> what KYC is really necessary for a company like this? If I understand correctly, all they do is pass through transactions.

Products like this are particularly susceptible to fraud, especially given that they're charging your bank account directly. Without any KYC, if I as a fraudster get access to your bank login, I can basically drain your account. That opens up a ton of liability to Privacy. Also, the card networks tends to be pretty risk-averse with allowing issuing products access to their networks if there's a lot of fraud going through their services.

So, it's much easier to put KYC in place in order to avoid the headache of dealing with fraud/AML/etc

Ok yes, I can see that they would want to have some insulation from having banks charge them back on whole user accounts. That makes sense.

The point of KYC is to make money laundering harder (and other transactions that the various governments want to track/police). To that extent, yes, they need to be able to show a regulator who was making those transactions.

The actual funding source/bank behind them won't see any detail beyond "privacy.com".

Any card issuer (or virtual card issuer) has to do this.

My point is that privacy doesn't need to do KYC because there is no possibility of the customer evading regulators. Assuming that privacy answers subpoenas, they would be able to give the government detailed transaction info and a bank account which would identify the customer. KYC at this level of abstraction doesn't seem to solve any kind of legal problem. I'm glad to be educated by an expert, though.

Edit: A sibling explains a good liability reason for this, which makes sense but would not imply any legal reason.

How do you validate that they own the bank accounts if you don't know who the user is?

They only verify control. They do the method of making two small deposits and asking what they were.

Which is why KYC is required. Two small deposits just means you have access to someone's bank account, not that you're actually them. Money launderers will pay mules to use their bank account to move money around.

Privacy is backed by an actual credit card ever since they restructured things to get around most sites rejecting their cards due to mistaking them for prepaid.

It is a legal requirement for their bank and for mastercard.