Coin Center urges privacy-first shift in KYC checks

Coin Center research director Laz Pieper has called for a shift away from identity-verification systems that routinely collect and retain full copies of personal documents, arguing that privacy-preserving technology could reduce the large stores of sensitive data now targeted by cybercriminals.

The warning follows an FBI investigation into claims that a dark-web service offered access to more than 153 million US and Canadian driver’s-licence records, along with other identity documents. The source and scale of the material have not been publicly confirmed, and IDScan. net, an identity-verification provider linked to samples examined by security researchers, has said it is investigating.

Pieper said the episode illustrates a structural weakness in many know-your-customer systems: businesses and compliance vendors often gather names, addresses, photographs, identity numbers and document images, then keep that information in central databases. Such repositories can become attractive targets because a single compromise may expose data that is difficult or impossible for individuals to replace.

His proposed alternative is based on privacy-preserving identity systems that allow a user to prove a specific fact without handing over the underlying document or a complete personal profile. A service might verify that a customer is over a required age, is eligible to open an account or is not on a sanctions list, while receiving no more information than needed for that decision.

The approach draws on technologies including verifiable digital credentials, zero-knowledge proofs and secure multiparty computation. Coin Center, a policy group focused on open blockchain networks and digital rights, argued in a 2025 paper that these tools could support portable identity credentials, attribute-based verification and dynamic risk checks while limiting the creation of centralised data stores.

The debate has gained urgency as identity theft and fraud remain persistent problems despite extensive customer-identification rules. The US Federal Trade Commission received more than 6.47 million consumer reports concerning fraud, identity theft and other consumer problems in 2024. More than 1.1 million were identity-theft reports, while consumers reported losing more than $12 billion to fraud.

Financial institutions in the United States are required under the Bank Secrecy Act and related regulations to collect identifying information for customer due diligence and anti-money-laundering controls. Businesses outside finance also use identity checks for commercial reasons, including fraud prevention, access control and age restrictions. Verification providers can therefore sit at a critical junction between customers and large numbers of merchants.

Privacy advocates do not dispute that institutions have legitimate reasons to establish identity or assess risk. Their argument is that the present model often collects more information than a particular transaction requires and retains it longer than necessary, increasing the consequences of a breach.

ID-verification vendors commonly process front-and-back document images, machine-readable identity fields and photographs used for facial comparison. Some services also provide cloud portals through which business customers can access verification records after onboarding. That architecture can simplify compliance and repeat checks, but it also broadens the number of systems handling sensitive information. Unlike passwords, government-issued identity details cannot always be changed quickly after theft, increasing the potential durability of harm from an intrusion.

Pieper has urged regulators to give institutions room to test alternatives as the technology matures and to reconsider rules that unnecessarily require retention of complete identity records. He also argues that lawmakers should be cautious about expanding mandatory identity checks into new areas, including age-verification regimes, unless the collection is proportionate and technically necessary.

Any move towards selective disclosure would still have to satisfy regulators that identity assertions are trustworthy, resistant to forgery and usable for audits or investigations where legally required. Banks and other regulated firms would also need standards for credential issuers, revocation, record keeping and interoperability before replacing established KYC procedures at scale.