SEC Commissioner Peirce Urges Privacy-Preserving ID Checks, but No Rule Has Changed

Identity-document privacy illustration. Photo: Nicole Geri/Unsplash.

SEC Commissioner Hester M. Peirce called on policymakers to consider identity checks that verify a person’s relevant attributes without routinely exposing the personal information behind them. Her September 23 remarks at SIFMA’s Digital Assets Conference described digital credentials and zero-knowledge proofs as possible tools. They did not change the rules that financial institutions must follow.

Peirce expressly said she was speaking for herself, rather than the Securities and Exchange Commission. That distinction matters because her proposed direction reaches further than a separate September 8 FinCEN FAQ on government-issued verifiable digital credentials. The FAQ explains how banks and credit unions can consider certain credentials under existing customer-identification rules; it does not authorize crypto firms to replace their identity checks with zero-knowledge proofs.

What Peirce is asking policymakers to reconsider

In her speech, Peirce criticized broad collection of personal information and urged a move, where feasible, toward verifying the attributes a transaction actually requires. She pointed to cryptographic methods that could establish a fact about a person without disclosing the underlying data. That is an argument about how future policy could balance verification and privacy, not an SEC-approved method for satisfying current requirements.

The speech supplies no finding that financial firms have adopted such a model or that it meets every applicable identification, sanctions and anti-money-laundering obligation. Whether a regulator acts on the suggestion, and what an acceptable implementation would retain, remain open questions.

What FinCEN’s credential FAQ actually covers

FinCEN and federal banking-agency staffs took a narrower step in their September 8 answers. They said banks and credit unions may consider state mobile driver’s licenses and other government-issued verifiable digital credentials when using documents to verify a natural-person customer’s identity, provided the institution still meets its existing Customer Identification Program requirements. The FAQ says it changes neither Bank Secrecy Act legal requirements nor supervisory expectations. Banks must also consider indications of fraud.

Under the bank CIP rule, a bank needs risk-based procedures that let it form a reasonable belief it knows each customer’s true identity. The rule specifies minimum identifying information, including name, date of birth for an individual, address and identification number. It also permits reliance on another financial institution’s CIP procedures when stated conditions are met. Identity checks therefore need not always mean each institution starts from scratch, but the rule still requires a defensible verification process.

The FAQ concerns eligible government-issued credentials at depository institutions. It does not say that selective disclosure or zero-knowledge credentials satisfy the rule, and it is not a new compliance route for crypto businesses. Reading it as an implementation of Peirce’s proposal would turn two different statements into a policy change neither source announces.

What would turn the idea into a compliance path?

For now, the concrete development is a commissioner’s public call for a different approach to personal data, alongside agency staff guidance that works within existing bank rules. A later rule, formal guidance or other agency action would be needed to establish any broader regulatory shift. Until then, claims about crypto-firm adoption or reduced data retention would need their own evidence.