No-KYC vs Light-KYC vs Full KYC: What Each Actually Collects

By Inveil Research · Updated February 28, 2024

"KYC" is not one thing — it's a spectrum, and the differences matter for your privacy and risk. No-KYC collects no identity; light-KYC collects a contactable identifier like an email or phone; full KYC collects government ID, often with a selfie and proof of address. Each step up the ladder hands over more data that can be breached, subpoenaed, or used to freeze you — so the right question isn't "is it KYC'd?" but "what exactly does it collect, and what's my exposure if that database leaks?"

The three tiers, by what they actually collect

Tier	Typically collects	What it can do	Your exposure
No-KYC	Nothing personal (just a wallet / passkey)	Can't identify you	Minimal — nothing to leak
Light-KYC	Email and/or phone number	Contact you, link sessions	A contactable identifier in a breach
Full KYC	Gov ID, selfie, address, sometimes source-of-funds	Verify legal identity, report, freeze	A complete identity dossier

No-KYC: identity is never created

A genuinely no-KYC platform never asks who you are. On a non-custodial on-chain platform this is natural: your wallet address — or a passkey account with no email or password — is your identity, and nothing personal is attached. There's no signup form to fill, no document to upload, and crucially no database of your identity to leak. The honest caveat: no-KYC is not anonymity. Your activity is still pseudonymous and permanently on-chain — see pseudonymity vs anonymity for what that does and doesn't hide.

Light-KYC: a contactable thread

Light-KYC asks for something that can reach you — usually an email, sometimes a phone number. This is often framed as "for your security" or "for notifications," and it does enable account recovery and alerts. But it also creates a durable identifier that links your sessions together and can be correlated with other services that have the same email or number. If the platform is breached, that identifier is what leaks. It's a smaller honeypot than full KYC, but it's no longer nothing.

Full KYC: the complete dossier

Full KYC collects what a bank collects: a government ID, frequently a selfie matched to the ID, proof of address, and sometimes source-of-funds documentation. This lets the platform verify your legal identity, comply with reporting requirements, and — the part traders feel — freeze or close your account and tie it to you. The data is also the highest-value breach target in the system. What KYC databases leak walks through why these dossiers are honeypots and how often they spill.

Why the tier you accept is a risk decision

Each tier is a trade. Full KYC can be a legal requirement for fiat on-ramps and gives you bank-grade recourse, but it concentrates your most sensitive data in one breachable place and makes account freezes and deplatforming possible. No-KYC minimizes that exposure but shifts more responsibility to you and the protocol's design. Light-KYC sits in between, and is easy to underestimate — "just an email" is still a thread back to you. The "nothing to hide" framing misses that the risk isn't about hiding wrongdoing; it's about not creating a dataset that can hurt you later.

How to tell which tier you're really in

Marketing language blurs this constantly. To find the real tier, look at what the signup requires:

• Can you transact with only a wallet or passkey, no email? → No-KYC.
• Does it require a verified email or phone but no documents? → Light-KYC, regardless of how it's branded.
• Does it ask for an ID, selfie, or address before you can trade or withdraw? → Full KYC, even if early steps felt light.

Watch for progressive KYC, where you start light and get asked for documents once your volume crosses a threshold — the tier you signed up at isn't always the tier you end at.

Bottom line

Treat "KYC" as a question of what's collected, not a yes/no. No-KYC creates no identity to leak; light-KYC creates a contactable thread; full KYC creates a complete dossier and the power to freeze you. None is universally right — fiat on-ramps may need full KYC by law — but you should choose the minimum tier your use case actually requires, because every field you hand over is a field that can be breached or used against you.

FAQ

Is no-KYC the same as anonymous?

No. No-KYC means no identity is collected at signup, which removes the easiest link to your name. But on a public chain your activity is still pseudonymous and permanently recorded, and it can be de-anonymized if your address is ever bridged to your identity. No-KYC is strong data-minimization, not anonymity.

Is "just an email" really KYC?

It's light-KYC. An email is a durable identifier that links your sessions and can be correlated with other services using the same address, and it's what leaks if the platform is breached. It's a much smaller honeypot than a full ID dossier, but it's no longer collecting nothing.

Why would a platform require full KYC?

Usually because it custodies funds or bridges fiat in ways that trigger legal identity-verification and reporting requirements. Full KYC also gives users bank-style recourse. The cost is that it concentrates your most sensitive documents in a breachable database and enables account freezes tied to your real identity.

How do I know a platform's real KYC tier?

Look at what's required to actually transact, not the marketing. If you can trade with only a wallet or passkey, it's no-KYC; if it needs a verified email or phone, it's light-KYC; if it asks for ID, a selfie, or proof of address, it's full KYC. Also watch for progressive KYC that escalates once your volume grows.