# Privacy stack for expats and cross-border travelers in 2026 > Source: https://fuckyc.org/guides/privacy-stack-for-expats/ > Published: 2026-05-12 · Last verified: 2026-05-12 A practical privacy stack for expats, digital nomads, and frequent cross-border travelers in 2026 — banking compartmentalization, no-KYC mobile, jurisdiction-aware hosting, and travel-day operational hygiene. ## TL;DR Cross-border life multiplies jurisdictions and identity-binding events. Hold value in **Bitcoin** (cold-stored on **Coldcard** or **Trezor**) plus **Monero** for spending. Use **Silent.link** eSIM for mobile data so your home carrier doesn't track you. Email through **Proton Mail** or **Tuta** with **SimpleLogin** aliases per service. **Mullvad VPN** with cash-by-mail payment. P2P swap via **Bisq** or **AgoraDesk** in your current jurisdiction's local rail. Don't carry your real-name phone alongside the privacy phone in the same compartment unless you have to. --- Expat and cross-border life multiplies the number of jurisdictions you touch and the number of identity-binding events you create. Privacy posture for this life looks different from a single-residence threat model — the durable answer is compartmentalization plus jurisdiction-aware tool choice. ## Threat model For expats and frequent travelers: - **Multiple tax authorities** that may share information under CRS / OECD frameworks. - **Border-control systems** that are by definition KYC. - **Home-country surveillance** that may continue to apply via citizenship even when you're physically elsewhere. - **Host-country regulatory exposure** that varies trip-by-trip. The defensive posture is to keep a clean separation between your civil identity (which the immigration system knows) and your day-to-day activity (which it does not need to know). ## The stack ### Banking and money Most expats end up with a portfolio: - **A bank account in your tax-residence jurisdiction** for receipts, salary, tax. Fully KYC; don't try to hide this. - **Wise or Revolut** for cross-border transfers. KYC but exist for this purpose. - **Bitcoin on [Coldcard](/services/coldcard/) or [Trezor](/services/trezor/)** for hold-value. Convert to local fiat via P2P only when needed. - **Monero on [Feather](/services/feather-wallet/) / [Cake](/services/cake-wallet/)** for the spending side where on-chain opacity matters. ### Mobile - **[Silent.link](/services/silent-link/)** eSIM for data. Cross-country coverage, no SIM-registration in any jurisdiction. - Cash-prepaid local SIMs in countries that still allow it (UK, parts of Eastern Europe). Don't rely on this — verify per country. - Avoid roaming with your home carrier if home-carrier surveillance is part of your threat model. ### Network - **[Mullvad VPN](/services/mullvad/)** as the everyday VPN. Cash-by-mail or crypto payment. - **[Tor Browser](/services/tor-browser/)** for sessions where the destination should not see your travel-pattern. ### Email - **[Proton Mail](/services/proton-mail/)** or **[Tuta](/services/tuta/)** as primary. Don't bind to your home-country phone for recovery. - **[SimpleLogin](/services/simplelogin/)** or **[addy.io](/services/addy-io/)** for per-service aliases. Critical when you sign up for things in every country you visit. ### Crypto on-ramps (jurisdiction-by-jurisdiction) P2P is the durable cross-border on-ramp: - **[Bisq](/services/bisq/)** — works in every jurisdiction with bank rails. - **[Hodl Hodl](/services/hodlhodl/)** — broad payment-method support. - **[RoboSats](/services/robosats/)** — Lightning-native, fast trades. - **[AgoraDesk](/services/agoradesk/)** — cash routes including cash-in-person, useful when you have local cash you need to convert. See the [country pages](/country/) for jurisdiction-specific guidance. ### Storage - **[Filen](/services/filen/)** or **[Tresorit](/services/tresorit/)** for E2E cloud storage that travels with you. - **[VeraCrypt](/services/veracrypt/)** container on a USB drive for material you don't want in the cloud. - **[CryptPad](/services/cryptpad/)** for collaborative work with people across borders. ### Documents Physical documents are the hardest part of expat life. The minimum: - Encrypted backup of all identity documents in a VeraCrypt container on multiple drives in different physical locations. - A trusted person in your home jurisdiction who can ship documents to you if needed. - Don't carry the only copy of anything irreplaceable. ## Operational hygiene Cross-border life has specific pattern-of-life risks: - **Don't carry the privacy phone alongside travel documents** unless you can explain it at immigration. - **Don't use the privacy persona's email to book travel** — the airline knows your real name. - **Don't post your location on real-name social** in real-time if location-correlation is part of your threat model. - **Bank apps may geofence** based on your IP — using VPN to access them from abroad can trigger fraud alerts. Use cellular data on the home-country roaming SIM (or just accept the location signal). ## What this stack defeats - A home-country investigator without coordinated international action. - Mass-surveillance of cross-border activity that defaults to "doesn't try too hard." - Carrier-level tracking of your physical movement (via Silent.link). - Bank-rail correlation between your travel pattern and your spending. ## What this stack does NOT defeat - Border and immigration systems. These are KYC by design. - A coordinated international investigation (Interpol, CRS-driven information sharing, FATCA). - Tax obligations. Privacy posture doesn't change what you owe. - Coercion in a host country. Local law and physical safety matter. ## See also - [Country pages](/country/) — jurisdiction-by-jurisdiction guidance. - [Privacy stack for crypto users](/guides/privacy-stack-for-crypto-users/) — for the crypto-only side. - [Operational privacy — combining tools](/guides/operational-privacy-combining-tools/) — the layered model. ## FAQ **Q: How do I handle banking across multiple jurisdictions?** Keep a low-friction bank account in your tax-residence jurisdiction for receipts and tax. Use **Wise** or **Revolut** for cross-border transfers — they are KYC but they exist for this. For the privacy-relevant side, hold value in Bitcoin (Coldcard) and convert to local fiat via P2P only when you need it. Don't treat crypto as your only money — bank-rail access matters when you're traveling. **Q: What about SIMs while traveling?** An anonymous eSIM via Silent.link works across many countries without binding to a local SIM-registration. Buy locally where it's still possible (UK, some Eastern European countries). Don't use your home-country roaming SIM if your home carrier knowing your location is part of the threat. **Q: How do I receive mail at no fixed address?** Address-forwarding services exist in most countries — research the operator's policy. For email, SimpleLogin aliases per service plus a single primary inbox at Proton or Tuta. For physical mail, fewer options matter than people think — most expats settle on a single forwarding address with strict mail-handling rules. **Q: Do I need to declare crypto holdings?** Depends on your tax residence. Most jurisdictions require self-reporting of crypto holdings above thresholds. The 1% TDS in India and the BRL 30,000/month reporting in Brazil are concrete examples. This guide does not give tax advice — consult a cross-border accountant in your residence jurisdiction. **Q: What about visa renewals and KYC at borders?** Border officials and immigration systems are by definition KYC. Privacy posture stops at the immigration line. What matters is having clean compartmentalization for the rest of your life — don't carry your privacy phone alongside your travel documents unless you can explain it. ## Sources - [Privacy Guides](https://www.privacyguides.org/) — accessed 2026-05-12 - [NomadList (community reference)](https://nomadlist.com/) — accessed 2026-05-12