Does zero-knowledge KYC satisfy MiCA, FATF and AMLA? An evenhanded look at where ZK proofs fit, where retention duties remain, and what actually works today.
Table of contents
- Zero-knowledge KYC uses cryptographic proofs to confirm a fact about a user, such as that they are over 18 or have passed verification, without revealing the underlying personal data behind it.
- Regulators have not blanket-approved the technique, but the EU is actively deploying zero-knowledge proofs for age verification through its Digital Identity Wallet, which shows where it already fits.
- For an obliged entity's customer due diligence, zero-knowledge KYC does not remove the duty to identify and verify the customer against reliable sources and to keep records authorities can obtain.
- The workable model is to verify once with a qualified party that sees and retains the minimal evidence, then let downstream relying parties consume proofs instead of raw data.
- Under MiCA, crypto-asset service providers remain obliged entities with full due diligence and record-keeping duties, so the technique minimises data shared, not the obligation to verify.
- Zyphe combines decentralised, sharded storage with privacy-preserving verification, so personal data is never pooled centrally while the audit trail stays complete and regulator-defensible.
Zero-knowledge KYC is the application of zero-knowledge proofs to identity verification, letting one party prove a specific claim about a user, such as having passed KYC or being above an age threshold, without disclosing the underlying personal data. It is a data-minimisation technique: the relying party learns only the answer it needs, not the data behind it.
TL;DR
Zero-knowledge KYC uses cryptographic proofs to confirm a fact about a user without revealing the data behind it. Regulators have not issued a blanket approval, but the EU is already deploying zero-knowledge proofs for age verification through its Digital Identity Wallet, which shows the direction of travel. The important nuance is that for an obliged entity's due diligence, the technique minimises what is shared and stored downstream, but it does not erase the duty to identify and verify the customer and to keep records authorities can obtain. The model that satisfies both privacy and regulation is verify once and retain minimally, then issue proofs downstream rather than raw data.
What is zero-knowledge KYC?
Zero-knowledge KYC applies a well-established branch of cryptography, the zero-knowledge proof, to the problem of identity. A zero-knowledge proof lets one party convince another that a statement is true without revealing anything beyond the truth of the statement itself. Applied to identity, that means a service can be told yes, this user has passed verification, or yes, this user is over 18, without ever receiving the user's name, date of birth or document.
The motivation is data minimisation. In conventional flows, every service that needs assurance about a user tends to collect and store the underlying identity data, multiplying the number of places a person's most sensitive information sits and the number of potential breach targets. The proof-based model inverts that: the proof travels, the data does not. The relying party gets exactly the assurance it needs and nothing more, which is both a privacy improvement and a security one, because data that is never shared cannot be stolen from the party that never held it. This sits alongside the broader zero-knowledge proof in KYC verification concept and the data-minimisation logic of KYC without storing passports.
How does a zero-knowledge proof work in verification?
In identity verification, a zero-knowledge proof works by separating the entity that establishes a fact from the entities that rely on it. A qualified issuer verifies the user once, in full, using reliable sources, and then issues a credential. When the user later needs to prove something to a service, their device generates a proof from that credential that attests to the specific claim required, and the service cryptographically checks the proof without seeing the data.
A concrete example is age. Rather than handing a bar or a website a full identity document to prove you are over 18, a zero-knowledge KYC system produces an attestation that certifies only that you meet the threshold. No document, no date of birth, no identifier changes hands. The EU's age-verification solution is built on exactly this principle: it generates a proof that certifies a user meets an age requirement while disclosing no document photo, identification number or tracking data. The same mechanism generalises to other claims, including that a user has completed verification with a regulated issuer, which is the form most relevant to financial services.
Does zero-knowledge KYC satisfy regulators?
This is where careful framing matters, because the honest answer is: it depends on which obligation you are talking about, and no regulator has issued a blanket endorsement of zero-knowledge KYC. For the relying party that simply needs assurance, the picture is increasingly favourable, and the EU's own deployment of zero-knowledge proofs for age verification is the clearest signal that the technology is regarded as fit for that purpose.
For the obliged entity that owes customer due diligence, the picture is more demanding. The FATF Guidance on Digital Identity makes clear that regulated entities using digital ID must still have access to, or a process for authorities to obtain, the underlying identity information and evidence used to identify and verify the customer. In other words, a regulated firm cannot use the technique to put itself in a position where neither it nor the authorities can ever reach the identity data behind a customer. The proof can shield the data from unnecessary parties, but the verification still has to happen against reliable sources, and the evidence still has to be retrievable. Zero-knowledge KYC therefore satisfies regulators when it is designed as data minimisation layered on top of proper verification and record-keeping, not as a way to make identity data permanently inaccessible.
What does MiCA require, and where does it fit?
Under the Markets in Crypto-Assets Regulation, MiCA, Regulation (EU) 2023/1114, crypto-asset service providers are brought firmly into the regulated perimeter, and the EU AML package treats them as obliged entities subject to the same core due diligence and record-keeping standards as traditional finance. That means a CASP must identify and verify its customers, screen them, monitor activity and retain records, regardless of the cryptographic techniques it uses to do so. The detail of what crypto firms must do is covered in our guide to MiCA KYC requirements in 2026.
Where zero-knowledge KYC fits within MiCA is at the data-sharing layer, not the verification duty. A CASP that has properly verified a customer can use zero-knowledge proofs to avoid spreading that customer's raw data across counterparties, partners or downstream services, sharing only the assurances each genuinely needs. This is especially relevant alongside the Travel Rule, where information must move between providers; minimising what is exposed while still meeting the obligation is precisely the balance our FATF Travel Rule guide addresses. The MiCA-compliant use is to keep the verification rigorous and the records retrievable, and to use proofs to reduce unnecessary data exposure rather than to escape the obligation itself.
How do FATF and AMLA treat privacy-preserving KYC?
FATF does not name zero-knowledge KYC specifically, but its standards set the frame every regime builds on. Recommendation 10 requires identification and verification using reliable, independent sources, and Recommendation 11 requires retaining records sufficient to reconstruct the verification for at least five years and to make them available to authorities. FATF's digital identity guidance then explicitly contemplates digital ID systems, provided the underlying evidence remains accessible to the entity or to authorities. Nothing there prohibits the technique; what it prohibits is using any method to render the identity evidence permanently unreachable.
The EU's Anti-Money Laundering Authority and the single rulebook under the AML Regulation carry the same logic into a harmonised, centrally supervised regime, as set out in the European Commission's AML framework. AMLA's emphasis on consistent, high-quality, auditable records reinforces rather than relaxes the retention expectation. So both FATF and AMLA are compatible with zero-knowledge KYC under the same condition: the regulated entity must have verified the customer properly and must be able to produce the evidence on demand. Privacy-preserving proofs are welcome at the sharing layer; they cannot substitute for verification and retention at the obliged-entity layer.
Where does zero-knowledge KYC genuinely work today?
The clearest live deployment is age verification. The EU's age-verification solution, a privacy-focused subset of the broader European Digital Identity Wallet, uses zero-knowledge proofs so a user can demonstrate they meet an age threshold without revealing a document or identifier. The Commission published an updated age-verification blueprint with technical specifications in late 2025, support for zero-knowledge proofs is part of the design, and in April 2026 the EU announced the app was technically ready, with rollout following. Several member-state wallets have signalled similar capabilities. This is the strongest evidence that the techniques are not theoretical but operational where the use case is proving an attribute to a relying party.
The second area that works today is reusable credentials in financial onboarding. When a regulated issuer has verified a user, that user can re-present their verified status to other services as a proof rather than a fresh data dump, which is the model behind a reusable KYC passport. Here the issuer retains the evidence as the rules require, and the relying parties consume proofs, capturing the privacy benefit without breaching record-keeping. The third area is selective disclosure within data sharing, such as proving a user is not on a sanctions list or is resident in a permitted jurisdiction, without transmitting the full underlying record.
What are the limits of the technique?
The first limit is the one regulators care about most: zero-knowledge KYC does not dissolve verification and retention duties. A regulated firm still has to identify and verify the customer against reliable sources and keep retrievable records. Any architecture that claims no one, including authorities through lawful process, can ever reach the identity evidence is incompatible with obliged-entity obligations, however privacy-friendly it sounds.
The second limit is trust in the issuer. A proof is only as good as the verification that produced the credential behind it, so the assurance depends entirely on the rigour and accountability of the issuer that performed the original check. The third is maturity and interoperability: standards for credentials and proofs are still consolidating, and a proof is only useful if relying parties can verify it, which requires shared frameworks like those the EU wallet is building. The fourth is that the approach addresses data exposure, not every fraud vector; you still need strong verification, liveness and ongoing monitoring underneath. Recognising these limits is what separates a defensible deployment of zero-knowledge KYC from a marketing claim.
How does Zyphe use zero-knowledge techniques?
Zyphe applies privacy-preserving and decentralised techniques in the way regulators can defend rather than as a way to evade obligations. Verification is performed rigorously, reading the NFC chip in modern documents to the ICAO 9303 and eIDAS standards with two-step liveness and no image upload, so the original check meets the reliable-source standard that FATF and the EU require. The minimal evidence needed for record-keeping is then retained, never discarded, so the audit trail stays complete and authorities can be served on demand.
What changes is where that data lives and how it is shared. Retained evidence is sharded across a network of more than 60,000 nodes under a scheme that requires a threshold of nodes to reconstruct anything, with a customer-held key and no master key, so there is no central honeypot. Downstream, verified users carry a reusable credential and re-present proofs of their verified status rather than re-sharing raw data, which is the practical, regulator-defensible expression of zero-knowledge KYC. The result aligns privacy and compliance: data minimisation at the sharing layer, rigorous verification and full retention at the obliged-entity layer, on decentralised KYC infrastructure. Book a demo to see how it maps to MiCA, FATF and AMLA expectations.
The bottom line
Zero-knowledge KYC is real, useful and already operational where the task is proving an attribute, as the EU's zero-knowledge age-verification rollout demonstrates. But it is not a regulatory escape hatch. For a regulated obliged entity, the duties to verify against reliable sources and to retain retrievable records survive intact under FATF, MiCA and the EU single rulebook. The deployment that satisfies both privacy advocates and supervisors is the same one: verify once, properly, with a qualified issuer that retains the minimal evidence, then let downstream relying parties consume proofs rather than data. Treated that way, the technique is one of the strongest tools available for reconciling data protection with anti-money-laundering obligations.
Related resources
- What is a zero-knowledge proof in KYC verification?
- MiCA KYC requirements in 2026
- FATF Travel Rule and VASP compliance
- KYC without storing passports
- Zyphe decentralised KYC
Cited sources
Michelangelo Frigo (Co-Founder at Zyphe) Michelangelo Frigo is a privacy and identity infrastructure expert and co-founder of Zyphe.