- The IOTA Foundation, together with partners, develops a KYC system for Web3, focusing on user privacy and control.
- This innovative tokenized KYC process enables secure authentication on Web3, ensuring that the user’s personal information remains off the chain.
In an unprecedented collaboration, the IOTA Foundation together with walt.id, IDnow, Bloom Wallet and SPYCE.5 have developed a cutting-edge system for user authentication in the Web3 universe, putting the privacy and autonomy of the individual at the forefront.
This innovative identification process, which relies on tokenization, allows users to confirm their identity in Web3 applications while maintaining full control over their personal information.
With the early implementation of regulations both in the European Union and globally in the field of cryptocurrencies, aimed at combating money laundering and terrorist financing, obliged entities are required to implement rigorous Know Your Customer (KYC) and Anti-Money Laundering (AML) measures.
Existing tools to date for user authentication in Web applications3 do not provide the necessary guarantees to effectively identify the people behind an address on the blockchain.
The solution proposed by the IOTA Foundation and its partners satisfies these stringent authentication needs, while respecting user privacy and reducing the burden for decentralized applications (dApps). This KYC system, which incorporates tokenization, facilitates secure and efficient user authentication for both on-chain and off-chain applications.
Unraveling the Regulatory Environment
New regulations, such as the Transfer of Funds Regulation (TFR) and the forthcoming Anti-Money Laundering Regulation (AMLR), extend AML obligations to Crypto Asset Service Providers (CASPs), requiring them to collect data on their users and the identity of customers using self-managed wallets.
Under the TFR, all crypto asset transactions involving CASPs must include data on both the sender and the receiver, just as with bank transfers .
If the transfer exceeds €1,000 to or from a self-managed address, the CASP must verify whether the address actually belongs to the originator or beneficiary. The AMLR will require all CASPs to comply with AML regulations similar to those of other financial institutions.
In the face of these regulatory requirements, Web3 applications must find ways to ensure the identification of their users, while respecting the privacy and security principles of distributed registration technology.
It is essential that no personal data is recorded on the blockchain and that data collection protects customer privacy, especially now that regulators are beginning to explore ways to regulate decentralized finance (DeFi).
Our solution guarantees the protection of personal data by ensuring that it is never recorded on blockchain. Users have full control over their data and can easily identify themselves with different Web3 applications.
With the continuous development of regulatory requirements in the crypto asset industry , we foresee an increase in demand for simple identity verification tools for Web3 applications.
Tokenized KYC Process: Privacy-Friendly Onboarding in Web3
Together with our partners, we have designed a reusable KYC system to onboard users to any dApp or application seamlessly, efficiently and fully compliant with regulatory standards. Every step of the process has been optimized to make the user experience as simple as possible.
Initially, a remote identification process is performed by IDnow, complying with current AML/CFT regulations. Subsequently, walt.id tokenizes this identification process, giving applications confidence that it has been performed correctly.
The resulting token is stored in the user’s Bloom wallet (or other supported wallets) and associated with the authenticated address, becoming a token linked to the user’s identity.
This can be used for chain processes, allowing native Web3 interactions with the certainty that the user has been authenticated, without revealing personal information at this stage.
The identity information collected can be disclosed later if requested by a competent authority, such as law enforcement, and the token can be revoked if invalidation is required (e.g., changes to watch lists).
In addition to the token, identity information can be issued in W3C Verifiable Credential format, allowing users to receive their verified information and share it in a controlled manner in off-chain use cases.
Evolution of KYC in Web3
At a time when data privacy and regulatory compliance are essential, IOTA and its partners are leading the development of a KYC solution for Web3 that respects the autonomy and privacy of individuals.
By tokenizing the identification process, users can interact with confidence in Web3 applications, knowing that their personal information is kept secure and off the chain.
As the regulatory environment evolves, solutions like this will be key to ensuring that DeFi and Web3 applications meet KYC compliance standards.
To learn more about the IOTA Foundation work on user authentication and Digital Identities, you are invited to consult the IOTA Identity Framework.
