Why we don't ask for KYC on small swaps
If you've swapped crypto anywhere before, you've probably been asked for a photo of your face and a driver's license. SwapToZec doesn't do that for supported swaps. This post explains why, honestly.
What KYC is for
KYC — Know Your Customer — is a set of identity checks financial institutions are required to run on their users. In the US, they come out of the Bank Secrecy Act; in the EU, the AMLD directives; in the UK, the Money Laundering Regulations. The specific triggers depend on jurisdiction and the type of business you are.
The two most common triggers are:
- You're a Money Services Business (MSB) or similar — most centralized crypto exchanges are, and they must KYC.
- The transaction size crosses a threshold — even for services that aren't MSBs, big transactions can trip separate reporting rules.
Where we sit
SwapToZec runs as a non-custodial swap interface. The distinction matters: custodial exchanges have to KYC because they hold user balances that could be transferred to third parties on order. A non-custodial swap doesn't. There's no "user balance" for us to move around — every swap is a one-shot atomic operation with a specific destination address you gave us upfront.
This isn't a loophole. Every regulator I've seen speak to it distinguishes between "you deposit, we hold, later you withdraw" (custodial) and "you send us this, we send you that, done" (non-custodial). The former has KYC; the latter, at reasonable sizes, doesn't.
What "reasonable sizes" means
The right of a non-custodial service to skip KYC is not unlimited. If SwapToZec's daily volume from any one person hit exchange-sized numbers, we'd need to revisit. In practice, our largest swaps are still small compared to the thresholds that would trip additional reporting rules in any of our operating jurisdictions.
We also monitor for patterns — the same address funding a hundred small deposits in a day, obvious structuring behavior, funds coming from sanctioned addresses. We can and do decline swaps that look like that.
Why not just KYC everyone anyway?
Two reasons.
Privacy. Zcash is a privacy-focused chain. Half the reason you're on SwapToZec is that you'd rather not tie your on-chain footprint to a photo of your face. Requiring KYC on the on-ramp defeats that purpose entirely.
Data risk. Every KYC dataset is a liability. Every exchange that's been breached in the last decade has leaked identity documents alongside the balances. The safest data is data you never collect.
What we DO collect
- The source amount and asset.
- The destination Zcash address you supplied.
- The on-chain transaction ids so we can prove the swap happened.
- Your email, if you created an account.
That's it. No IP-based tracking pixels, no ad SDKs, no third-party analytics we didn't disclose. The /trust page has the full list.
Where this might change
If we launch a fiat on-ramp (buy ZEC with a card), that's a different regulatory beast — the payment processor pushes KYC requirements upstream, and we'd inherit them. Any such feature would be clearly separated and clearly labeled. It wouldn't retroactively apply to crypto-to-crypto swaps.
The tl;dr
We don't ask for KYC on supported swaps because our custody model doesn't require it and because the whole point of the product is that you don't have to hand over identity documents to move value privately. If that ever changes, it changes with warning, and it changes for a specific, disclosed reason.