If you’re not doing anything dodgy, why are you so resistant to KYC and AML?
This was the last thing I’d expected to hear from a speaker on a panel about “DeFi adoption across Asia.” But that was the response, at a satellite event on the sidelines of TOKEN2049 in Singapore last month, when an audience member asked about the challenges of meeting KYC (know your customer) and AML (anti-money-laundering) compliance requirements for web3 builders looking to bridge traditional finance (TradFi) and decentralized finance (DeFi).
Blame it on the hot and sticky afternoon weather that was making me cranky, or the glass of sparkling wine I nabbed off the buffet on the way in, but I couldn’t resist the urge to call him out.
Leah Callon-Butler is a CoinDesk columnist and director of Emfarsis Consulting.
“What if you’re someone in a developing country who lacks the necessary ID documents?” I heckled from the back of the event space. The speaker quickly agreed with me, acknowledging that identity verification is a massive obstacle for millions of people across Asia who are unable to open a bank account due to the many rigid and onerous KYC requirements. He added a caveat, however, stating that he still believed identifying and tagging users was essential for the purpose of avoiding illicit activity.
For years, the crypto industry has mulled how to avoid crypto being exploited for nefarious means while staying true to our community’s core ethos of privacy and decentralization. But KYC is known to be horribly ineffective, and the majority of financial crime still goes through the traditional banking world anyway. Meanwhile, public blockchains are open, transparent and immutable ledgers that anyone can access, making it easier for law enforcement to track and trace criminal activity. Pair this with privacy-protecting technologies, such as zero-knowledge proofs, and you’ve got yourself the foundations of a system that could do a much better job of balancing the right to know with the right to privacy.
In any case, forcing decades-old KYC rules onto crypto today is like taking something that was built for a horse and cart and retrofitting it to a rocket ship, as I wrote in an earlier op-ed for CoinDesk.
Anyway, it wasn’t actually the KYC thing that got me all riled up, and in hindsight I wish I’d not used the example of it being an obstacle to financial inclusion. A quick scan of the room told me the audience was made up of dudes in swanky suits, likely more concerned with taking their investment portfolios to the moon than solving the struggles of the unbanked. As such, my decision to refer to an edge case to prove a point about KYC’s failings served only to underscore that the only people with a good reason to avoid it must be marginalized, oppressed or persecuted in some way. Conversely, if you’re an upstanding citizen with a government-issued ID and a bank account who lives in a politically and economically stable, democratic country, privacy needn’t be your top priority.
After the Tornado
I was reminded of this after reading Neeraj Agrawal’s recent guest post for the Bankless newsletter, titled “Crypto Privacy Is Humanitarian.” In it, Coin Center’s long-time communications head makes a case for encouraging privacy tools such as the U.S. Treasury Department-sanctioned Tornado Cash by demonstrating how “crypto privacy is the difference between life and death” for “those who live in authoritarianism.” He cites a range of examples where crypto’s privacy properties have given “desperate people” a way to dodge the “weaponized intermediaries” that punished them by enforcing choke points in the financial system.
These include protestors in Belarus and Nigeria, Vladimir Putin’s political opposition in Russia, resistance fighters in Myanmar, sanctioned and starving Afghanis, a Chinese dissident artist evading censorship and women at risk of being unable to access abortion in the United States – the latter being a good example of how the line between dodgy and not-dodgy is constantly being redrawn.
Agrawal’s argument is powerful in demonstrating the very real “life or death” situations in which many people across the world unfortunately find themselves. But rattling off all these Orwellian instances where privacy is essential implies that privacy is nonessential for those without an extreme reason to avail it. Further, focusing on a person’s reasons for privacy is somewhat ironic – a form of doxxing in itself. It’s another way of saying that those who skirt KYC are trying to hide something.
Read more: Michael Casey - The Coming Privacy Wars
The narrative suggests that privacy-preserving behaviors exist on a bell curve. At one end of the graph, you have bad guys trying to conceal their crimes. At the other, you have freedom fighters resisting oppression. One is deemed a criminal while the other is a hero but both are unlawful, even if the laws in question are draconian or unjust. More important, for the sake of mainstreaming the right to privacy, neither example is a relatable experience for the mainstream population occupying the normal distribution of the bell curve – that is, all the normies of the world without a Netflix-worthy pitch to justify their privacy.
Privacy aficionados are often painted as conspiracy theorists, tin foil hat-wearing crazies and paranoid gun fanatics, whose chosen topic is incriminating in itself. “Normal people” become suspicious of those who deviate from expectations of disclosure. But publicly shaming people into revealing their private information is a method of social control that grooms complacency, establishing standards of behavior. From this place of nonchalance, it is a slippery slope into a dystopian surveillance state where our personal information can be easily collected and used against us as a tool of oppression.
This is why more movies like "Identity Thief" (2003) are needed (it’s a comedy starring Melissa McCarthy and Jason Bateman, if you haven’t seen it). I endured this cheesy Hollywood movie for the sake of writing this article. I wasn’t a big fan of it, but then I doubt I was the target audience. I can see how it would appeal to a mainstream audience, which is duly needed because so much of the pro-privacy content out there is just preaching to the converted.
The movie does a good job of demonstrating the sensitivity of personal identifying data that is commonly collected via standard KYC processes, how easily this data can be stolen and misused, and the awful ramifications for victims. It also shows remarkable empathy for the societal failures that lead to some criminal behavior being committed in the first place.
If we want to inspire a world where privacy is not an individual’s responsibility but the default feature on every platform we interact with, we need to do a better job of demonstrating how and why privacy is a basic human right for absolutely everyone. People who care about their privacy do not deserve to be called “dodgy,” and no one should need an excuse to protect their identity.