Sub-Account API Permissions and KYC Boundaries
Sub-accounts and API keys are operational tools, not a way to avoid identity, regional, tax, or source-of-funds checks. The safest setup uses least privilege and clear records.
Table of Contents
Map permissions before creating API keys
Create separate API keys for separate systems and disable withdrawals unless they are strictly required. Prefer read-only keys for reporting tools.
Record the purpose, owner, permissions, creation date, IP restrictions, and revocation date for every API key.
If a sub-account is used by a team, keep access roles and identity records consistent with the platform's business or institutional requirements.
Evidence package
Maintain an API inventory, permission screenshots, IP allowlist records, and security audit notes.
If a key is exposed, revoke it immediately, review account activity, and rotate related credentials.
Risk boundaries
This guide is general information, not legal, tax, investment, or account-recovery advice. If a transaction involves third-party funds, fraud reports, gambling, money laundering, sanctions, or unknown counterparties, stop the transaction and contact the bank, the platform's official support channel, or a qualified professional.
Do not share passwords, 2FA codes, seed phrases, private keys, full card numbers, or remote access. A legitimate support process should not require secret credentials.
🔍 Related safety guides
Field Notes: API Keys Need Ownership, Purpose, and Exit Rules
For every master or sub-account key, record the owner, application, permissions, IP restrictions, creation date, and rotation plan. Tax and portfolio tools usually need read-only access; trading bots need narrower permissions than a full account; withdrawal permission should stay disabled unless there is a documented operational need.
When a team member, vendor, or device changes, revoke old keys before creating new ones. If a key was pasted into chat, stored in a public repository, or used on an unknown server, treat it as exposed and rotate immediately.
Sources and Review Basis
This guide is for risk education and record preparation only. It is not legal, tax, investment, bank, or account-recovery advice. Always confirm account, KYC, fiat, and P2P requirements through official channels.
- Binance Support Center: official account, security, KYC, P2P, fee, and support-ticket documentation.
- FTC scam guidance: consumer-facing fraud and impersonation warnings.
Reviewed by the Risk Team
This guide is reviewed to reduce overclaims, clarify evidence requirements, and keep account, bank, tax, and identity issues inside official support channels.