In the United Kingdom we are about to ask a hundred random people to design our national digital identity scheme. Seriously. Invitations went out to 36,000 UK addresses (mine wasn’t one of them) asking recipients to comment on “How should we design a Digital ID system for the UK?”. Of those who respond, the government will choose (via some opaque process) somewhere between 100 and 120 of them to come to central Birmingham for a couple of weekend sessions (plus some Zoom sessions in the week). The government says that those chosen will represent “a cross-section of the UK population”. Who knows what they will come up with.
Meanwhile, in advanced nations, life goes on. China has just announced that robots will be getting digital identities and launched the Humanoid Full Lifecycle Management Service Platform to manage them. The identities will be used to track the robots from assembly through to recycling in a programme led by the Humanoid Robotics and Embodied Intelligence Standardization (HEIS) committee, part of the country’s Ministry of Industry and Information Technology.
That fact is that the demands of the economy mean that digital identities not only for people but for businesses and bots are a priority, a foundational layer for not only the economy but for a safe and secure society. If we want economic growth, we have get this layer in place.
Noelle Acheson, who knows her onions* when it comes to real-world markets, says “It’s unlikely a tokenized share in Palantir will be able to ‘seamlessly’ plug into a Russian DeFi application, for instance, or any DeFi application that has no KYC unless we finally sort out the onchain identity issue”. I am a big believer in digital assets and tokens and next-generation financial market infrastructure (FMI) and all that jazz but Noelle is right.
In the Bank for International Settlement (BIS) white paper on the topic of next generation FMI, they themselves frame digital identity as a fundamental platform on which the financial internet (that is, the “finternet”) needs. Until there is a working identity infrastruture in place, the finternet cannot happen.
Now, that identity infrastructure does not need to a global ID solution used for everything or network of national IDs or anything like it. It might well be an identity infrastructure solely for financial services. Some kind of financial services passport, for want of a better term. I think that one way we can make some progress is by focusing on a practical solution here rather than try to boil the ocean and solve the entire world’s superset of (wholly different) identity problems.
What if financial instutitions got together to solve this problem for themselves?
It is a fairly straightforward idea, after all. The first time you come into contact with the financial system, you are KYCd, AMLd, CTFd and PEPd up the wazoo: folded, spindled and mutilated until you are a certified player, at which point you would be issued with a financial services passport that you can use to visit other institutions, accountants, lawyers and so on. Then, instead of sending your personally-identifiable information with a transaction, you need only send a pointer to the passport (a public key, in essence). There will be a visa to the land of (eg) Barclays stamped inside the passport (a verifiable credential, in essence) which testifies to your certified playerness. You can show this visa to anyone: they can’t copy it our counterfeit it because they do not have access the private key, which is locked away in secure hardware somewhere.
In one of their reports last year, McKinsey said that what they label “credentialling and identity” is the first of their key control points in the agentic economy becaue agents need secure, user-granted permission before they can initiate transactions across multiple institutions. Indeed they do and therefore, organisations that already manage high-trust credentials start with a clear advantage. They go on to highlight some success factors: zero-trust architectures that never assume persistent access, dynamic consent via standardized protocols (for example, OAuth2/OpenID Connect) and continuous audit trails.
All of these ought to be
* I deliberately used onions here, rather than apples or SEC rules, because the trading of onion futures in the US is illegal, a fact that to my mind at least highlights just why markets are not just about technology.