Binance Registration Guide: Sign-Up, KYC and the First Four Security Settings

Why a hodler still cannot avoid an exchange account

The short version: for a long-term holder, a centralized exchange account is for moving money in and out, and coins shouldn't be stored there.

A reasonable way to use it: the account stays open year-round and the balance stays low year-round. It handles a few jobs that are awkward to do any other way.

The first is fiat in and out. An on-chain wallet does not take a bank card. Your salary, your bonus, the money from selling part of a stock position — turning any of it into an on-chain asset requires one fiat-to-crypto step somewhere. In reverse: the day you need to pull some out for rent, for a medical bill, for a child's tuition, you also need an exit that turns coins back into fiat and lands it in a bank account. You do not use that exit most of the time, but it has to be open, and it has to be one you have verified works. If your first cash-out comes on the day you urgently need the money, a security review can leave you stuck.

The second is swapping between assets. Holding long term does not mean you never touch anything again. You might want to move part of an altcoin position back into BTC, or park some profit in a stablecoin. A decentralized exchange can do that, of course, but it asks you to manage gas yourself, manage token approvals yourself, and judge for yourself whether a contract is genuine, all of which are places where mistakes are easy to make (for approvals, see How to Check and Revoke Token Approvals). For someone who just wants to sit still, doing the swap in a deep centralized order book and then withdrawing is a shorter path with fewer places to trip.

The third is the small set of operations you cannot route around. Some tokens have gone through a contract migration or a token swap where the exchange handled the conversion window; some chains need a pile of node configuration on the wallet side, and going through an exchange is simply cleaner. When you do run into one, you need the account to already exist.

The fourth: an account has a recovery process, and a self-custody wallet does not. Lose the hardware wallet, burn the seed phrase, and nobody can help you. An exchange account at least has identity verification and an appeals channel. That is no reason to keep coins on a platform. But when you are arranging your estate, an account a family member can claim with identity documents can be kept alongside a seed phrase backup; the two routes don't conflict.

Now the other half. The balance you see on an exchange is a row in that company's database, not coins in your hands. Whether that row can be redeemed depends on whether the company is still operating normally and still allows withdrawals. If the private key is not yours, what you hold is a counterparty's promise.

First decide how much you'll use this account

Before you click sign up, spend ten minutes on three questions. The three answers decide how you set everything that follows.

Question one: roughly how much money will move through it in a year? Buying two or three times a year, a few hundred at a time, is a completely different account from a monthly buy that also needs the occasional cash-out. The first can be locked down hard — one address on the allowlist, full verification on every withdrawal. The second may need a little more operating room, and in exchange you have to look at device management and login history more often.

Question two: what is the most you'll leave in the account? The number you give is the ceiling on the balance you allow to sit there long term. Above it, move the excess out. A simple way to set the number: look at how much you usually buy and sell in a month, and don't leave much more than that in the account.

Question three: where is your long-term stack going to live? This one is easy to skip, and it has the largest consequences. If you open the account and buy first, the coins have nowhere to go and end up staying on the exchange. The better order is the reverse: get the self-custody wallet ready and its backup verified first, then go open the exchange account. That way, from your very first purchase, there is a destination.

Which wallet form suits you depends on the amount and on how often you plan to touch it. 8 Types of Crypto Wallets and Where Keys Live puts custodial, non-custodial, cold and hot wallets side by side; Cold Wallet vs Hot Wallet: Key Differences covers which part of your money suits the exchange and which part belongs in a hardware wallet.

If you have already decided to buy a hardware wallet, look at the hardware wallet comparison table first. Delivery takes time, and it can run in parallel with the wait for KYC review.

What to have ready before you sign up

Get these few things ready first and the sign-up goes much more smoothly, while a few holes that are hard to patch later never open at all.

An email address that barely exists in public

Do not use the everyday address you register everywhere with and receive every newsletter on. Open a separate one for the exchange: never use it on a forum, never type it into a giveaway form, never post it on social media. The reason is direct: a leaked address becomes a target for phishing mail. An address that has never appeared anywhere is itself a layer of filtering.

That mailbox needs two-factor of its own, and preferably not the same method on the same device as the exchange — if the mailbox falls, the exchange's email confirmations are worth nothing.

A long password used exactly once

Generate it in a password manager, do not invent it. Passwords out of a human head have patterns, and the dictionaries went through those patterns long ago. What matters more is not reusing it: if you have ever used this email-and-password pair on a site that later got breached, an attacker will take the pair and try it on every major exchange in turn. That is credential stuffing, and it costs almost nothing to run, so give the exchange a password you use nowhere else.

A phone number you can keep for years

Changing a phone number is a nuisance inside an exchange's system, especially once you are no longer in the country the number came from. Pick one you are sure you will not give up for the next few years. And note this: the phone number is the weakest link among your verification methods, because someone can take your personal details to the carrier and have your SIM reissued to them (SIM swap; see the glossary). So avoid SMS verification wherever you can and use an authenticator app or a passkey instead; where the platform requires a phone number to stay on file, follow its official instructions.

An authenticator app, and a decision about where its backup key lives

Install the authenticator app before you sign up (Google Authenticator, Authy, anything of that kind). The part to think through in advance is this: when you enable it, the platform hands you a backup key, and you need to know where that string is going to live. In a screenshot on the same phone is the same as nowhere — lose the phone and you lose both at once. Copied onto paper and stored apart from your seed phrase is the least troublesome answer. The reasoning behind this layer is set out in Is SMS 2FA Safe? Authenticator vs Passkey.

Your ID document, and how your name is actually spelled

Have a valid identity document ready, ideally with more than six months left on it. Which types are accepted — passport, national ID, driver's license — and whether an extra proof of address is needed varies by region; go by what your own account page lists.

One trap deserves its own line: the name you type at sign-up has to match the one printed on the document exactly. That includes how the given names are split, whether there is a hyphen, whether the middle name is included. If you type a spelling you habitually use instead, it can fail to match at the KYC step and need a manual correction.

Confirm the service is actually available where you are

Confirm this before you open an account; it is easy to skip. Different jurisdictions treat crypto trading platforms very differently, and the same platform offers different services in different places. The rules keep moving, so read what the sign-up page and the platform's terms of service currently say about your region.

What I would not do is use a VPN to force a sign-up from another region. The cost of that usually arrives later, when you try to get your money out. For the situation in mainland China specifically, see the FAQ page on whether Binance can still be used in mainland China.

Sign-up step by step: where the referral code goes

The sign-up itself is not complicated. Below it is broken out in order, with the places things go wrong marked.

Step 1: Reach the sign-up page through the right entrance

If this step goes wrong, nothing you do afterwards makes up for it. Fake exchange login pages reach people by several routes: the ad slot at the top of the search results, a shortened link forwarded on social media, a so-called exclusive channel posted in a chat group — any of them can drop you on a site that looks identical to the real one. Every character you type there, including the verification code that comes later, gets relayed to the real site in real time.

There are only two reliable habits: type the official domain by hand once, bookmark it, and afterwards only ever enter through the bookmark; or arrive through a link you trust and that you can see in full, and check the address bar the moment you land. How to tell apart fake official sites in search ads and fake apps is covered in the search ads and fake apps sections of the phishing scams article.

Step 2: Choose how to register

You can usually register with an email address or a phone number, and there may be a one-click option through a third-party account. My advice is use the email address. Email is the most controllable: it does not depend on your mobile carrier, it survives moving countries, and it makes for better paperwork if you ever have to appeal. Signing in through a third-party account looks convenient, and the price is that your exchange account is now attached to the security of another account, which is one more single point you do not control.

Step 3: Set the password

Paste in the string your password manager generated. Do not use "I can remember it" as the standard — not being able to remember it is the point, because remembering it is the password manager's job. While you are here, confirm one thing: does your password manager itself have a backup, and is the master password written down somewhere else as well?

Step 4: Enter the referral code

The sign-up form usually has a field called referral code, invite code or Referral ID, and that field is often collapsed, showing only a small line of text on the page until you click it open. If you arrived through a link carrying a ref parameter, it is normally filled in already, and your job is to expand it and check that it matches the code in the disclosure box above.

Check before you submit: whether the code can be added after registration, and how long that window lasts, differs by region and over time, so go by Binance's current rules and by the referral information shown in your account.

Step 5: Code, terms, submit

A verification code arrives by email or SMS. There is a habit to build here: you only ever type a verification code into an action you started yourself. Anyone asking you for a code in any situation — claiming to be support, claiming to be from the security team, claiming to be helping you unfreeze something — is running a scam, with no exceptions. How to handle fake support messages and calls is in the fake support section of the phishing scams article.

You do not have to read the terms word for word, but do at least skim the parts of the service agreement covering your own region, along with the sections on asset custody and where liability sits.

Step 6: Log in, and do nothing yet

Once registration succeeds, finish the security settings before you deposit or buy; that is the next section.

KYC: documents, the liveness check and why it gets rejected

Identity verification (KYC) is now a precondition for withdrawing. Doing it cleanly once is the fastest route.

Roughly which gates you pass through

The tiers and their names are not identical everywhere, but the flow generally has this skeleton: fill in basic details (name, date of birth, nationality, address), then upload the front and back of a document, then complete a liveness check (turn your head, blink or read out a string of digits as the screen prompts), and in some regions supply an additional proof of address or a source-of-funds statement. The higher the tier, the more limits and features open up.

Review times vary: automated approval is fast, manual review is slower, and slowest at peak times. What you can control is submitting correct material the first time, so there is no back and forth.

Common reasons for rejection, and how to fix each

The table below puts the common rejection situations next to what to do about them, grouped by the kind of fix each one needs. The exact wording you get is whatever your own account page shows.

The rejection	Usually because	How to fix it
Document photo not sharp	Focus never locked, not enough light, or shaky hands	Lay it flat on a table, use daylight, take it out of the plastic sleeve
Glare covering key details	A ceiling light or flash hitting the laminate	Turn the flash off and move the document to the side of the light source
Corners cropped off	Framed too tight, so the four corners fell outside the shot	Leave a margin so all four corners and the background pattern are in frame
Name does not match	The spelling typed at sign-up differs from the document	Change it to the spelling printed on the document, do not invent one
Document expired	The expiry date passed without you noticing	Renew it first; do not keep retrying with an expired document
A copy or a photo of a screen	You shot a printout, a screen, or a photocopy	The physical original has to be what is in the photo
Liveness check fails	Moving too fast, too little light, wearing a hat or a mask	Remove anything covering your face, light it from the front, follow the prompts slowly
Proof of address rejected	The document is too old, or the name and address on it do not match what you typed	Use a recent utility bill or bank statement, with all three details aligned

One more warning: submit the verification material yourself, and never hand it to any person or agency claiming they can get you verified. Giving a stranger both sides of your identity document plus a liveness video is handing over a complete kit for impersonating you — used later to open other accounts and sign up for other services, entirely without your knowledge.

If the account is restricted after verification, follow the notice inside your account and Binance's help center.

Before you buy: four security settings to make first

A new account is at its most fragile exactly when it has just been opened and you are keen to make the first purchase. Not one security option is set yet, and the balance is about to arrive. Do the four things below before you deposit. The first matters most for someone who holds long term, so it comes first.

Setting 1: The withdrawal allowlist

With the allowlist on, the account can only send coins to addresses you added and confirmed beforehand, which blocks what somebody who has taken over the account wants to do: send the balance to a new address on the spot. A long-term holder withdraws to the same one or two addresses, so add your own self-custody address to the allowlist before you buy your first coin, and turn on the new-address hold. As for quick withdrawal (small withdrawals to allowlisted addresses without a second check), I'd leave it off and verify every time.

Setting 2: Move two-factor off SMS

With two-factor, what matters is which kind you use. Set an authenticator app's rotating code (TOTP) or a passkey as the primary method and turn SMS verification off wherever you can; where the platform requires it to stay on, follow its official instructions. When you enable TOTP, copy down the backup key and store it straight away, because that string is what restores the authenticator on a new device.

Setting 3: An anti-phishing code

You set a string of characters, and from then on the platform's official emails to you carry it, so an email without the code gets deleted. A matching code doesn't prove an email is genuine; for anything on the account, still go in through the official bookmark you saved yourself. Anyone who contacts you asking for your anti-phishing code is a scammer.

Setting 4: Devices, sessions and API keys

Remove any device in the device list that you do not recognize or no longer use. The API key section starts out empty on a new account; remember where it is, and delete each key once you are done with the tool that needed it.

These four are layers 2 to 5 in Binance Account Security: Seven Layers Every Beginner Should Set. That article goes through how each one works, what it blocks and how to set the other three, and you can work through it once the account is open. For how to recognize the various phishing techniques, see 13 Crypto Phishing Scams and How to Spot Them.

Your first deposit and your first purchase

Which deposit methods are available depends on where you are — bank card, third-party payment, peer-to-peer trading (P2P) and so on. Which ones this particular account can use is whatever the page shows you; do not copy someone else's experience.

The buying step is the easy part for a long-term holder: a market order fills straight away, or a limit order sits at a price you would be happy with. There is no need to study technical analysis here — you came to accumulate, not to trade. The thing genuinely worth your attention is in the next section.

There are also two small habits that will save you a lot later if you build them now:

• Keep your own records. The time, quantity, unit price and fee of every transaction, written down separately by you. If something goes wrong with the account, you may not be able to pull the platform's history at all. Tax filing, cost basis, a portfolio review years from now — all of them need that record. Tax treatment varies a great deal from place to place; go by the rules where you live.
• Small before large. The first time you walk the whole path (deposit, buy, withdraw to your own wallet), do it with an amount so small you would not care about losing it. Once the path works, go back to your planned amount. That small rehearsal exposes every snag you did not anticipate.

After you buy: when to withdraw and what to check first

This section is the most important one in the article. Every step before it exists to get you here — turning coins from rows in a platform's database into a balance controlled by your own private key.

When to withdraw

Rather than fixing an absolute amount, set three trigger lines and act when any one of them is met:

1. The balance goes above the number you gave yourself in question two. That is the ceiling you wrote down for yourself: cross it and withdraw.
2. You do not plan to touch these coins any time soon. The standard can be loose — say, no intention of selling or swapping in the next month. If you are not touching them, there is no reason for them to sit on the platform.
3. You have finished this round of buying. If you buy regularly, consolidate monthly or quarterly and withdraw once, which saves both fees and hassle.

The other way round, what can stay: the portion you genuinely intend to trade soon, and the small amount you keep for cashing out. Those two are reasonable to leave.

Six things to check before every withdrawal

Withdrawals are irreversible. Once an on-chain transaction is packed into a block, no support agent can pull it back (the FAQ covers the different cases of a withdrawal sent to the wrong address). So run through these six every time, even when it feels tedious.

Check	What exactly to look at
Where the address came from	The address was copied out of your own wallet, not out of a chat log, an email or a screenshot
Address, character by character	After pasting, check from the first character to the last, not only the start and the end. Clipboard malware exists specifically to swap the address at this step
Network / chain	The chain selected on the withdrawal side must be the same chain your receiving wallet supports
Allowlist	The destination is already on the allowlist and past the new-address hold
Small test first	The first time you send to a new address, send a small amount, confirm it arrived, then send the rest
Backup verified	You have checked the destination wallet's backup with the device's own backup-check feature, or by resetting the device and restoring once

That last one is easy to skip, and it is the most severe when it bites. A backup you have never verified you can restore from is not a backup. The order is: initialize the wallet, write down the seed phrase, use the device's own backup-check feature or reset this device and restore once, confirm the addresses match, and only then send money in. A hardware wallet's seed phrase is never typed into a phone or computer. For which medium to keep the backup on, see How to Store Your Seed Phrase Safely; for how a seed phrase relates to addresses, see Private Key vs Seed Phrase: How They Relate.

Picking the wrong network is the other way a withdrawal goes wrong. The same token on different chains is a different contract, and getting it wrong means a recovery process at best and nothing back at worst — Sent USDT to the Wrong Network? What to Do covers each case. While you are checking the address, check the network field in the same pass.

After the withdrawal

Once it arrives, check on a block explorer that the balance shown in the wallet matches what is on chain. Then put the transaction hash and the date into your own ledger. Only when that is done has the asset really landed in your own pocket.

Keeping a dormant account healthy

Once the coins are out, this account settles into a long low-frequency state — maybe one login every few months. That sounds harmless, but an idle account quietly accumulates a few problems that all surface together on the day you genuinely need it (which is usually the day you need it urgently).

The things that tend to break are these: the phone number you bound is out of service; the authenticator app never made it across when you changed phones; the document expired without being renewed; the platform's rules or verification requirements changed without you knowing; some third-party authorization you forgot about is still active.

Ten minutes once a quarter

Item	What to look at
Log in once	Confirm you still remember the password, two-factor still works, and there is no pending notice on the account
Email and phone number	Confirm both channels can still receive the platform's verification messages
Allowlist	The addresses are still the ones you use now; if you changed wallets, delete the old address
Devices and sessions	Remove devices you no longer use and check the login history for anything that does not line up
API keys	Delete anything you no longer use, especially anything carrying withdrawal permission
Document expiry	Renew ahead of time rather than discovering it on the day you need to cash out
Account balance	Confirm that occasional odds and ends have not quietly built back into a balance that should not be sitting there

What to do before changing phone, number or country

The order is the same in all three cases: while the old device still works, migrate the bindings first, and only then deal with the old device.

New phone: install the authenticator app on the new one, restore it with the backup key, confirm it produces correct codes, and only then wipe the old phone. New number: change and verify the bound number on the platform first, then cancel the old one. Moving country: confirm the service availability and verification requirements for your new address first, rather than discovering the problem when a new proof of address is demanded.

And a restatement of what this account is for

Maintaining the account keeps the channel open for when you need it. The balance in the account stays below the ceiling you set for yourself earlier.

Common questions

I just want to hold. Can I avoid exchanges entirely?

In theory yes; in practice it is hard. You can buy over the counter from someone you know, you can swap on a decentralized exchange, but the fiat end always needs an exit, unless your coins were mined or paid to you directly. The more realistic approach is to treat the exchange as a port rather than a warehouse: open one account, set every security option, withdraw to your own wallet as soon as you buy, and keep only a very small balance there long term. That way, if the platform blows up, what you lose is that small balance plus some hassle, not everything you own.

Is KYC mandatory? Can I withdraw without it?

Major exchanges now tie identity verification to withdrawals, and an unverified account can do very little. Rather than looking for a way around it, do it cleanly in one pass: a document still within its validity period, a name matching the document exactly, photos that do not cut off the corners, and a liveness check done slowly, following the prompts. If your name contains unusual characters or can be transliterated more than one way, use the spelling printed on the document and do not invent a prettier one. Which materials your region requires and how the tiers are divided are matters for Binance's current verification flow and the prompts on your own account page.

Can I use a VPN to sign up from another region?

I would not. The cost usually arrives later, when you try to get your money out. Registration may go through smoothly, but when you withdraw, cash out, or are asked for extra documents during a review, a login location, a document nationality and a bank record that do not line up can get the account restricted, and you will be in a very weak position. Whether this exchange can be used normally where you live is something to settle before you open the account.

If I withdraw right after buying, is the fee wasted?

A withdrawal costs an on-chain fee, and the amount depends on the network you pick. But look at what that fee buys: these coins no longer depend on one company staying in business. For someone planning to hold for years, that one-off cost spread across those years is small. What you should economize on is frequency. Do not withdraw three times a day; let it accumulate to a sensible amount and withdraw once, which also spreads out the cost of the small test transfer.

If the account sits untouched for a long time, will it be closed or charged?

Not logging in for a long time does not usually get an account closed by itself, but it stacks up several problems: the phone number you bound is out of service, the authenticator app was lost when you changed phones, the document expired, the platform's rules changed without you knowing. Put those together and, on the day you actually need the account, you may have to go through a long appeals process. Log in once a quarter and run through the allowlist, the device list and the verification methods while you are there. On fees, go by Binance's current announcements and your own account page.

One thing to do before you open the account

A dedicated email address, an authenticator app or a passkey, an anti-phishing code and the withdrawal allowlist block attacks aimed at you personally. No account setting blocks risk at the platform level; the only answer to that is moving the coins to an address your own private key controls.

So the order is: get the self-custody wallet ready, verify once that the backup restores, then come back and open the account. That way, when you buy your first coins, there is somewhere to withdraw them to.