US Securities and Exchange Commission (SEC) Commissioner Hester Peirce wants financial firms to stop stockpiling customer data after breaches exposed the cost of mandatory identity collection.
This week, the SEC Commissioner called for wider use of reusable digital credentials that could establish facts about customers without requiring every financial institution to collect the underlying personal information again.
According to her:
“Today society is at a crossroads. Down one path lies the status quo: more data collection, more intermediary surveillance, more “know your customer’ requirements that turn our financial rails into a panopticon. Down the other path lies an opportunity to use new technologies to improve our ability to catch criminals while collecting less personal information than ever before, and monitoring more sparingly to protect Americans’ privacy.”
Her remarks follow recent security incidents at major financial platforms like Revolut that exposed identity documents, addresses, and other information these companies collect to meet customer-verification and anti-money-laundering requirements.
Peirce said regulators should reconsider whether institutions need particular pieces of information or merely need confirmation of the facts those records establish. Attribute-based credentials, she said, could prove whether someone meets an age requirement, holds a particular citizenship or appears on sanctions lists without revealing information such as their name, income or address.
“Does more than one firm need to collect it?” Peirce asked, arguing that technology already exists to reduce the information customers surrender and the number of institutions that receive it. She said the remarks represented her own views rather than those of the SEC.
The question is becoming more consequential as Washington builds a new compliance regime for stablecoins.
The GENIUS Act requires permitted payment stablecoin issuers to maintain customer-identification programs, and regulators are proposing rules that would continue requiring covered issuers to obtain and retain identifying information from customers.
Breaches turn KYC records into targets
Coinbase provided one of the clearest examples of the risk last year.
Attackers bribed contractors or employees working in overseas customer-support roles to obtain information from the exchange’s internal systems. Coinbase later disclosed that 69,461 customers were affected.
The compromised information included names, addresses, phone numbers, email addresses, partial Social Security numbers, government-issued identification images, account balances and transaction histories. Passwords and private keys were not stolen, but Coinbase warned that the information could be used in social-engineering attacks against customers.
Chief Executive Officer Brian Armstrong then turned the breach into an argument against how much information financial companies are required to retain.
“We don’t want to collect it, and our customers hate it,” Armstrong said while calling for lawmakers to reconsider the Bank Secrecy Act and anti-money-laundering requirements.
He also argued that Congress should review the laws or they should face a constitutional challenge, a position that goes considerably further than Peirce’s proposal to change how required information is collected and verified.
The problem resurfaced this month at Revolut through a different route.
The fintech company said an unauthorized party used a legitimate government-agency email domain to send fraudulent information requests.
Revolut disclosed customer information in response, including identity and contact details and copies of passports and driver’s licenses. Depending on the customer, the material could also include verification selfies, account statements, and transaction histories. Revolut said its systems and customer funds were unaffected.
The episodes illustrate the vulnerability Peirce is targeting: once institutions accumulate identity records, stealing money does not require breaching private keys or directly compromising financial accounts. Personal information can itself become an asset for extortion, impersonation, and subsequent attacks.
Stablecoin rules preserve the collection model
The policy challenge is that US regulators are simultaneously extending customer-identification requirements to another part of the financial system.
Under the proposed GENIUS Act implementation, a permitted payment stablecoin issuer would generally have to obtain a customer’s name, date of birth or formation, address, and identification number before opening a covered account.
The identifying information would then be retained for five years after the account closes, while records describing verification methods and results would generally remain for five years after they are created.
The requirement does not cover every person who receives or holds a stablecoin. It targets customers establishing covered relationships with issuers, including relationships involving direct issuance or redemption.
Regulators say the requirements implement Congress’s direction that permitted stablecoin issuers be treated as financial institutions under the Bank Secrecy Act and maintain effective customer-identification programs designed to combat money laundering, terrorist financing and other illicit activity.
The proposal already leaves some room for technology. An issuer may use digital credentials as part of identity verification and, under specified conditions, rely on procedures performed by another regulated financial institution.
FinCEN also said this month that banks and credit unions may use qualifying government-issued digital credentials, including mobile driver’s licenses, within their existing customer-identification programs.
Those mechanisms stop short of the portable model Peirce described. Verification technology can change how an institution confirms an identity without necessarily eliminating its obligation to obtain prescribed customer information or maintain records.
The fight moves to the final rule
Regulators have left that question open.
FinCEN and the banking agencies explicitly asked whether the final stablecoin rule should address digital identity systems or verifiable credentials and what benefits and risks would accompany their use.
They acknowledged that a nongovernmental credential could allow someone to prove who they are without revealing additional information, but declined to include specific verifiable-credential provisions in the proposed regulatory text.
That creates room for the final rules to determine how much duplicate collection survives.
Regulators could broaden the circumstances in which stablecoin issuers rely on identity checks conducted elsewhere, give clearer recognition to cryptographically verifiable credentials, or allow firms to retain evidence that required checks occurred without keeping additional copies of the underlying documents where the law permits.
For stablecoin companies, the outcome will determine whether compliance requires building another generation of databases containing customer identity information or investing in systems designed to verify required attributes while holding less of the raw data themselves.
The GENIUS Act has already settled that regulated issuers must know their customers. The remaining rulemaking will determine how many companies need to keep copies of the information used to prove who those customers are.
