UK Demands More Crypto Surveillance While KYC Systems Crumble

Just as trust in Know Your Customer (KYC) protocols hits a new low, the UK doubles down on harvesting user data—because nothing rebuilds confidence like a good old-fashioned privacy grab.

Regulators push for deeper transparency while exchanges struggle with leaks, hacks, and ’oops-we-lost-your-data’ moments. A classic case of demanding receipts after the house burns down.

Bonus jab: If banks handled security like some crypto platforms, they’d still be blaming ’user error’ for the 2008 crash.

Protecting consumers

Authorities say the MOVE is about protecting consumers and creating a more robust regulatory environment. But it’s also clearly aimed at closing tax loopholes and keeping pace with broader global standards, including the European MiCA regulation. As HMRC put it, firms should start preparing now — not in 2026 — to avoid a last-minute scramble.

Mark Aruliah, head of EMEA policy at blockchain analytics firm Elliptic, said in a commentary for crypto.news that the move is an “expected next step” for an industry maturing toward parity with traditional finance.

“Reporting of personal transaction data has historically been a challenge for the industry and for consumers. This clarity on legal obligations to reporting will help and also the growth of new reporting services.”

Mark Aruliah

While Aruliah acknowledged the potential burden on smaller startups, he said the push toward transparency was not only necessary but overdue.

“Any regulation is generally regarded as an additional cost burden to the industry but that has to be balanced against the benefits that it provides. Therefore, it may be that smaller firms are impacted disproportionately based purely on costs (i.e. due to their size and profits), but nevertheless, these obligations are an expected next step and simply look to match the general reporting obligations in the tradfi space.”

Mark Aruliah

But for many critics, the bigger question is not about collecting data. It’s about keeping it safe.

Great responsibility

That concern came into sharp focus as cryptocurrency exchange Coinbase recently confirmed a breach involving customer data. According to the U.S.-based crypto exchange, contractors working for Coinbase overseas were bribed by attackers who gained access to sensitive customer information.

That included names, emails, phone numbers, addresses, and in some cases, partial Social Security numbers. Some users have even reported that ID documents like passports and driver’s licenses were exposed.

Coinbase said the breach affected less than 1% of its user base, though with nearly 9 million monthly active users, even that sliver represents a significant population. Worse still, it’s exactly the kind of personal data the U.K. now wants firms to collect and verify — and the breach raises urgent questions about whether crypto companies are equipped to handle such responsibility.

While Coinbase claims its internal systems caught the breach quickly, blockchain investigator ZachXBT has said signs of trouble were visible much earlier. Back in February, he flagged a string of scams tied to Coinbase’s infrastructure, including one victim who lost $850,000 after being duped by a fake Coinbase support agent.

If the U.K.’s CARF-aligned rules were already in force, the firm could be staring down millions in fines, not to mention reputational damage that’s harder to quantify. Still, the juxtaposition is hard to ignore: the U.K. is telling crypto firms to hoard personal data, just as one of the world’s largest exchanges admits it failed to keep such data safe.