There is a difference between "evil" and "ineffective", and while I agree with the more controversial "evil" part, my point was to emphasize the "ineffective" p

There is a difference between "evil" and "ineffective", and while I agree with the more controversial "evil" part, my point was to emphasize the "ineffective" part of it. I won't go into further details even under anonymous account, but I have some first-hand experience dealing with compliance from various financial institutions, I have a general idea of what they ask, what they do NOT ask, and all of this feels much like IP address logging or so-called "chain analysis": it may work against unprepared people (mostly those who "have nothing to hide"), but is almost trivially bypassable by any semi-motivated attacker. Mostly it's because incentives are completely off. These people are not the police; their top priority is to cover their asses with enough paperwork, not actively engage in yet another anti-whatever crusade.