Financial institutions have spent decades collecting more customer information than they may ever actually use. The reasoning, for a long time, made sense: More data meant better visibility into who customers were and what they were doing.
What it also produced, quietly and over many years, was a financial system sitting on enormous databases of identity documents, financial records, and personal details that banks and other institutions are now expected to protect indefinitely.
A growing number of regulators and technologists are asking whether those databases need to exist at all.
SEC Commissioner Hester Peirce has become one of the more prominent voices raising that question. In recent remarks before the Security Industry and Financial Markets Association (SIFMA) Digital Assets Conference, she argued that traditional know-your-customer (KYC) and anti-money laundering (AML) rules have pushed institutions to collect and hold far more sensitive information than compliance actually requires.
The solution she pointed to involves technologies that could allow institutions to verify specific facts about customers without taking possession of the personal data behind those facts. Zero-knowledge proofs and attribute-based credentials are among the tools Peirce named.
Proving identity without revealing the data behind it
The concept behind zero-knowledge proofs is more straightforward than the name suggests, IntelligentHQ noted. One party proves a statement is true without ever showing the other party the information used to prove it.
In financial services, that could mean confirming a customer is above a required age without handing over a full identity document, or verifying that an investor qualifies for a specific product without the institution seeing the entire record behind that determination.
More Wall Street:
Wall Street’s AI trade faces its biggest valuation test
The next Wall Street shift is already underway
Wall Street sends strong 4-word verdict on the stock market
Remco Bloemen, head of Blockchain at World Foundation, told TheStreet in an interview that the core technical work is largely complete. “The hard technical problems to make all of these zero-knowledge proof claims are mostly solved,” he said. “And specifically for age verification, production-grade solutions already exist.
“The state of zero-knowledge proofs as a technology is mature and they have successfully been used to secure billions of dollars in funds,” Bloemen added.
Sanctions screening and investor eligibility checks follow the same basic structure. Each is a pass-or-fail determination, and a cryptographic proof can establish that outcome without the institution ever handling the underlying data.
Why the regulatory framework still needs to catch up
Technology readiness and regulatory framework readiness are two different things. KYC and AML requirements go beyond checking whether someone is eligible to open an account. Institutions are also expected to monitor transactions over time, flag suspicious activity, and, in certain circumstances, hand over the identity of a specific person to authorized investigators.
A system built on withholding personal data from institutions runs directly into that last obligation. For privacy-preserving identity to work inside an AML-compliant structure, there must be a mechanism for disclosing someone’s identity when investigators need it, even if that identity is never exposed during ordinary transactions.
Bloemen said the design question is still being worked out. “Exactly what the conditions of identity disclosure are and who is authorized to observe the identity is IMO the most interesting design question that needs to be worked out in collaboration with the regulatory side,” he said.
Wider adoption will also require regulators to build in room for experimentation. New approaches to KYC need to be tested in practice and challenged in court before most institutions will feel confident relying on them.
Technology now exists that could allow institutions to verify specific facts about customers without taking possession of the personal data behind those facts.Thomas Barwick / Getty Images
Verification and anonymity are not the same thing
It’s worth noting that nobody making this argument is calling for financial transactions to be anonymous. The push is narrower than that.
It is about separating verification from disclosure and confirming that a customer clears a specific bar without an institution needing to hold everything used to clear it.
Under such a model, checking that a customer is not on a sanctions list would not require the investment platform to retain the full identity record behind the check. Authorized investigators could still access someone’s identity when needed, but that information would not be sitting in a database waiting to surface in a breach.
Banks and other institutions have a direct financial reason to want this. KYC data breaches have exposed hundreds of millions of records in recent years, according to FinCrime Central. Large identity databases attract attackers, and the compliance costs of maintaining and securing them compound year after year.
Why digital finance is raising the stakes
The broader financial system is already moving onto digital infrastructure, and this debate is arriving right alongside that shift. Stablecoins allow money to move around the clock. Tokenized assets allow securities and other forms of ownership to settle on digital ledgers. Programmable payments can execute according to preset conditions without waiting for human sign-off at each step.
Each development sharpens the same underlying question about identity. If transactions can be initiated by software and assets can transfer automatically, the authorization systems sitting behind those transactions need to work at the same speed.
Pairing digital settlement with compliance infrastructure built around manual document collection creates a mismatch that will become harder to ignore over time.
For most of its modern history, financial compliance has run on one core assumption: that collecting more information provides better protection against financial crime. The technologies now entering the conversation are built on an entirely different premise.
Verifying only what’s needed and keeping nothing else could meet the same regulatory standard with considerably less risk. It remains to be seen whether regulators move quickly enough to really test that premise.
Related: Digital infrastructure is reshaping global finance