I have bought multiple domains, and a couple of hostings before, and I was never asked to verify my identity. I still use them to this day.
Some registries do not really ask for KYC or any data when registering domains, although they are obliged to do so. Of course, you can always provide fake personal data, but no one often checks it. However, this opens up the possibility of a potential problem
ICANN policies say for example:
3.7.7.1 The Registered Name Holder shall provide to Registrar accurate and reliable contact details and promptly correct and update them during the term of the Registered Name registration, including: the full name, postal address, e-mail address, voice telephone number, and fax number if available of the Registered Name Holder; name of authorized person for contact purposes in the case of an Registered Name Holder that is an organization, association, or corporation; and the data elements listed in Subsections 3.3.1.2, 3.3.1.7 and 3.3.1.8.
3.7.7.2 A Registered Name Holder's willful provision of inaccurate or unreliable information, its willful failure promptly to update information provided to Registrar, or its failure to respond for over fifteen (15) calendar days to inquiries by Registrar concerning the accuracy of contact details associated with the Registered Name Holder's registration shall constitute a material breach of the Registered Name Holder-registrar contract and be a basis for cancellation of the Registered Name registration.
https://www.icann.org/resources/pages/ra-agreement-2009-05-21-en#3.7.7.2Well, for some serious businesses, hiding data can bring problems.
There is even a WDRP rule, the "WHOIS Data Reminder Policy", which obliges all registries to remind all their clients once a year to check the accuracy of the data.
source:
https://www.icann.org/resources/pages/faqs-f0-2012-02-25-enIt's a good thing with the GDPR, which contributed to the fact that at least every registry offers free whois protection, so the domain owner is not fully exposed to the public.