Fingerprints, passports, and digital identities have become the backbone of financial onboarding, yet ever more breaches have cast doubt on the integrity of Know Your Customer (KYC) systems. Even as companies rely on verification to foster trust, breaches involving insider and vendor activity are mounting. Many experts question if traditional architectures, with sensitive documents passing through third-party vendors, are fit for a world where stolen identities cannot be reversed. Organizations, including banks, fintechs, and crypto firms, now assess whether exposure of customers’ data is truly necessary during verification processes.
Recent reports document a persistent pattern: earlier incidents highlighted external threats and hackers breaching security perimeters. More recently, focus has shifted to internal vulnerabilities as misconfigurations and outsourced operations claim growing responsibility for leaks. Breaches in 2025, such as the incident involving the Tea app, exposed how basic errors, like leaving databases publicly accessible, continue to put millions at risk in spite of previous warnings and regulatory requirements. Regulatory compliance alone has not guaranteed data safety, and broad industry reliance on third-party vendors has introduced new forms of risk not previously considered.
How Prevalent Are Insider Threats in KYC?
Industry research estimates insider involvement in 40 percent of breach incidents, as broad access to identity documents creates opportunities for both malicious intent and unintentional exposure. Vendors and internal staff may access highly sensitive records ranging from biometric data to government-issued identifiers. As a result, every additional system or individual exposed to this data expands the scale of probable damage in a breach situation. Increasing use of cloud services and outsourced compliance further compounds these risks, with recent data indicating that misconfiguration and third-party vulnerabilities contributed to nearly half of major incidents last year.
How Do Centralized Systems Increase Vulnerability?
Traditional KYC workflows often require transmitting documents and credentials through multiple software tools and manual review layers. This design leaves users’ lifelong identity records vulnerable, because resetting compromised information, such as a passport, is rarely possible. In 2025, over 12,000 confirmed breaches and tens of millions of compromised records demonstrated the scale of the problem, with supply chain leaks often causing the largest losses. One financial sector survey found breach volumes growing sharply in step with the increased reliance on external compliance platforms.
Can Confidential A.I. Close the Gaps?
Technological approaches such as confidential A.I.—using hardware-based isolation like Intel SGX and AMD SEV-SNP—are now proposed to restrict access to sensitive information even from insiders. By keeping KYC data encrypted even during processing, verification can take place without exposing raw documents to humans or vendors. An industry representative suggested,
“Reducing direct access to identity documents can limit both intentional and accidental breaches.”
Regulations may require verification, but confidential computing solutions allow compliance without unnecessary data exposure, shifting trust from policy to technical control.
Users and regulators increasingly demand demonstrable safeguards against leaks, and technology vendors like Onfido and Sumsub are incorporating confidential computation to address these requirements. Still, some critics note the added complexity and reliance on hardware vendors may introduce new questions. However, proponents argue,
“Auditable, hardware-based isolation gives institutions more assurance than process controls ever could.”
This industry shift reflects growing consensus that the conventional ‘visibility equals security’ logic is outdated as attack patterns evolve.
Global reliance on digital identity verification for financial access will remain necessary, yet current trends suggest that exposing vast troves of personal data to insiders and third parties will no longer remain acceptable. Confidential A.I. does not remove all risks or replace governance, but it is a meaningful step toward minimizing unnecessary data exposure. Readers interested in practical KYC solutions should note that the least visible data during verification is often the most secure. In today’s regulatory landscape, technical solutions like confidential computing allow organizations to prove compliance and accountability, shrinking opportunities for abuse or error. For those seeking to trust institutions with sensitive identity data, understanding how and where information is protected—or exposed—will be key in evaluating real-world risk.
