Securities and Exchange Commission Commissioner Hester Peirce used one of her final public appearances to argue that current know-your-customer and anti-money-laundering rules collect excessive personal information while delivering limited results against financial crime. Speaking on September 23 at SIFMA’s Digital Assets Conference in New York, Peirce said the system builds ever larger collections of data that complicate rather than aid detection efforts and expose ordinary people to unnecessary risk.

Peirce, in her penultimate week as a commissioner, described the prevailing approach as driven by a “data go up” mentality among regulators and private firms that assist them. She said institutions following Customer Identification Program requirements gather names, birth dates, addresses, identification numbers and ongoing transaction details, then file Currency Transaction Reports and Suspicious Activity Reports that further expand the stores of sensitive information.

She framed the moment as a choice between two paths. One continues expanding collection and intermediary surveillance until financial systems function as a panopticon. The other uses emerging cryptographic methods to improve detection of illegal activity while gathering less personal data and monitoring more selectively.

Cryptographic Alternatives to Traditional Collection

Peirce pointed to zero-knowledge proofs and attribute-based credentials as practical tools already available. These methods can confirm specific facts—such as age, citizenship, accredited-investor status or absence from sanctions lists—without disclosing the underlying personal details that produce those facts. A zero-knowledge proof, she explained, can inform a counterparty that a person meets a requirement without revealing the individual’s name, income or address.

She argued that regulators should shift from prescriptive demands for particular pieces of information toward verification of the relevant attributes whenever technology makes that feasible. Questions she recommended asking include whether a specific data point is truly needed, whether only a derived fact is required, whether collection thresholds remain appropriate, and whether more than one firm must gather the same information.

On the last point, Peirce urged making it easier for registered entities to rely on identity verification already performed by another regulated, trustworthy firm. Current rules generally require each institution to collect and verify customer information independently, resulting in the same sensitive records being copied and stored across many organizations. Allowing broader reliance, she said, would reduce both privacy exposure and compliance costs.

Blockchain Transparency and Intermediary Roles

Peirce also addressed permissionless networks. She defined a truly permissionless system as one whose core protocol runs through automated, immutable code, lacks a custodial intermediary between users and their assets, and treats participants and transactions neutrally. Such public blockchain networks, she noted, generate permanent, auditable ledgers that law enforcement can examine with increasingly sophisticated forensic tools. The absence of a traditional intermediary does not eliminate supervisory information, she said.

She cautioned against inserting intermediaries solely to facilitate data collection when new technologies operate without them. Intermediaries will remain central to the financial system, yet customers and counterparties may still use disintermediated tools. Regulators, in her view, must adjust methods accordingly rather than force outdated structures onto new systems.

Context of Recent Breaches and Innovation Exemption

The remarks arrived against a backdrop of recent incidents in which KYC-related data became a liability. Fintech firm Revolut disclosed exposure of customer passports and Bitcoin transaction histories after responding to a fraudulent government request. Hardware wallet company Trezor reported breaches at third-party vendors that exposed contact and shipping information for tens of thousands of customers, later linked to phishing campaigns. Such events have intensified concerns about physical targeting of crypto holders whose identities and holdings become known.

Peirce linked her privacy arguments to the SEC’s Innovation Exemption, issued the previous week. The time- and size-limited relief allows qualifying tokenized National Market System stocks to trade through permissioned automated market makers while the agency develops permanent rules. She described the measure as a bridge toward durable regulation and expressed preference for domestic development of tokenized exposure to U.S. equities rather than reliance on overseas platforms. The exemption invites public comment and does not alter existing customer-identification or anti-money-laundering obligations.

Peirce emphasized that her comments represented her personal views and did not necessarily reflect those of the Commission or other commissioners. The speech did not announce any new rulemaking, exemption or change to current compliance requirements. Broker-dealers remain subject to written Customer Identification Programs, identity verification, recordkeeping and screening against government lists.

She closed by stating that Americans deserve both security and privacy. New technologies, properly harnessed, can protect personal data more effectively while strengthening efforts to identify illegal conduct. Tradeoffs will persist, she acknowledged, and the temptation to deploy technology in ways inconsistent with a free society will remain. Open discussion among regulators, firms and the public, she said, will help capture the benefits of technological change.