You downloaded an app to move your own money and it wants a photograph of your IC. The instinct to hesitate is a healthy one — you should hesitate before handing identity documents to anyone.
So here is what the check is, why it is not optional, exactly what happens to the document, and how to tell a legitimate request from the fake ones that copy it.
What KYC is
KYC — Know Your Customer — is the process of confirming that you are who you say you are before a financial service opens an account for you. It sits inside a wider set of anti-money-laundering obligations that apply to regulated financial services everywhere, not only to crypto.
It is the same reason a bank asks for your IC when you open an account. Crypto services are not exempt from it, and any service claiming to be exempt is telling you something about itself.
Why it cannot be skipped
Three reasons, in descending order of how much they sound like an excuse:
It is a legal requirement. Regulated financial services are required to identify their customers. Not doing so is not a feature, it is a breach.
It protects your identity, not just ours. Verification is what stands between a stranger holding a photo of your IC and them opening a financial account in your name. If accounts could be opened with an unverified document, the person most exposed would be you.
It keeps the payment rails open. Cards run on Mastercard, and settlement runs through licensed payment providers. Those relationships exist on the condition that customers are identified. A service that skips checks loses the rails and, with them, the ability to pay anyone.
What actually happens, step by step
- You enter your details in the app.
- You photograph an identity document — passport, IC or driving licence, depending on your country.
- You take a short selfie or liveness check, which confirms the person holding the document is the person in it.
- Checks run and the result comes back — usually in under five minutes.
You need to be between 18 and 70 years old, and availability depends on your country of residence.
Getting it right the first time
Most failures are photography, not suspicion:
- Flat surface, no glare. Overhead light bouncing off the laminate is the most common cause of an unreadable image.
- Every corner in frame. A cropped edge fails automatically.
- The document must be current. An expired one will not pass.
- Details must match. The name and date of birth you typed must match the document exactly — including the order of names, which trips up a lot of Malaysian applicants with long full names.
- No screenshots, no photocopies. The original document, photographed directly.
What happens to the document afterwards
This is the part worth being specific about. Your data is processed for the purpose of identifying you and meeting legal obligations, and it is handled under our Privacy Policy, which sets out who processes it and what rights you hold over it.
Those rights are real and you can use them: access to what is held about you, correction of anything wrong, and deletion where the law allows. Deletion “where the law allows” is doing work in that sentence — records tied to anti-money-laundering obligations must be retained for a legally defined period even after you close an account. No financial service can delete those on request, and one that promises to is either mistaken or lying.
If you want to close your account, there is a process for that.
How to tell a real request from a fake one
Criminals imitate KYC precisely because people expect it. The tells are consistent:
- Real verification happens inside the app you downloaded, at the point you signed up. Not in a chat, not over email, not on a link someone sent you.
- We will never ask for your password, a one-time code, or a wallet recovery phrase. None of those are part of identity verification, ever. Anyone asking is stealing.
- Nobody legitimate asks for a “verification fee” or a deposit to unlock your account.
- Urgency is the tell. “Your account will be closed in 24 hours unless you verify” is pressure, and pressure is the technique.
- Check the domain yourself. Type wavedigipay.com; do not follow a link from a message. Get the app from the official links.
More patterns worth recognising in what can and cannot go wrong.
If verification fails
Retake the photograph in better light before assuming anything is wrong. If it still fails, email [email protected] — describe what happened but do not attach identity documents to an email. Support will tell you where they belong.
The trade being offered
You give up some privacy to a regulated service, and in exchange you get a card that works at 170+ countries’ terminals, cash from ATMs, and a company that can be held to a complaints process.
The alternative — a service that asks nothing — cannot offer any of that, and has no obligation to you when something goes wrong. Five minutes is a reasonable price for the difference.
Download the app when you are ready.
