Reusable KYC: How Verifiable Credentials Could End Repeated Identity Checks in Crypto

Every crypto user knows the routine: sign up for a new exchange, upload a government ID, snap a selfie, wait for approval, and repeat the entire process on the next platform. Across exchanges, wallets, lending protocols, and on-ramps, the average active crypto user completes KYC verification multiple times, each instance requiring the same documents submitted to a different entity. The result is a fragmented identity landscape where sensitive personal data is duplicated across dozens of databases, each one a potential breach target.

Reusable KYC built on verifiable credentials offers an alternative: verify once with a trusted provider, receive a cryptographic attestation, and present that proof to any service that accepts it. No document re-uploads, no redundant selfie checks, no new copies of your passport sitting on a server you have never heard of.

Why Repeated KYC Is a Problem

The friction of repeated identity verification is not just an inconvenience. It creates real costs for users, platforms, and the broader ecosystem.

• Data proliferation: each KYC submission creates a new copy of sensitive documents (passport scans, utility bills, selfies) on a different company's servers. More copies mean more breach surface area.
• Onboarding abandonment: industry data from verification providers suggests that roughly 30% of users abandon sign-up flows that require full document verification, especially on mobile devices.
• Cost duplication: platforms pay $2 to $15 per verification depending on the jurisdiction and depth of checks. Across an ecosystem where users interact with five or more services, the same person's identity is verified and paid for repeatedly.
• Exclusion: users in regions with non-standard identity documents or limited internet connectivity face disproportionate rejection rates, compounding the problem of financial inclusion.

The core paradox: KYC exists to reduce risk, but the current model increases data risk by scattering identity documents across every service a user touches. Reusable credentials flip this by reducing data exposure while maintaining compliance assurance.

How Verifiable Credentials Work

The technical foundation for reusable KYC is the W3C Verifiable Credentials standard, which defines a three-party model for digital attestations. The Data Model v2.0 reached W3C Recommendation status, and v2.1 is currently in Working Draft as of 2026.

The Three Roles

• Issuer: a trusted entity (exchange, identity provider, or government) that verifies a user's identity and issues a signed credential attesting to the result.
• Holder: the user who stores the credential in a wallet and decides when and to whom it is presented.
• Verifier: the service that checks the credential's signature, confirms it has not been revoked, and grants access without contacting the issuer directly.

This model decouples verification from presentation. The issuer does not need to know where the credential is used. The verifier does not need to see the underlying documents. And the holder controls disclosure, choosing which attributes to reveal and which to withhold.

Credential Lifecycle

A verifiable credential follows a defined lifecycle: issuance after identity verification, storage in the holder's wallet, selective presentation to verifiers, and eventual expiry or revocation. The credential itself is a JSON-LD document signed by the issuer's cryptographic key, and it can carry an expiration timestamp and a status list URL for revocation checks. This lets verifiers confirm validity without a live call to the issuer's API.

Technical Approaches to Reusable KYC

Several distinct technical architectures have emerged for implementing reusable identity in crypto. Each makes different tradeoffs between privacy, composability, and regulatory fit.

On-Chain Attestations

The most deployed approach records identity attestations directly on a blockchain. The Ethereum Attestation Service (EAS) provides a general-purpose framework: an issuer registers a schema in the SchemaRegistry contract, then calls the attest function to create an attestation linked to a recipient address. Attestations can include expiration times, revocation flags, and references to other attestations via UIDs.

EAS is deployed on Ethereum mainnet, Base, Optimism, Arbitrum, Polygon, and Avalanche. Coinbase Verifications, the most prominent KYC attestation product, uses EAS on Base to issue attestations under the verifications.coinbase.eth ENS domain.

Zero-Knowledge Proofs of Identity Attributes

Zero-knowledge proofs allow a user to prove a statement about their identity (such as "I am over 18" or "I passed KYC with a regulated provider") without revealing the underlying data. This is the most privacy-preserving approach, because the verifier learns only the boolean result, not the user's name, date of birth, or document number.

Privado ID (formerly Polygon ID) uses zk-SNARKs built on the Iden3 protocol and Circom toolkit to generate proofs from W3C-format credentials. The holder's wallet creates a proof locally, and the verifier checks it against the issuer's public key and a revocation registry. The proof confirms the credential's validity without exposing its contents.

Soulbound Tokens

Soulbound tokens (SBTs) are non-transferable tokens bound to a specific wallet address. In the KYC context, an issuer mints an SBT to a user's address after verification, and any smart contract can check for its presence as a gate. The approach is simple to implement: a standard ERC-721 with the transfer function disabled.

However, SBTs have significant limitations. They expose the fact that a user has been verified to anyone who queries the chain. They cannot support selective disclosure (the token is either present or not). And key loss means credential loss, since the token cannot be transferred to a recovery address. Several projects that initially used SBTs, including Human Passport (formerly Gitcoin Passport), have migrated to attestation-based models instead.

Comparing the Approaches

Leading Implementations

Several products are building reusable KYC infrastructure for crypto, each targeting different segments of the market.

Coinbase Verifications

Coinbase's attestation product issues on-chain credentials via EAS on Base. Three verification types are currently available: Account (confirming a trade-eligible Coinbase account), Country (attesting to the account's country of residence), and Coinbase One (membership verification). Because Coinbase has verified over 100 million users globally, its attestation product has a large potential credential base. The Coinbase Verifications documentation describes the attestation schema and integration process for developers building on Base.

Privado ID

Originally launched as Polygon ID, Privado ID spun out from Polygon Labs in 2024 to operate as a chain-agnostic decentralized identity protocol. It supports W3C Verifiable Credentials and uses zk-SNARKs for private verification. The protocol is compatible with any EVM-compatible blockchain and has run proof-of-concept integrations with financial institutions including Deutsche Bank.

zkPass

zkPass takes a different approach by using zkTLS: a three-party TLS handshake combined with multi-party computation and zero-knowledge proofs. This allows users to prove facts derived from existing web accounts (such as a bank's identity verification status) without exposing the underlying data. The protocol raised $12.5 million in a Series A in October 2024, and had generated over two million attestations from more than 70 web data sources by that date.

Other Notable Projects

• Fractal ID: offers reusable KYC and KYB onboarding with liveness detection, reportedly serving over 160 dApps.
• zkMe: provides zero-knowledge identity verification SDKs for DeFi protocols, focused on privacy-preserving compliance.
• Civic Auth: following the sunset of Civic Pass in mid-2025, Civic shifted to an authentication-focused product. The CVC token ecosystem retains over 2 million historically verified identities.

Implementation Comparison

Regulatory Landscape for Reusable KYC

Reusable credentials only work if regulators accept them. The legal framework for third-party KYC reliance varies significantly by jurisdiction, creating a patchwork of acceptance.

FATF Recommendation 17

The FATF's Recommendation 17 permits regulated institutions to rely on third parties for customer identification and verification. The relying institution retains ultimate responsibility for the KYC outcome, but it can accept the results of checks performed by another regulated entity. This principle forms the basis for reusable KYC across most jurisdictions that follow FATF standards.

However, FATF standards only take effect through national legislation, and implementation varies. Some countries allow broad third-party reliance; others restrict it to specific types of institutions or require bilateral agreements.

Key Jurisdictions

• European Union: the eIDAS 2.0 regulation (Regulation EU 2024/1183) requires member states to offer at least one digital identity wallet by late 2026. These wallets will store verifiable credentials including identity documents, and obligated organizations such as banks and telecoms must accept them by approximately late 2027. The EU's 5th Anti-Money Laundering Directive also permits third-party CDD reliance under conditions that mirror FATF Recommendation 17.
• United States: a September 2026 interagency FAQ recognized that qualifying verifiable digital credentials can be used within a bank's Customer Identification Program (CIP), though it did not approve every credential design or decentralized identifier scheme.
• Australia: AUSTRAC allows reliance on KYC performed by third parties that are either domestic reporting entities or foreign businesses regulated under FATF-equivalent AML laws, subject to a risk assessment of the third party's jurisdiction and business complexity.
• Germany: BaFin's framework under Section 17 of the AMLA distinguishes between banks and payment institutions (which can rely on each other without a formal outsourcing agreement) and other third parties (which require one).

Regulatory caveat: Third-party reliance does not mean unlimited acceptance. In every jurisdiction that permits it, the relying entity must assess the third party's regulatory status, jurisdiction risk, and the adequacy of their CDD procedures. A verifiable credential from an unregulated issuer in a high-risk jurisdiction would not satisfy these requirements regardless of its cryptographic validity.

The Travel Rule Intersection

Reusable KYC credentials also intersect with the travel rule, which requires VASPs to share originator and beneficiary information for transfers above certain thresholds. A verifiable credential could streamline travel rule compliance by allowing the receiving VASP to verify the sender's identity attestation rather than requesting raw identity data. For a deeper look at travel rule implementation, see our stablecoin travel rule compliance guide.

Challenges and Open Questions

Despite the clear benefits, reusable KYC faces significant hurdles before it can replace the current model at scale.

Issuer Trust and Liability

If a verifier accepts a credential that later turns out to be fraudulent, who bears liability? The issuer, who performed the original check? The verifier, who relied on it? This question has no universal answer yet. Most regulatory frameworks place responsibility on the relying institution, which creates a disincentive to accept third-party credentials unless the issuer's procedures are well understood and auditable.

Credential Freshness

Identity attributes change. A person's country of residence, sanctions status, or politically exposed person (PEP) status can shift between the time a credential is issued and the time it is presented. Verifiers need mechanisms to check credential freshness: expiration timestamps, revocation registries, or re-attestation requirements. The W3C standard supports status lists for this purpose, but adoption is inconsistent.

Interoperability

The ecosystem is fragmented across competing standards and chains. EAS attestations on Base cannot be natively verified on Solana. A Privado ID credential uses different proof formats than a zkPass attestation. Until the industry converges on interoperable standards (or bridge layers that translate between them), reusable KYC will remain siloed within specific ecosystems. Cross-chain identity messaging protocols are an active area of development, but none have achieved broad adoption.

Privacy Spectrum

On-chain attestations, which are the easiest to implement and the most widely deployed, are also the least private. Anyone who knows a wallet address can see whether it holds a Coinbase verification. This creates a tension between composability (smart contracts can permissionlessly check attestations) and privacy (users may not want their verified status publicly visible). Zero-knowledge approaches solve this but add implementation complexity and require verifiers to support proof verification.

Where Reusable KYC Meets Stablecoin Payments

The strongest near-term application for reusable KYC is in stablecoin payment infrastructure. As digital identity and payments converge, users who hold a verified credential could onboard to new payment apps instantly rather than repeating multi-day KYC flows. This is particularly relevant for wallets built on infrastructure like the Spark protocol, where the Spark SDK enables developers to build self-custodial wallets that support both Bitcoin and stablecoin transfers.

Consider the onboarding flow for a Spark-powered wallet like General Bread: if a user has already verified their identity with one regulated provider and holds a reusable credential, they could begin transacting with USDB or Bitcoin immediately rather than waiting for a redundant verification process. For ecosystems building on the Spark SDK, integrating credential verification at the wallet level could reduce onboarding friction dramatically while maintaining compliance requirements.

What Comes Next

Reusable KYC is not a solved problem, but the building blocks are maturing. The W3C Verifiable Credentials standard provides a common data model. On-chain attestation infrastructure like EAS offers composability. Zero-knowledge proof systems enable privacy. And regulatory frameworks in the EU, US, and Australia are beginning to accommodate credential-based verification.

The remaining gaps are primarily in interoperability (credentials that work across chains and ecosystems), liability frameworks (clear rules for who bears risk when relying on third-party credentials), and adoption (enough issuers and verifiers to make the network useful). As compliance automation tooling improves and credential issuance scales, the current model of uploading the same passport scan to every new service will increasingly look like the relic it is.

This article is for educational purposes only. It does not constitute financial or investment advice. Bitcoin and Layer 2 protocols involve technical and financial risk. Always do your own research and understand the tradeoffs before using any protocol.