# Decentralized Identity Pseudonymity

> SKILL 55: Decentralized Identity & Pseudonymity

- Skill: `nickgallick/decentralized-identity-pseudonymity` (Agent Skill)
- Install (CLI): `npx skillmds@latest add nickgallick/decentralized-identity-pseudonymity`
- Raw SKILL.md: https://api.skillmd.com/api/skills/nickgallick/decentralized-identity-pseudonymity/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: nickgallick (https://skillmd.com/u/nickgallick)
- Updated: 2026-09-21
- Page: https://skillmd.com/skills/nickgallick/decentralized-identity-pseudonymity

---

# SKILL 55: Decentralized Identity & Pseudonymity

## Purpose
Balance crypto culture's pseudonymity with regulatory KYC/AML requirements. Design progressive identity systems that minimize friction while maintaining compliance.

## The Core Tension
- Crypto culture: users interact via wallet addresses, not legal names
- Regulatory requirement: FinCEN CDD Rule, state gambling KYC, tax reporting all require identity
- Solution: progressive KYC — more identity required as financial stakes increase

## When KYC IS Required

### Federal FinCEN Triggers
- If you're a Money Services Business (MSB): KYC/AML required on all customers
- Customer Due Diligence (CDD) Rule (31 C.F.R. §1020.210): know your customer, understand their expected transaction behavior
- If non-custodial architecture: may avoid MSB designation (see SKILL 5 — money transmission)

### Tax Reporting Triggers
- Prize winnings ≥ $600 in a calendar year: require W-9 (US person) or W-8BEN (non-US person) for 1099 filing
- Gambling winnings ≥ $1,200 (slots) / $1,500 (keno) / $5,000 (poker tournaments): W-2G required
- Crypto prizes: 1099-MISC or 1099-NEC at $600 threshold; apply regardless of payment method
- **Practical implication**: any user winning $600+ in a year needs name + SSN before you can pay them

### State Licensing Triggers
- DFS licenses (NY, NJ, etc.): age verification required at registration
- State gambling license: full KYC typically required

### OFAC Sanctions Screening
- ALL users: wallet addresses must be screened against OFAC SDN list
- Wallet screening ≠ full KYC, but it IS required regardless of KYC tier
- Tool: Chainalysis Sanctions Oracle (on-chain event), Elliptic API (off-chain, pre-transaction)

## When KYC is NOT Required
- Free-to-play: no financial transactions → no KYC requirement
- Non-custodial platform below MSB threshold: wallet address only may suffice
- Information/analysis only: no money changes hands → no KYC
- **Note**: even without formal KYC, OFAC wallet screening is always required for crypto platforms

## Progressive KYC Architecture (Recommended)

### Tier 0 — Anonymous (Wallet Only)
- Connect wallet address
- OFAC screen the wallet address
- Can: view content, browse markets, participate in free contests, earn reputation/points
- Cannot: pay entry fees, receive cash prizes

### Tier 1 — Light KYC (Email + Age Verification)
- Email address + date of birth (age verification: 18+)
- Cryptographic age proof or third-party age verification service
- Can: enter paid contests up to $100/day, receive prizes up to $600/year
- Cannot: exceed $100/day or $600/year prize threshold (triggers tax reporting)

### Tier 2 — Full KYC (Government ID + Address)
- Government-issued photo ID (passport, driver's license)
- Address verification
- Use a KYC provider: Persona, Jumio, Onfido (they handle BIPA compliance for you)
- Can: unlimited participation, all withdrawals, prize winnings >$600/year
- Required: before any prize payment that triggers 1099 reporting

### Tier 3 — Enhanced Due Diligence (EDD)
- For: politically exposed persons (PEPs), high-volume users, users flagged by OFAC screening
- Additional: source of funds verification, enhanced OFAC/sanctions screening
- Managed: on a case-by-case basis

## Right to Be Forgotten vs. Blockchain Immutability

### The GDPR Problem
- GDPR Article 17: right to erasure ("right to be forgotten")
- Blockchain transactions: permanent and immutable
- Apparent conflict: user wants data deleted, but it's on-chain forever

### The Solution (EU-Accepted Approach)
1. Store ALL PII (name, email, government ID, address) OFF-CHAIN in deletable database (Supabase)
2. Store ONLY wallet addresses ON-CHAIN
3. When user requests deletion: delete ALL off-chain PII → wallet address on-chain becomes pseudonymous (no longer linked to any identity)
4. Legal basis: GDPR Article 17 is satisfied when the LINK between on-chain data and identity is destroyed, even if on-chain data itself remains
5. EU regulators and data protection authorities have accepted pseudonymized on-chain data as satisfying erasure requirements

**Implementation**: wallet address is the on-chain identifier. The wallet-to-identity mapping lives ONLY in your off-chain database. Delete the mapping = effective erasure.

## Privacy-Preserving Compliance Tools (Advanced)
- **Zero-knowledge age proofs**: prove age is ≥18 without revealing exact birthdate or identity (Worldcoin, Polygon ID, zk-SNARK implementations)
- **zk-KYC**: prove compliance with KYC requirements using zero-knowledge proofs without revealing identity to the platform
- **Selective disclosure**: reveal only what's required (prove you're not in a sanctioned country without revealing which country you're in)
- **Status**: emerging technology, not yet battle-tested in US regulatory context; use as supplement to, not replacement for, traditional KYC

## COPPA (Under-13) Compliance
- Age verification at Tier 1 blocks under-13 users
- If a user under 13 is discovered: delete ALL their data immediately, document the deletion
- Keep record of: when the underage user was identified, when data was deleted (demonstrates good faith)

---
*This is legal research and intelligence, not legal advice. Consult qualified legal counsel before taking action.*