Data Privacy
Reusable KYC: Verify a Customer Once and Reuse the Proof
October 22, 2026
7 mins read
Reusable KYC lets customers verify identity once and share a credential with other firms instead of re-uploading documents. How it works in 2026.
Reusable KYC means a customer goes through identity checks once, with a firm that is allowed to do them, and then shares a verified credential with other firms instead of uploading the same documents again. The Financial Action Task Force calls this a portable digital ID: one that lets a customer prove identity to new firms "without their having to obtain and verify personal data and conduct customer identification/verification each time" (FATF).
In 2026 the idea moved from pilots into rules. US regulators confirmed in September that government-issued verifiable digital credentials, such as mobile driver's licences, can be used for customer identification, the EU digital identity wallet deadline arrives in December, and the UK now has a statutory register of digital verification services. This guide explains how reusable KYC works, what each of these rules allows, and the part of the job that reuse does not remove.
Why Repeating KYC Is a Problem
Every new account usually means a new upload of a passport, a new selfie and a new review. The cost shows up on both sides.
For firms, it is money and lost customers. Fenergo's 2025 survey of 600 decision-makers found that average AML and KYC operations spend reached US$72.9 million per firm per year, and that 70% of financial institutions lost clients in the past year because onboarding was too slow (Fenergo).
For customers, it is risk. Each copy of an identity document sits in another database that can leak. In September 2026 Revolut answered a fake data request sent from a real government email domain, and copies of identity documents, selfies and transaction histories were exposed (Forbes). We looked at what that case means for KYC providers in the Revolut KYC data breach and zk-KYC.
Reusable KYC targets both problems at once: fewer repeat checks, and fewer copies of the raw documents.
How Reusable KYC Works
Most designs have three roles:
- Issuer. A firm that completes the identity check, such as a bank or a regulated verification provider, issues a signed credential that says what it checked and when.
- Holder. The customer keeps the credential in a wallet or account and decides who to share it with.
- Relying party. A new firm receives the credential, checks the issuer's signature and status, and decides whether it can rely on it.
The common format is the verifiable credential. The W3C Verifiable Credentials Data Model 2.0 became a W3C Recommendation on May 15, 2025, and it supports selective disclosure: the holder can make "fine-grained decisions about what information to share" (W3C). Our guide to verifiable credentials covers the format in more detail.
Zero-Knowledge Proofs (ZK proofs) take selective disclosure further. Instead of sharing a field such as a date of birth, the customer proves a statement about it, for example "over 18" or "passed KYC with a regulated issuer", and the relying party learns nothing else. In July 2025 Google open-sourced its ZK proof libraries for exactly this kind of check in age assurance (Google). When ZK proofs carry KYC status, the result is often called zkKYC, which we cover in ZK KYC and decentralized identity for financial institutions.
What Regulators Allow in 2026
| Jurisdiction | Rule | Stage |
|---|---|---|
| United States | FinCEN and the federal banking agencies confirmed that verifiable digital credentials issued by government bodies, such as mobile driver's licences, may be used to verify customers under the Customer Identification Program rule (FinCEN) | FAQs issued September 8, 2026 |
| European Union | eIDAS 2.0 requires each member state to provide at least one European Digital Identity Wallet, and banks and financial services that must use strong user authentication have to accept it when the user asks (EUR-Lex) | Wallets due by December 24, 2026; acceptance by December 24, 2027 |
| European Union | The Anti-Money Laundering Regulation lets a firm rely on another regulated firm for customer due diligence, but "the ultimate responsibility" stays with the firm that relies (Article 48) (AMLR Article 48) | Applies from July 10, 2027 |
| United Kingdom | The Data (Use and Access) Act 2025 created a statutory register of digital verification services; in July 2026 it listed 46 providers offering 64 certified services (OfDIA) | Register live since December 1, 2025 |
| Singapore | The Monetary Authority of Singapore treats Myinfo, the government's consent-based personal data service, as a reliable source for onboarding (MAS) | Banks began using Myinfo for account opening in a May 2017 pilot (GovTech) |
The direction is the same everywhere: a verified digital credential can stand in for a new document check. Rollout is uneven, though. In September 2026, 24 of the 27 EU member states still had no wallet available (Brussels Signal).
What Reuse Does Not Remove
Reusing a credential does not move the legal duty. Under the EU's reliance rule, the firm that relies on another firm's checks still carries the responsibility for its own customer due diligence. In practice, a relying party needs to be able to show, later and to a supervisor:
- Who verified the customer, and whether that issuer was allowed to.
- When the check happened and under which rules.
- Whether the credential was still valid at the moment it was relied on, not revoked or expired.
- What the firm saw and decided, without keeping a fresh copy of every document.
A credential or a ZK proof answers the first question well. The others need a record that the relying firm can produce on request, and that record has to be trustworthy without becoming another store of passports and selfies. This is where most reusable KYC designs still need work.
Where zkDatabase Fits
zkDatabase, built by Orochi Network, is a verifiable database powered by Zero-Knowledge Proofs. In a reusable KYC flow it can hold KYC status records off-chain, such as issuer, check date, rule set and revocation state, and generate a proof for every update. A relying firm, an auditor or a smart contract can then check that a customer held a valid, unrevoked status at a given time without receiving the underlying documents.
The proof shows that the status data was stored and processed as claimed. It does not replace the original identity check, which stays with the regulated issuer, and it does not move the relying firm's own responsibility. What it adds is evidence next to those processes: a record of reliance that can be checked without creating another copy of the customer's identity. For the wider design, see our piece on AML and KYC without mass surveillance.
FAQ
Is reusable KYC legal?
Generally yes, within each jurisdiction's rules. FATF guidance supports reliable digital ID for customer identification, US regulators confirmed in 2026 that government-issued verifiable digital credentials can be used under the CIP rule, and the EU's AMLR, which applies from July 10, 2027, allows reliance on another regulated firm. The relying firm still owns its due diligence.
Is reusable KYC the same as zkKYC?
Not exactly. Reusable KYC is the goal: verify once, reuse many times. zkKYC is one way to do it, where the customer shares a Zero-Knowledge Proof of their KYC status instead of the data itself.
Who is responsible if a reused KYC check turns out to be wrong?
Under the EU AMLR reliance rule, the firm that relied on the check keeps ultimate responsibility for its customer due diligence. That is why relying firms need a clear record of who verified the customer, when, and whether the credential was valid when they used it.
Talk to the Team (https://orochi.network/partnership) to discuss how verifiable KYC status records can fit your onboarding and audit process.
Related toData Privacy
