Every time you open an account, apply for a loan or sign up for an investment app, you hand over the same documents again: your ID, your address proof, your photograph, sometimes your income records. Each copy sits in another database, waiting to be misused, leaked or breached.
What if you could prove you are verified, over 18, or not on a sanctions list, without revealing the underlying data at all? That is the promise of zero-knowledge proofs. And with new data protection rules taking effect, it is quickly moving from academic cryptography to practical necessity.
The KYC paradox
Know Your Customer rules exist for good reasons: preventing money laundering, fraud, terrorist financing and identity theft. But the way KYC is typically implemented creates a paradox.
- The more institutions verify identity, the more copies of sensitive data exist.
- The more copies exist, the greater the risk of breach and misuse.
- Customers repeat the same process again and again, adding friction and abandonment.
- Institutions duplicate costs, each re-verifying what another has already confirmed.
The ideal would be to verify once, reuse safely, and share only what is strictly necessary. That is exactly what modern privacy-preserving cryptography enables.
Why this is urgent now: India's DPDP regime
India's Digital Personal Data Protection Act, 2023 established a comprehensive framework for how personal data must be collected, used and protected. The DPDP Rules, 2025 were notified by the Ministry of Electronics and Information Technology on 14 November 2025, with an 18-month phased implementation:
- November 2025: establishment of the Data Protection Board of India.
- November 2026: the consent manager framework comes into effect.
- May 2027: remaining substantive compliance obligations come into force.
For financial institutions, the direction is unmistakable: collect less, protect more, prove consent, and be accountable. Techniques that let institutions verify facts without holding raw data are a natural fit for this world.
What is a zero-knowledge proof?
A zero-knowledge proof (ZKP) is a cryptographic method that lets one party (the prover) convince another party (the verifier) that a statement is true, without revealing any information beyond the fact that it is true.
A classic analogy: imagine proving you know the password to a door without ever saying the password, simply by walking through the door while the verifier watches from outside.
In identity terms, ZKPs make statements like these possible:
- "This person is over 18" without revealing their date of birth.
- "This person has completed KYC with a regulated bank" without revealing their documents.
- "This person is a resident of India" without revealing their address.
- "This transaction complies with sanctions rules" without revealing customer details to every party.
Three building blocks of privacy-preserving identity
1. Verifiable credentials
A trusted issuer, such as a bank, university or government body, issues a digitally signed credential stating a fact about a person. The signature proves it came from that issuer and has not been altered.
2. Self-sovereign or user-held wallets
The person holds the credential in their own digital wallet, rather than the data living only in the issuer's database. They decide when and with whom to share it.
3. Selective disclosure and zero-knowledge proofs
Instead of sharing the whole credential, the person shares only what is needed, or a proof derived from it.
Real-world examples showing the way
Project Mandala: compliance proofs across borders
On 28 October 2024, the BIS Innovation Hub Singapore Centre, with the Reserve Bank of Australia, the Bank of Korea, Bank Negara Malaysia and the Monetary Authority of Singapore, announced that Project Mandala had reached proof-of-concept stage.
Mandala demonstrated that regulatory compliance can be automated and embedded into cross-border transaction protocols. Its architecture combines peer-to-peer messaging, a rules engine and a proof engine. Once required checks are satisfied, the system generates a compliance proof that can travel with the transaction, and, crucially, the proof can be verified without revealing underlying customer data.
Use cases included cross-border lending between Singapore and Malaysia, and securities financing between South Korea and Australia. India has since joined Project Mandala Phase 2, according to reporting on the RBI's Annual Report 2025-26.
The EU Digital Identity Wallet
Under the EU's revised eIDAS framework, every EU member state must make at least one European Digital Identity Wallet available to citizens by the end of 2026. A core feature is selective disclosure, allowing users to prove attributes, such as being over 18, without revealing full personal data.
Anon Aadhaar
In India, Anon Aadhaar, an open-source project from Privacy and Scaling Explorations, supported by the Ethereum Foundation, demonstrates how zero-knowledge proofs can be generated from the digitally signed Aadhaar Secure QR code. Users can selectively reveal limited fields, such as whether they are above 18, their state or their PIN code, with proofs generated locally on their device. The project describes itself as still under development and not intended for production use, but it shows what is technically possible.
How zero-knowledge KYC could work in practice
Consider a shared, privacy-preserving KYC layer between institutions.
- Bank A completes full KYC on a customer, following RBI requirements, and stores the documents securely under its regulatory obligations.
- Bank A issues a signed credential to the customer's wallet: "KYC completed, risk category low, verified on this date."
- The customer applies to Fintech B for a new service.
- The customer's wallet generates a proof that they hold a valid, unexpired KYC credential from a regulated institution, and that they meet Fintech B's eligibility rules.
- Fintech B verifies the proof cryptographically. It learns that the customer is verified and eligible. It does not receive the passport, Aadhaar number or address.
- The verification is logged on a permissioned ledger as a non-sensitive record, creating an audit trail without exposing personal data.
Where regulations require Fintech B to hold certain data itself, that data can be shared with explicit, recorded consent, and nothing more.
Benefits for everyone
For customers
- Less repetition of onboarding.
- Less exposure of sensitive documents.
- More control over who sees what.
For banks and fintechs
- Lower onboarding costs and faster conversion.
- Reduced breach liability, because they hold less raw data.
- Stronger data minimisation, aligning with the DPDP framework.
For regulators
- Consistent, auditable compliance evidence.
- Better cross-border cooperation without data localisation conflicts.
Beyond KYC: verifiable credentials everywhere
The same technology works for many other claims:
- Education: prove you hold a degree without sharing transcripts.
- Employment: prove employment history for a loan application.
- Professional licences: prove a doctor, lawyer or chartered accountant is currently licensed.
- Income bands: prove income is above a threshold without revealing exact salary.
- Accredited investor status: prove eligibility for certain investments.
Challenges to address honestly
Regulatory acceptance. Regulators must recognise proofs and reusable credentials as satisfying KYC obligations. That requires clear frameworks, pilots and supervisory confidence.
Revocation. If a credential is revoked, for example because of fraud, verifiers must be able to check status without compromising privacy.
Key and wallet security. If a user's wallet is compromised, their credentials could be misused. Strong device security and recovery options are essential.
Usability. Cryptography must be invisible. Customers should see a simple "Share proof of verification" button, not technical details.
Performance and cost. Generating and verifying proofs has computational costs, although modern schemes have improved significantly.
Liability. Institutions relying on another's verification need clarity on who is responsible if something goes wrong.
Design principles for privacy-preserving identity
- Keep personal data off-chain. Ledgers should hold proofs, hashes and non-sensitive references only.
- Disclose the minimum. Ask only for the specific fact needed.
- Make consent explicit and recorded.
- Support revocation and expiry.
- Use open standards so credentials work across institutions.
- Audit the cryptography and the bridges between systems.
A quick glossary for decision-makers
Privacy-preserving identity comes with its own vocabulary. Here are the terms that matter most when evaluating solutions.
- Issuer: the trusted organisation that verifies a fact and signs a credential, such as a bank confirming KYC.
- Holder: the person who stores the credential, usually in a digital wallet on their phone.
- Verifier: the organisation that needs to check a claim, such as a fintech onboarding a new customer.
- Verifiable credential: a digitally signed statement that can be checked for authenticity and tampering.
- Selective disclosure: sharing only specific attributes from a credential rather than the entire document.
- Zero-knowledge proof: a cryptographic proof that a statement is true without revealing the data behind it.
- Revocation registry: a privacy-preserving way to check whether a credential is still valid.
- Consent manager: under India's DPDP framework, a registered entity through which individuals can give, manage, review and withdraw consent.
- Data minimisation: collecting and keeping only the personal data necessary for a stated purpose.
- Permissioned ledger: a distributed ledger where only authorised participants can read or write, suitable for recording non-sensitive verification events.
Understanding these roles makes it much easier to see where risk sits, who is accountable, and how personal data can be kept out of places it does not need to be.
How E1 approaches digital identity and privacy
Privacy is foundational to E1's vision of trustworthy financial infrastructure. E1's approach is built on a simple rule: sensitive fiat and KYC data stays strictly off-chain.
E1 is building digital identity infrastructure designed to include:
- A shared institutional KYC/AML vault, designed as a secure, cross-chain identity layer where banks and fintechs can verify a user's KYC status using zero-knowledge proofs, so Bank A can prove to Bank B that a user is verified without sharing passport or personal data.
- Self-sovereign identity for enterprise, designed for issuing verifiable credentials such as degrees, employment history and professional licences that users hold in their own wallets and present instantly.
- Compliance and data-privacy advisory, designed to help institutions map data flows, maintain PCI-DSS compliance and align with Indian regulations and global standards.
- Datachain interoperability, designed so proofs and credentials can be recognised across heterogeneous ledgers.
KYC should protect people, not expose them. E1's vision is an identity layer where trust is proven mathematically, and personal data is shared only when it truly must be.
Sources
