What should banks in Asia Pacific pay attention to this year to protect themselves and their customers?
Financial institutions face an average of $6.08M per breach, 22% above the global average. What should banks and financial institutions do to protect themselves and their customers?
We find out more from Terence Kwok, Founder and CEO, Humanity Protocol, on how banks can materially reduce this exposure by rethinking customer identity.
Why are traditional KYC processes and centralized data stores still the weakest link for banks?
Kwok: Traditionally, KYC processes require banks to collect, duplicate, and store large volumes of sensitive identity data. This creates centralised repositories that remain attractive targets long after onboarding is complete. These data stores contain static information such as passports, ID documents, and proof of address, which attackers can easily monetise through identity theft or the creation of synthetic identities.
The issue is structural. Even when security controls improve, the underlying model still forces institutions to hold data that is no longer operationally necessary but still carries significant long-term liability. IBM’s recent breach analysis shows that most financial-sector breach impact comes from data at rest rather than data in transit. This exposes a fundamental mismatch. Verification is a single event, yet the associated custodial responsibility persists indefinitely.
As digital channels expand, centralised data stores become harder to secure and more costly to maintain. Banks inherit long-term risk simply by holding information that attackers actively seek. The system meets compliance requirements, but it enlarges the threat surface at the same time.
How does removing high-value data “honeypots” change the economics of a potential breach?
Kwok: When storage of sensitive information is eliminated, the financial and operational consequences of a breach change significantly. Breaches involving personal data trigger a long and expensive chain of remediation activities that include regulatory reporting, customer notification, identity restoration support, and reputational management. These costs often extend for years.
If verification is achieved through cryptographic proofs rather than stored documents, attackers have very little to gain. There are no passport scans, utility bills, or identification records to extract. Cyberattackers rely on concentrated, easily monetisable data sets. When those data sets no longer exist, the potential reward falls sharply.
This changes the nature of incidents. Breaches become operational disruptions rather than large-scale data exposure events. Institutions focus on restoring systems, not mitigating identity compromise. The overall cost profile becomes more predictable and far less severe. By removing high-value honeypots, organisations significantly reduce the economic incentive for attackers.
How can decentralized, privacy-preserving identity fit within today’s regulatory expectations for AML and KYC?
Kwok: Decentralized, privacy-preserving identity models can meet AML and KYC requirements by providing the assurance and auditability regulators expect without requiring institutions to store excess personal data. Regulators care about whether an institution can prove that a customer meets specific criteria. They do not require organisations to hold more information than is necessary to demonstrate compliance.
Using cryptographic verification methods such as or zkTLS (zero-knowledge transport layer security), institutions can validate attributes such as account ownership or eligibility against sanctions lists without accessing or storing the underlying documents. These verification steps can be logged, audited and reproduced, which preserves regulatory integrity.
This approach also aligns with a broader shift toward data minimisation in frameworks such as GDPR, MAS guidelines, PDPA, and new requirements across the Middle East and Asia Pacific. Many regulators are now encouraging institutions to reduce the amount of identity data they retain, as unnecessary storage is increasingly viewed as a security and compliance risk.
In practical terms, privacy-preserving identity models do not reduce oversight. They strengthen it by allowing institutions to verify what is required while avoiding the long-term custodial obligations that create unnecessary risk.
