SQ-E02
ACCOUNT PRIVACY FILE
Kraken
A custodial exchange whose regional entity split, account controls, funding partners and PoR workflow create distinct identity and data hand-offs.
- REVIEW DATE
- STATUS
- partially verified
- CONFIDENCE
- medium
Written by SignalQuoin Editorial TeamIndependently reviewed by SignalQuoin Review TeamPublished by SignalQuoin Team
EDITORIAL ASSESSMENT
Kraken documents security and product boundaries well, including the difference between Exchange and Wallet. Privacy conclusions remain restrained because terms and feature pages cannot show the complete live telemetry, vendor and retention graph.
- Exchange and Wallet boundary is explicit
- Regional terms identify different service entities
- Security and PoR limits are disclosed
- No live request or tracker map yet
- Funding partners vary by currency and route
- PoR inclusion is not a privacy or solvency guarantee
CLAIM → EVIDENCE → LIMIT / 5
The privacy ledger
Product identity
- CLAIM UNDER REVIEW
- Kraken Exchange and Kraken Wallet use different control and data models.
- EVIDENCE FOUND
- Kraken states that the Exchange is custodial and the Wallet is self-custodial.
- DO NOT INFER
- A product comparison page does not establish every network request or recovery dependency.
Regional hand-off
- CLAIM UNDER REVIEW
- One Kraken brand can involve multiple legal entities by service and market.
- EVIDENCE FOUND
- Global and EEA terms assign activities across specific entities.
- DO NOT INFER
- A named entity does not imply every associated service shares the same licence or privacy role.
Sources: Kraken Global Terms ↗ · Kraken EEA Terms ↗
Account controls
- CLAIM UNDER REVIEW
- Passkeys, 2FA and Global Settings Lock can reduce account-takeover exposure when configured.
- EVIDENCE FOUND
- Kraken publishes the available security controls and assurance claims.
- DO NOT INFER
- Availability is not evidence that every control is on by default or prevents support-side exposure.
Sources: Kraken security features ↗
Funding data flow
- CLAIM UNDER REVIEW
- Bank funding creates data and timing dependencies outside the exchange interface.
- EVIDENCE FOUND
- The funding matrix lists routes, fees, providers and possible withdrawal holds.
- DO NOT INFER
- A route table does not reveal every processor's retention or onward disclosure.
Sources: Kraken cash deposit options ↗
Reserve-verification data
- CLAIM UNDER REVIEW
- A user can check inclusion in a PoR snapshot without that process becoming a complete privacy or solvency assessment.
- EVIDENCE FOUND
- Kraken publishes a Merkle verification workflow and its limitations.
- DO NOT INFER
- PoR does not reveal off-chain liabilities, asset encumbrance or the platform's full data map.
Sources: Kraken Proof of Reserves ↗
EXPERT PRIVACY REVIEW / 8 FLOWS
From identity edge to revision trigger.
Kraken Exchange account identity, regional entity selection, funding providers, security controls and PoR. Kraken Wallet is explicitly outside the hosted-account data model.
Users who want strong account-control options and will verify the legal entity, funding rail and hold applicable to their region.
Users who want anonymous trading, one global controller, no third-party funding data, or a belief that self-custody Wallet and Exchange share a single privacy boundary.
Exchange and Wallet boundary is explicit
Coinbase offers a US public-company filing trail; a self-custody wallet removes exchange key control but adds device, RPC and on-chain observability.
IDENTITY / AUTHORITY BOUNDARY
The global terms assign different Payward entities by residence and redirect EEA residents to separate terms. Identity and financial-account verification can involve external agencies and funding providers.
- 01
An EEA or global user records the actual entity, uses the least-data bank rail, enables strongest available account controls, completes one Pro trade and requests a harmless support clarification.
- 02
Least-data funding: Verified account → selected bank rail → credited balance
- 03
Account-control change: Sign-in → enable lock/2FA → attempt settings change → notification
- 04
Alternative path: Coinbase offers a US public-company filing trail; a self-custody wallet removes exchange key control but adds device, RPC and on-chain observability.
| FLOW QUESTION | BOUNDED FINDING | PROOF STATE | VERIFICATION PLANNED |
|---|---|---|---|
| Who verifies the user? | Kraken may verify identity directly or through third parties and can receive responses from credit-reference and fraud-prevention agencies. | SUPPORTED RECORD | Record the actual provider disclosures and fields for one region. |
| Which entity controls the record? | The applicable Payward entity depends on residence and service; a brand-level controller claim would be incomplete. | SUPPORTED RECORD | Match account documents to the named entity and local privacy notice. |
| Where do keys and identity meet? | Exchange assets sit in a custodial ledger while Kraken Wallet is a separate self-custody product. Exchange identity and transaction records remain linkable. | SUPPORTED RECORD | Trace one deposit and withdrawal record without importing Wallet assumptions. |
| Which controls are optional? | Kraken advertises passkeys, 2FA and Global Settings Lock. A feature list does not show defaults, recovery exposure or user adoption. | PARTIAL RECORD | Capture clean-account defaults, recovery and control-change notifications. |
| What does the payment route disclose? | Bank and payment rails carry identity, financial-account and transaction data; hold logic can keep that data operationally relevant after credit. | SUPPORTED RECORD | Compare manual bank and integrated funding disclosures without moving unnecessary funds. |
| What can API or session access reveal? | Professional account surfaces imply API and session permissions, but this dossier has not observed their scopes or audit trail. | VERIFICATION PLANNED | Inventory read, trade and withdrawal permissions plus revocation and event logs. |
| How are disputes and restrictions handled? | Arbitration, suspension and termination paths are documented; identity challenges and case-level access remain unobserved. | PARTIAL RECORD | Run a documentation-only support case and map escalation and retention notices. |
| What does PoR add? | PoR can expose a user-specific snapshot-inclusion workflow but does not prove privacy, solvency or current account integrity. | PARTIAL RECORD | Document what identifier is needed for verification and whether it creates additional disclosure. |
| SCENARIO | SEQUENCE | DATA DISCLOSED | OPEN QUESTION |
|---|---|---|---|
| Least-data funding | Verified account → selected bank rail → credited balance | Identity and approved financial-account information described in the terms. | Which payment processor sees which fields, and can a manual route reduce recipients? |
| Account-control change | Sign-in → enable lock/2FA → attempt settings change → notification | Authentication, device and security-event data. | Are controls default, what recovery path bypasses them, and how long are events retained? |
Start from residence and entity. Map KYC, sign-in, funding and support recipients; record optional versus default controls. Treat PoR account inclusion as a separate disclosure event rather than a privacy credential.
Medium-high for the regional entity, identity and control disclosures; insufficient for actual analytics traffic, vendor retention, rights-request handling and support access.
- Regional terms or entity assignments change.
- Funding or third-party sign-in routes introduce a new material recipient.
- Observed account controls or privacy-request outcomes contradict the documentation.
CHANGE / REVISION TRAIL
Rechecked global terms, security and PoR; expanded entity, funding and control-event data maps.
Opened the regional-entity privacy dossier.
Regional terms or entity assignments change.
DECISION FAQ
Is Kraken Wallet part of this exchange dossier?
No. Official material separates self-custody Wallet from the custodial Exchange.
Does PoR improve privacy?
Not by itself. It is a balance-inclusion mechanism with separate data and solvency limits.
Were account-control defaults observed?
No. The feature record is reviewed; clean-account observation is planned.
What would change this privacy conclusion?
Regional terms or entity assignments change. Funding or third-party sign-in routes introduce a new material recipient. Observed account controls or privacy-request outcomes contradict the documentation.
PRIMARY SOURCE REGISTER
6 records
Source access and applicable scope were recorded on 16 August 2026; records are attributed by class.- termsKraken Global Terms ↗Retrieved 2026-08-16
- termsKraken EEA Terms ↗Retrieved 2026-08-16
- productKraken Wallet versus Kraken Exchange ↗Retrieved 2026-08-16
- productKraken security features ↗Retrieved 2026-08-16
- productKraken cash deposit options ↗Retrieved 2026-08-16
- productKraken Proof of Reserves ↗Retrieved 2026-08-16