KYC Tiers and Why Your Withdrawal Limit Changed

A verification tier is the exchange's answer to a regulatory question: how much do we know about this customer, and how much activity does that knowledge justify. The tiers are not fixed categories so much as a continuously updated risk assessment, which is why limits move without an announcement.

The typical ladder

Level zero — registered. Email and password. Usually enough to deposit crypto and look at the interface, rarely enough to withdraw or to trade meaningfully. Some venues no longer offer any functionality here at all.

Level one — identity verified. Government photo ID, a selfie or liveness check, name, date of birth and address. This is where most retail accounts sit and it unlocks ordinary trading, fiat deposits by bank transfer, and daily withdrawal limits typically in the tens of thousands.

Level two — enhanced. Proof of address, proof of source of funds or wealth, sometimes employment and tax residency. Required for higher limits, larger fiat movements, and in many jurisdictions for corporate accounts. This is where the friction is real: source-of-funds documentation means bank statements, payslips, or sale documents, and reviews take days.

Institutional. A separate process entirely, with corporate documents, beneficial ownership disclosure and named signatories.

Why a limit changes on an account that did nothing

Five common causes, and none of them generate an explanation.

Jurisdiction rules changed. A new licensing regime or a change in the exchange's local authorisation shifts what it may offer to residents of a country. This is also why an exchange can stop serving your country entirely, covered in regional availability.

Documents expired. ID with a lapsed expiry date drops the account a tier until it is replaced. This is the single most common cause and the easiest to prevent.

Risk scoring updated. Exchanges score accounts continuously on transaction patterns, counterparty exposure and screening data. A deposit from an address associated with a sanctioned entity or a mixing service can restrict an account whose owner did nothing wrong.

Pattern triggers. Sudden large volume, rapid deposit-and-withdraw cycles, or transactions inconsistent with a stated profile prompt review. The account is frequently restricted first and reviewed afterwards.

Periodic refresh. Regulated firms must re-verify customers on a cycle. Ignoring the request results in restriction on a schedule you cannot see.

What verification actually gives the exchange

It is worth being clear about the exchange of value. You provide identity documents, a biometric capture, address evidence and often source-of-funds records. In return you get access, higher limits and, in a regulated venue, whatever consumer protections the jurisdiction provides.

That data then sits with the exchange, is shared with its verification vendor, is reported to tax authorities under information-exchange frameworks, and persists after the account closes because retention periods are mandated. The Ledger breach demonstrated what a leaked customer list is worth to attackers; exchange KYC databases are larger and more sensitive.

This is a real cost, not a reason to avoid verification — it is a reason to prefer venues with a security record and a regulator, and to use a dedicated email address so a future breach is at least identifiable.

Non-custodial and lighter-touch alternatives

Instant exchange services often allow small swaps with limited verification, escalating to full checks above thresholds or when screening flags a transaction. The trade-off is worse rates, less recourse, and the possibility of funds being held mid-swap pending verification you did not expect to complete — which is the specific failure mode to understand before using one, and why the instant exchanger ratings weight the published verification policy heavily.

Decentralised exchanges do not verify identity because there is no account, but they also cannot convert to bank money, which is where verification requirements bind.

Practical handling

Complete the highest tier you might plausibly need before you need it. Verification takes days when queues are long and always seems to be required at the worst moment.

Keep documents current and update the address on file when you move. Use an email address you control permanently and secure it with a hardware key or passkey — the 2FA guide covers why SMS is not adequate here.

Expect that deposits from certain sources will trigger review, and think about where funds have been before sending them to a regulated venue. And keep your own transaction records rather than relying on the platform's, because an account under review is an account you cannot export from — a problem the exchange ratings treat as part of custody risk rather than a support issue.