A ZK-KYC (Zero-Knowledge Know Your Customer) system lets you prove facts about yourself — "I'm over 18," "I'm a citizen," "I'm not on a sanctions list" — without revealing the underlying personal data. It's the cryptographic equivalent of a bartender who only needs to see a green checkmark "Age ≥ 18 ✓" on your phone, instead of your whole ID card with name, address, and birth date.
One sentence: ZK proofs let you convince a verifier that a statement is true (age ≥ 18) without exposing the secret inputs (your birth date) — the verifier learns only that the statement is true, nothing else.
If you've wondered zk kyc là gì, how kyc không lộ dữ liệu works technically, or why zk proof kyc is the missing piece for Vietnam's VNeID and ND 13/2023 digital identity push — this article breaks it down with the "bartender" analogy that makes it click.
Figure 1: The Bartender Analogy — Traditional KYC reveals everything; ZK-KYC reveals only the verified claim
The Problem: KYC Today Is Oversharing
Every time you sign up for an exchange, open a bank account, or join a regulated platform, you go through KYC:
- Upload ID card / passport (name, birth date, address, ID number, photo)
- Selfie + liveness check (prove you're the person in the photo)
- Wait for manual/auto review (minutes to days)
- Your data sits in their database (name, DOB, address, ID number, biometrics)
Problems with this model:
- Privacy leak: You reveal everything to prove one thing (age, citizenship, not-sanctioned)
- Honeypot risk: Centralized databases are breach targets (millions of IDs leaked yearly)
- User friction: Repeated KYC for every platform; no portability
- Over-collection: Services collect more data than they need "just in case"
What ZK-KYC Actually Is
ZK-KYC = Zero-Knowledge Proof + KYC workflow.
Instead of sending your birth date to the verifier, you send a ZK proof that says:
"I know a birth date such that (current_date - birth_date) ≥ 18 years, and this birth date matches the one signed by the Government Issuer in my Verifiable Credential. Here's the proof."
The verifier checks the proof. Valid = you're 18+. Invalid = you're not (or proof is fake). The verifier never sees your birth date.
The Core Components
| Component | Role |
|---|---|
| Issuer (Govt / trusted authority) | Issues Verifiable Credential (VC) — signed attestation: "This person was born on 1995-06-15" |
| Holder (User) | Stores VC in wallet (phone). Generates ZK proof from VC when needed. |
| Verifier (Service / Bar / Exchange) | Receives ZK proof, checks validity. Learns only the proven claim. |
| ZK Circuit | The "rules" encoded in arithmetic: current_date - birth_date ≥ 18*365 |
How It Works: Step by Step
- Issuance: Government issues you a Verifiable Credential (VC) — a tamper-proof digital credential (W3C standard) containing your birth date, signed with their private key. Stored in your VNeID wallet.
- Proving: You want to buy age-restricted goods. Service requests "Proof of age ≥ 18." Your wallet:
1 (true) + ZK proof (cryptographic receipt)
- Verification: Service receives
(claim: "age ≥ 18", proof). Verifier contract/algorithm checks:
- Result: Service grants access. Your birth date never left your device.
Figure 2: ZK-KYC Flow — birth date never leaves wallet, only boolean result + ZK proof travels
Why This Matters for Vietnam
ND 13/2023 & VNeID: The Regulatory Push
Nghị định 13/2023/NĐ-CP (April 2023) mandates:
- eKYC as standard for remote identity verification
- Sinh trắc học (khuôn mặt, vân tay) as proof of liveness
- VNeID as national digital identity platform (Level 3 eID)
- Goal: Replace physical ID checks with digital verification for public services, banking, telecom, healthcare
Current VNeID eKYC: User scans CCCD + selfie → system verifies match → service gets full identity data.
ZK-KYC upgrade: Same VNeID infrastructure, but user proves specific claims via ZK proof instead of sharing full VC. Aligns with ND 13's "data minimization" principle (Chỉ thu thập dữ liệu cần thiết).
Real-World ZK Identity Deployments
| Project | Model | ZK Primitive | Status |
|---|---|---|---|
| Bhutan NDI (Ethereum) | Govt-run | ZK-SNARK (age, citizenship) | Live, 700k+ citizens |
| World ID (Worldcoin) | Private (Orb) | Semaphore (group membership) | 5M+ verified humans |
| Semaphore (PSE/EF) | Protocol | ZK-SNARK (Merkle membership) | Open source, widely used |
| VNeID + ZK (Proposed) | Govt-run | ZK-SNARK/STARK | R&D / Pilot |
Vietnam has 70M+ VNeID users — a ZK-KYC rollout would be the world's largest ZK-native identity system.
The Bartender Analogy: Why It Clicks
Imagine walking into a bar:
- Traditional KYC: You hand the bartender your CCCD. He sees: Nguyễn Văn A, born 1995-06-15, lives at 123 Nguyễn Trãi, ID 001200001234. He checks birth year, hands it back. He now knows your name, address, ID number — forever.
- ZK-KYC: You tap phone on NFC reader. Screen shows: "Age ≥ 18: VERIFIED ✓" (with ZK proof). Bartender sees green checkmark. He learns ONLY that you're 18+. Nothing else.
Same result for the bartender (legal compliance). Vastly different outcome for your privacy.
Technical Deep Dive: The ZK Circuit
The "age ≥ 18" circuit in pseudocode:
`circom template AgeCheck(threshold_years) { signal private input birth_timestamp; signal private input current_timestamp; signal output result;
var threshold_seconds = threshold_years 365 24 * 3600; result = (current_timestamp - birth_timestamp >= threshold_seconds) ? 1 : 0; } `
Inputs (private): birth_timestamp (from VC), current_timestamp (from oracle or block timestamp) Output (public): result (1 = pass, 0 = fail) Proof: ZK-SNARK (Groth16) or ZK-STARK proving the circuit executed correctly with valid VC signature.
Verifier only needs: circuit verification key, proof, public inputs (current_timestamp, threshold), VC issuer public key.
Selective Disclosure: Beyond Age
ZK-KYC isn't just for age. The same architecture proves any predicate on your credentials:
| Claim | Circuit Logic | Use Case |
|---|---|---|
age ≥ 18 | now - birth ≥ 18y | Alcohol, gambling, adult content |
age ≥ 65 | now - birth ≥ 65y | Senior discounts, pension |
citizen_of == "VN" | nationality == "VN" | Voting, govt services |
not_sanctioned | id ∉ sanctions_list | DeFi, banking, exchange |
credit_score ≥ 700 | score ≥ 700 | Lending, BNPL |
degree == "Bachelor" | credential.type == "degree" | Job applications |
Each is a separate ZK proof — verifier learns only the boolean result.
Figure 3: Selective Disclosure — one credential, infinite selective proofs, verifier learns ONLY the proven claim
Sybil Resistance: One Human, One Account
ZK-KYC + nullifier = sybil resistance without doxxing.
` nullifier = hash(user_secret, app_id) `
- User generates nullifier when proving claim
- App stores nullifier in "used" set
- Same user can't prove again for same app (nullifier collision)
- But: nullifier reveals nothing about user identity
This powers: one-human-one-vote (quadratic funding), airdrop fairness, social media authenticity, DAO governance.
ZK-KYC vs Traditional KYC
| Aspect | Traditional KYC | ZK-KYC |
|---|---|---|
| Data shared | Full ID (name, DOB, address, ID#, photo) | Only proven claim (e.g., "age ≥ 18") |
| Storage | Service DB (breach risk) | User wallet (self-custody) |
| Portability | Repeat KYC per service | One VC, infinite ZK proofs |
| Verification time | Minutes-hours (manual review) | Milliseconds (math verification) |
| Compliance | GDPR/PDPA burden on service | Data minimization by design |
| Sybil resistance | Phone/email (weak) | Nullifier (cryptographic) |
Common Questions About ZK-KYC
What is ZK-KYC in simple terms?
A system where you prove something about yourself (age, citizenship, credit score) using a zero-knowledge proof — the verifier learns the fact is true, but not the underlying data (birth date, ID number, etc.).How is "kyc không lộ dữ liệu" different from normal KYC?
Normal KYC: you give the service your ID card. ZK-KYC: you give them a math proof that your ID satisfies their requirement. They never see the ID.What is a "zk proof kyc" technically?
A ZK-SNARK or ZK-STARK proof generated by a circuit that takes your Verifiable Credential as private input, checks a predicate (e.g., age ≥ 18), and outputs a proof that the predicate holds. The proof is verified on-chain or off-chain.Does the verifier need to trust the issuer?
Yes — the ZK proof includes verification of the Issuer's signature on the VC. The verifier must trust the Issuer (e.g., Government) to issue honest credentials. The ZK proof only proves "this credential from Issuer X satisfies condition Y."Can ZK-KYC work with VNeID today?
Yes. VNeID already issues VCs (W3C format). Adding a ZK circuit layer (age check, citizenship check) is a software upgrade — no new hardware for users. The VNeID wallet app generates proofs locally.What about biometrics (face scan)?
ND 13 requires liveness check. ZK-KYC handles the credential verification part. Biometric liveness is a separate step (done at issuance or per-session). ZK proof can include "liveness check passed at time T" as a signed claim from the liveness provider.Is this legally compliant in Vietnam?
ND 13/2023 encourages data minimization (Chỉ thu thập dữ liệu cần thiết). ZK-KYC is more compliant than current eKYC — it mathematically guarantees the service only receives the specific claim they're authorized to verify.The Honest Tradeoff
What you gain:
- Privacy by default: Services learn only what they need
- User sovereignty: Credentials live in your wallet, not their DB
- Portability: One VNeID VC → infinite ZK proofs for any service
- Sybil resistance: Nullifiers prevent fake accounts cryptographically
What you give up:
- Issuer trust: You still trust the Government to issue correct VCs
- Circuit audit: ZK circuits must be formally verified (bugs = false proofs)
- Key management: User must protect wallet keys (social recovery helps)
- Offline verification: Requires app/internet (though offline ZK proofs exist)
The Bottom Line
ZK-KYC is the cryptographic upgrade to identity verification that Vietnam's digital transformation needs. With ND 13/2023 mandating eKYC and 70M+ VNeID users, Vietnam can leapfrog to ZK-native identity — where proving "I'm 18" reveals nothing but "VERIFIED ✓."
The bartender doesn't need your life story. He just needs the green checkmark. ZK-KYC gives him exactly that — and gives you your privacy back.
Quick Reference
| Property | ZK-KYC |
|---|---|
| Core idea | Prove attribute (age ≥ 18) via ZK proof without revealing source data |
| Credential format | W3C Verifiable Credential (VC) signed by Issuer |
| Proof system | ZK-SNARK (Groth16) or ZK-STARK |
| Circuit | Arithmetic predicate on VC fields (e.g., now - birth ≥ 18y) |
| Verification | Milliseconds (on-chain or off-chain) |
| Sybil resistance | Nullifier = hash(secret, app_id) |
| Vietnam context | ND 13/2023, VNeID Level 3, 70M+ users |
| Global examples | Bhutan NDI, World ID, Semaphore, MACI |
| Main risk | Issuer trust, circuit bugs, key loss |