[hn_throwaway_99]

> Banking KYC isn't about making sure people are authorized to bank, its about making sure the government is able to track them down if they are (determined by the government to be) associated with bad things.

That's simply not true. E.g a huge part of KYC is ensuring people aren't sanctioned for banking purposes (i.e. OFAC checks are mandatory).

Yes, a record of a user's identity is important, but it's still bad design that every little company, many of which have dubious security practices where they squeaked through figuring out all the right boxes to check to "pass" a SOC 2 audit, have to store this information indefinitely. Some sort of federated system where a business could delegate KYC responsibilities to a respected provider (which is exactly analogous to how Stripe-like credit card processing works) would make a lot more sense.