KYC blockchain

Open DeFi pools typically do not enforce KYC of users, a challenge for institutional DeFi. The Kinexys unit of J.P. Morgan built a verifiable credential solution so that participants transact only with authorized, known parties on a public blockchain, without "having to reinvent existing KYC processes". A trade using the solution exchanged tokenized Singapore dollar deposits for tokenized yen through a liquidity pool.

That trade was part of Project Guardian, a wider MAS industry initiative. On 2 November 2022 the Monetary Authority of Singapore announced the first trades: DBS Bank, J.P. Morgan and SBI Digital Asset Holdings traded against liquidity pools of tokenized government bonds, yen and Singapore dollars. MAS describes an access model built on trust anchors, which it defines as "regulated financial institutions that screen, verify and issue verifiable credentials".

The Chainlink explainer on blockchain KYC begins with document checks by a trusted entity outside the blockchain network. The ledger records a credential or a cryptographic hash, while the personal data stays off chain or on the customer's device. A smart contract compares the credential with the record and checks that the issuer is trusted, and other institutions can rely on the same check instead of repeating it.

Tokenized securities can build the eligibility check directly into each token. Under ERC-3643 an identity registry links each investor wallet to an identity contract with signed claims, and the token reads those claims before it allows a transfer. A zero knowledge proof can show that a wallet passed a check without revealing who owns it.

The European Data Protection Board published its final blockchain data-protection guidelines on 7 July 2026. The guidance recommends avoiding personal data on a blockchain when storage conflicts with data-protection principles, keeping additional personal data off-chain, and completing a data-protection impact assessment before implementation. A buyer therefore needs the exact on-chain fields, retention logic, governance roles, erasure method and data-subject process before approving an architecture.

The AML duties remain legally separate from the credential technology itself. Regulation (EU) 2024/1624 generally applies from 10 July 2027, and Article 40 requires crypto-asset service providers to assess risks from self-hosted addresses and apply proportionate measures. Those measures can include identity verification, additional origin and destination information, and closer monitoring, so an onchain credential does not replace customer due diligence or ongoing controls.

The W3C Verifiable Credentials Data Model separates issuers, holders and verifiers, while each verifier still applies its own business rules and decides which issuers to trust. A platform comparison should therefore name supported credential formats, securing methods, status mechanisms and trust-list governance. It should also show who can add or remove an issuer, which policy change requires a new credential, and how the verifier detects an expired or revoked credential.

Architecture choices become concrete operational questions during the procurement process. Buyers can test issuance, credential refresh, wallet replacement, issuer removal, unavailable status services and a policy change that makes an earlier credential insufficient. The test record should show which component rejected the transaction, which audit evidence remains available, and how an authorized team resolves the exception without exposing personal documents on-chain.

Integration evidence should cover documented APIs and software development kits, supported networks, key custody, smart-contract upgrades, monitoring, audit exports and recovery procedures. A pilot should test the intended token, trading or lending workflow under representative policy and failure conditions. These acceptance cases give competing providers the same production criteria before a buyer selects one.

Finance Loop activates a curated network of compliance, legal, identity and tokenization specialists across Central European financial centers. Banks, asset managers, fintechs and technology providers can use introductions, briefings, roundtables and training to examine requirements with the specialists responsible for implementation. Finance Loop supplies neither KYC software nor compliance advice to participating institutions across Europe.

Onchain KYC is a setup where a smart contract checks a credential tied to a wallet before accepting a transaction. A regulated institution performs the identity check off chain and issues the credential.

Common designs keep personal data outside the blockchain's permanent record. The ledger holds a credential or a hash, and the documents stay with the institution or on the customer's device, out of a record that cannot be erased.

Zero knowledge KYC is a variant where the wallet holder proves that a check was passed without showing the underlying data to the application.

No, because regulated institutions remain responsible for their customer checks and resulting decisions. In the MAS model, regulated institutions act as trust anchors that issue credentials, while J.P. Morgan built the solution on existing KYC processes. The blockchain only carries the result of that completed customer check.