What is KYC in web hosting?

KYC, defined

Know your customer (KYC) is the process of verifying that a customer is who they say they are. It comes from financial regulation: banks and payment companies must identify customers to comply with anti-money-laundering (AML) and counter-terrorist-financing rules.

In hosting, KYC usually means one or more of the following:

• Uploading a government ID such as a passport or driving licence.
• A selfie or live video check matched against that ID.
• Proof of address, such as a utility bill or bank statement.
• Phone number verification by SMS.
• A card payment in your own name used as an identity check.

Why hosting providers ask for ID

Most hosting providers are not directly required to run KYC on every customer. They do it for other reasons:

• Fraud and chargebacks. Stolen cards are routinely used to buy servers. Verifying identity reduces losses.
• Payment processor rules. Card networks and processors impose their own risk checks, and a flagged payment can trigger a demand for ID even if the host itself does not care.
• Abuse prevention. Servers used for spam, phishing, or attacks damage a provider's IP reputation. Identified customers are easier to hold accountable.
• Local law. Some countries do require hosting or telecom providers to identify customers, and providers based there must comply.

Understanding the reason matters, because it predicts when a check can happen. A provider that relies on a card processor can be forced into a check by that processor at any time, whatever its own policy says.

Not all "no KYC" is equal

Providers describe their policies in very different ways, and marketing pages rarely match the fine print. nokyc.host scores every provider on a five-level scale based on the exact wording of its terms:

1. Level 0: guaranteed no KYC. The terms explicitly state ID will never be requested.
2. Level 1: no KYC mention. Nothing in the documentation mentions identity checks, now or in the future.
3. Level 2: rare KYC. No routine checks, but the provider may request ID or freeze funds when compelled by authorities, legal orders, or internal risk review.
4. Level 3: possible KYC. ID may be requested mid-order through AML checks, transaction limits, or payment-partner rules.
5. Level 4: mandatory KYC. Verification is required for key features or can be demanded at any time.

The difference between level 0 and level 1 is a written promise. Level 1 providers may never ask, but nothing stops them from changing that tomorrow. Level 0 providers would have to change their terms first, and that change would appear in the provider's change history on nokyc.host. The full scoring rules are in the methodology.

How "surprise KYC" happens

The most frustrating experience is a provider that takes your money and then asks for ID. It usually happens in one of these ways:

• A payment is flagged by a card processor or crypto payment gateway, which requires the merchant to verify you.
• Fraud scoring on the order (VPN usage, mismatched country, unusual order size) triggers a manual review.
• An abuse report arrives about your server, and the provider demands ID before restoring service.
• Terms change and existing customers are asked to verify.

You can reduce the risk by choosing level 0 or level 1 providers, preferring crypto-only billing (no card processor in the loop), and reading the provider's acceptable use policy for clauses about verification.

What to do if a host asks for ID

If a provider asks for documents after you have ordered, you have more options than simply complying.

1. Ask why. Request the specific reason and the clause in the terms that allows it. Sometimes a flagged payment can be resolved by paying with a different method, such as cryptocurrency.
2. Check the terms you agreed to. If the provider's own terms (at the time you ordered) did not allow verification, point that out. A written level 0 promise is especially useful here.
3. Ask for a refund instead. Many providers will cancel and refund an order rather than force verification, especially before the server has been used.
4. Never send documents over plain email if you do decide to comply. Use the provider's secure upload system, and redact anything not required (such as ID numbers, if the provider allows it).

Whatever happens, consider reporting the experience. Real-world verification requests are exactly the kind of information that keeps directory scores honest, and they are shown in a provider's change history when a score changes as a result.

How to check a provider's KYC policy yourself

1. Read the terms of service, acceptable use policy, and privacy policy, not just the homepage.
2. Search the documents for words like "verify", "identification", "identity", "documents", "KYC", and "fraud".
3. Check the payment page: card processors and some gateways add their own verification rules.
4. Look for recent changes. On nokyc.host, every provider page shows a dated change history.