Nick Szabo  🔑

Not sure what is so surprising about this?

Put it this way: for which businesses in the crypto space who KYC/AML' their customers do you have strong expectation that they are not and never will share such information? Why do you have such expectations?

I think a reasonable person would expect information to not be shared other than as disclosed a-priori, and as required to conduct business. And for external access: for reasonable efforts to screen requests for legal authority and rationale for access.

They are legally required to collect it because they are legally required *to* share it. If they didn't have to share it there would be no point in collecting it, it's a huge hassle and liability for all concerned.

Once they have collected the legally required info it's very useful or them, and extremely easy (indeed hard to avoid) to share it with their contractors, who share it in turn, etc., and it's soon out of control, regardless of what money changed hands.