‘Zero-knowledge’ proofs could revolutionize banking compliance

One of the paradoxes of banking and payments compliance is that the requirements are getting increasingly onerous, and yet financial crime persists. Meanwhile, the efforts to protect data from theft struggle to keep pace with the moving goalposts, and users rightfully worry about their privacy.

Proposed solutions tend to focus on more data collection, higher hurdles and greater use of AI, while overlooking that part of the problem is the relative ease of fraud in the digital age, as well as the vulnerabilities stemming from the convenience of centralized data.

Blockchain networks, however, don’t just present an entirely new type of distributed base layer with embedded security and customizable privacy. They also offer a new way of treating information responsibility and verification, by enabling the application of a cryptographic concept known as “zero-knowledge proofs,” or ZKPs.

As the name suggests, these are algorithms that allow for the verification of information without revealing what that information is. For instance, I can prove I have something without showing it to you. Or, I can prove I know where something is without divulging its location.

Each of those and other use cases would employ different cryptographic techniques, but the bottom line is that you are convinced a condition is met, even though I have not revealed any details.

The potential applications are vast, and outline a lighter and yet more effective framework for financial compliance. An asset manager can verify I meet minimum personal wealth requirements without finding out how much money I have. A bank manager can confirm I live in the U.S. without knowing my address. A payments provider can be confident I’m not on a sanctions list without knowing anything else about me.

The idea sounds simple, but its workings are complex and are implemented via many different ZKP models and formats. Some chains admit ZKP applications on top of their protocols, others are built around the technology.

I’ll focus here on two potential examples, a small representation of the possibilities but which sketch out how the application of the concept could work.

For compliance purposes, I could submit relevant personal information to a digital certification platform. For instance, verification of my passport data would produce a token confirming that I am a citizen of the U.S. and not on any restricted list. Banks and payment services could query my wallet-based identity, see the token, and accept my instructions without needing further information. Or, my wallet could hold a digital credential showing I am an accredited investor. A tokenized fund platform could then automatically include me in its distribution without needing to see my financial status.

These verifications would happen automatically and instantly, reducing the considerable cost of compliance. What’s more, using ZKPs drastically reduces the data storage burden on financial entities by eliminating the need to store sensitive client information; they just need to implement the necessary smart contracts.

Also, financial institution audits could be streamlined by enabling the bulk verification of the necessary checks without giving auditors access to client data.

As well as making compliance more efficient, ZKPs can also embed privacy directly into payments, enabling the transfer of money while hiding identities as well as the amount being transferred.

To see how this could work, we need to get rid of the idea of traditional “balances” adjusted by a centralized entity.

Imagine a tree with hundreds of envelopes hanging from the branches. Each envelope contains a note with a specific face value, or — easier to imagine — a piece of paper with a number written on it. Each envelope also contains an ownership identifier, which is not a name but a one-time code that links to a specific user.

Let’s say one of the envelopes that links to you has a face value of 150 (for simplicity, let’s ignore units). You want to send me 100. You go to the tree, find your envelope, take out the note inside and destroy it. You then make two new pieces of paper, one with 100 on it, and the other with 50. You put the 100 in an envelope with a one-time identifier that links to me, and the 50 in an envelope with another identifier that links back to you.

The tree doesn’t know what you did, other than that you added an envelope. It doesn’t know the value you put into each envelope, nor to whom their identifiers point. All the tree cares about is that the total value of the bits of paper in all the envelopes hasn’t changed. And it hasn’t: You swapped one envelope with a 150 note for two new ones, one with 100 pointing to me and one with 50 pointing to you.

Now imagine that I have a special app that can scan all the tree’s envelopes for identifiers that point to me. I run the app, and I see that my total envelope value has gone up by 100. If you were to run your app, you’d see that you no longer have your 150 envelope, but you gained one with 50 — net, you have 100 less.

Of course, this is an egregious simplification of a complex process, and notice that I haven’t dwelled on how the tree checks the totals and makes sure that the identifiers are valid. But it hopefully illustrates a mind-bending alternative map of how finance could work.

Other potential applications include proving tax compliance without revealing financial information, confirming punctual loan repayments while hiding amounts, demonstrating sufficient reserves to cover client deposits without disclosing size, and much more.

Bigger picture, zero-knowledge proofs can change how we understand compliance and payments information. They don’t just boost efficiency by automating routine checks while increasing security. They also leverage decentralized data structures to question long-held assumptions and processes. And in so doing, they remind us that crypto innovation in markets is not just about new types of assets with new types of settlement and programmability. It’s also about rewriting the framework around identity, and who owns knowledge.