SEC commissioner urges privacy-focused shift in financial surveillance

An SEC commissioner urged the federal government and regulated institutions to shift from prescriptive data collection toward attribute-based verification where technologically feasible. The commissioner said existing know-your-customer and anti-money-laundering frameworks create increasingly large financial data haystacks. The commissioner argued that larger haystacks can make it harder to find illicit activity. Customer Identification Programs collect names, birthdays, addresses, identification numbers, and other information. Financial institutions also monitor customer relationships and activities on an ongoing basis. Institutions must file Currency Transaction Reports and Suspicious Activity Reports when specific conditions apply. The commissioner said this system is costly and may expose innocent people and businesses to tracking and data breaches. The commissioner said public ledgers and cryptography can verify facts without revealing underlying personal data. Attribute-based credentials could verify age, citizenship, accredited investor status, or the absence of sanctions-list entries without disclosing the underlying information. Zero-knowledge proofs could confirm that a person meets a requirement without revealing the person's name, income, or address. The commissioner said the regulatory framework needed to support these tools is missing. The commissioner proposed making it easier for registered entities to rely on third-party identity verification for Customer Identification Program purposes. The commissioner said current rules generally require each regulated entity to collect and verify customer information independently, with limited exceptions. The commissioner said this duplicates sensitive data across dozens of institutions. The commissioner also said regulators must adjust their methods for technologies that operate without intermediaries. The commissioner described permissionless networks as systems that use automated and immutable code, have no custodial intermediary between users and assets, and treat participants and transactions neutrally. The commissioner said public blockchain networks can provide permanent, public, auditable transaction records that law enforcement can analyze with blockchain forensics tools. The commissioner also discussed an Innovation Exemption announced the previous week. The exemption consists of two exemptions in one order. It is limited by time and size. It is intended to facilitate trading in tokenized securities on crypto networks through automated market makers. The commissioner said the exemption is intended to lead toward durable rulemaking. The commissioner said the goal is a final ruleset for intermediaries and venues involved in tokenized securities trading.