Enough of leaving copies of your documents scattered everywhere: how zero-knowledge technology can change KYC
Have you ever stopped to count how many times you sent a photo of your RG, your CNH, proof of address, and a selfie to open an account? Bank, fintech, brokerage, credit card, investment platform… each one asks for almost the same thing. And each one keeps a copy of your documents on its own servers.
The result is simple and worrying: your most sensitive personal data sits scattered across dozens of companies. When one of them suffers a leak — and many already have —, it is not only the email or the password that leaks. It is the documents you trusted them with. This KYC (Know Your Customer) model that demands “send everything” has become a normalized absurdity. Zero-knowledge technology (a zero-knowledge proof) offers a way to end that.
The current problem: you hand over the whole document to prove one simple thing
Today, to open an account, the institution needs to confirm a few basic facts: whether you are of legal age, whether you live in Brazil, whether your registration status is in order and, in some cases, whether your income falls within a given profile.
But instead of receiving only the confirmation of those facts, it receives the complete document. A photo of the RG with the number, date of birth, parentage, full address, sometimes even more. Those files stay stored. If the company is breached, or if an employee accesses them improperly, your data is there. And because you go through the process in several places, the same document exists in multiple copies, under the control of different companies, with varying levels of security.
What changes with zero-knowledge
Zero-knowledge technology makes it possible to prove that a statement is true without revealing the data behind it.
Instead of sending your RG to prove that you are over 18, you generate a cryptographic proof that confirms only this: “this person is of legal age”. The institution checks the proof, confirms that it is valid, and continues opening the account — without ever receiving or storing the document. The same applies to residence, registration status, income range, or any other requirement. You reveal only what is necessary, at the moment it is necessary.
In practice, this drastically reduces the amount of personal information each bank or fintech needs to keep. Less stored data means less material to leak in the event of a breach. The risk of having your documents circulating on third-party servers drops significantly.
Less repetition, more control
Another important advantage is less repetition. Today you resend almost the same documents to each new institution. With zero-knowledge proofs, the initial verification can be done once with a trusted entity. After that, you reuse selective proofs in different places, showing only what each one needs at that moment.
This does not eliminate KYC. Institutions remain required to know the customer and to comply with rules on fraud prevention and money laundering. What changes is the form: instead of collecting and storing complete documents, they receive verifiable proofs. “Send your documents” becomes “prove only what is necessary”.
The absurdity that can end
Leaving copies of your documents everywhere is not security — it is exposure. Each new account you open increases the number of places where your sensitive data exists. Zero-knowledge technology attacks exactly that point: it lets institutions do what they need (verify identity and requirements) without becoming permanent custodians of your documents.
We are still in the first steps of this transition. There are technical, regulatory, and adoption challenges. But the path is becoming clearer. In a scenario where zero-knowledge proofs become the standard, today’s model of spreading documents across dozens of servers will look as outdated as sending a copy of your RG by fax.
The goal is not to end verification. It is to end the need to hand over the whole document to prove a single fact — and, with that, to actually reduce the risk of having your personal data leaked.