Endpoint

6/5/2018
12:30 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

68% of EU, US Crypto Exchanges and Wallets Fail on Proper Customer Identity Checks

London and Amsterdam, June 5th, 2018 — Analyst house P.A.ID Strategiesannounces the results of research into the onboarding practices of cryptocurrency wallets and exchanges. The research, commissioned by Mitek, a global leader in digital identity verification solutions, looked into whether prominent cryptocurrency exchanges and wallets across Europe and the US are using Know Your Customer (KYC) checks when on boarding customers.

The research, “The Cryptocurrency Identity Crisis” shows that of 25 prominent custodian wallets and crypto exchanges examined, 68% are allowing users to trade crypto and fiat currency with no formal identification and no Know Your Customer (KYC) checks. The EU’s fifth anti money laundering directive, AMLD5, will bring these platforms into line with other financial products such as bank accounts, demanding that checks are carried out on new customers to affirm their identity.

The recent surge in ICOs and the volatile price of bitcoin has made the crypto markets an attractive place for both legal and not-so-legal trading activity. However, for the 68% of exchanges and wallets that do not meet upcoming regulation, there are no identity verification checks against official identity documents, against Politically Exposed Persons lists or sanctions screening, and no audit trail that would help to trace criminal activity. As well as failing to meet upcoming compliance demands, this could lead to irreparable harm to the reputation of these platforms if they are used to launder money.

The research ranks wallets and exchanges according to how compliant the onboarding process is, with AMLD5 due to come into force next year, plus the speed and simplicity with which a customer can sign up and get started. The below table ranks exchanges and wallets according to their identity verification process.

 

Company

Wallet / Exchange

Requires unverified personal information

Requires official ID documents to begin trading

ID Verification Score (/10)

Coinbase

E

P

P

9

Gemini

E

P

P

9

Poloniex

E

 

P

9

itBit

E

P

P

9

Luno

W

P

P

8

Bonpay

W

P

P

8

Mercatox

W

P

 

7

Kraken

E

P

P

7

Bitstamp

E

P

P

7

CoinCorner

W

P

 

7

QuadrigaCX

E

P

 

6

Cex.IO

E

P

 

6

Blockchain Wallet

W

 

 

6

Wirex

W

 

 

6

Lykke Wallet

W

P

 

6

Coinexchange

E

 

 

5

Exmo

E

 

 

5

Coinjar

W

 

 

5

Liqui

E

 

 

4

Local Bitcoins

E

 

 

4

YoBit.net

E

 

 

4

BitPanda

W

 

 

4

Bitwala

W

 

 

3

SpectroCoin

W

 

 

2

Indacoin

E

P

 

2

 

In order to sign up to exchanges and wallets that do not perform KYC, customers only need a verified email address and mobile number. Both of these are easily obtainable without ID—any webmail service such as Gmail or Outlook.com can provide an email address, while in many countries a pay-as-you-go mobile phone would provide the number. Armed with these, users of the services that fail to meet upcoming AMLD5 regulation can buy and sell cryptocurrencies and exchange them for fiat currencies.

“Cryptocurrency wallets and exchanges want to enjoy the same trust as the wider traditional financial services, but for this to happen they need to rise above the sometimes-dubious reputation of cryptocurrency’s past and be seen as ‘model citizens’ of the economy,” said John Devlin, Principal Analyst, P.A.ID Strategies. “Meeting regulatory demands ahead of AMLD5 coming into force could go a long way to changing this sector’s reputation as being something of a ‘wild west’.”

“Wallets and exchanges want to change perceptions of lawlessness and it’s a relatively straightforward fix. Identity verification processes can be—if implemented correctly—simple for the customer and no barrier to signing up,” said Kalle Marsal, COO, Mitek. “By incorporating systems that are just as future-looking as cryptocurrency itself, exchanges and wallets can be both competitive and compliant with regulatory demands."

Companies surveyed included Kraken, Poloniex, Coinbase, Coinjar, Luno and Bitwala. The report can be downloaded here:https://www.miteksystems.co.uk/resources/cryptocurrency-paid-strategies

 

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Crowdsourced vs. Traditional Pen Testing
Alex Haynes, Chief Information Security Officer, CDL,  3/19/2019
BEC Scammer Pleads Guilty
Dark Reading Staff 3/20/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
The State of Cyber Security Incident Response
The State of Cyber Security Incident Response
Organizations are responding to new threats with new processes for detecting and mitigating them. Here's a look at how the discipline of incident response is evolving.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-15583
PUBLISHED: 2019-03-25
Cross-Site Scripting (XSS) vulnerability in point_list.php in GNUBOARD5 before 5.3.1.6 allows remote attackers to inject arbitrary web script or HTML via the popup title parameter.
CVE-2017-7340
PUBLISHED: 2019-03-25
A Cross-Site Scripting vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows an attacker to execute unauthorized code or commands via the applicationSearch parameter in the FortiView functionality.
CVE-2014-9187
PUBLISHED: 2019-03-25
Multiple heap-based buffer overflow vulnerabilities exist in Honeywell Experion PKS all versions prior to R400.6, all versions prior to R410.6, and all versions prior to R430.2 modules, which could lead to possible remote code execution or denial of service. Honeywell strongly encourages and recomme...
CVE-2014-9189
PUBLISHED: 2019-03-25
Multiple stack-based buffer overflow vulnerabilities were found in Honeywell Experion PKS all versions prior to R400.6, all versions prior to R410.6, and all versions prior to R430.2 modules that could lead to possible remote code execution, dynamic memory corruption, or denial of service. Honeywell...
CVE-2019-10044
PUBLISHED: 2019-03-25
Telegram Desktop before 1.5.12 on Windows, and the Telegram applications for Android, iOS, and Linux, is vulnerable to an IDN homograph attack when displaying messages containing URLs. This occurs because the application produces a clickable link even if (for example) Latin and Cyrillic characters e...