Institutions Want On-Chain — But Not Repeated KYC
TREE NEWS reports: a16z crypto analysts Maggie Hsu and Michele Korver argue that the biggest friction keeping banks, brokerages, and asset managers out of on-chain markets is not blockchain risk — it is the repeated, duplicative identity verification that every new platform demands. Under the Bank Secrecy Act (BSA), each financial institution must independently run its own Customer Identification Program (CIP), even when the same user has already been verified elsewhere. The result: mounting cost, delay, and a growing pile of centralized identity “honeypots” that invite fraud and identity theft.
Reusable KYC and the Trust Ecosystem
The proposed fix is a reusable, or “trusted,” KYC model in which a verified credential issued by a qualified provider can be accepted by downstream platforms. The report points to emerging infrastructure: Fireblocks’ Open Transaction Layer (OTL), which lets regulated network members recognize each other’s verification status; Privado ID’s verifiable credentials; SpruceID’s government-issued digital IDs; and Sumsub, World ID, MoonPay and Stripe-via-Privy as trust anchors. Traditional finance has a precedent — SWIFT’s KYC Registry, used by nearly 8,000 institutions across 200+ countries.
The Legal Hurdle: Reliance vs. Outsourcing
Critically, the authors distinguish reliance — a specific legal term applicable only when accepting another regulated financial institution’s verification — from mere outsourcing, which leaves full CIP liability with the institution. FATF rules permit third-party delegation only if the provider is supervised, the underlying data is retrievable on demand, and the relying institution retains full legal responsibility. The “on-demand raw data” requirement clashes with zero-knowledge and privacy-preserving designs, and many crypto platforms are not “regulated institutions” under US federal AML reliance rules — a gap Treasury must address.
Tooling: KYW, KYA, KYT
The piece maps a practical compliance stack:
- Know Your Wallet (KYW): bind real-world identity to wallet addresses via soulbound tokens (Quadrata), zero-knowledge passport proofs (Self.xyz, Aztec/zkPassport, Opacity Labs), or proof-of-personhood (World ID, Human Passport).
- Know Your Asset (KYA): embed transfer restrictions in token contracts, as Securitize does for BlackRock’s BUIDL and Apollo’s ACRED, and Ondo and Superstate do for OUSG and USTB.
- Know Your Transaction (KYT): use Chainalysis, Elliptic, TRM and AI tools like Eunice.ai, Didit and Sardine.ai for continuous monitoring and travel-rule messaging via TRUST, Notabene and Sumsub.
Forward Look: Know Your Agent
The next frontier is “Know Your Agent” — verifying AI agents acting on behalf of users. ERC-8004, deployed to Ethereum mainnet in January 2026 with over 30,000 registrations in its first week, anchors agent identity on-chain, while Google’s AP2, Catena Labs’ ACK v2, Skyfire, Circle, Anchorage, Mastercard’s Agent Pay and Visa’s Intelligent Commerce handle off-chain authorization.
The bottom line: most of this needs no new legislation. FinCEN’s April 2026 proposal and September 2026 FAQ already bless machine learning, digital identity, and verifiable credentials as compliant AML tools. Institutions waiting for clarity can start building now.
