Key Takeaways
- • Traditional KYC is seen as a major obstacle to bringing institutions onchain, because each institution repeats identity verification of the same customers, adding cost, delay, and privacy risk.
- • Under the Bank Secrecy Act, a bank's customer-identification obligations cover its own account holders, not every counterparty or liquidity pool participant, which supports reusable KYC models.
- • Reliance KYC is a specific legal provision that applies only when relying on another regulated financial institution; using a non-qualifying vendor is treated as outsourcing, leaving the institution fully responsible.
- • FATF permits reliance on third parties if three conditions are met, but the requirement for immediate access to underlying PII conflicts with privacy-preserving onchain designs.
- • The U.S. Treasury is evaluating how institutions can use new technologies to satisfy AML/CFT program requirements, including CIP/KYC, following passage of the GENIUS Act.
Summary
An a16z crypto analysis argues that Know Your Customer (KYC) checks, required under the Bank Secrecy Act (BSA) to combat money laundering and terrorist financing, are often viewed as an obstacle to bringing traditional finance onchain and growing DeFi. The article's central argument is that institutions do not want to avoid KYC; they want to avoid redundant KYC. Banks, broker-dealers, and other BSA-covered institutions face the challenge of reaching more customers and accessing liquidity while meeting compliance requirements that add time and complexity.
The article contends that the BSA's customer-identification rules apply to an institution's own account holders. Someone does not become a bank's customer merely by transacting with one of its customers or trading against a liquidity pool the bank supplies. Under this reading, a bank can satisfy its obligations through a compliance program covering its own customers and transactions, regardless of the blockchain or protocol that settles them. The U.S. Department of the Treasury is reportedly considering how institutions can use new technologies to meet AML/CFT program requirements, and the article notes that regulators are now tasked with pursuing innovative standards following the GENIUS Act.
The piece highlights the cost and privacy burden of repeated verification. Traditional KYC is conducted institution by institution, and customers must repeat the process at each new provider. Citing Coin Center, the article notes that the current system forces individuals to repeatedly surrender sensitive personal information to centralized databases. It also cites former SEC Commissioner Peirce's view that collecting more and more data has not worked well and that technology has outpaced legacy approaches. SWIFT's KYC Registry, launched in 2014 and spanning nearly 8,000 institutions across more than 200 countries, is presented as a traditional-finance analog, though the article notes it is more accurately a KYB registry for bank-to-bank relationships. Crypto lacks an equivalent registry.
The article examines crypto-native alternatives. Examples of ecosystem-of-trust reliance models include Sumsub ID, World ID, MoonPay, and Stripe through Privy, with basic verification reportedly costing $1 to $2 per initial verification. The Fireblocks Open Transaction Layer, Privado ID, and SpruceID's credential-based approach are cited as tools for making verified credentials portable. However, the article cautions that institutions remain responsible for their legal obligations when using third-party providers.
Legal hurdles remain. FATF's reliance conditions require third-party regulation, immediate access to underlying KYC data, and ultimate liability with the relying institution. The immediate-access requirement is in tension with privacy-preserving onchain KYC, and many crypto platforms are not "regulated institutions" under the federal reliance rule even when registered as money services businesses. The article identifies these as issues Treasury will need to resolve when considering more flexible, crypto-native CIP methods.
The article contends that the BSA's customer-identification rules apply to an institution's own account holders. Someone does not become a bank's customer merely by transacting with one of its customers or trading against a liquidity pool the bank supplies. Under this reading, a bank can satisfy its obligations through a compliance program covering its own customers and transactions, regardless of the blockchain or protocol that settles them. The U.S. Department of the Treasury is reportedly considering how institutions can use new technologies to meet AML/CFT program requirements, and the article notes that regulators are now tasked with pursuing innovative standards following the GENIUS Act.
The piece highlights the cost and privacy burden of repeated verification. Traditional KYC is conducted institution by institution, and customers must repeat the process at each new provider. Citing Coin Center, the article notes that the current system forces individuals to repeatedly surrender sensitive personal information to centralized databases. It also cites former SEC Commissioner Peirce's view that collecting more and more data has not worked well and that technology has outpaced legacy approaches. SWIFT's KYC Registry, launched in 2014 and spanning nearly 8,000 institutions across more than 200 countries, is presented as a traditional-finance analog, though the article notes it is more accurately a KYB registry for bank-to-bank relationships. Crypto lacks an equivalent registry.
The article examines crypto-native alternatives. Examples of ecosystem-of-trust reliance models include Sumsub ID, World ID, MoonPay, and Stripe through Privy, with basic verification reportedly costing $1 to $2 per initial verification. The Fireblocks Open Transaction Layer, Privado ID, and SpruceID's credential-based approach are cited as tools for making verified credentials portable. However, the article cautions that institutions remain responsible for their legal obligations when using third-party providers.
Legal hurdles remain. FATF's reliance conditions require third-party regulation, immediate access to underlying KYC data, and ultimate liability with the relying institution. The immediate-access requirement is in tension with privacy-preserving onchain KYC, and many crypto platforms are not "regulated institutions" under the federal reliance rule even when registered as money services businesses. The article identifies these as issues Treasury will need to resolve when considering more flexible, crypto-native CIP methods.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.