Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

6/5/2018
12:30 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

68% of EU, US Crypto Exchanges and Wallets Fail on Proper Customer Identity Checks

London and Amsterdam, June 5th, 2018 — Analyst house P.A.ID Strategiesannounces the results of research into the onboarding practices of cryptocurrency wallets and exchanges. The research, commissioned by Mitek, a global leader in digital identity verification solutions, looked into whether prominent cryptocurrency exchanges and wallets across Europe and the US are using Know Your Customer (KYC) checks when on boarding customers.

The research, “The Cryptocurrency Identity Crisis” shows that of 25 prominent custodian wallets and crypto exchanges examined, 68% are allowing users to trade crypto and fiat currency with no formal identification and no Know Your Customer (KYC) checks. The EU’s fifth anti money laundering directive, AMLD5, will bring these platforms into line with other financial products such as bank accounts, demanding that checks are carried out on new customers to affirm their identity.

The recent surge in ICOs and the volatile price of bitcoin has made the crypto markets an attractive place for both legal and not-so-legal trading activity. However, for the 68% of exchanges and wallets that do not meet upcoming regulation, there are no identity verification checks against official identity documents, against Politically Exposed Persons lists or sanctions screening, and no audit trail that would help to trace criminal activity. As well as failing to meet upcoming compliance demands, this could lead to irreparable harm to the reputation of these platforms if they are used to launder money.

The research ranks wallets and exchanges according to how compliant the onboarding process is, with AMLD5 due to come into force next year, plus the speed and simplicity with which a customer can sign up and get started. The below table ranks exchanges and wallets according to their identity verification process.

 

Company

Wallet / Exchange

Requires unverified personal information

Requires official ID documents to begin trading

ID Verification Score (/10)

Coinbase

E

P

P

9

Gemini

E

P

P

9

Poloniex

E

 

P

9

itBit

E

P

P

9

Luno

W

P

P

8

Bonpay

W

P

P

8

Mercatox

W

P

 

7

Kraken

E

P

P

7

Bitstamp

E

P

P

7

CoinCorner

W

P

 

7

QuadrigaCX

E

P

 

6

Cex.IO

E

P

 

6

Blockchain Wallet

W

 

 

6

Wirex

W

 

 

6

Lykke Wallet

W

P

 

6

Coinexchange

E

 

 

5

Exmo

E

 

 

5

Coinjar

W

 

 

5

Liqui

E

 

 

4

Local Bitcoins

E

 

 

4

YoBit.net

E

 

 

4

BitPanda

W

 

 

4

Bitwala

W

 

 

3

SpectroCoin

W

 

 

2

Indacoin

E

P

 

2

 

In order to sign up to exchanges and wallets that do not perform KYC, customers only need a verified email address and mobile number. Both of these are easily obtainable without ID—any webmail service such as Gmail or Outlook.com can provide an email address, while in many countries a pay-as-you-go mobile phone would provide the number. Armed with these, users of the services that fail to meet upcoming AMLD5 regulation can buy and sell cryptocurrencies and exchange them for fiat currencies.

“Cryptocurrency wallets and exchanges want to enjoy the same trust as the wider traditional financial services, but for this to happen they need to rise above the sometimes-dubious reputation of cryptocurrency’s past and be seen as ‘model citizens’ of the economy,” said John Devlin, Principal Analyst, P.A.ID Strategies. “Meeting regulatory demands ahead of AMLD5 coming into force could go a long way to changing this sector’s reputation as being something of a ‘wild west’.”

“Wallets and exchanges want to change perceptions of lawlessness and it’s a relatively straightforward fix. Identity verification processes can be—if implemented correctly—simple for the customer and no barrier to signing up,” said Kalle Marsal, COO, Mitek. “By incorporating systems that are just as future-looking as cryptocurrency itself, exchanges and wallets can be both competitive and compliant with regulatory demands."

Companies surveyed included Kraken, Poloniex, Coinbase, Coinjar, Luno and Bitwala. The report can be downloaded here:https://www.miteksystems.co.uk/resources/cryptocurrency-paid-strategies

 

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
97% of Americans Can't Ace a Basic Security Test
Steve Zurier, Contributing Writer,  5/20/2019
How a Manufacturing Firm Recovered from a Devastating Ransomware Attack
Kelly Jackson Higgins, Executive Editor at Dark Reading,  5/20/2019
Why AI Will Create Far More Jobs Than It Replaces
John DiLullo, CEO, Lastline,  5/14/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Talk about vendor lock in...
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-11816
PUBLISHED: 2019-05-20
Incorrect access control in the WebUI in OPNsense before version 19.1.8, and pfsense before 2.4.4-p3 allows remote authenticated users to escalate privileges to administrator via a specially crafted request.
CVE-2019-10076
PUBLISHED: 2019-05-20
A carefully crafted malicious attachment could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking.
CVE-2019-10077
PUBLISHED: 2019-05-20
A carefully crafted InterWiki link could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking.
CVE-2019-10078
PUBLISHED: 2019-05-20
A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking. Initial reporting indicated ReferredPagesPlugin, but further analysis showed that multiple plugins were vulnerable.
CVE-2019-12239
PUBLISHED: 2019-05-20
The WP Booking System plugin 1.5.1 for WordPress has no CSRF protection, which allows attackers to reach certain SQL injection issues that require administrative access.