SEC Commissioner Hester Peirce is urging financial institutions to adopt technology that reduces the collection and storage of customer personal data, citing recent security breaches that exposed sensitive information collected for know-your-customer (KYC) compliance.
Peirce called for broader use of reusable digital credentials that could verify customer facts—such as age, citizenship, or sanctions list status—without requiring firms to collect and retain underlying personal information like names, addresses, and income details. She stated that regulators should reconsider whether institutions need particular pieces of information or merely confirmation of the facts those records establish.
Data Breaches Highlight KYC Risks
Recent security incidents at major financial platforms have illustrated the vulnerability. In 2023, Coinbase disclosed that attackers with access to overseas customer-support systems obtained information from 69,461 customers, including names, addresses, phone numbers, partial Social Security numbers, and government-issued identification images. Coinbase's CEO Brian Armstrong used the breach to argue that financial companies should reconsider how much customer information they are required to collect and retain.
This month, fintech platform Revolut disclosed that an unauthorized party using a fraudulent government-agency email sent requests for customer information. Revolut released identity details, passport and driver's license copies, and in some cases verification selfies and account statements.
Stablecoin Rules Extend KYC Requirements
Peirce's proposal comes as US regulators finalize compliance rules for stablecoins. Under the proposed GENIUS Act implementation, permitted payment stablecoin issuers would be required to obtain customer names, dates of birth, addresses, and identification numbers before opening accounts. Identifying information would be retained for five years after account closure, while verification records would be kept for five years after creation.
The regulatory framework directs stablecoin issuers to maintain customer-identification programs under the Bank Secrecy Act to combat money laundering and terrorist financing. However, regulators have left open the question of how digital identity verification systems and verifiable credentials could be incorporated into the final rules.
Room for Technology in Final Rules
The Federal Financial Crimes Enforcement Network (FinCEN) and banking agencies have asked whether final stablecoin regulations should address digital identity systems and verifiable credentials, acknowledging that nongovernmental credentials could allow individuals to prove identity without revealing additional information.
For stablecoin companies, the outcome will determine whether compliance requires building databases containing customer identity information or investing in systems designed to verify required attributes while retaining less raw data.
