Field notes · Identity & compliance

The Compliance Money Pit

A fortune spent proving who you are, almost nothing caught, and the bill charged to the people with the least.

Topic · identity, KYC, AML synthesized from years of notes Read · ~5 min Stance · the gate is the exclusion

What I've come to believe

The identity layer of finance is a paradox: huge spend, a catch rate close to zero, and the people it hurts most are the ones who cannot prove they exist in the first place. It was built to keep bad actors out. In practice it mostly keeps the documentless poor out.

Identity sounds like back-office plumbing, the boring layer beneath the product. It is actually the gate that decides who is allowed into the financial system at all, before any question of credit or product is even asked. And the way the industry runs that gate today manages to be expensive for everyone and impassable for exactly the people who most need to get through.

01How it actually works

Identity in finance splits into three jobs. Identification proves a real-world person exists, usually through official documents. Authentication confirms the person showing up is that person, through credentials or biometrics. Authorization decides what they are then allowed to do. Most of the cost and most of the pain sit in the first job, because it depends on paperwork the wealthy take for granted and the poor often do not have.

Wrapped around all of this is the anti-money-laundering regime, and its economics are the part worth staring at. The spend is vast, most of it goes to people doing manual checks rather than to technology, and the amount of criminal money actually intercepted is a rounding error against the cost of looking for it.

We spend a fortune to catch almost nothing, and we charge the friction of that search to ordinary customers, hardest of all to the ones with the thinnest paperwork.

The money goes into the search, not the catch, and the gate falls hardest on people with no documents to show. Figures are paraphrased from the notes and are illustrative.

02What holds

The cost lands on the wrong people. The AML burden shows up as friction on ordinary, honest customers: forms, holds, repeated checks, declined onboarding. The actual recovery rate against that spend is tiny. We have built an expensive machine that mostly inconveniences the innocent and rarely catches the guilty.
Self-sovereign identity solves a problem most people do not have. The elegant future where everyone custodies their own credentials ignores how people behave. Most have no desire to manage private keys and stash backups somewhere safe. What they actually want is an institution to hold it for them and to be accountable when it breaks. The real demand is recourse, not autonomy.
The frontier is inclusion, not elegance. Roughly one in eight people on earth cannot prove their identity well enough to enter the regulated system. That is the market opportunity and the moral one at the same time. Re-architecting identity for the already-banked is a smaller, less interesting problem than building a door for the people who have none.

03How I read it

My take

KYC and AML are sold as protection, and at the edges they are. But from where I sit, the whole apparatus is really a sorting machine that runs before anyone asks about credit at all. It decides who is even allowed to be a customer. The person who later cannot pay first had to clear this gate to get in, and the gate is hardest for the people with the thinnest paperwork and the deepest need.

So my read is that the inclusion story and the compliance story are not two topics, they are one. Every unit of friction we add at the gate to catch a vanishingly small amount of crime is a unit of exclusion charged to the people with the least margin to absorb it. I spend my time on the back end of credit, with people on a bad month. This is the front end of the same injustice: a system that is quick to question whether a poor person is real and slow to question whether the cost of asking is worth it.

The plumbing here is the identity check. The point is the person standing outside a system that cannot decide whether to believe they exist.

04Where this is going

Banks are unusually well placed to become guarantors of reputation: vouching that you are in good standing without handing over your underlying data to everyone who asks. Done right, that is privacy-enhancing infrastructure and a genuine on-ramp for the excluded. Done lazily, it is the same gate with a nicer interface. The technology will allow either one. Which we get depends entirely on who the people building it are actually trying to let in.

Threads worth pulling: the "Decoding: Banks" series (11:FS), the episodes on identity and on regulation; plus World Bank work on the identity gap and financial inclusion. The AML and inclusion figures are paraphrased from those notes and are illustrative.