One User, Many Licenses: How Super Apps Are Rethinking Identity

Picture a user who opens a crypto exchange app on a Monday morning to buy bitcoin. By lunch, they have swapped into a tokenized share of a US stock. By evening, they are using leverage on a NASDAQ perp, and before bed they have placed a position on an NFL game. They never leave the app, and they never log in twice.

Behind the scenes, that single session touched four product lines, four regulatory regimes, and potentially four different licensed entities, each with its own rules on who is allowed in. The user sees one relationship. The platform has to prove, to several regulators at once, that it knew exactly who it was dealing with at every step.

That gap between what the user sees and what the platform must answer for is quickly becoming the defining constraint on the largest consumer crypto platforms.

In July 2025, perpetual futures of assets such as single-name stocks, commodities and stock indices, called RWA perps, saw trading volumes of ~$1.5B. Fast forward one year, and that figure reached ~$756B, with equity perps alone accounting for ~83% of that.

Prediction markets followed a similar arc, where combined monthly trading volume across Kalshi, Polymarket and Polymarket US hit its own record of ~$72B in September 2026, a 16x increase year-over-year (YoY).

Neither of these products is crypto in the traditional sense, as the former is more akin to legacy traditional finance (TradFi) brokers while the latter is akin to binary outcomes and, to an extent, sports betting.

Despite that, both are increasingly offered through crypto platforms. The largest consumer-facing platforms are now becoming financial “super apps” that can offer crypto alongside equities, derivatives, payment cards and prediction markets, all under one account.

This creates a different kind of identity problem, where each new product line comes with its own regulator, license and rules on who is allowed to use it. In short, one user, one app, but many licenses.

This shift is already visible to the platforms building these super apps, several of whom have shared their thoughts and experiences in a series of interviews with Socure and The Block’s Research team.

Jonathan Brockmeier, Chief Compliance Officer at OKX, which has expanded its product offerings beyond crypto trading into payment cards and tokenized equities, described identity as three separate decisions: who a user is, whether they are eligible for a given product based on factors such as location, age or documentation like a passport or visa, and which licensed entity grants that specific permission, as one verified identity can span several product-level approvals across different licensed entities.

Put simply, super apps have to answer three questions in order: Who is this person? Are they allowed to use this product here? Which licensed entity is granting access? Most platforms built for the first question and are now retrofitting for the other two.

This primer is set to look at why identity, rather than product breadth, is becoming the biggest constraint on how far these super apps can scale further.

From Exchange to Super App

OKX, one of the largest crypto exchanges, has expanded into payments with OKX Pay and Card, live in Europe and Brazil, and has also launched OKX Money, a stablecoin savings and spending app for emerging markets. They also have a joint venture with Intercontinental Exchange (ICE), the parent company of the NYSE, where OKX customers will have access to NYSE tokenized equities and ICE futures.

OKX is already among the largest venues for RWA perps, accounting for ~14% of all RWA perps volume between July and September 2026, behind only Binance, while holding a MiCA license that allows it to serve customers across the European Economic Area.

etoro, a multi-asset trading and investing platform, reported over 4.2M funded accounts in Q2 2026, up 18% YoY. Alongside its traditional brokerage and crypto products, it also offers an etoro Money account and card, with European issuance up over 30% quarter-over-quarter (QoQ). Through its acquisition of Zengo, etoro customers can trade tokenized assets on the blockchain using the non-custodial wallet. Additionally, etoro announced plans to acquire US broker TradeZero.

On the other hand, Crypto.com took a different route, becoming a regulated US venue with CFTC licenses for derivatives and prediction markets, alongside its crypto exchange and Visa card.

Despite the impressive headline growth numbers, it is worth pointing out that every product line on a super app has its own identity requirements. Buying crypto, trading NASDAQ perps, betting on an NFL game and paying with a card are, in effect, onboarded under several different regimes.

Examples of this can be seen when Europe’s ESMA reminded firms that perps offered to clients likely fall under existing CFD product intervention measures, meaning leverage limits, risk warnings and a ban on trading incentives.

Similarly, for prediction markets, Connecticut issued cease-and-desist orders to multiple platforms, while Missouri’s Attorney General did something similar, arguing prediction markets for sports are essentially unlicensed sports betting.

The current norm is that a single check at a super app’s signup confirms who a user is. In reality, it cannot confirm whether that user is eligible for a specific product, in a specific location, at a specific point in time.

 

Read down the right-hand column and the pattern is clear. Each row asks a different question about the same person. Crypto asks who the user is and who they pay. Perps ask whether they should be using leverage. Prediction markets ask where they are standing. A single signup check can only answer the first.

Nevo Lapidot, Head of Crypto Compliance at etoro, which holds licenses across the world, describes a similar process, where identity is verified at onboarding, eligibility is treated as a technical decision based on jurisdiction and product rules, and suitability draws on each customer’s risk profile, so that complex products are not offered to users with only a basic understanding of financial products.

OKX, on the other hand, organizes the entire process around the license itself. While the customer sees “one relationship,” each licensed entity keeps its own record of what was checked, how and when, in order to meet its own regulatory requirements.

Geography then adds another layer. etoro noted that none of its products are offered identically across every jurisdiction, with localized compliance requirements and workflows built around a core product instead.

KuCoin takes a similar approach, with Edwin Wong, Vice President and Head of Risk Control at KuCoin, explaining that the exchange keeps its core onboarding flow consistent across markets while adjusting verification requirements, transaction limits, product access and monitoring rules based on a user’s location.

Taken together, etoro, OKX, and KuCoin point to the same design principle. The core identity record stays constant, while eligibility, limits, and monitoring flex by product, license, and location.

Identity as the Growth Lever

For super apps, growth increasingly comes from cross-selling, where introducing an existing user from crypto into stocks, perps or prediction markets is far cheaper than acquiring a new user for each product.

However, every new product also comes with a point of friction. A user already verified for crypto trading being asked to resubmit documents or repeat KYC processes to be able to access RWA perps is a significant hurdle for user conversion.

But the pressure runs on the other side as well, where removing too much friction risks providing ineligible users with restricted products. Not to mention the fraud dimension where a super app is only as strong as its most lightly verified entry point.

This leaves platforms with a three-way tradeoff between conversion, compliance, and fraud. Tightening one tends to loosen another, which is why a static, one-size-fits-all check no longer works at super app scale.

OKX’s Brockmeier put it bluntly, noting that “fraud is always going to go where the lightest checks are,” and that “if the friction’s low, the fraud comes in.” Its approach is to scale friction with assessed risk, keeping the experience low-friction for verified, low-risk users and adding checks as risk rises.

KuCoin described something similar, particularly with the rise of AI-generated identities that have become harder to spot. Rather than relying on photo-based verification alone, they profile users based on country, behavior and transaction patterns, flagging anomalies such as large withdrawals in the middle of the night from a user whose activity normally concentrates during the day.

Socure, an AI-powered identity verification platform, argues the answer is reusable, risk-based identity, where a user is verified once, and the platform then uses signals such as device, behavioral and account history, in addition to continuous identity monitoring, to decide which additional checks, if any, are needed as that user moves into a new product.

In practice, this treats each new product as a risk decision rather than a fresh onboarding, and is what Socure’s RiskOS platform does, streamlining the user experience and minimizing friction. Socure claims it verifies over 99% of identities on the first attempt, compared to the industry average of 64%.

Why it matters at scale: if each new product launch triggers a fresh onboarding, cost per cross-sell rises and conversion falls. If each launch is a risk decision on an identity the platform already trusts, cross-sell cost stays low and friction stays proportional to risk.

Verify Once, Unlock Many

Combined monthly volume across RWA perps, Polymarket and Polymarket US, alongside Kalshi, who is a client of Socure, grew from ~$6B this time last year to over $600B in September 2026. That is a ~100x increase in twelve months.

The platforms capturing that growth already hold their users’ identity. The open question is whether that identity is eligible across different product lines and licenses, or whether it has to be rebuilt every time a user opens a new tab in the app.

All partners interviewed for this report broadly agree that the technology for reusable identity already exists, and that the bottleneck is now standards and trust.

etoro’s Lapidot said that a reusable identity could cover a general identity verification requirement, but suitability checks are usually much more intimate with the customer and specific to their understanding of their unique offering, “that’s hard to generalize.”

KuCoin’s Wong argued that national-level digital identity systems would give platforms a consistent standard and allow users to verify once to access a wider range of regulated financial products.

Socure is building toward that model with Socure Pass, its reusable identity product where users verified once by a regulated entity can, with their permission, share that credential with downstream partners instead of having to repeat KYC at every platform.

The platforms that win the next phase of growth will likely be those that treat identity as shared infrastructure across every license they hold. The next primer looks at the payment providers sitting underneath these flows.