I advise most of my ICO clients that AML - and its subset KYC, and its subset CIP requires certain qualitative and and at least one third party verification of that qualitative information. Passports tend to be more reliable than driver's license/ID.

So, i would contend that it is not unusual or improper to ask. Could it in theory be used in a fraudulent manner, of course - but every time you use a debit card you are also opening yourself up to some sort of fraud

AT