SEC commissioner Hester Peirce seeks less KYC data before stablecoin rules add more

SEC Commissioner Hester Peirce wants financial firms to reduce the personal information they collect for customer verification. Peirce said reusable digital credentials could verify customer attributes without requiring every institution to store the underlying information. She said regulators should consider whether institutions need specific data or only confirmation of the facts that data establishes. The credentials could verify age, citizenship, or sanctions-list status without revealing a customer's name, income, or address. Peirce said the remarks reflected her own views rather than those of the SEC. Coinbase disclosed that 69,461 customers were affected after attackers obtained information from its internal systems through overseas customer-support personnel. The compromised information included identity documents, addresses, contact details, partial Social Security numbers, account balances, and transaction histories. Coinbase said passwords and private keys were not stolen. Coinbase warned that the information could support social-engineering attacks. Chief Executive Officer Brian Armstrong called for lawmakers to reconsider customer-information requirements under the Bank Secrecy Act and anti-money-laundering rules. Revolut said an unauthorized party used a legitimate government-agency email domain to send fraudulent information requests. Revolut disclosed identity and contact information in response. The disclosed material could also include passports, driver's licenses, verification selfies, account statements, and transaction histories, depending on the customer. Revolut said its systems and customer funds were unaffected. The GENIUS Act requires permitted payment stablecoin issuers to maintain customer-identification programs. Proposed implementation rules would generally require those issuers to obtain a customer's name, date of birth or formation, address, and identification number before opening a covered account. The rules would generally require issuers to retain that identifying information for five years after an account closes. Records describing verification methods and results would generally remain for five years after creation. The requirements target customers who establish covered relationships with issuers. Regulators asked whether final rules should address digital identity systems or verifiable credentials. The proposed text did not include specific verifiable-credential provisions. The final rules could determine how much duplicate collection remains.