Endpoint

6/5/2018
12:30 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

68% of EU, US Crypto Exchanges and Wallets Fail on Proper Customer Identity Checks

London and Amsterdam, June 5th, 2018 — Analyst house P.A.ID Strategiesannounces the results of research into the onboarding practices of cryptocurrency wallets and exchanges. The research, commissioned by Mitek, a global leader in digital identity verification solutions, looked into whether prominent cryptocurrency exchanges and wallets across Europe and the US are using Know Your Customer (KYC) checks when on boarding customers.

The research, “The Cryptocurrency Identity Crisis” shows that of 25 prominent custodian wallets and crypto exchanges examined, 68% are allowing users to trade crypto and fiat currency with no formal identification and no Know Your Customer (KYC) checks. The EU’s fifth anti money laundering directive, AMLD5, will bring these platforms into line with other financial products such as bank accounts, demanding that checks are carried out on new customers to affirm their identity.

The recent surge in ICOs and the volatile price of bitcoin has made the crypto markets an attractive place for both legal and not-so-legal trading activity. However, for the 68% of exchanges and wallets that do not meet upcoming regulation, there are no identity verification checks against official identity documents, against Politically Exposed Persons lists or sanctions screening, and no audit trail that would help to trace criminal activity. As well as failing to meet upcoming compliance demands, this could lead to irreparable harm to the reputation of these platforms if they are used to launder money.

The research ranks wallets and exchanges according to how compliant the onboarding process is, with AMLD5 due to come into force next year, plus the speed and simplicity with which a customer can sign up and get started. The below table ranks exchanges and wallets according to their identity verification process.

 

Company

Wallet / Exchange

Requires unverified personal information

Requires official ID documents to begin trading

ID Verification Score (/10)

Coinbase

E

P

P

9

Gemini

E

P

P

9

Poloniex

E

 

P

9

itBit

E

P

P

9

Luno

W

P

P

8

Bonpay

W

P

P

8

Mercatox

W

P

 

7

Kraken

E

P

P

7

Bitstamp

E

P

P

7

CoinCorner

W

P

 

7

QuadrigaCX

E

P

 

6

Cex.IO

E

P

 

6

Blockchain Wallet

W

 

 

6

Wirex

W

 

 

6

Lykke Wallet

W

P

 

6

Coinexchange

E

 

 

5

Exmo

E

 

 

5

Coinjar

W

 

 

5

Liqui

E

 

 

4

Local Bitcoins

E

 

 

4

YoBit.net

E

 

 

4

BitPanda

W

 

 

4

Bitwala

W

 

 

3

SpectroCoin

W

 

 

2

Indacoin

E

P

 

2

 

In order to sign up to exchanges and wallets that do not perform KYC, customers only need a verified email address and mobile number. Both of these are easily obtainable without ID—any webmail service such as Gmail or Outlook.com can provide an email address, while in many countries a pay-as-you-go mobile phone would provide the number. Armed with these, users of the services that fail to meet upcoming AMLD5 regulation can buy and sell cryptocurrencies and exchange them for fiat currencies.

“Cryptocurrency wallets and exchanges want to enjoy the same trust as the wider traditional financial services, but for this to happen they need to rise above the sometimes-dubious reputation of cryptocurrency’s past and be seen as ‘model citizens’ of the economy,” said John Devlin, Principal Analyst, P.A.ID Strategies. “Meeting regulatory demands ahead of AMLD5 coming into force could go a long way to changing this sector’s reputation as being something of a ‘wild west’.”

“Wallets and exchanges want to change perceptions of lawlessness and it’s a relatively straightforward fix. Identity verification processes can be—if implemented correctly—simple for the customer and no barrier to signing up,” said Kalle Marsal, COO, Mitek. “By incorporating systems that are just as future-looking as cryptocurrency itself, exchanges and wallets can be both competitive and compliant with regulatory demands."

Companies surveyed included Kraken, Poloniex, Coinbase, Coinjar, Luno and Bitwala. The report can be downloaded here:https://www.miteksystems.co.uk/resources/cryptocurrency-paid-strategies

 

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Election Websites, Back-End Systems Most at Risk of Cyberattack in Midterms
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/14/2018
Intel Reveals New Spectre-Like Vulnerability
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/15/2018
Australian Teen Hacked Apple Network
Dark Reading Staff 8/17/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-15504
PUBLISHED: 2018-08-18
An issue was discovered in Embedthis GoAhead before 4.0.1 and Appweb before 7.0.2. The server mishandles some HTTP request fields associated with time, which results in a NULL pointer dereference, as demonstrated by If-Modified-Since or If-Unmodified-Since with a month greater than 11.
CVE-2018-15505
PUBLISHED: 2018-08-18
An issue was discovered in Embedthis GoAhead before 4.0.1 and Appweb before 7.0.2. An HTTP POST request with a specially crafted "Host" header field may cause a NULL pointer dereference and thus cause a denial of service, as demonstrated by the lack of a trailing ']' character in an IPv6 a...
CVE-2018-15492
PUBLISHED: 2018-08-18
A vulnerability in the lservnt.exe component of Sentinel License Manager version 8.5.3.35 (fixed in 8.5.3.2403) causes UDP amplification.
CVE-2018-15494
PUBLISHED: 2018-08-18
In Dojo Toolkit before 1.14, there is unescaped string injection in dojox/Grid/DataGrid.
CVE-2018-15495
PUBLISHED: 2018-08-18
/filemanager/upload.php in Responsive FileManager before 9.13.3 allows Directory Traversal and SSRF because the url parameter is used directly in a curl_exec call, as demonstrated by a file:///etc/passwd value.