BitPay -- KYC is here!

[squatter]

I made a BitPay merchant payment just now. Before I could reach the invoice, the following prompt popped up:



As I had feared, KYC is coming to BitPay. I'm not sure if this is a direct response to the FATF travel rule or not, but it's certainly possible. It looks like they're getting ready for full compliance.

Most payments won't trigger KYC yet. For now, these are the thresholds:

We are introducing a new identity verification flow for purchasers requesting refunds of $1,000 or more*1, for people receiving BitPay payouts, or for purchasers paying $3,000*1 or more to BitPay merchants (or loading via a BitPay prepaid product).

1 These thresholds for high-value verified payments, refunds, and payouts are subject to change, and we will announce any changes to BitPay Dashboard users.

When national laws are passed to incorporate the FATF travel rule, we might see that $3,000 threshold lowered to $1,000. I also wonder if they'll be aggregating multiple purchases together over time to trigger the threshold. If that happens, no more using the BitPay wallet to buy Amazon gift cards. Off to Bitrefill in that case.

[1715287852]

1715287852

[1715287852]

1715287852

[joniboini]

Did they ever allow a user without KYC before?

Any centralized solution will probably require KYC sooner or later. Can't blame them, they can't run away and move from one country to another like Binance to avoid complying with regulations. They already told us what their stance to compliance is: https://blog.bitpay.com/is-it-safe-to-accept-bitcoin/

[figmentofmyass]

Did they ever allow a user without KYC before?

not sure about merchants, but purchasers have never had to complete KYC before. spending on goods and services was never seen as money transmission before so it didn't seem to imply AML/KYC requirements. the FATF rules seem to have changed things for the worse.

leave it to bitpay to comply before any countries have even passed laws to enforce the FATF rules yet.

[malevolent]

Did they ever allow a user without KYC before?

not sure about merchants, but purchasers have never had to complete KYC before. spending on goods and services was never seen as money transmission before so it didn't seem to imply AML/KYC requirements. the FATF rules seem to have changed things for the worse.

leave it to bitpay to comply before any countries have even passed laws to enforce the FATF rules yet.

It also says the numbers are subject to change. In time every transaction above $100 will require KYC, and they can sort of afford to do it with their market share, I think.

I was asked to go through KYC once when trying to buy computer hardware with a card (long time ago), but that was in a foreign country when the store was suspicious that the card may have been stolen, but this is something new, even a single Macbook can be above the $3k threshold.

Anyone know how long do they store the users' KYC info?

[sowns]

.
Anyone know how long do they store the users' KYC info?

Their faq doesn’t say how long they keep the info but you can request that they destroy it if you don’t want them to hold it for long.

[eternalgloom]

Did they ever allow a user without KYC before?

not sure about merchants, but purchasers have never had to complete KYC before. spending on goods and services was never seen as money transmission before so it didn't seem to imply AML/KYC requirements. the FATF rules seem to have changed things for the worse.

leave it to bitpay to comply before any countries have even passed laws to enforce the FATF rules yet.

It also says the numbers are subject to change. In time every transaction above $100 will require KYC, and they can sort of afford to do it with their market share, I think.

I was asked to go through KYC once when trying to buy computer hardware with a card (long time ago), but that was in a foreign country when the store was suspicious that the card may have been stolen, but this is something new, even a single Macbook can be above the $3k threshold.

Anyone know how long do they store the users' KYC info?

Oh damn, I hope that will not happen. I really do not trust any of these companies to handle my data securely.
This is how your personal information end up for sale on some darknet marketplace. It's only a matter of time and chances increase every time you send over your documents.

Why can't they just set the threshol at, say, 5K USD and leave it at that?

[mk4]

Yikes. As if BitPay wasn't bad enough with them not providing wallet addresses to send the payments to(yes I know there are tools for this but it's tedious as heck). If they go through with this even with a minimum of $1000 for the KYC, honestly why bother using BitPay. I'd rather go with PayPal instead if there's going to be an account required anyway. I assume it's just going to get worse from here.

[GreatArkansas]

Maybe this is also the reason why one of the famous sources for Bitcoin news leaves Bitpay and switched to OpenNode.



A lot of users also too complained about Bitpay. It's time to move on with Bitpay, there are some much better payment provider services especially those accepting also Bitcoin lightning payments. This could be a big negative impact on the side of Bitpay, a lot of people already leaving Bitpay.
What is BitPay ID verification? What documents are accepted? - On their KYC, they are using a third-party company (Onfido) to process the KYC of Bitpay's users, it's still useless.

[timerland]

Jesus. Another one bites the dust of rules and regulations then, it looks in the years that crypto is being recognized and more mainstream, governments and companies are often forced to be much more strict, especially when it's related to KYC and money laundering issues.

I believe they allowed businesses to operate without KYC, I personally did a couple of large transactions via their service provider and had no issues.

Have there been any actual rules made, or are they just jumping the gun here? I'm not fully familiar on money laundering rules, but I don't think they were this strict.

[LeGaulois]

It's just matter of time before people are forced to use non-centralized solution or give up on their privacy/control over their coin.

They will keep using centralized services. The mass doesn't care about its privacy, and the majority thinks KYC is a good thing for the ecosystem. They're very happy to give personal information, as long they see their money in their bank (or get what they wanted).

Jesus. Another one bites the dust of rules and regulations then, it looks in the years that crypto is being recognized and more mainstream, governments and companies are often forced to be much more strict, especially when it's related to KYC and money laundering issues.

People consider cryptos as investments, so governments follow the logic and treat it as it is. It was expected. I know in some years people will regret advocating regulations

[dothebeats]

.
Anyone know how long do they store the users' KYC info?

Their faq doesn’t say how long they keep the info but you can request that they destroy it if you don’t want them to hold it for long.

I am not even sure whether they will really destroy the said KYC data after everything is processed and verified. You know, private companies, especially big firms with huge market shares do not really do what they tell the customers, and so I'm still not certain as to whether Bitpay would really delete the data after all. And yeah, this is already expected from a service based in the US for full compliance. They really are choking the mainstream players and making the playing field uneven. If all things fail, btcpay and OpenNode aree still free from the constraints of KYC in the mean time.

[malevolent]

Have there been any actual rules made, or are they just jumping the gun here? I'm not fully familiar on money laundering rules, but I don't think they were this strict.

They might have decided to introduce these restrictions to appease the legacy fiat institutions they cooperate with to send merchants fiat currencies. I could be wrong but that's the first thing that comes to mind, especially considering the country they're incorporated in.

[squatter]

Have there been any actual rules made, or are they just jumping the gun here? I'm not fully familiar on money laundering rules, but I don't think they were this strict.

They might have decided to introduce these restrictions to appease the legacy fiat institutions they cooperate with to send merchants fiat currencies. I could be wrong but that's the first thing that comes to mind, especially considering the country they're incorporated in.

I'm only guessing, but I think they're just trying to make a smooth transition to KYC because they see the writing on the wall regarding the FATF travel rule. They're getting customers used to the idea now, knowing that it won't be popular. The first step is establishing an account/membership system, and naturally they are painting this as a good thing: "Get access to new BitPay payment features!"

If customers start seeing this today, they won't be surprised when thresholds are lowered in a year and they are forced to make an account. There's no legal basis yet, so they're starting out with higher thresholds while they still have time. It's virtually guaranteed that those thresholds will be significantly reduced as FATF-compliant laws start being passed.

[1Referee]

I am not even sure whether they will really destroy the said KYC data after everything is processed and verified. You know, private companies, especially big firms with huge market shares do not really do what they tell the customers, and so I'm still not certain as to whether Bitpay would really delete the data after all.

Once you have KYC verified yourself, you should assume that your information is stored on X Y Z servers for ever. I would never take the word of a company (regardless of how established they are) serious when they tell me that they have deleted most of the sensitive information they have about me.

Even if they did truly delete your data, who says they haven't been hacked? Or that an employee copied their database and use it to extort them at a later stage through a proxy? I rather be paranoid than too comfortable in times where crazy things are happening with people's information. Crypto as a whole is too immature and unprofessional to take serious.

[PrimeNumber7]

I also wonder if they'll be aggregating multiple purchases together over time to trigger the threshold.

This is almost certainly never going to happen.

The process for confirming KYC information is to verify the information prior to the transaction being initiated, so they will have no way of knowing if your history meets the threshold to require them to have verified your KYC information.

I strongly suspect that they are under scrutiny from various regulators being the largest bitcoin payment processor, and this change is probably to appease a regulator somewhere.

[figmentofmyass]

I also wonder if they'll be aggregating multiple purchases together over time to trigger the threshold.

This is almost certainly never going to happen.

The process for confirming KYC information is to verify the information prior to the transaction being initiated, so they will have no way of knowing if your history meets the threshold to require them to have verified your KYC information.

they will via account login. this "continue as guest" button won't be around forever. i'm sure having an account will be mandatory at some point. so you'd have to juggle multiple accounts with VPN and hope to dodge their algorithms for triggering KYC or detecting multi-accounters, which would probably work at least for a time. but they will also be clocking users with other conventional analysis to mitigate compliance risk: exchanging customer information with merchants, logging IP addresses, browser analysis, all manner of other leaked PII.

it's not like they need to prove anything beyond a reasonable doubt. it's the opposite. they will just have various forms of risk analysis to cut off risky customers who seem to be dodging their terms. multi-accounting will definitely be against their terms once accounts are mandatory.

will it be possible to get around this? sure, with some common sense and effort. but most people are sheep and will just voluntarily give up their KYC.

[PrimeNumber7]

I also wonder if they'll be aggregating multiple purchases together over time to trigger the threshold.

This is almost certainly never going to happen.

The process for confirming KYC information is to verify the information prior to the transaction being initiated, so they will have no way of knowing if your history meets the threshold to require them to have verified your KYC information.

they will via account login. this "continue as guest" button won't be around forever. i'm sure having an account will be mandatory at some point. so you'd have to juggle multiple accounts with VPN and hope to dodge their algorithms for triggering KYC or detecting multi-accounters, which would probably work at least for a time. but they will also be clocking users with other conventional analysis to mitigate compliance risk: exchanging customer information with merchants, logging IP addresses, browser analysis, all manner of other leaked PII.

it's not like they need to prove anything beyond a reasonable doubt. it's the opposite. they will just have various forms of risk analysis to cut off risky customers who seem to be dodging their terms. multi-accounting will definitely be against their terms once accounts are mandatory.

will it be possible to get around this? sure, with some common sense and effort. but most people are sheep and will just voluntarily give up their KYC.

My understanding is the prompt will only appear if the transaction size exceeds the threshold mandating KYC collection. I understand you can create an account that holds your KYC information so all you need to do is login to proceed with the transaction and the continue as a guest button will allow you to enter your KYC information on a one time basis— I don’t think using this button will allow you to bypass KYC.

BitPay will only collect KYC information to the extent that they have to. Every time they collect KYC, they might not be able to close the sale which means less revenue for them. You might be correct in that customers may eventually have to create an account to buy anything from a merchant using BitPay, but they have given no indication this is coming. I don’t see any real advantage to requiring customers create an account, except for compliance with regulations, so I don’t see them forcing users to create an account until their regulators strong arm them to.

[figmentofmyass]

My understanding is the prompt will only appear if the transaction size exceeds the threshold mandating KYC collection. I understand you can create an account that holds your KYC information so all you need to do is login to proceed with the transaction and the continue as a guest button will allow you to enter your KYC information on a one time basis— I don’t think using this button will allow you to bypass KYC.

of course it won't. that's not what i suggested. i said they will probably mandate accounts eventually and remove the option to transact as a guest. you can't KYC as a guest anyway---if the threshold is triggered, you need to create an account. bitpay says this is a one-time verification which implies it must be linked to an account.

BitPay will only collect KYC information to the extent that they have to.

maybe, but that's a slippery statement. i mean, why are they enforcing KYC for using bitpay's payouts API in any amount? the FATF travel rule doesn't require that and to boot, virtually no law in the world does.

bitpay is obviously terrified of regulators and are highly likely to go above and beyond their perceived obligations. in fact, they already have. i think it's crazy to assume they won't lower the current KYC thresholds or combine multiple orders in your account history to trigger it. their biggest priority is covering their ass legally---that's a much bigger priority than minimizing KYC.

i remember people used to think shapeshift would never bend over for regulators. then overnight one day, we had mandatory accounts and KYC.

[PrimeNumber7]

My understanding is the prompt will only appear if the transaction size exceeds the threshold mandating KYC collection. I understand you can create an account that holds your KYC information so all you need to do is login to proceed with the transaction and the continue as a guest button will allow you to enter your KYC information on a one time basis— I don’t think using this button will allow you to bypass KYC.

of course it won't. that's not what i suggested. i said they will probably mandate accounts eventually and remove the option to transact as a guest. you can't KYC as a guest anyway---if the threshold is triggered, you need to create an account. bitpay says this is a one-time verification which implies it must be linked to an account.

I just tried to complete a purchase on bitpay above the threshold, and you are correct, you do not have the option to continue as a guest, and must create an account to complete KYC.

BitPay will only collect KYC information to the extent that they have to.

maybe, but that's a slippery statement.
[/quote]There are plenty of competitors to BitPay. No one wants to show ID to buy a $50 walmart gift card, and if they are forced to do so, they probably will not buy from the merchant using BitPay as a payment processor, so the merchant will switch to a competitor if this happens.

[AdolfinWolf]

Even if they did truly delete your data, who says they haven't been hacked? Or that an employee copied their database and use it to extort them at a later stage through a proxy? I rather be paranoid than too comfortable in times where crazy things are happening with people's information. Crypto as a whole is too immature and unprofessional to take serious.

This.

The entire concept of KYC in crypto is completely ridiculous when there are billion dollar banks and EMIs who don't even have access to goverment databases, (as far as i'm aware. I think equifax is the exception here.)

Yet, i should be eager to share my passport and thus very identifying information that could be misused in dozens of different ways to a *shitty* crypto startup, (for which if things go south, no one will take real responsibility.) which probably hired some junior CS student to check them, for a payment that is way less than a second-hand car.

i remember people used to think shapeshift would never bend over for regulators. then overnight one day, we had mandatory accounts and KYC.

Worse yet, analyzing their traffic it doesn't look like it hurt them that much. https://www.alexa.com/siteinfo/shapeshift.io - https://www.similarweb.com/website/shapeshift.io

If we let KYC become salonfähig for companies, instead of boycotting those who implement it, they'll probably all start implementing it. Looks like that's already happening/happend.