Outgoing Securities and Exchange Commission (SEC) Commissioner Hester Peirce has called for an overhaul of the U.S. government's financial surveillance framework. Speaking at a Securities Industry and Financial Markets Association (SIFMA) event, Peirce advocated replacing data-heavy compliance mandates with zero-knowledge (ZK) proofs and attribute-based credentials.
Peirce challenged the foundational premises of legacy know your customer (KYC) and anti-money laundering (AML) frameworks, which mandate that institutions continuously collect personal data. She cautioned that current rules risk turning financial infrastructure into a regulatory panopticon driven by data maximalists who operate under the flawed assumption that collecting more data improves market integrity.
"We build ever bigger data haystacks on the theory that we will find a needle or two inside," Peirce said. "The bigger haystack, however, makes it harder to find the needles."
Reducing Data Collection While Maintaining Compliance
Every piece of confidential business and personal data collected creates significant risks of mishandling or data breaches, imposing costs on compliant institutions and everyday Americans alike, according to Peirce. Although not widely adopted by governments and regulatory agencies, zero-knowledge technology could potentially reduce unnecessary data collection while maintaining and enhancing the transparency of the underlying transaction record.
Remco Bloemen, head of blockchain at World Foundation, supports Peirce's position. Bloemen told Bitcoin.com News that zero-knowledge proofs could realistically replace significant parts of traditional KYC and AML rules by allowing institutions to verify pass/fail attributes without accessing underlying personal data. The key challenge, however, is translating each verification into a precise, computable circuit, including clear definitions for complex issues like aliases in sanctions screening or acceptable evidence of income and assets.
Regulatory Sandbox Framework Essential for Adoption
While the underlying technical challenges are largely solved, broader adoption would require standardized, legally recognized definitions and reliable data sources. Production-grade age verification has already demonstrated that the model can work in practice.
"For this to be adopted widely, in my opinion, the most important missing piece is a clearly defined regulatory sandbox where institutions can experiment with this new technology in close collaboration," Bloemen said. "Privacy-preserving KYC/AML will have to be battle-tested and case law established before broad adoption is possible."
Bloemen argues that zero-knowledge identity systems could substantially reduce privacy and security risks by eliminating centralized databases containing sensitive KYC information, which are the primary target for large-scale breaches. While he considers the underlying technology mature, citing its successful use in securing billions of dollars, Bloemen acknowledges that transitioning to a new system would introduce new risks that institutions must identify and manage.
Peirce, who is set to leave the SEC before the end of the year, encouraged the commission and market participants to move toward attribute-based verification. She advocated allowing registered entities to rely on third-party verification to reduce operational costs and mitigate cyber vulnerabilities.
