A Bank App With an Iris Behind It
World Money went live on September 17. Tools for Humanity, the company Sam Altman co-founded alongside Alex Blania, describes it as a self-custody financial app: stablecoin balances in eight currencies, virtual accounts for payroll and direct deposits through Bridge, a trading tab for digital assets and gold. It adds free cross-border transfers using a World username. Stripe integration lets US users fund the app with Apple Pay in minutes.
The differentiator sits underneath the feature list. World ID, verified at an Orb scanner, unlocks what the company calls boosted rewards in the Earn tab and priority access to new features. The company's own framing is that accounts should belong to verified humans, not bots or duplicate identities. World's own announcement notes that features and eligibility vary by country, with some functions supplied under third-party terms.
The ID Behind the Rewards Is the Part Regulators Keep Flagging
On December 19, 2024, Germany's Bavarian data protection authority, BayLDA, ruled that World's identification procedure carries fundamental data protection risks and does not comply with GDPR. BayLDA president Michael Will said every user who had handed over iris data would get an unrestricted right to erasure. Tools for Humanity appealed, arguing the ruling targeted an older process and that current iris codes are encrypted, split three ways and held by outside custodians including university partners in Berkeley and Zurich. The appeal is still pending.
Spain moved next. On February 13, 2026, its data protection authority AEPD issued a formal preventive warning to Tools for Humanity GmbH, timed to the company's own notice that it planned to relaunch Orb scanning in Barcelona. AEPD flagged three gaps: impact assessments that did not justify the necessity of biometric scanning over non-biometric alternatives, an unresolved question over whether iris codes count as special category data under GDPR and privacy notices omitting the legal basis for processing. The warning did not block the relaunch. It put the company on notice before the fact, which is rarer than a fine after one.
Two Regulators, One Underlying System
Laid side by side, the two actions concern the same identity layer that World Money now leans on to pay out its rewards.
| Date | Regulator | Finding | Status |
|---|---|---|---|
| Dec 19, 2024 | BayLDA (Germany) | World ID procedure carries fundamental GDPR risk; ordered a deletion right for iris data collected without sufficient basis | Under appeal by Tools for Humanity |
| Feb 13, 2026 | AEPD (Spain) | Impact assessments and biometric classification gaps ahead of a planned Barcelona relaunch | Preventive warning; relaunch not blocked |
| Since Jul 1, 2026 | MiCA (EU-wide) | Any crypto-asset service to EU clients needs an EU license; no dedicated regime yet for non-EU stablecoin issuers | Mandatory; World's own announcement does not address it |
Between the German ruling and the Spanish warning, Tools for Humanity changed what it was offering. The Barcelona relaunch swapped token-based crypto rewards for digital subscription benefits and moved to a personal-custody model that keeps encrypted biometric data on the user's own device. The company is already redesigning the mechanic under regulatory pressure. World Money now takes that same mechanic and rolls it out to 150 or more countries at once.
The Wall That Was Already Standing on Launch Day
MiCA's licensing requirement for crypto-asset service providers became mandatory across the EU on July 1, 2026, more than two months before World Money's launch. A firm serving EU clients with stablecoin balances, trading, or yield products needs authorization in an EU member state, which then passports across the bloc. European officials are separately working to extend MiCA to cover non-EU stablecoin issuers directly, with a consultation running to the end of September and a legislative change targeted for 2027, which suggests the current framework does not yet fully reach a company structured the way Tools for Humanity is.
Whether Tools for Humanity holds that authorization is not stated anywhere in the World Money launch material Servola reviewed. For an EU-based operator evaluating World ID as a fraud or verification layer, that silence is the detail worth chasing down before the rewards engine, not after.
The Bottom Line
None of this makes World Money's underlying idea wrong. Proof of personhood is a real problem. An iris-based system is one credible answer among several. What the timeline shows is a company that keeps redesigning its core mechanic one region at a time, in direct response to regulators, while marketing a single global rollout everywhere else. Barcelona got a rewritten custody model before its Orb scanners restarted. The rest of the launch countries got the September 17 version.
An operator that plugs World ID into anything customer-facing in the EU is not adopting a finished identity standard. It is adopting one still being negotiated, article by article, with two data protection authorities and, as of this year, a licensing regime that has not yet said where a company like this one fits.
Read next: Second LED Patch, Same Unanswered CNIL Objection | Spain's Regulator Just Named a New Kind of Attacker
