On Coinbase, KYC and Regulatory Compliance

The author, a self-described former customer support compliance worker at three centralized exchanges, argues that KYC data at centralized exchanges (CEXs) is stored and accessible to many staff, so users should treat it as at risk and consider non-KYC alternatives. They say CEXs must keep KYC and deposit/withdrawal data for at least 5 years and up to 10 years under EU anti-money laundering directives, and that a GDPR deletion request does not remove this data. They list customer support, legal, risk/compliance, developers and leadership as roles that can typically access full user data, and note that third-party KYC providers also hold it.