--- title: "Hosting Without ID Verification: Why Hosts Ask, What’s Kept" description: "Why Hetzner and OVHcloud ask for ID, the withdrawn US cloud KYC rule, BitPay’s ID requirement, and what a no-KYC host still keeps. Checklist and red flags." url: "https://powerdedi.com/blog/hosting-without-id-verification" last_updated: "2026-10-15" publisher: "PowerDedi (https://powerdedi.com)" --- # Why hosting providers ask for ID, and what no-KYC hosting means Why mainstream hosts ask for passports and card photos, what happened to the proposed US KYC rule for cloud providers, what crypto payment processors require, and what a host without ID checks still records, with a checklist and red flags. By PowerDedi Engineering · October 15, 2026 · 9 min read **Share this article** Hosting providers ask for ID mainly to stop fraud: servers ordered with someone else’s card or identity, and the abuse that often comes with them. Hetzner and OVHcloud describe their checks as fraud prevention; Scaleway ties verification to higher quotas. Hosting without ID is lawful privacy, not anonymity: a no-KYC host still keeps records and answers valid legal orders. ## The short version | Question | Answer, as of October 2026 | | --- | --- | | Why does Hetzner want my ID? | To confirm that your account and order details are correct and authentic, as part of its fraud prevention. A prepayment from your own credit card is the alternative. | | What do other hosts ask for? | OVHcloud US may ask for photos of your ID, of the card you paid with and of you holding the ID. Scaleway checks an ID and your face before raising quotas. Contabo screens customers against sanctions lists. | | Does a law require KYC for servers? | Not under the US rule proposed for cloud providers in 2024: it was withdrawn on December 16, 2025. The ID checks hosts run are their own policies, and sanctions law applies whatever a host checks. | | Does paying in crypto avoid ID? | Only if the payment path does. BitPay requires ID verification for every invoice payment, and CoinGate screens the coins you send. | | Does “no KYC” mean anonymous? | No. The host keeps your email address, billing records and logs, enforces its acceptable use policy and acts on valid legal orders. | ## Why does Hetzner need my ID? Hetzner explains its checks in a fraud prevention FAQ, last changed on August 6, 2026. The stated purpose is to make sure that the information you enter for your account and order is correct and authentic, and to protect its own systems and those of its customers. Before processing an order, Hetzner may ask you to verify your account in one of two ways: - **An identity document.** A copy of a valid government-issued ID, such as an ID card or a passport, which Hetzner compares with your registration details. - **A prepayment.** An advance payment with your own credit card, which shows that you hold a valid payment method. As a general rule, Hetzner refunds unused credit from this step only if you close the account with no invoices outstanding. The same FAQ asks you not to register through a VPN and, if possible, not with a free email address, because both make it harder to verify your identity and assess the risk of fraud. First orders that look unusually large or expensive get a plausibility check, because Hetzner sees more potential for misuse in them, and may be held back or rejected. In other words, the ID request is one of Hetzner’s fraud controls, not a formality every customer goes through. ## Why do hosting providers ask for ID? Hetzner is not alone. Here is what other large hosts say in their own documentation, checked in October 2026. | Host | What it may ask for | Stated reason | | --- | --- | --- | | Hetzner | A copy of a government-issued ID, or a prepayment with your own credit card | Fraud prevention: confirming that account and order data are correct and authentic | | OVHcloud (US) | When an order cannot be verified: full-color photos of a government-issued photo ID, of the card used for the order showing your name and its last four digits, and of you holding the ID, within about 48 hours or the order may be canceled | Ensuring authorized access, preventing fraud and keeping its cloud safe; it says it destroys the documents once validation is complete | | Scaleway | An optional check with a government-issued photo ID and a facial check, completed within 15 minutes | Unlocking resource quotas and the console’s full features | | Contabo | Additional evidence at its discretion, especially when it has reason to doubt your identity | Identity doubts; its terms also provide for ongoing sanctions-list screening | None of the four asks every customer for documents by default. The request follows an order the host cannot verify, a doubt about your identity or, at Scaleway, a need for higher quotas. Behind the policies sit three motives. - **Card fraud and chargebacks.** A server goes live within minutes and uses hardware, power and IP addresses from the start. If a stolen card paid for it, the real cardholder disputes the charge, and the merchant is debited the disputed amount plus a dispute fee, as Stripe’s documentation describes. That is why OVHcloud asks to see the card used for the order, and why Hetzner accepts a prepayment from your own card instead of an ID. - **Abuse prevention.** A customer who cannot be identified is hard to hold to account for spam, phishing or attacks, and the host’s network and IP reputation bear the consequences. Hetzner’s extra scrutiny of large first orders targets that risk of misuse. - **Sanctions.** Sanctions law forbids dealing with designated people and companies; for US persons, OFAC’s rules generally prohibit any transaction involving their property. Contabo’s terms commit it to ongoing sanctions-list screening and reserve the right to refuse customers from North Korea, Russia, Syria, Sudan, Iran, Cuba, and the Donetsk, Luhansk and Crimea regions. Legal obligations can also sit with the payment provider rather than the host, as the next two sections show. ## Is KYC for servers required by law? In the United States, the closest thing to a KYC law for servers was a proposal that never took effect. Executive Order 13984 of January 19, 2021 directed the Commerce Department to propose rules requiring US providers of Infrastructure as a Service (IaaS) to verify the identity of their foreign customers. The department’s Bureau of Industry and Security published the proposed rule on January 29, 2024. It would also have required reports when a foreign person used US IaaS to train a large AI model, under a 2023 executive order on artificial intelligence. Comments closed on April 29, 2024. No final rule followed. In the Commerce Department’s 2026 Unified Agenda of regulations, the rulemaking is listed among completed actions, with the status “Withdrawn” dated December 16, 2025. As of October 2026, that proposal places no obligation on hosts or their customers. Two things are unaffected. Sanctions law applies whether or not a host checks identity documents. And hosts remain free to set their own verification policies, which is what the checks above are. ## What crypto payment processors require Paying in crypto does not by itself mean paying without ID. It depends on who processes the payment. - **BitPay** requires a BitPay account with completed BitPay ID verification before you pay an invoice. BitPay says applicable laws and regulations require it to collect information about shoppers for any transaction through its service, invoice payments included. Identity documents and a facial liveness check are verified by Sumsub. Only its self-custody wallet is exempt. - **CoinGate** screens incoming payments on the blockchain. A payment from a sanctioned country, from a wallet linked to sanctioned people, entities or exchanges, or tied to stolen funds, scams, ransomware or darknet activity is rejected, marked invalid and not refunded. A host can therefore skip identity checks itself and still route you through a processor that runs them. If that matters to you, look at the checkout before you sign up, not after. ## What “no KYC” means, and what it doesn’t “No KYC” means the host does not verify who you are: no identity document, no phone number, no card. It does not mean the host knows nothing about you, and it does not put anyone beyond the reach of the law. - **The host keeps records.** At the very least an email address, a billing history, the data needed to run your service and security logs. Its privacy policy should tell you exactly what it keeps and for how long. - **Blockchains keep records too.** Bitcoin and Ethereum have transparent blockchains on which anyone can trace transactions, as getmonero.org notes, while Monero hides the sender, the receiver and the amount of every transaction. Even then, the host’s own billing record ties the payment to your account. - **Rules still apply.** Acceptable use policies, abuse reports and legal orders work the same way for a customer who signed up with an email address as for one who uploaded a passport. That is the difference between privacy and anonymity. A no-KYC host keeps copies of your passport out of its database, where they could leak or be misused. It does not promise that nobody can ever link you to your server, and it should not. ## How PowerDedi handles it We ask for an email address and nothing else: no ID, no phone number, no card. Payment is in crypto only, in Bitcoin, Ethereum, Monero, USDT on TRON or Solana, at prices set in US dollars. Here is what that leaves us with, and what we do with it. - **What we keep.** Your email address; billing records, including the deposit addresses created for your payments and their transaction hashes; the service data needed to run your servers; and security logs, with IP addresses truncated. Our [privacy policy](https://powerdedi.com/legal/privacy) has the details. - **What we don’t allow.** Our [acceptable use policy](https://powerdedi.com/legal/acceptable-use) prohibits spam, phishing, malware, attacks, mass scanning and illegal content, with zero tolerance for child sexual abuse material. Mining is not permitted, and Tor exit relays need our prior written approval. - **How we handle abuse.** Reports go through our [abuse process](https://powerdedi.com/abuse), and we contact the customer first unless an attack is in progress. - **Who we answer to.** We act on requests from authorities only when they come as valid orders from a competent authority. What we can hand over is what we hold: the records listed above. - **What Monero changes.** Paying in XMR keeps the amount and the addresses off the public record, but our billing record still links the payment to your account. See [paying with Monero](https://powerdedi.com/crypto-payments/monero). The offer is summarized on our [no-KYC dedicated servers](https://powerdedi.com/no-kyc-dedicated-servers) page. We are not the right host if you need to pay by card or bank transfer: we accept crypto only. ## How to choose a no-ID host safely 1. **Read the policies before you pay.** Look for a privacy policy that says what is kept and for how long, an acceptable use policy that bans spam, malware and attacks, and terms that say when a server can be suspended. Missing or vague policies are a warning sign. 2. **Check the payment path.** Pay directly on-chain or through a processor whose rules you know; BitPay, for one, verifies the identity of every payer. 3. **Check the abuse process.** A serious host publishes how it handles reports and contacts you before acting, except during an active attack. 4. **Verify what you can.** CPU models, disks, port speeds and locations should be specific, and testable once your server is running. 5. **Start month-to-month.** Test before you commit, and keep backups with another provider. 6. **Secure your email.** With email-only sign-up, your mailbox is your identity. Protect it and the client area with unique passwords and two-factor authentication, as in our [first-hour security checklist](https://powerdedi.com/docs/secure-your-server). Our [guide to choosing a crypto dedicated server provider](https://powerdedi.com/blog/how-to-choose-crypto-dedicated-server-provider) covers hardware, network and support in more detail. ## Red flags - **“Bulletproof.”** The US Treasury describes bulletproof hosting providers as selling servers and infrastructure built to evade detection and resist law enforcement efforts to disrupt malicious activity. In 2025 its Office of Foreign Assets Control (OFAC) sanctioned two of them. On February 11, jointly with Australia and the United Kingdom, it designated Zservers, which leased IP addresses and hosting to affiliates of the LockBit ransomware group. On July 1, it designated Aeza Group, which hosted infostealer operators, ransomware and the BlackSprut darknet drug market; that action also covered a UK front company. US persons are generally prohibited from dealing with designated persons, and violations can bring civil or criminal penalties. - **“DMCA ignored” or “all complaints ignored.”** A host that promises to ignore every report is promising to keep hosting whatever its worst customers do, on the same network and IP ranges as you. - **Absolute promises.** “No logs at all”, “untraceable” or “beyond the reach of any authority” cannot be true of a business that takes payments and runs a network. - **A no-KYC sign-up that ends at a KYC checkout.** Sign-up without ID, then a payment processor that asks for your passport. - **Fake urgency.** Countdown timers and permanent “limited” discounts are sales pressure, not privacy features. ## Sources - [Fraud prevention FAQ](https://docs.hetzner.com/general/security-and-identify/fraud-prevention-faq/) — Hetzner Docs (last changed August 6, 2026) - [OVHcloud order validation FAQ](https://support.us.ovhcloud.com/hc/en-us/articles/29332308749587-OVHcloud-order-validation-FAQ) — OVHcloud US Support - [How to verify your identity](https://www.scaleway.com/en/docs/account/setup-lifecycle/verify-identity/) — Scaleway Documentation (reviewed February 4, 2026) - [Terms & Conditions](https://contabo.com/en/legal/terms-and-conditions/) — Contabo (General Terms and Conditions effective December 2025) - [How disputes work](https://docs.stripe.com/disputes/how-disputes-work) — Stripe Documentation - [Taking Additional Steps To Address the National Emergency With Respect to Significant Malicious Cyber-Enabled Activities](https://www.federalregister.gov/documents/2024/01/29/2024-01580/taking-additional-steps-to-address-the-national-emergency-with-respect-to-significant-malicious) — Federal Register, proposed rule, January 29, 2024 - [Taking Additional Steps to Address the National Emergency With Respect to Significant Malicious Cyber-Enabled Activities (RIN 0694-AJ35)](https://www.reginfo.gov/public/do/eAgendaViewRule?pubId=202510&RIN=0694-AJ35) — 2026 Unified Agenda, reginfo.gov - [United States, Australia, and the United Kingdom Jointly Sanction Key Infrastructure that Enables Ransomware Attacks](https://home.treasury.gov/news/press-releases/sb0018) — U.S. Department of the Treasury, February 11, 2025 - [Treasury Sanctions Global Bulletproof Hosting Service Enabling Cybercriminals and Technology Theft](https://home.treasury.gov/news/press-releases/sb0185) — U.S. Department of the Treasury, July 1, 2025 - [What is BitPay ID verification? What documents are accepted?](https://support.bitpay.com/hc/en-us/articles/360030710712-What-is-BitPay-ID-verification-What-documents-are-accepted) — BitPay Support - [Why was my order suspended?](https://support.coingate.com/hc/en-us/articles/21182254878620-Why-was-my-order-suspended) — CoinGate Support - [What is Monero (XMR)?](https://www.getmonero.org/get-started/what-is-monero/) — getmonero.org **Share this article** PowerDedi Engineering The team that builds, racks and runs every PowerDedi server. We write about the hardware, networks and costs we deal with every day, and we cite our sources. **Dedicated servers** $55/mo and up About 40% below the market, with a 10 Gbps unmetered port on every server. Paid in crypto. [Browse servers](https://powerdedi.com/dedicated-servers) **More from the blog** - [Guides](https://powerdedi.com/blog/ton-node-requirements) October 21, 2026 **TON node requirements in 2026: full node, liteserver, validator** - [Comparisons](https://powerdedi.com/blog/crypto-dedicated-server-providers-compared) October 15, 2026 **Dedicated servers paid in crypto: 14 providers compared (October 2026)** - [Comparisons](https://powerdedi.com/blog/hetzner-alternatives-2026) October 15, 2026 **Hetzner alternatives in 2026: crypto payment, 10 Gbps, no setup fees** - [Comparisons](https://powerdedi.com/blog/ovhcloud-alternatives-2026) October 15, 2026 **Does OVHcloud accept crypto? OVHcloud alternatives in 2026** ## Related articles [All articles](https://powerdedi.com/blog) [Payments](https://powerdedi.com/blog/category/payments) September 1, 2026 ### [Bitcoin, Ethereum, Monero, USDT or Solana: how to pay for servers](https://powerdedi.com/blog/bitcoin-ethereum-monero-usdt-solana-paying-for-servers) Fees, confirmation times, privacy and price stability compared for the five coins we accept, plus the exchange-withdrawal mistakes behind most payment problems. 6 min read [Guides](https://powerdedi.com/blog/category/guides) September 25, 2026 ### [Dedicated server vs VPS: which one do you need in 2026?](https://powerdedi.com/blog/dedicated-server-vs-vps) A VPS is a slice of a shared machine; a dedicated server is the whole machine. What that changes for performance, cost and bandwidth, how to measure CPU steal on your VPS, and when moving to bare metal pays off. 5 min read [Comparisons](https://powerdedi.com/blog/category/comparisons) October 15, 2026 ### [Dedicated servers paid in crypto: 14 providers compared (October 2026)](https://powerdedi.com/blog/crypto-dedicated-server-providers-compared) We checked 13 hosts that sell dedicated servers for crypto, plus PowerDedi: which accept Monero, which ask for ID, who processes the payment, the cheapest current-generation server, port and traffic, stated delivery time and locations. 11 min read ## Your next server is 15 minutes away. From $55/month with 10 Gbps unmetered, no setup fee and no contract. [Browse servers](https://powerdedi.com/dedicated-servers) [All articles](https://powerdedi.com/blog) Live in ~15 min · Cancel anytime · BTC, ETH, XMR, USDT or SOL --- PowerDedi — Dedicated servers with 10 Gbps unmetered, paid in crypto. Page: https://powerdedi.com/blog/hosting-without-id-verification. Index of the site for AI assistants: https://powerdedi.com/llms.txt