Exchanges and legalities

[OmegaStarScream]

I would appreciate If someone could explain to me a few things about how exchanges work when it comes to KYC/AML.

It seems like a lot of exchanges (even the ones that have no fiat involved) start to ask users for documents at a certain period of time, for some reason. I can't seem to understand why.

If it's because of the laws of the country the exchange is operating in, then why not start by these document verification when launching the exchange? If that has nothing to do with it, then why ask for KYC in the first place?

Also, If a group of developers decides to make an exchange, and they have no physical offices and they decide to host it somewhere else in the world (Cloud). Should they go with the laws of their country or where their servers are?

If bitcoin is banned in a country (X) for example, and you make an exchange, and somehow, people in that (X) country are interested in using your exchange, can that country somehow enforce you to give documents about these users?

[squatter]

I would appreciate If someone could explain to me a few things about how exchanges work when it comes to KYC/AML.

It seems like a lot of exchanges (even the ones that have no fiat involved) start to ask users for documents at a certain period of time, for some reason. I can't seem to understand why.

If it's because of the laws of the country the exchange is operating in, then why not start by these document verification when launching the exchange? If that has nothing to do with it, then why ask for KYC in the first place?

It probably has more to do with where their customers reside than where the exchange operates from. For instance, any exchange that does business with US residents falls under FinCEN's jurisdiction. FinCEN published guidance in 2013 that applied its rules to Bitcoin services. A few highlights:

Businesses that accept bitcoin from one person and send it to another are money transmitters, and are not exempt from money transmission regulation simply because they do not deal in fiat currency.

Any business that exchanges fiat currency for virtual currency – or even one virtual currency for another – is a money transmitter.

Money transmitters are required to file a Suspicious Activity Report (SAR) when they suspect "transactions aggregating $5,000 or more that involve potential money laundering or violations of the Bank Secrecy Act." Filing an SAR requires all the typical KYC information. They also need to file a currency transaction report (CTR) for transactions involving more than $10,000.

Also, If a group of developers decides to make an exchange, and they have no physical offices and they decide to host it somewhere else in the world (Cloud). Should they go with the laws of their country or where their servers are?

Your biggest worry is the laws where your customers are. To be safe, you want to be legally covered where you reside, where you operate from, and where you do business.

[LeGaulois]

They must abide by the laws of the country where they are located and not the country where the server is hosted. (@squatter; The US is a particular case,...for a lot of thing btw...)
They did not ask for it at the time of launch because the law did not force them to do so. If they were not obliged to do so, they would not do and it would help them a lot. Others are not obliged but ask for it anyway to anticipate the inevitable.

There is also a difference between a group of people who create an exchange (for fun or whatever) and a company that has strict rules to follow, whether in terms of the law, accounting and other responsibilities

If bitcoin is banned in a country (X) for example, and you make an exchange, and somehow, people in that (X) country are interested in using your exchange, can that country somehow enforce you to give documents about these users?

You would be out of law so the problem is no more

[squatter]

They must abide by the laws of the country where they are located and not the country where the server is hosted. (@squatter; The US is a particular case,...for a lot of thing btw...)

It's a very important case, since the US has shut down numerous cryptocurrency services who were operating from overseas. BTC-e and 1Broker to name a couple. So you should be careful to not only prohibit US residents but also to actively stop them from joining your platform. Otherwise, the US considers you under their jurisdiction.

I'm pretty sure US law is the reason why Changelly and Binance do not enforce mandatory KYC, but enforce it based on certain "suspicious" account activity. They both serve US customers and that's what the Bank Secrecy Act mandates.

It's dangerous to ignore the laws where your customers reside. The EU has comprehensive money laundering regulations that apply to money services businesses too. If the OP is planning on serving EU customers while ignoring EU regulations, I'd recommend talking to a lawyer first.

[LeGaulois]

You're right for The US but the reason I said this country is a special case is that is there another country acting similarly?. This country is always trying to impose its own laws on everyone all over the world.

Think about it from the point of view of an exchange platform and let's say you're one. Wouldn't you say to The US, who the fuck are you to give me directives while I'm not in your country? Go chasing your residents, not me.

Binance doesn't deal with fiat, correct? Because when an exchange does or doesn't transactions with fiat it's a lot different. And if I am also correct users can use the platform freely (with no KYC as long they don't withdraw XBTC daily) I don't remember well about BTC-e but the only option to deal with fiat was via Perfect Money not via banks transactions.
Take a look at Europe, despite the evil KYC/AML, Europeans can still use an exchange without verification (i.e. with Kraken)

[squatter]

You're right for The US but the reason I said this country is a special case is that is there another country acting similarly?. This country is always trying to impose its own laws on everyone all over the world.

Think about it from the point of view of an exchange platform and let's say you're one. Wouldn't you say to The US, who the fuck are you to give me directives while I'm not in your country? Go chasing your residents, not me.

I totally agree, it's bullshit. I would just be careful to keep them off my site if I didn't want the FBI knocking at my door. Bitmex is shutting down the accounts of Americans (and also Quebec residents) because of government warnings about this. 1Broker took the position that it wasn't their responsibility -- the FBI seized their website for it.

Binance doesn't deal with fiat, correct? Because when an exchange does or doesn't transactions with fiat it's a lot different.

They serve US residents, and on that front, it doesn't matter. That's 99% why they have the KYC policies they do. It's why they sometimes lock accounts and enforce KYC even if you keep under their 2 BTC limit. US law says exchanges doing altcoin trading are money transmitters, so they need to do KYC and file an SAR when they suspect money laundering.

BTC-e but the only option to deal with fiat was via Perfect Money not via banks transactions.

They did bank wires for years, but they stopped at some point, probably due to intermediary banking problems (like Bitfinex).

Take a look at Europe, despite the evil KYC/AML, Europeans can still use an exchange without verification (i.e. with Kraken)

Don't they do direct SEPA transfers to/from customers? I thought EU regulations required KYC at €1,000.

[LeGaulois]

Don't they do direct SEPA transfers to/from customers? I thought EU regulations required KYC at €1,000.

They do, I once provided my DOB and my address (maybe my phone number too) I could have given incorrect information because other than that they never asked me my ID card, proof of residence or anything, and reading the quote below I am surprised since I crossed this limit a lot of times. Well, I am not going to complain since until this month I was not able to provide any valid paper to anyone LOL. I felt like a refugee.

If there are multiple transactions of less than €1,000 which appear to be linked, you must check how much the linked transactions add up to. If they add up to €1,000 or more, you must verify the complete information of the payer or payee.