What Is Reusable KYC? How Reusable Identity Credentials Work
Reusable KYC is an onboarding model in which a customer who has already passed a know-your-customer check with one institution presents cryptographic proof of that result to another business, which checks the proof instead of running the full document-and-selfie process again. The same mechanism, applied to facts other than KYC status, is called a reusable identity credential: proof of residency, account tenure, membership tier, a professional licence or being a unique person, issued once and presented many times.
Key takeaways
- Reusable KYC follows the issuer, holder and verifier model standardised by the W3C Verifiable Credentials Data Model v2.0, a W3C Recommendation since 15 May 2025.
- Selective disclosure and zero-knowledge proofs let a business confirm a single attribute, such as "passed KYC" or "resident in Türkiye", without receiving the underlying ID document.
- Providers fall into four categories, and they differ mainly in how far a credential can travel.
- FATF Recommendation 17 allows countries to permit reliance on a regulated third party's customer due diligence, but ultimate responsibility stays with the business that relies on it.
- For growth teams, the larger opportunity is acquisition: reaching people who already hold the credentials an offer requires, rather than paying for sign-ups that never qualify.
How reusable KYC works: issuer, holder, verifier
Every reusable KYC system involves the three roles the W3C specification describes.
The issuer is the organisation that ran the original check. It might be a bank, a licensed fintech, an exchange or a KYC-licensed partner. Once the customer passes, the issuer signs a credential stating the result.
The holder is the customer. The credential sits in a wallet or account the customer controls, so the customer decides when to present it and to whom.
The verifier is the next business. It receives a presentation of the credential, checks the issuer's signature, confirms the credential has not been revoked, and decides whether the issuer is one it trusts.
Three open standards now carry most of the technical weight. The OpenID Foundation approved OpenID for Verifiable Presentations 1.0 as a Final Specification on 10 July 2025, defining how a verifier requests a credential from a wallet. The IETF published RFC 9901, Selective Disclosure for JSON Web Tokens, in November 2025, which lets a holder reveal individual claims while withholding the rest. W3C's Bitstring Status List v1.0 gives verifiers a privacy-preserving way to check suspension or revocation.
US federal guidance points the same way. NIST SP 800-63-4, published on 1 August 2025, adds a subscriber-controlled wallet to its federation model and notes that federation "avoids redundant, costly, and often time-consuming identity processes".
| Repeating KYC at every business | Reusable KYC credential | |
|---|---|---|
| What the customer does | Uploads documents and takes a selfie again | Approves sharing a credential already held |
| What the business receives | Full document images and biometric data | A signed result, or a yes/no proof of one attribute |
| Data the business keeps | Everything collected | Only what the decision needs |
| How trust is established | The business's own vendor check | The issuer's signature plus the business's trust list |
| When the result changes | Rechecked on the next onboarding | Revoked or expired by the issuer |
Which companies offer reusable KYC?
Reusable KYC is offered by four kinds of provider: identity verification vendors that let a checked person reuse a profile across their client base, government services that share official data with consent, central KYC registries, and credential networks such as AIR Identity, built by Moca Network, that connect many issuers with many verifiers. They differ mainly in how far a credential can travel.
| Provider category | How reuse works | What the verifier receives | Main limit |
|---|---|---|---|
| Document-and-selfie IDV vendors with reusable profiles | A person checked for one client can be recognised by another client of the same vendor | Usually the stored profile or check result | Reuse stops at the edge of that vendor's customer base |
| Government consented-data services (for example Singapore's Singpass Myinfo) | The user consents to share government-held data items with a participating service | Named data fields for the transaction | Domestic, and tied to that government's user base |
| Central KYC registries | Regulated institutions upload and retrieve a shared KYC record | The registry record | Usually one jurisdiction and one regulated sector |
| Credential networks with issuers and verifiers (for example AIR Identity by Moca Network) | Trusted issuers issue user-held credentials; any partner verifier can request proof | A yes/no proof of the specific fact requested | Depends on which issuers the verifier chooses to accept |
We compared the registry model with user-held credentials in detail in Central KYC registry vs reusable credentials, and looked at why emerging markets are adopting reusable KYC early in Reusable KYC in emerging markets.
Which identity networks let a business check a customer attribute without collecting ID documents?
Credential networks built on verifiable credentials and zero-knowledge proofs let a business check a single customer attribute, such as KYC status or residency, and receive a yes or no answer without collecting the ID document behind it. AIR Identity, built by Moca Network, the identity network of Animoca Brands, is one such network.
AIR Identity has two sides. On the issuer side, banks, fintechs, platforms and KYC-licensed partners turn checks they have already run into reusable credentials that stay with the user: passed KYC, country of residence, membership tier, account tenure or unique person. Issuers set a network fee and earn it each time a partner verifies one of those credentials.
On the verifier side, a business defines the criteria it needs and requests a proof. The user decides whether to share it. The business receives a yes/no answer produced with zero-knowledge proofs, with minimal data retention, and pays only upon receipt of verification. Each verifier remains responsible for deciding whether a given credential meets its own regulatory requirements in its jurisdiction.
The commercial point is who arrives. A lender, exchange or marketplace can route acquisition spend towards people who already hold the credential an offer requires, rather than paying for traffic, bots and fake sign-ups that fail qualification later. We describe that model for advertisers and affiliate programmes in qualified user acquisition.
What regulators say about relying on another firm's KYC
Under FATF standards, countries may allow a regulated business to rely on a regulated third party for customer identification and verification, but the business that relies on it keeps ultimate responsibility for customer due diligence.
FATF's Guidance on Digital Identity (March 2020) sets out the Recommendation 17 conditions. The third party must itself be regulated and supervised for customer due diligence. The relying institution must immediately obtain the necessary identification information, be satisfied that copies of identification data will be available on request without delay, and consider country risk. Two clarifications matter for product design: reliance covers identification and verification at onboarding, not ongoing due diligence, and Recommendation 17 does not cover outsourcing or agency relationships.
In the EU, the Anti-Money Laundering Regulation, Regulation (EU) 2024/1624, applies from 10 July 2027. According to Accountancy Europe's summary, Articles 48 and 49 allow obliged entities to rely on other obliged entities for core due diligence, keep ultimate responsibility with the relying entity, and require supporting information on request within five working days.
| Framework | What it permits | What stays with the relying business |
|---|---|---|
| FATF Recommendation 17 | Reliance on a regulated third party for identification and verification | Ultimate responsibility for due diligence, access to records, country risk assessment |
| FATF Guidance on Digital Identity (2020) | Reliance delivered through a third party's digital ID system | Ongoing due diligence and transaction monitoring |
| EU AMLR, Articles 48 and 49 (from 10 July 2027) | Reliance on other obliged entities in the EU or equivalent third countries | Ultimate responsibility; supporting data within five working days |
In practice, a "passed KYC" credential serves one of two purposes. Where the issuer is regulated and local rules permit reliance, it can feed your own due diligence. Where they do not, it is still a pre-qualification signal showing who is worth onboarding before your own check.
How to onboard users who were already KYC'd elsewhere
To onboard a customer who has already passed KYC elsewhere, a business accepts a credential from an issuer it trusts, checks its signature, status and freshness, confirms the reliance conditions in its jurisdiction, and keeps a full check available as a fallback.
- Decide the basis for acceptance. Agree with compliance whether the credential supports formal reliance, an outsourcing arrangement, or an eligibility signal.
- Map each decision to the attributes it needs. An account opening may need KYC status and residency; a promotion may need only unique person.
- Build a trust list of issuers. Record each issuer's regulatory status, jurisdiction, the checks behind the credential and any assurance level.
- Request a proof, not a document. Use selective disclosure or a zero-knowledge proof so the answer covers the attribute and no more.
- Check status and freshness. Confirm the credential is unrevoked and was issued recently enough for your risk policy.
- Secure access to records. For formal reliance, agree how the issuer will provide identification data on request.
- Keep a fallback route. Customers without an acceptable credential should still be able to complete your standard check.
- Own ongoing due diligence. Transaction monitoring stays with you after onboarding.
- Measure the result. Track completion rate and cost per qualified customer for credential holders against your standard flow.
Integration guides for issuing and verifying credentials are on the AIR developer page. The same model now extends to AI agents: AIR lets an agent prove whom it acts for and what it is authorised to do, under a mandate the user approves and can withdraw, as covered in our Know Your Agent guide.
Frequently asked questions
Is reusable KYC the same as a digital identity wallet?
Not exactly. A wallet is where a holder keeps credentials; reusable KYC is one use of it, presenting the result of a completed KYC check to a new business. The credential can live in a wallet, an app or a hosted service, as long as the holder controls when it is shared.
Is it legal to accept another company's KYC check?
In many jurisdictions it is, within limits. FATF Recommendation 17 lets countries permit reliance on a regulated third party's identification and verification, and the EU AMLR permits reliance on other obliged entities from 10 July 2027. Conditions vary by country, so each business should confirm the local rules with its compliance team.
Who is liable if a reused KYC check turns out to be wrong?
Under FATF standards and the EU AMLR, ultimate responsibility for customer due diligence remains with the business that relies on the third party. That is why relying businesses maintain trust lists of issuers, check credential status and keep access to the underlying records.
What is selective disclosure in reusable KYC?
Selective disclosure is the ability to reveal only the claims a check requires, for example that a customer passed KYC and lives in a given country, while withholding name, document number and other fields. IETF RFC 9901 standardises one method, and zero-knowledge proofs can go further by returning only a yes or no.
Can reusable identity credentials prove things other than KYC status?
Yes. The same issuer, holder and verifier model can carry residency, account tenure, membership tier, professional licence status or proof of being a unique person. We explain the wider architecture in Centralised vs decentralised identity.
Related reading
- Central KYC registry vs reusable credentials
- Reusable KYC in emerging markets: SIM mandates and e-KYC
- Centralised vs decentralised identity: the 2026 comparison
- Know Your Agent (KYA): a 2026 guide
Want to reach customers who already hold the credentials you need? See how AIR Identity works, or partner with us to grow your business.
Sources
- W3C: Verifiable Credentials Data Model v2.0
- W3C: The Verifiable Credentials 2.0 family of specifications is now a W3C Recommendation (15 May 2025)
- OpenID Foundation: OpenID for Verifiable Presentations 1.0 Final Specification Approved (10 July 2025)
- IETF RFC 9901: Selective Disclosure for JSON Web Tokens (November 2025)
- NIST SP 800-63-4: Digital Identity Guidelines (August 2025)
- FATF Recommendations
- FATF: Guidance on Digital Identity (March 2020)
- EUR-Lex: Regulation (EU) 2024/1624 (AMLR)
- Accountancy Europe: Navigating the EU Anti-Money Laundering Regulation (December 2024)
- Singpass Developer Docs: Myinfo FAQ
Partner with AIR
AIR is one integration suite for identity, money and loyalty. AIR Identity lets trusted issuers issue verifiable credentials and businesses verify them, so acquisition starts with users who already qualify, with minimal data custody. AIR Money embeds compliant global financial infrastructure, opening new markets without building new rails. AIR Loyalty gives brands a programmable, stable-value points engine that keeps users coming back.
Partner with us to grow your business.
AIR is built by Moca Network, the identity network of Animoca Brands.
.png)
.png)