On 23 September, SEC Commissioner Hester Peirce stood up at SIFMA’s Digital Assets Conference in New York and described the current approach to customer checks as building “ever bigger data haystacks” in the hope of finding a needle or two. Her speech, Looking for Change in Haystacks, argued that know-your-customer rules risk turning financial rails into a panopticon, and that regulators should move toward verifying specific facts instead of collecting raw personal data. She was clear that the views were her own and not the Commission’s, and no rule has changed. Even so, it is the plainest statement yet from a sitting US regulator of the model behind zero-knowledge KYC, and it is the model Ontology has been building infrastructure for since 2018.
The case against the haystack
The argument in the speech is about cost and effectiveness. Every exchange, broker and bank collects the same passport, the same proof of address and the same tax number, and holds its own copy. Peirce’s point is that the costs of this system dwarf what it catches, and that each extra copy is one more place where sensitive data can be mishandled or stolen. The same identity documents end up, in her words, put at risk across dozens of institutions.
We made the same argument from the security side in May, in the honeypot piece from the Privacy Hour series: concentrated stores of personal data are the prize in every breach, and the answer is a different shape of system rather than a bigger vault. The UK regulator says it in a regulator’s terms. The ICO’s data minimisation guidance tells organisations they should not hold more personal data than their purpose needs. A securities regulator arriving at the same place from the cost and effectiveness side is new.
Four proposals, and the infrastructure each one needs
The speech makes four concrete proposals. Each maps onto a piece of infrastructure that already exists on Ontology.
Verify facts, not files. Peirce describes credentials that attest to specific facts, such as age, citizenship, accredited investor status or absence from a sanctions list, without revealing the data underneath. On Ontology that is a W3C verifiable credential: a signed, scoped statement issued once and held by the person it describes. When a service needs to know one thing, the holder presents that one thing. This is the starting point for zero-knowledge KYC.
Rely on checks that have already been done. She proposes making it easier for firms to rely on a trustworthy third party’s identity verification, so that a customer verified once does not have to be verified from scratch everywhere. That only works if a later firm can check the earlier verification without phoning the firm that did it. ONT ID anchors identifiers and their keys on a public chain, following the W3C Decentralized Identifiers model, so a verifier can confirm who issued a credential and that it is still valid without routing a request through the issuer. The issuer is never told who asked.
Fewer copies of the same data. If the credential travels and the document stays with the person, the number of databases holding a given passport scan falls toward one. On Ontology the chain holds only what is needed to check a claim: the identifier, its keys and the credential’s status. No documents and no profile.
Ask whether each field is needed. Her test for regulators is a single question: do we need this specific piece of information, or only a fact that it proves? A credential system lets a firm act on the answer, because the fact can be requested on its own.
Underneath all four sits one more requirement the speech implies without naming: permission and validity have to be withdrawable. A status list lets an issuer revoke a credential so that every later verification fails, which is what turns a one-off check into something a firm can rely on over time.
Where zero-knowledge KYC fits
Zero-knowledge KYC is the strongest form of this model. With an ordinary credential, the holder can choose which signed statements to show. With a zero-knowledge proof, the holder can show something derived from a statement, such as “over 18” from a date of birth, and the verifier learns that the condition is met and nothing more. Peirce’s own example is a proof that tells a counterparty yes, this person meets your requirement.
The standards work here is moving. The W3C’s Data Integrity BBS Cryptosuites, a Candidate Recommendation Draft, let a holder reveal only chosen parts of a signed credential, with proofs that cannot be linked back to each other. That unlinkability matters for KYC in particular: a person who proves their age to five services should not leave five matching records that can be joined up into a profile.
Zero-knowledge KYC is a layer on top of the identity infrastructure, and it depends on that infrastructure being in place. A proof is only as useful as the trust in the issuer behind it and the ability to check that the credential has not been revoked. That is the part Ontology runs: decentralised identifiers, verifiable credentials and status, on a public chain that any verifier can read.
The missing piece is regulatory
The most useful line in the speech may be the one about what is holding this back. Peirce says the technology exists and that what is missing is the regulatory framework that would allow and encourage its adoption. That is a fair description from where Ontology sits. The identity layer has been live for years. What changes adoption is a regulated firm being allowed to accept a scoped, verifiable claim in place of a stored document. Zero-knowledge KYC becomes routine when a regulator says that claim is enough.
ONTO Wallet is built for that world. It holds a person’s verified identity alongside the social, gaming and health data they choose to connect, with the holder deciding, item by item, what each counterparty sees. KYC becomes one more thing a person can prove without handing over.
Peirce gave this speech in her penultimate week at the Commission, so it should be read as an argument rather than a forecast. But the direction it sets out, from collecting data to verifying facts, is one Ontology has been working toward since before the products existed. If you are building something that needs to know a fact about its users and would rather not hold their documents, the infrastructure for zero-knowledge KYC is ready to use.
Further reading from Ontology: our Korea Blockchain Week recap, Beyond Data Ownership: Consent, Audit, Revocation, AI Chatbot Privacy: Public versus Private and the Privacy Hour recap that opened the series.
