In a significant call to action for the financial industry, U.S. Securities and Exchange Commission (SEC) Commissioner Hester Peirce has urged financial firms to fundamentally rethink their approach to customer data, advocating for a paradigm shift away from the extensive stockpiling of personal information following a series of high-profile data breaches. The urgency behind her appeal is underscored by recent security incidents that exposed the substantial risks and costs associated with mandatory identity collection mandated by “know your customer” (KYC) and anti-money laundering (AML) regulations.

Commissioner Peirce, speaking at the SIFMA Digital Assets Conference, proposed a broader adoption of reusable digital credentials. These innovative solutions, she explained, could authenticate customer identities and verify crucial facts about them without necessitating that every financial institution independently collect and store sensitive underlying personal information. This approach, Peirce posited, could significantly enhance security and privacy in the digital age.

"Today society is at a crossroads," Peirce articulated in her remarks, painting a stark dichotomy between the current trajectory and a more privacy-preserving future. "Down one path lies the status quo: more data collection, more intermediary surveillance, more ‘know your customer’ requirements that turn our financial rails into a panopticon. Down the other path lies an opportunity to use new technologies to improve our ability to catch criminals while collecting less personal information than ever before, and monitoring more sparingly to protect Americans’ privacy.”

Her statements arrive in the wake of a series of unsettling security incidents that have directly impacted major financial platforms. Companies like Revolut have recently experienced breaches that exposed sensitive customer data, including identity documents, residential addresses, and other personally identifiable information collected meticulously to comply with stringent customer verification and AML requirements. These events have amplified concerns about the security of vast troves of personal data held by financial institutions, transforming them into attractive targets for malicious actors.

Peirce elaborated on her vision, suggesting that regulators should critically re-evaluate the necessity of institutions collecting specific pieces of personal information versus merely confirming the factual assertions derived from that data. She highlighted the potential of attribute-based credentials, which could independently verify attributes such as age, citizenship, or inclusion on sanctions lists, without requiring the disclosure of potentially sensitive details like full names, income levels, or exact addresses.

"Does more than one firm need to collect it?" Peirce questioned, emphasizing that the technological infrastructure to reduce the volume of surrendered information and the number of entities possessing it already exists. It is important to note that Peirce clarified these remarks represented her individual views and not necessarily the official stance of the SEC.

The debate surrounding data collection practices is gaining significant traction as Washington D.C. actively constructs a new regulatory framework for stablecoins. The proposed GENIUS Act, for instance, mandates that permitted payment stablecoin issuers implement robust customer-identification programs. Current regulatory proposals stemming from this act are poised to continue requiring covered issuers to obtain and retain identifying information from their customers, thereby perpetuating the data collection model that Peirce is challenging.

Breaches Transform KYC Records into High-Value Targets

The vulnerabilities inherent in the current data collection model have been starkly illustrated by several high-profile security breaches. Coinbase, a prominent cryptocurrency exchange, provided a particularly concerning example last year. Attackers managed to gain access to sensitive customer information by bribing contractors or employees in overseas customer-support roles, who then accessed the exchange’s internal systems. Coinbase subsequently disclosed that approximately 69,461 customers were affected by this breach.

The compromised data encompassed a wide range of personal details, including names, addresses, phone numbers, email addresses, partial Social Security numbers, images of government-issued identification, account balances, and transaction histories. While passwords and private keys remained secure, Coinbase issued a stern warning that the stolen information could be exploited for sophisticated social-engineering attacks targeting its customer base.

Following the incident, Coinbase CEO Brian Armstrong publicly voiced his concerns about the extent of data financial companies are compelled to retain. "We don’t want to collect it, and our customers hate it," Armstrong stated, calling for lawmakers to re-examine the Bank Secrecy Act and AML requirements. He further suggested that Congress should review these laws or risk facing constitutional challenges, a position that extends beyond Peirce’s proposal for altering data collection and verification methods to a more fundamental questioning of the regulations themselves.

The issue resurfaced more recently with the fintech company Revolut, though through a different attack vector. In this instance, an unauthorized party utilized a legitimate government agency’s email domain to dispatch fraudulent information requests. Revolut, unfortunately, complied with these deceptive requests, inadvertently handing over sensitive customer information. The disclosed data included identity and contact details, as well as copies of passports and driver’s licenses. For some customers, this information also extended to verification selfies, account statements, and transaction histories. Revolut assured its users that its internal systems and customer funds remained unaffected by the incident.

These episodes vividly demonstrate the precise vulnerability that Commissioner Peirce aims to address: once financial institutions amass extensive identity records, the theft of funds no longer necessitates the compromise of private keys or direct breaches of financial accounts. The personal information itself transforms into a valuable commodity, ripe for extortion, impersonation, and subsequent, more damaging cyberattacks.

Stablecoin Regulations Appear to Preserve the Data Collection Model

Adding a layer of complexity to this evolving landscape, U.S. regulators are simultaneously extending customer-identification requirements to another segment of the financial ecosystem – stablecoins. The proposed implementation of the GENIUS Act mandates that permitted payment stablecoin issuers generally obtain a customer’s name, date of birth or formation, address, and identification number before establishing a “covered account.” This identifying information would then be retained for a period of five years after the account’s closure. Records detailing verification methods and their outcomes would also be kept for a similar duration.

It is crucial to note that these requirements do not encompass every individual who receives or holds a stablecoin. The focus is on customers who establish direct relationships with issuers, such as those involving direct issuance or redemption of stablecoins. Regulators assert that these measures are intended to align with Congress’s directive to treat permitted stablecoin issuers as financial institutions under the Bank Secrecy Act, thereby ensuring they maintain effective customer-identification programs designed to combat money laundering, terrorist financing, and other illicit activities.

The current proposal does, however, incorporate some flexibility for technological advancements. Issuers are permitted to utilize digital credentials as part of their identity verification processes and, under specific conditions, can rely on verification procedures conducted by other regulated financial institutions. Furthermore, FinCEN recently issued guidance stating that banks and credit unions may incorporate qualifying government-issued digital credentials, including mobile driver’s licenses, into their existing customer-identification programs.

Despite these concessions, these mechanisms fall short of the portable, reusable credential model envisioned by Commissioner Peirce. While verification technology can indeed evolve the method by which an institution confirms an identity, it does not necessarily absolve the institution of its obligation to obtain prescribed customer information or to maintain detailed records of the verification process.

The Regulatory Battleground Shifts to Final Rulemaking

The critical question of how much data will ultimately be collected and retained remains an open point for regulators. Both FinCEN and the banking agencies have explicitly solicited public input on whether the final stablecoin rule should address digital identity systems or verifiable credentials, and what potential benefits and risks such systems might present.

Regulators have acknowledged the potential of nongovernmental credentials to enable individuals to prove their identity without divulging extraneous personal information. However, they have thus far refrained from incorporating specific provisions for verifiable credentials into the proposed regulatory text. This omission creates significant room for maneuver in the final rules, which will ultimately determine the extent to which redundant data collection persists.

The path forward could see regulators broaden the circumstances under which stablecoin issuers are permitted to rely on identity checks performed by third parties. This could also involve providing clearer recognition for cryptographically verifiable credentials or allowing firms to retain proof of completed verification processes without necessarily maintaining additional copies of the underlying documents, where legally permissible.

For stablecoin companies, the ultimate outcome of this rulemaking process will have a profound impact. It will dictate whether compliance necessitates the construction of yet another generation of databases filled with customer identity information or, conversely, allows for investment in systems focused on verifying required attributes while minimizing the retention of raw personal data. The GENIUS Act has already established the foundational requirement that regulated issuers must indeed know their customers. The ensuing rulemaking will be instrumental in defining precisely how many entities will be mandated to maintain copies of the sensitive information used to establish and verify those customer identities.