Is no-KYC hosting legal?

People assume that if a provider is not collecting identity documents, it must be cutting a corner. It is not. Identity verification is a specific legal obligation imposed on a specific list of business types, and hosting is not on the list.

Where KYC obligations come from

KYC is a component of anti-money-laundering regulation. The main instruments:

• EU: Directives (EU) 2015/849 and 2018/843 (4AMLD and 5AMLD), and the 2024 AML package that creates the AMLA authority and a directly applicable regulation. These impose customer due diligence on "obliged entities."
• US: the Bank Secrecy Act (31 U.S.C. § 5311 et seq.), the USA PATRIOT Act §326, and FinCEN's Customer Identification Program rules.
• International: the FATF Recommendations, which most national regimes implement.

Every one of these frameworks works the same way: it enumerates the categories of business that must perform due diligence. The list covers credit and financial institutions, payment and e-money services, crypto-asset service providers, casinos, real-estate agents, dealers in high-value goods, and specified legal and accounting professionals.

Why hosting is not covered

Hosting providers are not obliged entities under any of them. The reasoning is straightforward: AML rules target businesses that move or store value, because that is the vector money laundering uses. Selling compute time is selling a service, in the same category as selling a bicycle or a haircut — neither of which triggers customer due diligence either.

A hosting provider that accepts card payments has a bank that is an obliged entity, and that bank performs due diligence on the merchant. But the obligation runs to the merchant, not through the merchant to its customers. A crypto-only provider does not even have that relationship — although note that the payment processor handling the crypto may itself be a regulated crypto-asset service provider, which is a question about the processor and not about the host.

The exceptions worth knowing

Three situations where the analysis changes:

• Telecommunications registration. Some countries impose registration, retention or lawful-interception duties on telecommunications service providers, and whether hosting falls inside that definition varies by country and is moving. Switzerland's revised BÜPF, for example, expressly creates a lighter category of derived communication service providers that the Federal Council reads as covering hosting and cloud — lighter than full telecom duties, but inside the Act. Do not assume hosting is categorically outside these regimes. Providers that also sell connectivity, transit or SIM-based services are more clearly inside.
• Sanctions screening. This is separate from KYC and does apply. Providers must not knowingly supply services to sanctioned persons or to embargoed territories. In practice this is enforced at the payment layer and by geography, not by collecting passports.
• Sector-specific regimes. If you are hosting regulated data — payment card data under PCI DSS, health records, certain financial records — the obligations attach to you as the data controller and may require a provider willing to sign specific agreements. Anonymity and regulated-data compliance are usually incompatible, and that is a constraint on your side, not ours.

What anonymous purchase actually buys you

• No identity database to breach. The largest single source of identity exposure is not surveillance; it is providers being hacked. A field that was never collected cannot be leaked.
• No identity to disclose. When a provider receives a subpoena, what it hands over is what it holds. A salted hash and a payment amount is a very short document.
• No commercial profiling. Your hosting purchase does not join a marketing graph, get sold in a data broker's file, or follow you into a bankruptcy auction.
• Protection from your own government's civil process. Journalists, researchers and political organisers in hostile environments are protected by the file not existing at all.

What it does not buy you

Anonymous purchase is one layer. It does not:

• Make illegal activity legal. The law applies to what happens on the server regardless of who bought it.
• Hide the server. The IP address is public, and everything the server does is observable from outside.
• Protect you from your own operational mistakes. A server bought anonymously and administered from your home IP, with a domain registered in your name, running an application that leaks an identifier, is not anonymous. This is how essentially every real deanonymisation happens.
• Stop lawful process. A valid local court order is binding on us and we comply with it. Anonymity means what we can produce is small, not that we produce nothing.

This article describes how these frameworks apply to our operations and is not legal advice. VPSDEN has never collected an identity document and the ordering system has no field to store one.