KYC

KYC checks you. It does not check the broker for you.

Know Your Customer (KYC) is the anti-money-laundering process in which a firm identifies you, verifies that identity from reliable sources, and understands what the account is for. Passing it tells you the firm has checked you. It says nothing about whether the firm is authorised, whether your contracting entity is the regulated one, or whether your money is protected.

Two practical rules follow. Verify the firm before you upload documents. And treat any request to pay a fee "to complete KYC" before a withdrawal as a scam signal.

UK and US rule text checked on 11 October 2026. This page explains the process; document lists vary by firm and are set out in each firm's own onboarding terms.

What the law requiresUK regulations and the US CIP rule
Why the forms keep goingKYC, appropriateness and professional status
Before you upload IDFive checks on the firm
KYC at withdrawal timeNormal review or red flag

1. What the rules actually require

Requirement	UK: Money Laundering Regulations 2017 rule text	US: CIP rule for futures commission merchants and introducing brokers rule text	What it means for you
Information collected	Identify the customer and assess the purpose and intended nature of the relationship (reg. 28)	Before opening an account: name, date of birth, address and an identification number (31 CFR 1026.220(a)(2)(i))	Questions about who you are and why you are opening the account are standard.
How identity is verified	From a reliable source independent of you; official documents count even if you supply them; secure electronic identification can qualify	Documents, such as unexpired government photo ID, or non-documentary methods such as database checks, within a reasonable time before or after opening	You may not need to upload anything if the firm verifies you electronically.
If verification fails	The firm must not transact and must end the relationship, but repaying money you deposited is not prevented (reg. 31)	The programme must say when an account is not opened, when it is closed, and when a suspicious activity report is filed	Failed KYC leads to refusal or closure, not to a fee that "unlocks" your money.
Record keeping	Not covered on this page	Identifying information kept for five years after the account closes	Check the firm's privacy notice for who holds your data and for how long.

2. Three different checks that arrive in the same onboarding flow

Check	Purpose	Rule	Red flag
KYC / customer due diligence	Who you are and why you want the account	Money-laundering rules above	ID requested over a messaging app, or requests for banking passwords or one-time codes
Appropriateness test	Whether you have the knowledge and experience to understand leveraged products	FCA COBS 10.2.1R; COBS 10.2.3R bars firms from encouraging clients not to provide the information	A salesperson tells you which answers will pass
Elective professional status	Optional request to be treated as a professional, often to access higher leverage	FCA COBS 3.5.3R: qualitative assessment, plus at least two of three quantitative criteria, a written warning about lost protections, and your separate written acknowledgement	Being pushed to "tick the professional box" without meeting the criteria

3. Five checks on the firm before you upload anything

Open the regulator's register yourself.The FCA advises typing the Firm Checker address directly rather than following links in emails or on firm websites, and comparing the firm reference number and contact details you were given.
Match the contracting entity.The company named in your client agreement must be the one on the register. A group company's licence does not cover a different entity. Compare entities with the licence check.
Use the official upload channel.Submit documents inside the firm's own website or app, not by email attachment or chat message to an "account manager".
Read the privacy notice.Look for the data controller, the retention period and how to request access or deletion.
Share identity data only.No onboarding process needs your online banking password, card PIN or one-time passcodes. The FCA notes it would never ask for bank PINs and passwords.

4. When KYC reappears at withdrawal time

Request	Assessment	Why
Update an expired ID or proof of address	Can be normal	Firms keep records up to date as part of ongoing monitoring (UK reg. 28).
Explain the source of a large deposit with payslips or statements	Can be normal	Ongoing monitoring includes the source of funds where necessary. It should be submitted through your account, with no new payment.
Pay a "verification fee", "tax" or "release fee" before money is sent	Treat as fraud	The rule consequence of failed checks is refusal or termination, and UK reg. 31 does not prevent repayment of deposited money. No rule requires the customer to pay to finish KYC.
Someone offers to "recover" your blocked funds for an upfront fee	Treat as fraud	The FCA describes recovery scams that target previous victims, often impersonate the FCA or police, and demand tax, solicitor or admin fees in advance.

Already asked to pay? Stop paying, keep the messages and receipts, call your bank on a number you look up yourself, and report it. In the UK the FCA consumer helpline is 0800 111 6768.

5. Copy-ready email to the firm

Account number: [      ]
Please confirm in writing:
1. The full legal name, registered address and regulator of the entity I contract with.
2. Exactly which documents you need and the rule or clause of my client agreement that requires them.
3. The official upload location in your website or app.
4. The data controller and retention period for these documents.
5. Whether any fee or additional deposit is required to complete the review.
6. Expected timescale, and the account my withdrawal will be returned to.

6. Frequently asked questions

If a platform asks for no KYC at all, is it a scam?

Not proven by that alone, but both rule sets above require identity checks before or around account opening. A platform that claims to be regulated yet verifies no one is inconsistent with those rules, so check its entity and licence before going further.

I passed KYC. Is the broker safe?

No conclusion follows. KYC is the firm checking you. Authorisation, entity and protections have to be checked separately on the regulator's register.

Can I refuse a source-of-funds request?

You can, but the firm may then be unable to continue. In the UK, a firm that cannot complete due diligence must end the relationship, while repayment of deposited money is not prevented.

Sources and open items

UK MLR 2017, regulation 28 and regulation 31.
31 CFR 1026.220: customer identification programmes for futures commission merchants and introducing brokers.
FCA COBS 10.2 and COBS 3.5.
FCA ScamSmart and Recovery room scams (updated 19 January 2026).

Still to check Whether the US CIP rule applies to retail foreign exchange dealers in the same form; UK record-retention period. The FATF Recommendations site refused access during review.