Products Lemma APIProof issuance & verification platformTrust402Delegate to agents, and transactSealSign-in for the agent era — no keys handed over
Use cases Manufacturing & Critical InfraInspection Record AssuranceFinance & FinTechCounterparty Record VerificationPublic SectorCertificate-less ProceduresHealthcareQualified Worker AssuranceProcurement & Supply ChainSupplier Credential MonitoringMedia & ContentContent AuthenticityService & RetailCross-group IdentityAI Adoption (cross-industry)AI Run GovernanceDevelopers & Agent OpsAgent Authority Control ▸ Browse the use-case index
Pricing
Resources Critical BriefThe frontier of AI × trustBlogThinking and implementation notesDocumentationAPI & specsVerification CenterReal verification & issuance countsAbout usFRAME00, Inc.ContactSales & press inquiriesGlossaryDefinitionsFAQFrequently asked questions
Get Started ↗ JA
Home / Critical Brief / Pillar archive
Lemma Critical Brief · Pillar archive

Pillar 04 Regulatory Attribute Proof

The layer that proves KYC / AML / regulatory attributes via selective disclosure.

26 Briefs
No. 150 · 2026-09-24

North Korean IT workers: they won contracts in Japan by posing as local enablers, using ID images the enablers supplied (joint advisory by seven agencies in Japan, the US, Australia and Germany; Japan's first laptop farm dismantled)

the ID was genuine, but nothing tied its holder to the person doing the work before the work was handed over

Attribute Proof Bypass Identity & Auth Brief →
No. 149 · 2026-09-21

Revolut: It kept handing over customer data for months, answering disclosure requests that arrived through Italy's state-certified email network (PEC; Italian prosecutors investigating)

the state certifies delivery, but nothing verifies the requester's authority before the data goes out

KYC / AML Disclosure Attribute Proof BypassIdentity & Auth Brief →
No. 141 · 2026-09-04

IDScan.net: More than 153 million scanned driver's licenses handed over at counters were being sold on the dark web

the check ends in a moment, the image does not

Attribute Proof Bypass KYC / AML DisclosureData Provenance Brief →
No. 140 · 2026-09-01

AnonyMousKIT: AI voice agents posing as 'Apple Support' extracted unlock passcodes from stolen-iPhone owners

being able to state the passcode is treated as proof of ownership

Attribute Proof Bypass Identity & Auth Brief →
No. 135 · 2026-08-21

Expired Visa EMV contactless cards were shown to pass at checkout

the expiry the terminal reads is never collated against the issuer's signed record

Attribute Proof Bypass Identity & AuthData Provenance Brief →
No. 126 · 2026-08-07

FCA fines Starling Bank £29m: since 2017, the automated sanctions screening had been matching customers against only a fraction of the list

the screening ran

KYC / AML Disclosure Attribute Proof BypassIdentity & Auth Brief →
No. 117 · 2026-08-03

Speechify verified voice-cloning consent with a single checkbox

CFA asks the FTC and state AGs to investigate

Attribute Proof Bypass Identity & AuthData Provenance Brief →
No. 093 · 2026-07-03

A7A5: a ruble-backed stablecoin moved $110B under sanctions

fully traceable on-chain, yet nothing proves or blocks a sender's sanctions status at transaction time (CertiK / Elliptic)

KYC / AML Disclosure Attribute Proof BypassData Provenance Brief →
No. 086 · 2026-06-30

Sumsub: An 18-Month Undetected Intrusion Into a Support Environment Exposed Customers' Names and Contact Details

Sumsub, a global identity-verification (KYC) vendor, disclosed unauthorized access to an internal support-related environment. In July 2024,…

KYC / AML Disclosure Identity & AuthData Provenance Brief →
No. 083 · 2026-06-26

Change Healthcare: a breach of a single Citrix account without MFA halted a third of US medical-claims processing for weeks

with no layer separating "knows the password" from "is the legitimate authorized party," stolen credentials were indistinguishable from legitimate access (UnitedHealth Group congressional testimony)

Identity & Auth Attribute Proof Bypass Brief →
No. 084 · 2026-06-26

Hong Kong deepfake video-call fraud: a real-time deepfake of the CFO and every colleague drove a ~$25.6M transfer

seeing a face and hearing a voice no longer proves the person is actually present (Hong Kong Police / Arup)

Attribute Proof Bypass Identity & AuthData Provenance Brief →
No. 077 · 2026-06-23

IDMerit: the disputed billion-record KYC exposure

an unsecured database was found, but no one can prove whose data it was (Cybernews report, IDMerit denial)

KYC / AML Disclosure Data ProvenanceAttribute Proof Bypass Brief →
No. 065 · 2026-06-17

NHO Hokkaido Hospitals: assumed shredded, sold online

180,000+ patients' drives slipped through, with no independently verifiable destruction trail

Attribute Proof Bypass Data Provenance Brief →
No. 050 · 2026-06-12

Generated Without Consent or Age Verification

The Provenance Gap Behind the Grok Deepfake Controversy

Attribute Proof Bypass Data ProvenanceAI Decision IntegrityAI Bias / Harm Brief →
No. 052 · 2026-06-12

70,000 Government IDs Leaked to Prove Age

Discord's Third-Party Verification Vendor Breach

Attribute Proof Bypass Data ProvenanceIdentity & Auth Brief →
No. 040 · 2026-06-09

Phantom Carbon Credits

When an Environmental Attribute Is Issued Without Independent Verification of Its Underlying Data (Operation Greenwashing)

Attribute Proof Bypass Data Provenance Brief →
No. 041 · 2026-06-09

AOG Technics: over 60,000 aircraft engine parts circulated with forged airworthiness certificates

the provenance of the certificates asserting airworthiness is not independently verified before receipt (SFO)

Attribute Proof Bypass Data Provenance Brief →
No. 034 · 2026-06-08

Live Biometric Verification Defeated by an Injected Video Feed

KYC Believed It Had Captured a Live Person, But the Provenance of the Capture Was Never Verified

Attribute Proof Bypass AI Decision IntegrityIdentity & Auth Brief →
No. 032 · 2026-06-08

Inside a Legitimate Booking Platform, the Payout Bank Account Was Silently Rewritten

The Change Was Not Independently Verified Before Funds Moved (Polaris Holdings / Booking.com)

Attribute Proof Bypass Data ProvenanceIdentity & Auth Brief →
No. 035 · 2026-06-08

The Inspections Were Recorded as 'Complete'

But Never Performed. On the Boeing 787, the Existence of a Record Was Mistaken for Proof of the Act

Attribute Proof Bypass Data ProvenanceIdentity & Auth Brief →
No. 022 · 2026-06-04

OnlyFake

AI-Generated IDs Bypass Exchange KYC

Attribute Proof Bypass Identity & AuthData Provenance Brief →
No. 020 · 2026-06-03

Tampered Certification Test Data Behind Type Designation

Product Regulatory-Conformance Attributes Asserted Without Independent Verification on the Path to Shipment

Attribute Proof Bypass Identity & Auth Brief →
No. 019 · 2026-06-03

Unqualified Engineers Placed Under National-License Claims

Regulatory Attributes Asserted Without Independent Verification at the Point of Assignment

Attribute Proof Bypass Identity & Auth Brief →
No. 021 · 2026-06-03

Wirecard: forged bank balance confirmations asserted €1.9B that didn't exist

a financial attribute disclosed without independent verification

Attribute Proof Bypass KYC / AML Disclosure Brief →
No. 013 · 2026-05-31

The Coinbase KYC Insider Breach

When Regulation-Mandated Storage of Raw PII Becomes the Breach Surface

KYC / AML Disclosure Identity & Auth Brief →
No. 006 · 2026-05-30

Google API Keys Remain Usable for 23 Minutes After Deletion

Independent Verification Gap in Credential Revocation Attributes

Attribute Proof Bypass Identity & Auth Brief →