KYC has zero to do with information security, and there's a legitimate argument that much of the regulation is anti-competitive regulatory capture with the primary goal of preventing new entrants in the market, with "security" being a secondary concern.