Peirce urges end to KYC data hoarding before stablecoin rules

SEC Commissioner Hester Peirce this week urged financial and stablecoin firms to stop stockpiling customer identity files and to adopt reusable digital credentials. She framed the remarks as her personal views rather than agency policy.

Peirce argued that new technology can let firms verify attributes such as age, citizenship or sanctions-list status without retaining names, addresses or other sensitive details. Peirce wrote, “Today society is at a crossroads. Down one path lies the status quo: more data collection, more intermediary surveillance, more ‘know your customer’ requirements that turn our financial rails into a panopticon. Down the other path lies an opportunity to use new technologies to improve our ability to catch criminals while collecting less personal information than ever.” She also asked, “Does more than one firm need to collect it?”

Her remarks followed recent security incidents that exposed KYC records. At Coinbase, attackers bribed overseas contractors or employees in customer-support roles to access internal systems. The company disclosed that 69,461 customers were affected. Exposed items included names, addresses, phone numbers, email addresses, partial Social Security numbers, government ID images, account balances and transaction histories. Coinbase reported that passwords and private keys were not taken but warned the data could enable social-engineering attacks.

At Revolut an unauthorized party used a legitimate government-agency email domain to request information. The firm disclosed identity and contact details, passport and driver’s-license copies, verification selfies, account statements and transaction histories. Revolut reported its systems and customer funds were not affected.

Coinbase CEO Brian Armstrong used the breach to call for broader legal change, urging Congress to reconsider the Bank Secrecy Act and anti-money-laundering rules and suggesting those laws could face constitutional challenges.

The debate coincides with implementation of the GENIUS Act, which treats permitted payment stablecoin issuers as financial institutions and requires customer-identification programs. Under the proposed rules a permitted issuer would generally need a customer’s name, date of birth or formation, address and identification number before opening a covered account. Identifying information would typically be retained for five years after an account closes, and records describing verification methods and results would be kept for five years after creation.

Regulators have allowed some technological flexibility. The proposed rule permits issuers to use digital credentials as part of identity checks and, in certain circumstances, to rely on checks done by another regulated financial institution. FinCEN said banks and credit unions may use qualifying government-issued digital credentials, including mobile driver’s licenses, within existing customer-identification programs. Those options do not fully adopt the portable, attribute-based model Peirce described, which would let customers prove facts without repeatedly surrendering raw identity data.

In the proposed rulemaking regulators asked whether the final rule should address digital identity systems or verifiable credentials, but the draft regulatory text did not include specific verifiable-credential provisions. The final rule could broaden when issuers may rely on third-party checks, give clearer recognition to cryptographically verifiable credentials, or allow firms to retain proof that checks occurred without keeping copies of underlying documents where the law permits.

How regulators answer those questions will determine whether compliance requires building more databases of customer identity information or investing in systems that verify required attributes while minimizing the amount of raw data firms hold.