November 10, 2025, recommends regularly exporting activity history from exchanges and other custodial platforms. Its stated reason is that an exchange may stop operating, stop offering services in Canada, or the account may become inaccessible [4]. What to keep is covered in the records needed for crypto taxes.

Is a platform that asks for no ID safer or riskier?

The Canadian Anti-Fraud Centre says never to rely on the website and phone number in unsolicited materials, and to check an investment’s legitimacy with provincial or territorial securities regulators. The Canadian Anti-Fraud Centre says never to rely on the website and phone number in unsolicited materials, and to check an investment’s legitimacy with provincial or territorial securities regulators [5].

Fake platforms also borrow the look of regulation. On December 22, 2025, the SEC alleged that purported crypto trading platforms named Morocoin, Berge and Cirkor falsely claimed to have government licences. According to the SEC complaint, no trading took place, withdrawals triggered demands for advance fees, and at least $14 million was misappropriated from US retail investors [6]. These are allegations, not court findings. Scams of this kind are covered in crypto profits shown by someone met online.

Where money goes matters if it has to be traced. The Canadian Anti-Fraud Centre advises checking the legitimacy of any investment with your provincial or territorial securities regulator, and doing the research yourself rather than relying on the contact details in unsolicited materials.

XRPL.org says the public key, account ID and address are public information, and NIST’s October 2018 overview of Bitcoin says users are pseudonymous, not anonymous, with all transactions publicly visible [1]. On the ledger side, XRPL.org says the public key, account ID and address are public information [8]. NIST’s 2018 blockchain overview, describing Bitcoin, says users are pseudonymous: account identifiers are not anonymous, and all transactions are publicly visible [9]. How these points combine is set out under Analysis.

What happens to ID data if a crypto company is breached?

This is the strongest case against handing personal data over. Ledger, a hardware wallet maker, said on December 21, 2020 that a customer database from a July 2020 breach had been dumped online. It held about 272,000 customers’ postal addresses, names and phone numbers, and many customers had been targeted by email and SMS phishing [10]. Ledger’s chief executive wrote that some customers feared physical attacks. He also wrote that there is no way to correlate the leaked data with the funds in a wallet [10].

Chainalysis, a blockchain analytics firm, reported on August 6, 2026 that France had 30 publicly known violent crypto-related incidents through mid-2026, up from 19 in 2025 [11]. Chainalysis called a data breach the likeliest culprit. It cited a French tax official alleged in 2024 to have sold dossiers on crypto holders, with names, addresses, holdings, phone numbers and tax records. It also cited a January 2026 breach of some 50,000 users at Waltio, a crypto tax-reporting firm [11]. In Chainalysis’s assessment, most violent incidents were premeditated, with victims chosen through exposed information from data breaches, social media or insider knowledge. The same firm says such attacks remain rare in absolute terms [11].

The FBI advised in February 2022 against posting personal details online, such as a mobile phone number or address [12]. Steps to reduce that exposure are in limiting the personal data that links you to crypto, and the violent cases are covered in physical attacks on crypto holders. The routes attackers use against the exchanges themselves are covered in how crypto exchanges actually get hacked.

Does buying on a legitimate exchange protect against scams?

The Canadian Anti-Fraud Centre said on June 1, 2023 that in most “pig butchering” reports it receives, victims are told to buy cryptocurrency from a legitimate exchange and transfer it to an address the fraudster controls [5]. The ID check happens at the purchase. The loss happens at the transfer out.