The Onchain Brief is here| Subscribe to our monthly newsletter

FAQs

Compliance, Identity & Regulation

What institutions need to know as onchain finance meets regulatory requirements.

Digital Identity & Credentialing

Digital identity refers to the set of attributes, credentials, and claims that represent an individual, organization, or device in a digital environment. In traditional systems, digital identity is managed by centralized authorities, governments, banks, or technology platforms, that issue and verify credentials on behalf of users. In onchain systems, digital identity can be managed through cryptographic mechanisms that give individuals greater control over their own identity data, enabling them to share credentials selectively without relying on a central authority to mediate every interaction.
Digital identity is a foundational requirement for onchain financial systems that must comply with regulatory obligations around customer verification, AML screening, and investor eligibility. Without reliable identity infrastructure, financial institutions cannot satisfy KYC requirements for onchain transactions, enforce access controls on tokenized asset programs, or demonstrate regulatory compliance to supervisory authorities. As traditional finance moves onchain, robust digital identity infrastructure is increasingly recognized as a prerequisite for institutional adoption at scale.
Self-sovereign identity (SSI) is a model of digital identity in which individuals control their own identity data and credentials without relying on a centralized issuer or identity provider. Rather than storing identity information in a central database controlled by a government or corporation, SSI systems allow individuals to hold their own credentials in a personal digital wallet and share them selectively with verifying parties. Blockchain technology plays a key role in many SSI implementations, providing a blockchain-based registry for identity-related data that no single party controls.
Authentication is the process of verifying that a party is who they claim to be, confirming identity. Authorization is the process of determining what an authenticated party is permitted to do, confirming access rights. In onchain systems, authentication is typically handled through cryptographic signatures using private keys, while authorization is enforced through smart contract access control logic. Both are critical components of a secure onchain identity and access management system, and weaknesses in either can create significant security risks.
Verifiable credentials (VCs) are a standardized format for expressing digital credentials in a way that can be cryptographically verified by any party, without requiring direct communication with the original issuer. A verifiable credential might represent a government-issued identity document, a professional qualification, an accredited investor status, or any other claim about its holder. The W3C Verifiable Credentials standard defines the data model and verification mechanisms for VCs, enabling interoperable credential exchange across different systems and platforms.
Decentralized identifiers (DIDs) are a type of globally unique identifier that enables verifiable, self-sovereign digital identity. Unlike conventional identifiers such as email addresses or usernames, which are issued and controlled by a central authority, DIDs are created and controlled by their subjects, with the associated cryptographic key material recorded in a blockchain-based registry. DIDs are a foundational component of many SSI and verifiable credential systems, providing a persistent, cryptographically verifiable identifier that does not depend on any central authority to function.
DIDs and verifiable credentials are complementary components of a self-sovereign identity system. A DID provides a persistent, cryptographically controlled identifier for an individual or organization. Verifiable credentials use that identifier as the subject of claims, for example, a government might issue a verifiable credential asserting that the holder of a specific DID is a verified citizen. When the holder presents this credential to a third party, the verifier can confirm its authenticity cryptographically using the issuer's DID, without contacting the issuer directly. This architecture enables privacy-preserving, interoperable identity verification at scale.
Zero knowledge proofs can significantly enhance the privacy properties of digital identity systems by enabling credential holders to prove specific claims about themselves without revealing the underlying data. For example, a user could use a ZKP to prove that they are over 18, that they are an accredited investor, or that they have passed a KYC check, without disclosing their name, date of birth, or other personal information to the verifying party. This capability is particularly valuable for financial institutions that must verify customer eligibility while minimizing the collection and exposure of sensitive personal data.
KYC and AML requirements can be integrated into onchain systems through several mechanisms. One approach involves whitelisting verified addresses, where a regulated entity verifies a user's identity offchain and records their wallet address in an onchain registry that smart contracts can check before permitting transactions. Another approach uses onchain credentials or attestations, where a verified identity is represented as a token or verifiable credential that the holder can present to access regulated onchain services. More advanced implementations use zero knowledge proofs to verify compliance attributes without exposing underlying identity data onchain.
An onchain attestation is a cryptographically signed statement recorded on a blockchain that asserts a claim about an address or entity, such as that the holder has passed a KYC check, holds a professional qualification, or meets a specific eligibility criterion. Attestations can be issued by trusted third parties such as regulated financial institutions, identity providers, or government agencies, and verified by smart contracts without requiring the underlying identity data to be stored onchain. Attestation frameworks are an increasingly important component of compliant onchain financial infrastructure.
The Ethereum Attestation Service (EAS) is an open-source infrastructure protocol for making and verifying onchain and offchain attestations on Ethereum and EVM-compatible networks. EAS provides a standardized, composable framework for any entity to issue attestations about any subject, enabling a wide range of identity, reputation, and compliance use cases to be built on a common infrastructure layer. For financial institutions building compliant onchain systems, EAS and similar attestation frameworks provide a flexible foundation for integrating identity verification into smart contract logic.
Financial institutions are exploring onchain identity infrastructure for a range of use cases. These include integrating KYC verification into tokenized asset programs to enforce investor eligibility restrictions, using onchain attestations to streamline compliance checks across multiple products and counterparties, and building portable identity credentials that reduce the friction of repeated verification for known customers. Onchain identity infrastructure also supports the development of compliant DeFi products that can be accessed by institutional investors subject to regulatory requirements.
A permissioned blockchain is a blockchain network where participation, whether as a validator, transaction submitter, or smart contract deployer, is restricted to authorized parties. Permissioned blockchains are used by some financial institutions as a way to maintain regulatory control over who can participate in onchain financial activities, integrating identity verification at the network access layer. Public blockchains can achieve similar outcomes through onchain identity and access control mechanisms, allowing permissioned behavior to be enforced at the application layer without restricting access to the underlying network.
One of the most significant potential applications of onchain identity infrastructure is in cross-border financial transactions, where the cost and friction of verifying customer identity across different jurisdictions and regulatory frameworks is a major operational challenge. Portable, cryptographically verifiable identity credentials could allow financial institutions to recognize KYC verification performed by a trusted counterpart in another jurisdiction, reducing duplicative verification while maintaining regulatory compliance. The development of interoperable identity standards is a key enabler of this vision.
Onchain identity systems introduce several security risks that must be carefully managed. Private key compromise is particularly consequential in identity systems, as the loss or theft of a key controlling a DID or identity wallet can allow an attacker to impersonate the legitimate holder. Smart contract vulnerabilities in identity registries, attestation systems, or access control logic can allow unauthorized modification of identity records or bypass of verification checks. Oracle risks arise where offchain identity verification results are fed onchain, creating a potential manipulation point. And privacy risks emerge if identity data is stored or exposed onchain in ways that allow sensitive personal information to be inferred or accessed.
Private key compromise in an identity system can be as damaging as the loss of financial assets, as it can allow an attacker to assume a verified identity and access systems or assets that depend on that identity. Key management best practices for identity systems follow the same principles as for financial key management: using hardware security modules or secure enclaves for key storage, implementing multi-party authorization for sensitive identity operations, establishing clear recovery procedures for lost or compromised keys, and minimizing the number of systems and individuals with access to key material. For institutional identity systems managing access to significant financial infrastructure, these controls are not optional.
Public blockchains are transparent by design, meaning that any data recorded onchain is potentially visible to anyone. This creates significant privacy risks for identity systems that store personal or sensitive information onchain. Best practices for privacy-preserving onchain identity include storing only cryptographic commitments or hashes onchain rather than raw identity data, using zero knowledge proofs to verify claims without revealing underlying information, and leveraging offchain credential storage with onchain verification. Careful system design that minimizes onchain data exposure while maintaining verifiability is essential for identity systems deployed in regulated financial contexts.

Digital Asset Regulation

Regulation provides the legal clarity and institutional trust that financial markets require to function at scale. For the blockchain ecosystem, regulatory frameworks establish the rules governing how digital assets are issued, traded, and custodied; how consumer and investor protections apply; and how participants must manage risks such as money laundering and market manipulation. As traditional finance moves onchain, regulatory alignment is increasingly a prerequisite for institutional adoption, making it a central consideration for any organization building onchain financial infrastructure.
Digital assets present regulators with a range of novel challenges. Their technical properties, programmability, pseudonymity, cross-border transferability, and the ability to combine characteristics of multiple asset classes, do not map neatly onto existing regulatory categories. A single digital asset may simultaneously exhibit characteristics of a security, a commodity, a currency, and a payment instrument, creating jurisdictional overlap and regulatory uncertainty. The pace of innovation in the space also means that regulatory frameworks are frequently playing catch-up with new asset types, protocols, and market structures.
The classification of digital assets under US law remains an area of ongoing legal and regulatory development. The primary question is whether a given digital asset constitutes a security under federal securities law, which would bring it under the jurisdiction of the Securities and Exchange Commission (SEC). The Howey Test, a longstanding legal standard for determining whether an instrument is an investment contract and therefore a security, has been applied to digital assets with varying results. Assets that do not meet the definition of a security may fall under the jurisdiction of the Commodity Futures Trading Commission (CFTC) as commodities, or be treated as currencies or payment instruments under other frameworks. The classification of any specific asset depends on its particular characteristics and the context in which it is offered.
The Securities and Exchange Commission has asserted jurisdiction over digital assets that meet the definition of securities under federal law. This includes oversight of digital asset issuances that qualify as securities offerings, trading platforms that facilitate securities transactions, and investment vehicles that hold digital assets as securities. The SEC has been an active enforcement presence in the digital assets space, bringing actions against issuers, exchanges, and other market participants it alleges have violated securities laws. The SEC's approach to digital asset regulation continues to evolve through rulemaking, guidance, and enforcement actions.
The Commodity Futures Trading Commission has jurisdiction over digital assets classified as commodities, including oversight of derivatives markets such as futures and options contracts on those assets. The CFTC has generally taken the position that certain major digital assets, including Bitcoin and Ether, are commodities. The CFTC also has anti-fraud and anti-manipulation authority in spot markets for commodity digital assets. As legislation defining the boundaries between SEC and CFTC jurisdiction over digital assets continues to develop, the CFTC's role in the regulatory landscape is expected to become more clearly defined.
US banking regulators, including the Office of the Comptroller of the Currency (OCC), the Federal Reserve, and the Federal Deposit Insurance Corporation (FDIC), have each issued guidance on how national banks and other regulated depository institutions may engage with digital assets. Areas addressed include digital asset custody, participation in blockchain networks, and the issuance of stablecoins. The regulatory posture of banking regulators toward digital assets has evolved over time and continues to develop as institutions seek greater clarity on permissible activities.
Stablecoin regulation in the United States has been a subject of significant legislative and regulatory activity. At a high level, the regulatory debate centers on questions of reserve requirements, issuer licensing, consumer protection, and systemic risk. Various proposals have sought to establish a framework for the issuance of payment stablecoins, with different approaches to whether issuers should be required to hold bank charters, what assets may back stablecoin reserves, and how redemption rights should be protected. The regulatory framework for stablecoins in the US continues to develop, and organizations issuing or integrating stablecoins should monitor legislative and regulatory developments closely.
The regulatory treatment of tokenized real-world assets in the US depends primarily on the nature of the underlying asset and the structure of the tokenization. Tokenized securities are generally subject to the same securities laws as their traditional equivalents, including registration or exemption requirements for issuances and broker-dealer requirements for secondary trading. Tokenized commodities may fall under CFTC jurisdiction. The application of existing regulatory frameworks to tokenized assets is an area of active engagement between market participants and regulators, with guidance and rulemaking continuing to develop.
The regulatory treatment of DeFi protocols in the US is one of the most actively debated questions in digital asset regulation. Regulators have grappled with how existing frameworks apply to protocols that operate through autonomous smart contracts without a central operator. Questions under active consideration include whether DeFi protocols constitute exchanges or broker-dealers subject to SEC or CFTC registration requirements, how AML and KYC obligations apply to permissionless onchain systems, and what liability attaches to developers, governance token holders, and other participants in DeFi ecosystems. The regulatory landscape for DeFi is evolving rapidly and remains an area of significant uncertainty.
The Markets in Crypto-Assets (MiCA) regulation is a comprehensive regulatory framework for digital assets adopted by the European Union. MiCA establishes harmonized rules across EU member states governing the issuance and trading of crypto-assets, the licensing of crypto-asset service providers, and requirements for stablecoin issuers. MiCA represents one of the most comprehensive regulatory frameworks for digital assets enacted to date and is closely watched by regulators and market participants globally as a potential model for other jurisdictions. For financial institutions with operations in the EU, MiCA compliance is a practical requirement for participating in European digital asset markets.
Beyond the US and EU, several other major financial jurisdictions have developed or are developing regulatory frameworks for digital assets. The United Kingdom has established a regulatory regime for cryptoasset businesses under the Financial Conduct Authority (FCA), with further legislation in development. Singapore's Monetary Authority (MAS) has implemented a licensing framework for digital payment token service providers. Hong Kong has introduced a regulatory framework for virtual asset service providers under the Securities and Futures Commission (SFC). Japan has one of the longest-established regulatory frameworks for digital assets, having recognized Bitcoin as legal tender in 2017\. Each jurisdiction takes a distinct approach, reflecting different policy priorities and financial market structures.
 Regulatory arbitrage refers to the practice of structuring activities to take advantage of more favorable regulatory treatment in a particular jurisdiction. In the digital assets space, the significant variation in regulatory frameworks across jurisdictions has created opportunities for market participants to operate from jurisdictions with lighter regulatory requirements. Regulators globally are increasingly aware of this dynamic and are working toward greater international coordination on digital asset regulation, recognizing that inconsistent frameworks can create risks for consumers, market integrity, and financial stability. 
For financial institutions operating onchain, regulatory compliance and security are deeply interconnected. Regulatory frameworks typically impose requirements around risk management, operational resilience, and the protection of client assets that translate directly into security obligations for onchain systems. Demonstrating compliance with these requirements requires not only sound security practices but also the documentation and auditability that formal security assessments provide. As regulatory scrutiny of onchain financial infrastructure increases, institutional-grade security is increasingly a prerequisite for regulatory approval as well as a risk management imperative.
OpenZeppelin supports financial institutions building regulatory-compliant onchain infrastructure by providing the security foundation that regulators and institutional risk frameworks require. This includes comprehensive smart contract audits that provide documented evidence of security assessment, infrastructure reviews that address operational resilience requirements, and ongoing monitoring capabilities that support the continuous oversight obligations that regulated institutions face. OpenZeppelin's neutral partner model and deep experience working with both financial institutions and crypto-native projects makes it well-positioned to help organizations meet the security standards that regulatory compliance demands.

This page is general information about OpenZeppelin, onchain security, and onchain financial system. For educational purposes only, not financial, investment, legal, tax, or regulatory advice. Consult your own qualified advisors before making decisions.