Kraken retains your identity documents (passport, proof of address, selfies, etc.) for as long as required by applicable law and regulation, and crucially, continues holding them even after you close your account — the EEA terms explicitly state they will retain verification documentation following termination "in accordance with the periods specified under applicable law or regulation," which typically means several years under AML/KYC rules. Biometric data specifically is destroyed within 3 years of your last interaction with Kraken, whichever comes first.

As for who they share it with: your data (including ID documents) can be disclosed to credit reference agencies, fraud prevention agencies, and financial crime agencies as part of their AML/KYC obligations; to banking and payment partners for investigating sanctions violations, fraud, and money laundering; to telecom/mobile network operators for identity verification purposes; and to third-party vendors that facilitate their verification services — all within the Kraken group of companies and carefully selected external partners. The conditions for sharing are regulatory compliance, fraud prevention, legal obligations, and legitimate business purposes, with recipients required to handle the data in accordance with applicable data protection laws.