SEC Commissioner Peirce Advocates Privacy-Focused Alternatives to Current KYC Rules

Rethinking Surveillance in Financial Regulation

In her final weeks as a commissioner at the U. S. Securities and Exchange Commission, Hester Peirce spoke at SIFMA's Digital Assets Conference, urging regulators to abandon invasive know-your-customer practices that compile excessive personal data. She argued that current anti-money laundering and KYC requirements create vast repositories of sensitive information that increase privacy risks without proportionally improving security. Her remarks came as part of her farewell address before departing the agency.

Peirce proposed that emerging technologies like zero-knowledge proofs and attribute-based credentials could verify essential facts—such as a user's age or sanctions status—without requiring the collection or storage of underlying personal data. These tools, she explained, allow confirmation of compliance criteria while keeping individuals' information private, effectively turning a broad data dragnet into targeted, privacy-preserving checks. She criticized the existing model for building what she called data haystacksthat make it harder, not easier, to find actual threats.

How Can Regulators Balance Security and Privacy?

The commissioner warned that the current approach treats every customer as a potential risk, leading to the accumulation of data that becomes a liability rather than an asset. She noted that breaches of these centralized databases expose millions to identity theft and fraud, undermining the very goals of financial safety. By contrast, privacy-enhancing technologies could shift the paradigm from data collection to minimal disclosure, aligning regulatory compliance with civil liberties. Peirce stressed that innovation in identity verification should not come at the cost of fundamental privacy protections.

Peirce acknowledged that regulators have a duty to prevent illicit finance but argued that effectiveness should not be measured by the volume of data gathered. She suggested that pilot programs testing zero-knowledge proofs in regulated environments could demonstrate feasibility without compromising oversight. Such approaches, she said, might satisfy AML objectives while reducing the attack surface for cybercriminals. The SEC, she noted, has begun exploring these concepts in its FinHub initiative, though broader adoption would require coordination across agencies.

What specific technologies did Peirce recommend as alternatives to traditional KYC? Peirce highlighted zero-knowledge proofs and attribute-based credentials as tools that can verify necessary information like age or sanctions status without exposing personal data, enabling compliance while preserving user privacy.

Frequently Asked Questions

Why does Peirce describe current KYC practices as a panopticon? She used the term to criticize the pervasive data collection under KYC/AML rules, which creates large, vulnerable databases resembling a surveillance system where constant monitoring undermines privacy and increases risk rather than enhancing security.

What is the potential outcome if regulators adopt her proposed approach? Adopting privacy-preserving verification methods could reduce data breach risks, lower compliance costs over time, and maintain regulatory effectiveness by focusing on relevant risk indicators rather than indiscriminate data accumulation.