A massive global data leak linked to IDMerit has exposed 1 billion personal records, including national IDs and emails, across the US, Europe, and Asia.
I’m uninformed about this, but do KYC laws come into effect at some profit point or are they globally enforced. I don’t see how any small businesses could possibly afford a 3rd party audit, or how that would even scale. I agree it’s necessary, but logistically it seems problematic.
KYC thresholds vary by jurisdiction and institution type, but the short answer: in the US, KYC obligations under the Bank Secrecy Act apply to ‘financial institutions’ — a category that’s broader than banks but still defined. Crypto exchanges, MSBs (money service businesses), and broker-dealers are all in scope. A random small e-commerce shop selling widgets is not.
The audit burden you’re describing is real, but it mostly falls on the institutions that are in scope, not every business that ever touches money. The problem with the IDMerit breach is a layer removed: the banks were complying with KYC, and they outsourced the identity verification piece to a third-party aggregator. That aggregator (IDMerit) is not itself a regulated financial institution — so no FFIEC exam, no mandatory pen testing cadence, no breach notification timeline baked into their operating license.
The compliance chain stops at the bank’s front door. Everything behind that — the vendors, the data processors, the identity APIs — operates in a much softer regulatory environment. That’s the structural gap. CMMC-style requirements for third-party processors handling regulated data would close it, but that’s a different law than the one that created the data collection requirement in the first place.
I’m uninformed about this, but do KYC laws come into effect at some profit point or are they globally enforced. I don’t see how any small businesses could possibly afford a 3rd party audit, or how that would even scale. I agree it’s necessary, but logistically it seems problematic.
KYC thresholds vary by jurisdiction and institution type, but the short answer: in the US, KYC obligations under the Bank Secrecy Act apply to ‘financial institutions’ — a category that’s broader than banks but still defined. Crypto exchanges, MSBs (money service businesses), and broker-dealers are all in scope. A random small e-commerce shop selling widgets is not.
The audit burden you’re describing is real, but it mostly falls on the institutions that are in scope, not every business that ever touches money. The problem with the IDMerit breach is a layer removed: the banks were complying with KYC, and they outsourced the identity verification piece to a third-party aggregator. That aggregator (IDMerit) is not itself a regulated financial institution — so no FFIEC exam, no mandatory pen testing cadence, no breach notification timeline baked into their operating license.
The compliance chain stops at the bank’s front door. Everything behind that — the vendors, the data processors, the identity APIs — operates in a much softer regulatory environment. That’s the structural gap. CMMC-style requirements for third-party processors handling regulated data would close it, but that’s a different law than the one that created the data collection requirement in the first place.