Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

6/5/2018
12:30 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

68% of EU, US Crypto Exchanges and Wallets Fail on Proper Customer Identity Checks

London and Amsterdam, June 5th, 2018 — Analyst house P.A.ID Strategiesannounces the results of research into the onboarding practices of cryptocurrency wallets and exchanges. The research, commissioned by Mitek, a global leader in digital identity verification solutions, looked into whether prominent cryptocurrency exchanges and wallets across Europe and the US are using Know Your Customer (KYC) checks when on boarding customers.

The research, “The Cryptocurrency Identity Crisis” shows that of 25 prominent custodian wallets and crypto exchanges examined, 68% are allowing users to trade crypto and fiat currency with no formal identification and no Know Your Customer (KYC) checks. The EU’s fifth anti money laundering directive, AMLD5, will bring these platforms into line with other financial products such as bank accounts, demanding that checks are carried out on new customers to affirm their identity.

The recent surge in ICOs and the volatile price of bitcoin has made the crypto markets an attractive place for both legal and not-so-legal trading activity. However, for the 68% of exchanges and wallets that do not meet upcoming regulation, there are no identity verification checks against official identity documents, against Politically Exposed Persons lists or sanctions screening, and no audit trail that would help to trace criminal activity. As well as failing to meet upcoming compliance demands, this could lead to irreparable harm to the reputation of these platforms if they are used to launder money.

The research ranks wallets and exchanges according to how compliant the onboarding process is, with AMLD5 due to come into force next year, plus the speed and simplicity with which a customer can sign up and get started. The below table ranks exchanges and wallets according to their identity verification process.

 

Company

Wallet / Exchange

Requires unverified personal information

Requires official ID documents to begin trading

ID Verification Score (/10)

Coinbase

E

P

P

9

Gemini

E

P

P

9

Poloniex

E

 

P

9

itBit

E

P

P

9

Luno

W

P

P

8

Bonpay

W

P

P

8

Mercatox

W

P

 

7

Kraken

E

P

P

7

Bitstamp

E

P

P

7

CoinCorner

W

P

 

7

QuadrigaCX

E

P

 

6

Cex.IO

E

P

 

6

Blockchain Wallet

W

 

 

6

Wirex

W

 

 

6

Lykke Wallet

W

P

 

6

Coinexchange

E

 

 

5

Exmo

E

 

 

5

Coinjar

W

 

 

5

Liqui

E

 

 

4

Local Bitcoins

E

 

 

4

YoBit.net

E

 

 

4

BitPanda

W

 

 

4

Bitwala

W

 

 

3

SpectroCoin

W

 

 

2

Indacoin

E

P

 

2

 

In order to sign up to exchanges and wallets that do not perform KYC, customers only need a verified email address and mobile number. Both of these are easily obtainable without ID—any webmail service such as Gmail or Outlook.com can provide an email address, while in many countries a pay-as-you-go mobile phone would provide the number. Armed with these, users of the services that fail to meet upcoming AMLD5 regulation can buy and sell cryptocurrencies and exchange them for fiat currencies.

“Cryptocurrency wallets and exchanges want to enjoy the same trust as the wider traditional financial services, but for this to happen they need to rise above the sometimes-dubious reputation of cryptocurrency’s past and be seen as ‘model citizens’ of the economy,” said John Devlin, Principal Analyst, P.A.ID Strategies. “Meeting regulatory demands ahead of AMLD5 coming into force could go a long way to changing this sector’s reputation as being something of a ‘wild west’.”

“Wallets and exchanges want to change perceptions of lawlessness and it’s a relatively straightforward fix. Identity verification processes can be—if implemented correctly—simple for the customer and no barrier to signing up,” said Kalle Marsal, COO, Mitek. “By incorporating systems that are just as future-looking as cryptocurrency itself, exchanges and wallets can be both competitive and compliant with regulatory demands."

Companies surveyed included Kraken, Poloniex, Coinbase, Coinjar, Luno and Bitwala. The report can be downloaded here:https://www.miteksystems.co.uk/resources/cryptocurrency-paid-strategies

 

 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Pen Testers Who Got Arrested Doing Their Jobs Tell All
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/5/2020
Researcher Finds New Office Macro Attacks for MacOS
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/7/2020
A Patriotic Solution to the Cybersecurity Skills Shortage
Adam Benson, Senior VP, Vrge Strategies,  8/3/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-12777
PUBLISHED: 2020-08-10
A function in Combodo iTop contains a vulnerability of Broken Access Control, which allows unauthorized attacker to inject command and disclose system information.
CVE-2020-12778
PUBLISHED: 2020-08-10
Combodo iTop does not validate inputted parameters, attackers can inject malicious commands and launch XSS attack.
CVE-2020-12779
PUBLISHED: 2020-08-10
Combodo iTop contains a stored Cross-site Scripting vulnerability, which can be attacked by uploading file with malicious script.
CVE-2020-12780
PUBLISHED: 2020-08-10
A security misconfiguration exists in Combodo iTop, which can expose sensitive information.
CVE-2020-12781
PUBLISHED: 2020-08-10
Combodo iTop contains a cross-site request forgery (CSRF) vulnerability, attackers can execute specific commands via malicious site request forgery.