Reusable KYC: Verify Once, Liable Everywhere

• UK, US, EU and Swiss regulators accepted digital identity credentials for onboarding in 2026, and each left CDD liability with the onboarding firm.
• A credential can carry stable facts such as name and date of birth, and sanctions status, wallet risk and account purpose still need fresh checks.
• Coinbase says its on-chain attestations should not be relied on for compliance.
• One compromised administrator account at Fractal ID in 2024 may have exposed document images and other data on about 6,300 users.
• AMLA owes reliance guidelines by 10 July 2027, and EU banks must accept recognized EUDI Wallets from December 2027.

Since 1 November 2026, financial intermediaries supervised by FINMA can identify new clients online with the Swiss state e-ID, under a revised FINMA circular that also adds liveness detection to online identification. The federal e-ID itself is expected to go live on 1 December 2026. The Swiss change closes a year in which four major AML regimes put reusable digital identity into their onboarding rules or guidance. The UK went first in February, FinCEN and the US bank agencies followed in September, and the EU’s new AML Authority finalized its due diligence standards in October.

Every one of those rules accepts the credential as evidence of who the customer is. Every one keeps the due diligence decision, and the liability for getting it wrong, with the firm doing the onboarding. A customer can prove identity once and present that proof to ten exchanges. Each of the ten still has to screen the customer, score the risk, understand why the account exists and answer to its own supervisor. Reusable KYC has become a portable identity layer, regulated and increasingly standardized. The “KYC passport” pitch, where one verification ends the compliance work for every firm downstream, describes a product no regulator in this group has approved.

Buy bitcoin and stocks. Signup to Coinbase today

Identity proofing and customer due diligence

FATF’s digital ID guidance summary asks regulated entities to understand the assurance level of a digital ID system’s technology, architecture and governance before using it for customer due diligence. It also states that the regulated entity remains responsible for meeting FATF requirements. The guidance treats identification at onboarding and ongoing due diligence as separate jobs that a digital ID can support.

That split decides what a credential can safely carry. Name, date of birth, nationality, a document number and the result of a document authenticity check change rarely, and a credential signed at proofing stays accurate until the document expires. Sanctions designations, politically exposed person status, adverse media, residence and the risk profile of a wallet change on someone else’s schedule. A credential issued in March knows nothing of a designation published in October. The purpose of the relationship belongs to each firm, since a customer opening a custody account and the same customer buying a stablecoin through an on-ramp present different risks.

Three legal relationships get filed under the reusable KYC label. Statutory reliance lets one regulated firm lean on CDD performed by another regulated firm, under conditions the law sets. Commercial outsourcing puts a vendor to work as the firm’s agent, and the firm answers for the result. Credential acceptance is narrower again, since the firm treats a signed assertion as one piece of evidence inside its own process. A cryptographically valid credential meets no statutory reliance condition by itself.

Reusable digital identity rules in the UK, US, EU and Switzerland

UK digital verification services under Regulation 28

HM Treasury’s February 2026 guidance confirms that a firm can meet its Regulation 28 obligations for individual customers through a certified digital verification service. The service has to be certified against the UK trust framework and listed on the DVS register. Certification runs through conformity assessment bodies overseen by UKAS, and the Office for Digital Identities and Attributes keeps the register under the Data (Use and Access) Act 2025. A service that breaches the framework can be removed from the register. Uncertified services “cannot reliably be deemed suitable for identity verification in compliance with the MLRs,” in the guidance’s words.

The same document tells firms not to assume a digital identity covers every part of CDD, to keep making their own assessment of customer risk, and that they remain ultimately liable for any failures. Understanding the purpose and intended nature of the relationship stays with the firm. Cryptoasset exchange providers and custodian wallet providers registered in the UK are relevant persons under the same regulations, and the DVS route applies to their onboarding on identical terms.

FinCEN’s verifiable digital credential FAQs

FinCEN and the staffs of the Federal Reserve, FDIC, NCUA and OCC issued FAQs on 8 September 2026 on digital credentials under the Customer Identification Program rule. An unexpired state-issued mobile driver’s license, or another unexpired government-issued verifiable digital credential, can serve as a documentary method of verifying a natural-person customer. The FAQs create no new obligations. An electronic credential can also serve as a non-documentary method where the bank’s program allows it, and the bank still has to form a reasonable belief that it knows the customer’s true identity. Credentials issued by a non-government third party remain the institution’s responsibility, and the institution has to make sure that third party authenticates customers to the standard the institution would apply itself.

The audience is US banks and credit unions. Most crypto exchanges in the US are money services businesses, a position FinCEN set out in its 2019 guidance on convertible virtual currency, and the CIP rule the FAQs interpret does not bind them. Formal reliance under the bank rule is narrow as well. A bank can rely on another institution’s CIP work only where the reliance is reasonable and the other institution sits under an AML program rule and a federal functional regulator. That institution also has to certify annually by contract that it performs the specified steps. State-licensed exchanges have no federal functional regulator, and a bank cannot formally rely on their CIP work under this provision.

EU AML Regulation reliance and the EUDI Wallet

The EU AML Regulation applies from 10 July 2027 and gives identity verification two routes. Article 22(6) accepts identity documents checked against reliable and independent sources, or electronic identification means that meet eIDAS requirements at the substantial or high assurance level. Reliance sits in Article 48, which keeps the ultimate responsibility for CDD with the relying entity while letting it use CDD performed by another obliged entity in the EU or in a third country with equivalent rules.

AMLA’s final CDD standards, announced on 1 October 2026 and now with the Commission, set out the information firms must collect and the requirements for non-face-to-face verification and electronic identification. They are expected to apply six months after entry into force. When a customer cannot use documents or eIDAS-compliant means, firms may use alternative digital verification methods only case by case and with a justification. Detailed reliance rules come later. Article 50 gives AMLA until 10 July 2027 to issue guidelines on when a firm may rely on information another obliged entity collected, including in remote CDD. The same guidelines cover the roles and responsibilities of each party and the supervisory approach to reliance.

The future of finance is here. Trade crypto and more

The wallet runs on a similar clock. Member States owe citizens a European Digital Identity Wallet by the end of 2026, and relying parties in banking and financial services that must use strong authentication have to accept recognized wallets from December 2027. Delivery is uneven. Euronews reported in September that Italy, France, Finland and Bulgaria were leading, while Sweden was targeting 2028 or 2029 and Germany was still at the prototype stage.

FINMA and the Swiss e-ID

The revised Circular 2016/7 lets intermediaries in Switzerland use the e-ID when they onboard clients through digital channels under the Anti-Money Laundering Act. FINMA added liveness detection as an extra safeguard for online identification and cited risks from artificial intelligence. Identity documents carrying a QR code, such as the Swiss driving license, now rank alongside documents with a machine-readable zone. Voters approved the e-ID Act with 50.39% of the vote on 28 September 2025, and the Federal Council is adding measures to build acceptance before launch, including a public register of the data requests providers make. FINMA’s circular took effect a month before the e-ID it permits is expected to go live.

Coinbase Verifications and on-chain KYC attestations

Coinbase Verifications issue attestations on Base through the Ethereum Attestation Service. They record that a wallet is associated with a verified Coinbase trading account and, if the user opts in, the user’s verified country of residence. Coinbase’s help page says no other personal information goes on-chain, that Coinbase reissues the verification automatically when status or country changes, and that a user can revoke after 24 hours. Revocation unlinks the wallet, though the on-chain record still shows the verification was attached to it at one point.

The repository terms go further. An attestation represents the status of the account as of issuance, and later changes may not be reflected immediately. Coinbase says attestations should not be relied upon by anyone for any legal, compliance or contractual purpose. A protocol can use one to gate a pool or a token sale. A regulated exchange that treats one as CDD evidence does so against the issuer’s own terms.

Eligibility is where the design works. A protocol that wants to restrict access to verified users from permitted countries can check a boolean and a country code without touching a passport. The public link between wallet and verified account persists after revocation, and any address carrying the attestation advertises that a regulated exchange holds its owner’s identity. Firms building on attestations should pair them with a fresh wallet signature and read the country field as a claim with an issuance date.

Centralized KYC reuse and the Fractal ID breach

Most reuse in crypto today runs through vendor networks. Sumsub’s reusable KYC product lets a user verified by one client share that verification with another client after consenting. Sumsub says Mercuryo has offered reusable identity across a network of more than 200 companies since 2021, and reports more than 4,000 clients of its own. Those are vendor figures, and they measure availability inside one provider’s network.

Document checks, database queries and liveness are paid for once, and reuse lets that single proofing event support several paid presentations. The receiving firm swaps a document capture for a lookup or a signature check. It keeps paying for its own sanctions screening, wallet analytics and exception handling.

The data stays where the vendor keeps it, and so does the risk. In July 2024, the Web3 KYC provider Fractal ID disclosed a breach that The Block traced to an employee account with administrator access. Hudson Rock researchers linked it to infostealer malware on the employee’s machine in 2022 and a password that appears to have stayed unchanged. About 6,300 users, roughly 0.5% of Fractal’s database, were affected, and names, addresses, wallet addresses and images of uploaded documents may have been exposed.

One administrator credential opened records that many client projects had routed to the same store. A reuse network built on a shared document archive adds exposure with every client that joins. The safer pattern moves signed claims between parties and keeps passport images and selfies with the issuer, or on the user’s device.

Buy bitcoin and stocks. Signup to Coinbase today

W3C Verifiable Credentials, OpenID4VP and credential status

The W3C published Verifiable Credentials 2.0 as a standard on 15 May 2025, defining the issuer, holder and verifier model and the vocabulary for claims. Bitstring Status List v1.0 became a Recommendation the same day. It gives issuers a privacy-preserving way to publish suspension and revocation, with guidance that lists be large enough for herd privacy and published without tracking who retrieves them.

OpenID for Verifiable Presentations 1.0 reached final status on 9 July 2025. It carries W3C credentials, ISO mdocs (the format behind mobile driver’s licenses) and SD-JWT credentials, which support selective disclosure. The verifier must generate a fresh random nonce for every request. The specification also warns that a verifier accepting a presentation without holder binding accepts that the credential may have been replayed.

Three bindings make a credential usable for crypto onboarding. Proofing ties the credential to a person through document checks and liveness. At each presentation, a signature over the verifier’s nonce shows that whoever presents the credential holds its key. The customer’s wallet then signs a separate challenge, which links that presenter to the address the exchange will credit. An attestation read from a chain carries the first binding and none of the others until the customer signs a fresh challenge.

Privacy-preserving proofs add little delay. The zk-creds paper, presented at IEEE Security and Privacy in 2023, reported identity assertions in under 150 milliseconds for a passport-based age check. That figure covers the proof alone, and a regulated flow also waits on screening, wallet analytics and any manual review.

Travel Rule messages carry originator and beneficiary data between VASPs in the IVMS 101 format, which standardizes the fields and carries no record of how the sending VASP verified them. A mature stack maps identity credentials onto those payloads and keeps the proofing metadata attached.

Singapore Myinfo and the fresh-data rule

Singapore has used government-verified data in financial onboarding since 2017. Four banks began piloting Myinfo for account and credit card applications in May of that year. GovTech reported that banks saw an average decrease of up to 80% in application time, and some saw up to 15% higher approval rates from better data quality. Businesses must seek the customer’s consent at every transaction before any data is released.

Myinfo reuses the source, and its developer rules forbid reusing the result. The Myinfo FAQ says every user profile a digital service retrieves must fetch new data, and that data previously retrieved should not be saved. Services should keep a manual form for users who decline, for foreigners without a profile and for outages.

The 80% figure measures application time. Form filling and document upload sit inside it, and GovTech published no figure for compliance cost.

Freshness rules for accepting a reusable KYC credential

None of the four regimes sets a universal refresh period, and the 2026 rules lean on triggers. FinCEN’s February 2026 exceptive relief order lets covered institutions skip re-identifying a legal entity customer’s beneficial owners each time it opens a new account. They may rely on information on file if the customer confirms it is current, and they must re-verify when they know facts that reasonably call its reliability into question.

The future of finance is here. Trade crypto and more

A credential worth accepting lets the verifier resolve the issuer and its regulatory status, the proofing date, the evidence class, the assurance level, expiry, a status reference, the schema version and the jurisdiction. It leaves out passport images, face templates and document numbers unless a specific rule needs them. Firms set their own thresholds on top. A policy that accepts identity proofing up to two years old, with residence evidence no older than 90 days, is the firm’s own risk call and the firm’s to defend before its supervisor.

Open questions for reusable KYC before 2028

AMLA’s reliance guidelines are due on the day the AML Regulation starts to apply, and crypto firms in the EU are building remote onboarding before they see them. The CDD standards still need Commission adoption and a six-month run-in. The wallet that eIDAS 2 promises will reach some member states years after others, and the bank acceptance duty starts in December 2027 regardless.

FinCEN has published no equivalent of its credential FAQs for money services businesses, the category most US crypto exchanges sit in. On-chain attestations such as Coinbase’s carry terms that exclude compliance use. The UK has the most complete arrangement for now, with independent certification, a public register and a clear statement that liability stays with the firm. Its crypto firms are moving from MLR registration to a new FSMA regime expected on 25 October 2027.

A crypto firm in November 2026 can accept a certified or government-issued credential as identity evidence where its local rule names one. Sanctions, wallet risk and the purpose of the account still get checked at that firm, under that firm’s name.