No-KYC VPS: what it really means, and what a host still has to know

A no-KYC VPS is a server you can rent without proving who you are: no ID upload, no selfie, no phone verification. That is normal rather than a loophole — KYC is a legal duty for banks, payment firms and crypto exchanges, and hosting providers are generally not bound by it. It does not mean the host knows nothing about you. An EU provider still needs contact and billing details for invoices and VAT, and it answers lawful orders with whatever it holds.

This page is about identity checks only. How to pay privately is covered in paying for a VPS with Monero, step by step, and what leaks once the server is running in anonymous VPS hosting. Here: what KYC actually is, what “no KYC” honestly covers, and how to check a host’s claim before you pay.

What is KYC, and who has to do it?

KYC stands for Know Your Customer. It is the customer due diligence that anti-money-laundering law requires from certain businesses: identify the customer, verify that identity against a document or another reliable source, understand what the business relationship is for, and keep the records for years.

In the EU, the businesses bound by these rules — “obliged entities” in the directive’s language — are mainly banks and other financial institutions, payment and e-money firms, crypto-asset service providers such as exchanges, and a set of professions and sectors including notaries, auditors, estate agents and gambling operators. Renting out servers is not on that list. There is no general legal duty for a hosting provider to check an ID document before it sells you a VPS, so a host that asks is following its own policy, not the law. That is a general description, not legal advice for any particular country.

What counts as an identity check?

“KYC” gets used loosely. These are the checks that hosts actually run, from the strongest to the weakest:

• ID document upload — a photo of a passport, ID card or driving licence, often checked by a specialised verification company.
• Selfie or liveness check — your face matched against the document.
• Video identification — a call in which an agent compares you with the document.
• Proof of address — a utility bill or bank statement.
• Phone verification — an SMS code. Weaker, but in many countries a SIM card is registered to a name, so a number often leads to a person.
• Card checks — 3-D Secure and a cardholder name. These happen at your bank, not at the host, and they identify you through the payment whatever the host’s own policy is.

A host that honestly says “no KYC” runs none of the first five. If you pay by card, the sixth happens anyway; pay in crypto from a wallet you control and there is no identity document anywhere in the process.

Why do some hosts ask for ID anyway?

Mostly fraud. Stolen card numbers are used to buy servers in bulk, and asking for a document costs a provider less than the chargebacks and the abuse that follow. It is usually triggered by risk signals — a new account, a VPN address, a country that does not match the card, an unusually large first order — rather than applied to everyone. How two large German hosts handle it is a good example, and the payment side of the story is in why some hosts ask for a passport.

Two other reasons exist. Abuse: a server bought to send spam or run phishing gets the provider’s address ranges blacklisted, and an identity check raises the cost of coming back under a new name. And sanctions: EU sanctions apply to every EU company, so some providers screen customers from certain countries more closely. Neither turns KYC into a legal requirement for hosting; both explain why policies differ so much.

What does a no-KYC host still collect?

More than nothing, and a provider that pretends otherwise is not being straight with you. As a concrete example, this is what we collect, according to our sign-up form and privacy policy:

• An e-mail address — for the login, invoices and server notices.
• Your name and a password.
• A postal address with the country — the invoice is issued to it, and the country sets the VAT rate.
• Technical and usage data — the IP address and browser you use the site and panel with, login times and your servers’ resource usage, as nearly every provider’s privacy policy lists them.
• Payment data — for crypto, the transaction on the chain; for a card, what the payment processor passes on.

What it never asks for: an ID card, passport or driving licence, a selfie or video call, or a phone number. Nothing you enter is verified. The name and address exist because every order gets a proper invoice, and a provider registered in the EU has to charge VAT by the customer’s country — not because anyone checks them against a document.

What does “no KYC” not mean?

• Not “no data”. The account details above stay as long as the account exists, and invoices as long as tax law requires.
• Not “no cooperation with authorities”. An EU host answers court orders, and under the Digital Services Act it must act on notices about illegal content and on official orders to provide information about specific customers. It hands over what it holds. The point of no KYC is that this does not include a passport scan.
• Not “anything goes”. The acceptable use policy applies to every server, however it was paid for.
• Not “no logs”. That is a separate claim about connection and usage data, and it deserves its own question. Look for a privacy policy that says exactly what monitoring covers — usage metrics only, for instance, with no packet contents or traffic data.
• Not anonymous. The honest wording is “no ID check”. Your server has a public IP address, you connect to it from somewhere, and the host has your account details.

How do you check a host’s no-KYC claim before paying?

A “No KYC” badge on a homepage costs nothing to print. These checks take ten minutes and tell you what will actually happen.

1. 1Read the sign-up form itself

   Open the registration page and look at the fields before you fill them in. A required phone number, a document-upload step or a third-party verification widget answers the question on the spot.

2. 2Read the data list in the privacy policy

   The GDPR obliges EU providers to say what they process and why. Search the policy for “identity document”, “verification”, “selfie” or the name of a verification company. A provider that collects ID documents has to say so there.

3. 3Search the terms for verification clauses

   Many terms of service reserve the right to request identification at any time, for example when an order looks suspicious. “No KYC at sign-up” and “no KYC, ever” are different promises; the terms tell you which one you are getting.

4. 4Look at the payment step and the refund rules

   A card payment brings the bank’s checks with it. A crypto checkout usually runs through a payment processor; see what its page asks the payer for. Read how refunds work too: a refund to a card or a wallet may need details the payment never did. Some hosts avoid that by refunding only as account credit, never back to a wallet; the terms say which applies.

5. 5Ask, in writing, before you pay

   Send one pre-sales question: “Will you ever ask me for an ID document, and in which situations?” A clear written answer is worth more than any badge. Directories such as kycnot.me track which services work without KYC; treat them as a starting point and confirm on the provider’s own pages.

Can I get a Windows RDP server without KYC?

Yes. Everything above applies to Windows as well: an RDP server is a VPS running Windows Server, and whether you show ID depends on the host, not on the operating system. Be careful with cheap “RDP accounts” that are really a user seat on somebody else’s Windows machine. No KYC there also means no control — the seller is the administrator of the machine your session runs on. With a Windows server of your own, you are the administrator.

How does it work at VMHeaven?

Sign-up asks for an e-mail address, your name, a password and a postal address, and nothing else: no ID document, selfie or phone number, at sign-up, payment or renewal. Card and crypto cost the same — the crypto VPS page shows how a crypto payment turns into a running server — and the servers run in Amsterdam and Frankfurt with DDoS protection always on. A Windows RDP server is ordered with the same sign-up: your own KVM machine with Windows Server 2022 or 2019 and full Administrator access, on an evaluation licence until you activate a key of your own.

If you are comparing providers on more than identity checks, the offshore VPS buyer’s checklist covers jurisdiction, acceptable use, abuse handling and refunds, and buying a VPS with Bitcoin walks through the payment itself. The “no ID check” part is the easy bit; what you do with the server afterwards decides how private it stays.

Frequently asked