KYC, AML, and ATM Transaction Security—How It Works

KYC at a Bitcoin ATM means verifying a user’s identity. AML refers to broader anti-money laundering procedures. The operator may require verification even for small amounts. Before visiting, check the current requirements for the chosen device; do not assume there is a common threshold across all Bitcoin ATMs that exempts users from identification.

Bitomat.com aggregates location and device information. It is neither the operator of these devices nor the entity that decides whether to approve a specific transaction. Below, we explain the names of the procedures and what you should prepare.

KYC vs. AML: What's the Difference?

• KYC (Know Your Customer): identifying a customer and verifying their identity based on relevant documents, data, or information.
• AML (Anti-Money Laundering): combating money laundering. It involves a broader risk assessment and transaction monitoring, not just document verification.
• CFT: Countering the Financing of Terrorism. It is often discussed in conjunction with AML.

Identity verification does not replace other checks and does not guarantee that a transaction will be executed. The EU framework for due diligence is set forth in the AML Directive, specifically Article 13. The requirements for a particular operator also depend on applicable national laws and the type of service.

When might a Bitcoin ATM request verification?

Don't base your decision solely on the amount. The country, the operator, the type of transaction, the required information, and the risk assessment all matter. Having your own wallet or paying in cash does not exempt you from verification requirements.

MiCA regulates the crypto-asset market, but it is not the sole basis for all KYC/AML obligations. The EU travel rule applies to information accompanying crypto-asset transfers subject to the rule, including transfers involving one’s own wallet addresses. See Regulation (EU) 2023/1113, Articles 14–17. You should not treat your own wallet as a way to circumvent these procedures.

The transaction limit, available cash, and identification requirements are different things. You can find the distinctions in the withdrawal limits guide. Confirm the current requirements with the operator before making a deposit or sending cryptocurrency.

What information and documents should I prepare?

Check which documents and forms of identification are accepted by the device you’ve selected. Don’t assume that a photo of a document or a document in an app will be accepted everywhere. The operator may require additional information, proof of address, or details about the purpose of the transaction.

1. Find the device on the location map and check service availability and operator requirements.
2. Have the required, valid document ready and follow the instructions on the screen or through the operator's verified channel.
3. Provide accurate information. Do not use someone else's document or impersonate another person.
4. Keep the transaction number and receipt. If the procedure does not work, contact the support service listed on the device.

Do not send documents to random profiles on messaging apps. First, verify the contact channel. Do not share your recovery phrase or wallet private key for verification purposes.

SoF, SoW, and EDD: Why the Additional Questions?

• SoF (Source of Funds): the source of the funds used for a specific transaction.
• SoW (Source of Wealth): the manner in which a customer’s assets were accumulated; this is a broader question than the origin of a single deposit.
• EDD (Enhanced Due Diligence): enhanced due diligence measures applied in high-risk situations.

The operator may request, for example, an account history, a document confirming the sale of assets, or a history of cryptocurrency transactions. This is not a universal list of required documents, nor is it a procedure that is triggered solely when a specific amount is exceeded. Ask what the request is for, and provide the documents as instructed by the relevant operator.

PEP and sanctions: Does this mean a refusal?

PEP status applies to a person who currently holds or has previously held a politically exposed position. These controls may also extend to the person’s family and close associates. This does not in itself imply that a crime has been committed. The FATF explains the preventive nature of PEP controls.

PEP status and sanctions are not the same thing. PEP status may result in additional due diligence and documentation; sanctions may impose separate restrictions. The decision is made by the relevant operator in accordance with applicable requirements, not by an automated guide or aggregator.

What should you do if a verification or transaction gets stuck?

Make a note of the transaction number, time, amount, and—if available—the blockchain transaction ID (TXID). Contact the operator’s support team listed for the location or on the confirmation. Ask about the status, any missing information, and the next steps.

A hold does not confirm that the transaction is complete or guarantee an immediate refund. The settlement method, any associated costs, and the timeframe depend on the stage of the transaction and the operator’s terms and conditions. Do not assume that the funds have not been sent until the operator confirms the status.

Do not perform additional operations to bypass the check. If the problem involves network confirmation times, see also the explanation of transaction time.

Data Protection and Frequently Asked Questions

Who is responsible for the documents to be verified?

Check the information about the data controller and the processing rules with the entity conducting the verification. Ask about the purpose, legal basis, retention period, and how to exercise your rights. Do not assume that the location aggregator stores documents for every transaction. You can find the website’s general documents in the privacy policy and terms of service.

Does a Bitcoin ATM allow anonymous transactions?

Don't assume you're anonymous. Using cash does not remove identification procedures or the operator’s obligations. Before you begin, check the requirements instead of relying on outdated information about thresholds.

How long does the KYC process take, and does it guarantee a purchase or withdrawal?

There is no single timeframe that applies to all devices and situations. Missing data or additional analysis may prolong the process. Positive identification does not replace other operational requirements, such as service availability, the correct network, or payment readiness.