KYC & limits · straight from the terms
Bitrefill KYC: how far you get on just an email address
Bitrefill is one of the last mainstream places you can spend crypto without proving who you are. That freedom has a precise numerical boundary — $500 a day — and a set of tripwires that can move it without notice.
CEX.IO Limited is authorised and regulated by the Gibraltar Financial Services Commission as a DLT Provider (authorisation FSC0686FSA) and is a FinCEN-registered Money Services Business in the United States.
The short answer
You can buy from Bitrefill with an email address and nothing else, up to $500 per day and $1,000 per month. Those are not estimates from a forum — they are the figures in Bitrefill's own terms of service. Beyond them, you climb a three-step ladder, each rung asking for more documentation.
- Unverified: $500/day, $1,000/month. Email only.
- Basic: $5,000/day, $10,000/month.
- Verified: $10,000/day, $50,000/month.
- Corporate: negotiated above that.
Two caveats that matter more than the numbers. Bitrefill can demand verification at any time if monitoring flags an order — the terms say so explicitly. And the Bitrefill Card always requires KYC, no matter how little you load onto it.
The exact tier limits
Most pages covering this topic guess, or repeat a number someone posted on Reddit in 2024. These come from the published terms, which is the only source that binds anyone.
Swipe sideways to see every column.
| Account level | Daily limit | Monthly limit | Typically requires |
|---|---|---|---|
| Unverified | $500 | $1,000 | Email address only |
| Basic | $5,000 | $10,000 | Identity details, light checks |
| Verified | $10,000 | $50,000 | Photo ID plus liveness selfie |
| Corporate | Negotiated | Negotiated | Company documentation |
Notice the shape of that ladder. The jump from unverified to basic is tenfold — from $500 to $5,000 a day. For most people buying vouchers for personal use, the unverified band is genuinely sufficient: $1,000 a month covers a couple of subscriptions, a gaming budget, some mobile data and the occasional larger gift. You only need to think about tiers if you are doing something at volume, and if you are doing something at volume you should expect scrutiny.
What actually triggers a verification request
The tiers are the predictable part. The unpredictable part is the monitoring layer sitting on top, and this is where people get surprised mid-purchase with an invoice already paid.
Bitrefill's terms state that transactions are monitored for compliance, that suspicious transactions will be reported to competent authorities, and that you "may be required at any time to complete a KYC program". That is boilerplate for any business handling payments, but the practical consequences deserve spelling out. From the patterns we have seen described, the common triggers are:
Volume that steps up abruptly. A dormant account that suddenly buys near its daily ceiling looks different from one that has been buying steadily for a year. A geographic mismatch — an IP address in one country buying a card region-locked to another — which is also, not coincidentally, exactly what geoblocking-circumvention looks like. Payment address history, since Bitrefill can see where the coins came from and chain-analysis flags travel through mixers or sanctioned addresses. Product mix, because high-liquidity, easily-resold cards bought in bulk are a classic money-laundering pattern and every compliance system in this industry watches for it.
What "no KYC" actually buys you — and what it does not
This is where a lot of writing about Bitrefill becomes wishful. Let us be precise, because the distinction is genuinely useful and it was made concrete by real events.
What you avoid: handing a passport scan and a selfie to a company that will store them. That is a real privacy win, and it is not trivial. Every document you upload is a permanent liability sitting on someone else's infrastructure, waiting for their worst day.
What you do not avoid: Bitrefill still records your email address, the crypto address you paid from, and your IP address. That triplet is not nothing. An email links to your other accounts, a payment address links to your on-chain history, and an IP links to your rough location and your ISP. Together they are a decent identity fingerprint even without a document.
We know exactly how much that matters because it has already been tested. In the 1 March 2026 breach, approximately 18,500 purchase records were exposed — and the data in them was precisely emails, crypto payment addresses and IP addresses. No passports, because Bitrefill did not hold many. The low-KYC model limited the damage substantially. It did not eliminate it.
Genuine privacy advantages
- No identity documents for purchases inside the unverified band.
- Guest checkout works with only an email address — no account required.
- Signup needs an email and a password: no phone number, no address, no card on file.
- Because Bitrefill holds little personal data, a breach exposes little personal data — as March 2026 demonstrated.
- A redeemed gift card breaks the link between your crypto and your purchase at the merchant.
What is still recorded
- Email address, payment address and IP address are recorded on every order.
- Chain analysis of your payment address can reveal far more than the purchase itself.
- Verification can be demanded at any time, including after payment.
- The Bitrefill Card requires full KYC with no exceptions.
- Suspicious transactions are reported to authorities under the terms.
- Using multiple accounts to stay under limits is a terms breach with asset-seizure consequences.
The Bitrefill Card exception
Everything above applies to gift cards, eSIMs and top-ups. The Bitrefill Card is a different regulatory animal and the rules change completely.
Issuing a Visa-branded payment card means working inside the card networks and with a licensed issuer, and that brings mandatory identity verification, sanctions screening and ongoing transaction monitoring. There is no low-value exemption. If you want the card, you will verify — and you will also accept the 1.99% deposit fee and, in most cases, residency restrictions skewed toward the EU and EEA.
That produces a clean decision rule. If you came to Bitrefill for privacy, buy gift cards and ignore the card. If you came for the convenience of spending crypto anywhere Visa is accepted, the card is a reasonable product and the KYC is simply the price of a regulated payment instrument. Trying to have both is the one path that guarantees disappointment.
A sane approach to tiers
Three positions make sense, depending on what you are actually doing. Pick one deliberately rather than drifting.
Stay unverified on purpose. If your voucher spending is genuinely under $1,000 a month — which covers most personal use — there is no reason to verify. Keep purchases modest, use guest checkout or a minimal account, and you have the most private mainstream option available. Accept that a flagged order may force your hand and that you will earn no cashback via guest checkout.
Verify early and stop thinking about it. If you are a regular customer at any real volume, do the verification on a quiet Tuesday rather than mid-purchase. You get the $10,000/day headroom, you stop worrying about tripwires, and you can use the card if you want it. The cost is a document on file.
Split by purpose. Use verified status where you need volume and the card, and keep small, unrelated purchases separate. What you must not do is run two Bitrefill accounts to achieve this — the terms prohibit multiple accounts used to evade limits, and the stated penalty is suspension and asset seizure. The legitimate version of splitting is using different platforms for different purposes, which our alternatives page covers.
The legal backdrop, briefly
Bitrefill's posture is not a loophole; it is a consequence of what it sells. Selling prepaid vouchers is not the same regulated activity as exchanging or safeguarding crypto-assets, so Bitrefill is not authorised under MiCA as a crypto-asset service provider and is not supervised the way a licensed exchange is by Finansinspektionen. It sits under general Swedish commercial and anti-money-laundering law, which is where the monitoring obligations in its terms come from.
The direction of travel across the EU is toward more reporting, not less — ESMA's MiCA framework and the DAC8 tax-reporting directive both widen the perimeter. It would be unwise to build a long-term plan on today's thresholds staying put. What is reasonable is to understand where the line currently sits, which is what this page is for.
One thing we will not do is advise you on your tax position. Spending appreciated crypto is a disposal in most jurisdictions and may be taxable whether or not the merchant reports it. That is between you and a qualified local professional. Nothing on this site is tax, legal or financial advice.
Frequently asked questions
Does Bitrefill require KYC?
Not by default for small purchases. Bitrefill's terms set an unverified ceiling of $500 per day and $1,000 per month, and inside that band you need only an email address. Above it, you move through basic and verified tiers, each requiring more documentation. The terms also reserve the right to require verification at any time if automated monitoring flags a transaction.
What are the exact Bitrefill spending limits?
From the terms of service: unverified $500/day and $1,000/month; basic $5,000/day and $10,000/month; verified $10,000/day and $50,000/month. A corporate tier exists above that.
Is Bitrefill anonymous?
No — low-friction is not the same as anonymous. Bitrefill records your email address, your crypto payment address and your IP address on every purchase. That exact combination was what leaked in the 1 March 2026 breach. You can transact without proving who you are, which is meaningfully more private than an exchange, but you are not invisible.
Can I buy a gift card with no account at all?
Yes. Guest checkout with an email address works for delivery of the code. The trade-off is that guest purchases earn no cashback and cannot accumulate a rewards balance, and you have no order history to point at if something goes wrong. For a one-off purchase it is the most private route available.
Does the Bitrefill Card need KYC?
Yes, always. This is the sharpest distinction on the platform: gift cards are low-friction, the card is not. Issuing a Visa-branded payment card is regulated activity, so identity verification is mandatory regardless of how much you intend to spend. If privacy is why you came to Bitrefill, the card is not for you.
What documents does verification ask for?
Standard identity-verification package: a government photo ID such as a passport or national ID card, and a live selfie for liveness matching. Higher tiers and edge cases can trigger proof of address or source-of-funds questions. Bitrefill uses a third-party verification provider rather than handling documents itself.
Why did Bitrefill suddenly ask me to verify?
Because something in your order pattern tripped an automated rule — a jump in volume, an unusual payment address, a mismatch between IP and product region, or simply crossing a tier threshold. The terms permit this at any time and note that suspicious transactions are reported to competent authorities. It is normal AML practice, not an accusation.
Does Bitrefill report to the IRS or tax authorities?
Bitrefill is a merchant, not a broker, and does not issue tax forms the way an exchange does. That is not the same as your purchases being untaxable. In most jurisdictions, spending appreciated crypto is a disposal event, and under the EU's DAC8 framework reporting duties across crypto services are widening. Talk to a local professional — this page is research, not tax advice.
Sources and further reading
Updated: August 12, 2026 · Independent editorial — we are not Bitrefill.