Crypto Card Data Retention 2026: Five to Ten Years
- The retention clock starts the day you leave, not the day you join. Regulation 40(3) of the UK Money Laundering Regulations 2017 runs five years from the date the relationship “has ended”; Article 40(1) of Directive (EU) 2015/849 says the same. Closing the card starts the countdown.
- Five years is the floor, and two programmes publish more. Gnosis Pay keeps identification, biometric, contact and financial information “for a period of up to a maximum of 7 years”. Crypto.com keeps emails, chats and letters “up to 10 years”, and cites ten years under Swiss law against five under EU and UK law.
- The regulation that forces them to keep it also orders them to delete it. Regulation 40(5) says the firm “must delete any personal data obtained for the purposes of these Regulations” once the period expires. Not one live privacy policy we read mentions that duty.
- Eight of sixteen programmes publish a privacy policy we could read. Bybit's and Nexo's render client-side and served no text; Bitget Wallet's two privacy URLs both return HTTP 200 serving the marketing homepage.
- XKard's terms promise a “Zero Data model” and point at a privacy policy that does not exist. The footer link labelled Privacy Policy resolves to a 170-word cookie notice; /privacy and /privacy-policy both 404. This site earns commission from XKard, and the finding stands anyway.
On this page
- The clock starts the day you close the card
- The four statutory floors under crypto card data retention
- Crypto card data retention, policy by policy: 16 programmes
- Two programmes go past the floor, and one goes to ten
- The privacy policy that is a cookie policy
- Your face is on a different clock
- What a deletion request actually gets you
- A no-KYC card is not a no-data card
- Four questions before you upload a document
- Final take
- Sources
- FAQ
Everybody asks what a crypto card wants before it will issue: a selfie, a passport page, a utility bill. Almost nobody asks the question that outlives the card, which is how long the programme keeps all of it after you have gone. Crypto card data retention is measured in years, it runs from the day you close the account rather than the day you open it, and the longest figure we found published is seven. So on 23 October 2026 we read sixteen programmes' own privacy notices alongside the four statutes they cite. Eight publish a policy we could read, one publishes a cookie notice where its privacy policy should be, and the clearest commitment to destroying anything belongs to a card that stopped working in September.
The clock starts the day you close the card
The intuition most people carry is that data ages out while the account is open — that something collected in 2022 is nearly spent by now. Every instrument in this niche works the other way round. The period is anchored to the end of the relationship, so an account you have held for six years and close tomorrow has a retention clock that starts tomorrow at zero.
Regulation 40(3) of the UK Money Laundering Regulations 2017 sets five years running from, for records tied to a business relationship, “the date the relationship has ended”. Article 40(1) of Directive (EU) 2015/849 reads “for a period of five years after the end of the business relationship with their customer”. The programmes' own notices repeat the construction almost word for word: Crypto.com's UK notice says it is “obliged to retain your personal data for a period of 5 years after the end of the relationship”, and OKX's rights table reads “5-year minimum post-relationship retention applies”.
The four statutory floors under crypto card data retention
Four instruments do almost all of the work, and they are not interchangeable. Two of them order deletion once the period is up. One of them does not mention deletion at all. The difference decides whether your record has an expiry date or merely a minimum age.
The UK is the strictest in both directions. Regulation 40(3) sets the five years, regulation 40(4) caps transaction records at ten, and regulation 40(5) then requires the firm to “delete any personal data obtained for the purposes of these Regulations” once the clock runs out, subject to three exceptions: another enactment or court proceedings, the data subject's consent, and a reasonable belief the records are needed for legal proceedings. The EU directive mirrors it, including a power for member states to require “further retention” that “shall not exceed five additional years” — which is how a five-year floor becomes a ten-year ceiling.
The United States is the outlier. 31 CFR 1010.430(d) says only that records “shall be retained for a period of five years” and that they must be stored so as to be accessible “within a reasonable period of time”. It specifies no start point and imposes no duty to delete afterwards, which is why US notices read the way they do: Crypto.com's US policy says “at least 5 years” under the Bank Secrecy Act, and leaves the sentence there.
| Jurisdiction | Instrument | Period | Runs from | Duty to delete after? |
|---|---|---|---|---|
| United Kingdom | MLR 2017, reg. 40(3)–(5) | 5 years; transaction records capped at 10 | “the date the relationship has ended” | Yes — “must delete”, 3 exceptions |
| European Union | Directive (EU) 2015/849, Art. 40(1) | 5 years, extendable by up to “five additional years” | “after the end of the business relationship” | Yes — unless national law provides otherwise |
| United States | 31 CFR 1010.430(d) | 5 years | Not stated in the rule | No — the rule is silent |
| Switzerland | AMLA, as cited by Crypto.com's own EEA notice | 10 years | “after the end of the relationship between us” | Not stated in the notice |
| Argentina | AML/CFT law, as cited by OKX's own notice | “a minimum of ten (10) years” | “following the end of the business relationship” | Not stated in the notice |
EUR-Lex would not serve us Regulation (EU) 2024/1624, so the EU row cites the directive still in force rather than the regulation replacing it in July 2027 — the date our KYC rules guide covers.
Crypto card data retention, policy by policy: 16 programmes
Here is what the market publishes. The pattern is not a spectrum from good to bad but a split: programmes that give you a number, and programmes that give you a sentence. Three more — Coinbase, Wirex and RedotPay — refused our requests outright, which we record as unread rather than absent.
Three programmes publish a figure you could plan around, and the best schedule in the market belongs to the smallest issuer in the table. Bleap gives six rows: account records at the life of the account plus five years, KYC and AML records at five years after the relationship ends, transaction records at six to ten years, security logs at 12 to 24 months, support records at 24 months, marketing data until you opt out. Gnosis Pay gives one maximum of seven years. OKX gives five as a post-relationship minimum and ten for Argentina.
Four give you a sentence instead. Gemini, MetaMask and KAST retain for “as long as necessary” with no period attached, and Plutus cites the UK five years in a notice last updated on 21 October 2021 — five years stale. It also names Modulr FS Limited as the card issuer, which the 13,335-word Plutus terms read for our issuers audit never do.
| Programme | Stated retention | In its own words | Policy date |
|---|---|---|---|
| Crypto.com (UK) | 5 years; comms up to 10 | “5 years after the end of the relationship” | 17 Jun 2024 |
| Crypto.com (EEA) | 5 years | “under the EU Anti-Money Laundering legislation” | 21 Dec 2024 |
| Crypto.com (Switzerland) | 10 years | “10 years after the end of the relationship” | 21 Dec 2024 |
| Crypto.com (US) | “at least 5 years” | “under the Bank Secrecy Act and its related statutes” | 18 Mar 2025 |
| Gnosis Pay | Up to 7 years | “up to a maximum of 7 years” — ID, biometric, contact and financial data | 13 Feb 2026 |
| OKX | 5 years min; 10 in Argentina | “5-year minimum post-relationship retention applies” | 1 Jul 2026 |
| Bleap | Six-row schedule, 12 months to 10 years | “KYC/AML records: 5 years after the relationship ends” | 12 Mar 2026 |
| Plutus | 5 years | “a period of five years” under the UK regulations | 21 Oct 2021 |
| Gemini | No period | “we will continue to retain your Personal Information” after closure | 11 May 2026 |
| MetaMask | No period | “the period necessary to fulfill the purposes outlined” | 30 Sep 2026 |
| KAST | No period | “as long as your account remains active” | 30 Jul 2026 |
| Cypher (terminated) | 5 years, then destruction | “a minimum of five years following account closure” | 8 Jul 2026 |
| XKard | None published | “We operate under a Zero Data model” — and no privacy policy exists | Cookie policy, 4 Jun 2025 |
| Bybit | Not readable | Renders client-side; served HTML carries 16 characters of text | — |
| Nexo | Not readable | Serves “Loading terms…”; HTML has no instance of “retention” | — |
| Bitget Wallet | None found | Both privacy URLs return HTTP 200 serving the marketing homepage | — |
Two programmes go past the floor, and one goes to ten
The five-year figure is so uniform across the statutes that it reads like an industry answer. It is not: four figures in this set sit above it.
Crypto.com is the clearest case, because it publishes several notices and they disagree by design. One document carries both the EU and Swiss figures: five years under EU anti-money-laundering legislation, ten under the Swiss act, “after the end of the relationship between us” in each sentence. Its UK notice adds a second axis — not identity data but correspondence: “email addresses and content, chats, letters will be kept up to 10 years following the end of our relationship”. Your support tickets outlive your KYC file by five years.
Gnosis Pay publishes the longest single headline at “up to a maximum of 7 years”, and the timing is what makes it worth knowing: on 3 September 2026 the company said it would “start to wind down our own direct-to-consumer services, including the web app”, and the card goes with it, as our shutdowns comparison records. The product has months left. The file has years.
| Above the five-year floor | Figure | What it covers | Source of the longer period |
|---|---|---|---|
| Gnosis Pay | 7 years | Identification, biometric, contact and financial information | The programme's own choice — “legal obligations or legitimate interests” |
| Crypto.com (UK) | 10 years | Emails, chat transcripts and letters | “the limitation period applicable in your country” |
| Crypto.com (Switzerland) | 10 years | All personal data of Swiss customers | Swiss anti-money-laundering act |
| OKX (Argentina) | 10 years | Customer identification and transaction records | Argentine AML/CFT legislation |
| Bleap | 6–10 years | Transaction and payment records only | “statutory/accounting” |
The privacy policy that is a cookie policy
This site earns a commission from XKard, which makes the next paragraph the one we have the least commercial reason to write and the most editorial reason to.
Section 5 of the XKard terms and conditions, operated by XHYPE FZCO, reads in full: “We operate under a Zero Data model. We do not collect or store personal data unless required by law or for transactional security. For more, see our Privacy Policy.” We went looking for that privacy policy. It does not exist. The footer link labelled Privacy Policy points at xkard.io/cookies, which is a 170-word cookie notice last updated 4 June 2025 covering essential, analytics and functional cookies — no retention period, no data-subject rights, no named legal entity, and a contact address as its only identifying detail. Both /privacy and /privacy-policy return 404.
Your face is on a different clock
Biometric data is the one category where this market beats its reputation, and where the spread is widest. Three of the eight readable policies treat a face scan as something to destroy rather than store, and the best keeps it for a single session.
OKX sets the standard: facial geometry “is deleted in-session - only the pass/fail result is retained in the authorization event log”. Bleap says biometric templates “are deleted once any legally required retention window ends”. Crypto.com's US notice runs a fixed clock instead, keeping biometric identifiers until the purpose is satisfied or “for three (3) years following your last interaction with us”, and adds that it does “not sell, lease, trade or otherwise profit from your biometric data”. Gnosis Pay is the outlier the other way, folding biometric information into the same seven-year maximum as a utility bill.
| Programme | Biometric retention | Clause |
|---|---|---|
| OKX | Session only | “deleted in-session - only the pass/fail result is retained in the authorization event log” |
| Bleap | Until the legal window ends | “deleted once any legally required retention window ends” |
| Crypto.com (US) | 3 years from last interaction | “for three (3) years following your last interaction with us, whichever occurs first” |
| Gnosis Pay | Up to 7 years | Biometric information listed alongside identification and financial information |
| Gemini, MetaMask, KAST, Plutus | No separate clock stated | Biometric data not distinguished from other personal data |
What a deletion request actually gets you
Send a deletion request to any of these programmes and every one will tell you about the exception before the right. That is the law working as drafted, and it is worth knowing which half of your file the request can reach.
Article 17(1) of the GDPR gives the right “to obtain from the controller the erasure of personal data”. Article 17(3)(b) disapplies it where processing is necessary “for compliance with a legal obligation”, and 17(3)(e) where data is needed “for the establishment, exercise or defence of legal claims”. Between them those cover the AML record and the dispute file — the identity documents and the transaction history, which are the two things people most want gone.
What is left is still worth asking for: marketing profiles, analytics identifiers, support correspondence outside a live dispute, cookies. Article 5(1)(e), the storage limitation principle, requires data to be “kept in a form which permits identification of data subjects for no longer than is necessary” — the hook for everything the AML carve-out misses.
| Programme | What it says about erasure |
|---|---|
| OKX | Erasure “cannot apply where retention is required by AML/sanctions legislation (5-year minimum post-relationship retention applies)” |
| Crypto.com (UK and EEA) | “We will honour your deletion request ONLY if the condition(s) is met” |
| Crypto.com (US) | Some data is “not covered by California law and therefore may not be subject to deletion requests” |
| Gemini | Retention continues after closure for legal, regulatory, fraud, tax and reporting purposes |
| MetaMask | You “may request to have your Personal Information anonymized, erased, or deleted” |
| KAST | Commits to erasing data when no longer needed “except where law or public interest prevents such erasure” |
| Bleap | “When retention ends, we will delete or irreversibly anonymise the data” |
Note what is missing from that column. Regulation 40(5) imposes a positive duty to delete once the five years expire, and the EU directive does the same. Not one live policy here mentions it. Bleap's line is the closest, and it reads as the company's practice rather than an obligation it is under.
A no-KYC card is not a no-data card
The premise of a no-KYC card is that you hand over less, and it is sound — our no-KYC guide covers the thresholds that let a programme issue without documents. But fewer documents is not no record, and the schedules prove it: every programme that publishes one separates identity material from everything else.
Bleap's schedule is the clearest illustration. KYC and AML records get five years. Transaction and payment records get six to ten. Security logs and telemetry get 12 to 24 months, and support records 24. A card that never asked for your passport still produces every row in that table except the first one, and the longest-lived row is the ledger rather than the identity file.
Four questions before you upload a document
- Does a privacy policy exist at all? Open the footer link and read the heading. A cookie notice under a Privacy Policy label is a real outcome, not a hypothetical one.
- Is there a number? “As long as necessary” is compliant and tells you nothing. A schedule with rows, as Bleap publishes, is what a planned retention policy looks like written down.
- What date is on it? Plutus's notice is from October 2021. A policy older than the product's current card programme has not been read by its own author recently.
- Which jurisdiction's notice applies to you? Crypto.com publishes five years for EU customers and ten for Swiss ones in one document. The same card is a different data deal depending on where you live, exactly as its regional fee schedules differ.
We read the documents so you can compare them
Kardd tracks what each card programme publishes — fees, custody, issuer, KYC thresholds and the notices behind them — so you can see which ones write things down before you hand anything over.
Kardd may earn a commission on sign-ups, including XKard. Affiliate disclosure.
Final take
The statutory answer is boring and consistent: five years from the day the relationship ends, in the UK, the EU and the United States alike. What is not boring is how differently sixteen programmes handle a duty they all share. Three write a number down, four write a sentence, one writes a cookie policy, and five would not serve us a document at all.
The sharpest result is the one at the end of the table. Cypher's card stopped working on 6 September 2026, and its notice of termination is the only document in the set that states the obligation, the period and the destruction in one place: five years minimum after closure under the Bank Secrecy Act, held under strict access controls, then destroyed. It took a wind-down to produce the clearest data-retention disclosure in the niche. The eight live policies had no such deadline and wrote less.
Sources
All read on 23 October 2026. Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, reg. 40; Directive (EU) 2015/849, Article 40; 31 CFR 1010.430; GDPR Article 17 and Article 5; Crypto.com UK privacy notice, EEA and Switzerland notice and US privacy policy; Gnosis Pay Privacy and Cookies Policy and its 3 September 2026 wind-down post; OKX Privacy Notice; Bleap privacy policy; Plutus privacy policy; Gemini privacy policy; MetaMask privacy notice; KAST privacy policy; XKard terms and conditions and cookie policy; Cypher notice of termination. Bybit's and Nexo's privacy pages served no policy text; Bitget Wallet's privacy URLs served its marketing homepage; Coinbase returned 403, Wirex 429 and RedotPay 403; EUR-Lex returned HTTP 202 with an empty body for Regulation (EU) 2024/1624.
Related Articles
- Crypto Card KYC Rules 2026: What Changes and When
- Anonymous Crypto Card: What the Word Actually Buys
- Crypto Card Issuers 2026: 16 Programmes Checked
- Crypto Card Shutdowns 2026: 90 Days or No Notice
- Crypto Card Closure Fees 2026: $0 to $55 to Exit
- Crypto Card Balance Protection 2026: The Insolvency Rules
Frequently Asked Questions
How long does a crypto card keep your data after you close the account?
Five years is the floor in the UK, the EU and the United States, and the clock starts when the relationship ends, not when you opened it. Crypto.com cites five years under UK, EU and US law and ten under the Swiss act; OKX a “5-year minimum post-relationship retention”; Gnosis Pay “up to a maximum of 7 years”.
Does the law force crypto cards to keep my data, or to delete it?
Both, and the deletion half is the part nobody quotes. Regulation 40(3) sets the five years; regulation 40(5) then says the firm “must delete any personal data obtained for the purposes of these Regulations” once it expires. Article 40(1) of Directive (EU) 2015/849 is the same. 31 CFR 1010.430(d) imposes no deletion duty at all.
Can I make a crypto card delete my data under GDPR?
You can ask, but the anti-money-laundering record survives the request. Article 17(3)(b) disapplies erasure where processing is necessary “for compliance with a legal obligation”. OKX says erasure “cannot apply where retention is required by AML/sanctions legislation”, and Crypto.com's UK notice honours a deletion request “ONLY if the condition(s) is met”.
Does a no-KYC crypto card keep less data about me?
It holds fewer identity documents, but that is not the same as holding nothing. The published schedules separate the two: Bleap keeps security logs for 12 to 24 months and transaction records for six to ten years, against five for KYC material. The useful question is whether a programme publishes what it keeps — and several publish no policy at all.
Which crypto card programmes publish a readable privacy policy?
Eight of the sixteen we checked: Crypto.com, MetaMask, Gemini, Plutus, Bleap, KAST, OKX and Gnosis Pay. Bybit's and Nexo's pages render client-side and served no policy text; Bitget Wallet's two privacy URLs return HTTP 200 serving the marketing homepage; Coinbase, Wirex and RedotPay refused us.
How long is biometric data kept by a crypto card programme?
Usually on a shorter clock than your documents. OKX deletes facial geometry in-session and keeps only the pass or fail result. Bleap deletes templates once the legally required window ends. Crypto.com's US notice keeps them up to “three (3) years following your last interaction”. Gnosis Pay folds biometrics into the same seven-year maximum as everything else.
Does closing a crypto card account stop the programme sharing my data?
Not according to the notices. Crypto.com's US policy carries a Gramm-Leach-Bliley line reading “When you are no longer our customer, we continue to share your information as described in this notice.” Gemini keeps sign-up data “even if your registration is left incomplete or abandoned”.
Which crypto card has the clearest data-deletion promise?
A card that has already stopped working. Cypher's notice of termination of 8 July 2026 states the obligation, the period and the outcome together: five years minimum after closure under the Bank Secrecy Act, under strict access controls, then destroyed. None of the eight live policies commits to destruction in those terms.