SpruceID (we're hiring) retweetledi
KYC is ineffective, expensive, and burdensome. It's time for an upgrade. We see just such a proposal in an exciting comment letter submitted to @SecScottBessent and his @USTreasury crypto team on implementation of GENIUS. It was submitted by the team at @SpruceID (see it here regulations.gov/comment/TREAS-…).
The letter argues that the BSA/AML framework (built for a paper/intermediary era) should be modernized for digital assets by recognizing high-assurance digital identity + privacy-preserving cryptography + standardized APIs as first-class compliance evidence—so institutions can detect illicit activity more effectively while collecting less sensitive personal data.
It argues we should adopt an Identity Trust model. Taking this approach, regulated entities (e.g., banks/trust companies/supervised providers):
- verify users once
-issue encrypted/pseudonymous credentials
-support unlinkable transaction identifiers, and
- enable lawful access via a threshold-key process (court + Identity Trust, conceptually).
The model’s four stages—Identifying, Transacting, Investigating, Monitoring—are positioned as a privacy-preserving way to achieve BSA identification where required.
The rundown of Spruce's proposals are:
1) Treat verifiable digital credentials (VDCs) as valid Customer Identification Program (CIP)/Customer Due Diligence (CDD) evidence, including as “documentary” methods where appropriate, with assurance baselines like NIST IAL2+ and issuers such as government authorities / approved institutions / identity trusts.
2) Enable/recognize privacy-preserving “attribute verification” (data minimization) so compliance can be satisfied by proofs like “not on OFAC list” without routinely collecting full PII.
3) Create or approve a financial-sector trust registry of approved credential issuers (e.g., DMVs, regulated FIs, certified identity providers), aligned with interoperability standards (the letter references NCCoE).
4) [THE BIG ONE] Use existing exemptions/relief authority to allow early adopters to treat validated credentials as acceptable documentary evidence for CIP (the letter explicitly points to using exemptions authority).
5) Modernize the Travel Rule to allow VDC-based transmission (i.e., transmitting verifiable proofs instead of plaintext PII), with conditions like trusted issuance, IAL2+, binding to required data, real-time validity checks, and lawful access on legal request.
6) Standardize “verifiable real-time APIs” and technical profiles and clarify what evidence (logs/signatures/receipts) satisfies BSA obligations.
*****
If we are going to improve consumers' lives by fixing KYC, we need the full engagement of the Treasury and other agencies like @SECGov, where I have to imagine @SECPaulSAtkins and @HesterPeirce would be in favor of an upgrade. Pursuing a sandbox or other MVP in-the-wild trial of such a system could change things for the better.
English
