Impact of Transfer of Funds Regulation in EU | European Blockchain Convention

Transcript

[Music] hello hello everyone thank you for being here and everyone who's outside of this room this is the best panel of the whole conference so you better come in so come and get your seats say it again yes everyone who's outside of this conference room come inside because the best panel is about to start let's go big round of applause again thank you all right all right so great to be here again it's my fourth or fifth time in the in the European blockchain convention so also I wanted to thank again Victoria and all their team for the great work that you're doing the 10th edition is a great result so thanks again for having us I'm Tomas

ATI I'm the head of Regulatory Affairs at blockchain for Europe which is a trade Association based in Brussels we are a long-standing partner of the European blockchain convention so again very happy to be here and I am very happy to be on stage with some very very expert people of this topic that we're going to talk about today the transfer of funds regulation also known as the travel rule but we're going to discuss all of that in details uh feel free to ask your question at the end if we have some time so we want to have this conversation a bit more of a conversation than just a a speech so I will let my uh panelists introduce themselves so I don't have to make any mistakes with pronunciations or titles but please Lana all yours um hello hell

everyone um so happy to be here my name is Lana schwarzman I am head of regulatory and compliance at Nota Ben I'm also a uh recovering Chief compliance officer from two different crypto companies which is quite fun um I am happy to be here uh to talk on this topic great Ela hi my name is Elsa madol I'm general manager emia for verify vasp verify vasp is a travel R solution provider headquartered in Singapore with subsidiaries in Tokyo and Paris we've been live with the travel rule in Asia for a number of years now so uh we'll be able to talk about some of Lessons Learned thank you and Kelly I I'm Kelly Fen I'm a partner at MK fintech Partners

limited uh MK fintech fors part of the Michael kianu group and I guide clients through the license application process for any fintech license and also offer ongoing advice and fill key roles for these entities perfect thank you and as you will see the title here is about the transfer of funds regulation a very important piece of legislation that was adopted in Brussels uh so I take a bit of credit for that uh but it's a very important piece of Regulation but it's all about this so-called travel rule so let's uh try and understand a bit what is this travel Rule and maybe Kelly you can give us a bit of an overview to our audience what really is the travel Rule

and how is this being implemented across jurisdictions sure so uh firstly the travel rule uh it emanated as a recommendation from the FF Financial action task force the fatf I'm not sure if many of you know it's an inter governmental organization it was established 1989 by the G7 Nations and they set International standards to combat money laundering and funding of terrorism and one of these International standards uh they would be you could say guide lines on how to two countries uh how to combat money laundering funding of terrorism and one of them would be recommendation 16 which is the travel

rule itself uh the travel rule initially um was targeted two financial institutions where wire transfers were concerned uh so that the a certain amount of information is collected on the sender and the receiver and these recommendations are constantly updated to keep up with and address new Financial risks and one of them was uh with respect to crypto assets so now the travel rule recommendation 16 applies not only to financial institutions uh with respect to our transfers but now also to casps uh crypto asset service providers with respect to uh the sending and receiving

of crypto assets um the EU has adopted recommendation 16 uh through the transfer of funds transfer of funds regulation um and with respect to this regulation uh it specifically outlines what information needs to be collected um I think a very good point to mention is who is exempt so firstly if it's a transfer where a Casp isn't involved it's exempt uh if it's a transfer between two casps on their own behalf no one else's it's exempt it doesn't apply but the minute

it's done by a Casp a Casp is involved in the transaction for a third party as a service then the travel rule applies and there is a certain amount of information which needs to be collected to summarize it would be that um if you're a Casp of an originator you would definitely need to collect information such as the name uh the basic account identifier the DT address and then you'd also need to collect information on the pH physical address place or or place and date of birth um and you need to collect this on both the originator and the beneficiary then I have I answered your question or shall I go on you you did a

good job in because I can go on I don't maybe if you want to touch uh quickly upon okay so we're talking now about the transfer of funds regulation so the EU implementation of the travel rule but of course as we were saying this has been implemented all over the world by many different jurisdictions we're going to go a bit deeper uh with Lana and Elsa but maybe you want to give us a quick pointers on what do you think are the main differences okay well firstly uh our rate the travel rule in the EU with respect to the EU regulation that applies as of 30th December of this year uh so clock is ticking uh which respect to I mean top of my head let's put it this way us is very important to mention

and they have been applying the travel rule I think since quite a couple of years ago now um 2013 maybe earlier uh no I think it was 213 but they have for example a threshold and that threshold is $3,000 us as as to when this travel rule must apply in the EU there isn't that threshold for all crypto asset TR transfers the travel rule applies um I think there's the you yes if you want to go so I just wanted to add one additional point on top of that I think it's uh important to note that it since you were talking about the exclusions but from the inclusion side it's not just about if you're a Casp in

the EU but it's also if you have customers in the EU as well correct that's a very important reminder that this I think this is just a an important point that it's good to keep in mind when looking at the European Union right so it's not just about when does a European regulation applies to your services it's not just if you are establishing the EU but it's also if you're trying to provide services to European citizens so this is a very important principle in European legislation which is good to keep in mind so maybe let's uh let's Deep dive a bit into other jurisdictions I think we were when preparing these conversations we obviously looked at some major jurisdictions and some major differences that we see between the those regulatory

approaches and the one in the EU so maybe let's start with Elsa if you want to give us a bit of an overview on the differences with the the Singapore approach yeah thank you it's probably worth mentioning that the the idea with fatf alignment is that uh Regulators meet a minimum set of Standards so you that that explains the differences between the different jurisdictions because as long as the standards are met at minimum that's considered to be aligned and then whatever variations can happen um I think it's important to note that the US is probably not quite aligned yet to Fat of Standards just that $3,000 threshold is not aligned so that's some of the some of the things we're waiting to see in the US but Lana will address that so from Singapore's

perspective um indeed uh between 2020 and 2022 the PSA act got phased in they have a very Progressive approach um you know that phased in stage completed in 2022 they're very open to engage Eng with the private sector and they've been taking feedback um they were a little slow to start accepting licensing to start um issuing licenses and that's while they were catching up with you know really understanding what the pain points and and the nuances were for the industry um now they've largely caught up so licensing is continu to happen uh enforcement is happening through uh writeups there's been so far one on-site visit organized across the board by uh by uh Mas um and it's also happening through licensing so uh in enforcement

through licensing meaning entities are fa are you know failing to achieve their license uh due to for a number of reasons but travel rule uh could be a common one um so in that case you know the the Mas will um encourage you to look at one of the travel rule service providers that they are comfortable with of which you have two on this stage tonight today feel pretty lucky because of that um but just to continue on that so their latest guidance one of the one of the challenges that they have seen is um the uh demonstration of what it means to be immediate and secure so you know that transfer of information happening immediately and securely so we're

expecting guidance on that on those two topics and also on counterparty vas due diligence that's been you know applied across the board it's it's implied in some countries this concept of counterparty vas due diligence it's it's very specific in other countries um and then in some countries there's not mention at all and that's something that needs to all right so we already see there are some differences between the the approach taken in Singapore and the one taken in the EU um but from a very as Elsa just told us you know quite positive approach uh also open to discuss to the industry with the industry I think we may see some differences now when we talk about the United States approach so what do you think la lana that give us a bit of an overview of those main differences with

the US absolutely so first of all to clarify the the so-called travel rule or in the US is called the transmittal of funds it actually is fully applicable in the US and it started its kind of Journey Through treasury in 1996 when it was applicable through Fiat and wire transfers and was called the part of the recordkeeping rule and this was required of Banks and and financial institutions to kind of collect and retain this information um on transfers over 3,000 so then what happened in 2019 finsen updated its guidance and they basically said well this same travel rule in transmittal funds applies to crypto

transfers as well so they were pretty clear in their guidance since 2019 and it's really interesting to see how even though they've been quite clear in it even though I personally had conversations with them to make sure am I missing something on this um it is quite interesting to see however that there are um certain industry um associations in the US and kind of some of the bigger exchanges that think that this shouldn't apply to crypto essentially um and because crypto doesn't fall under the definition of money so they're looking for the loopholes in this um however in July of next year um on the

docket is the notice of proposed rulemaking to really clarify that in the context of money for recordkeeping and for travel rule this is going to be applicable to crypto um to crypto transfers as well um and I also know that various um on-site exams and also uh annual audits uh that are done for compliance controls they all look at Travel rule um they all look for the efficiency of travel Rule and if you're not complying with it you are written up for it all right so I think we start to see that of course the travel rule can be uh somehow complicated to comply with but it also

provides that legal certainty uh for users for operators for providers that they know that they are you know complying with a very set very important set of rules which in the end helps uh with the general overside over the transfers in crypto assets right um but of course there is differences in these approaches as we're seeing and if we go back and look at the EU maybe Lana you can give us a bit of an idea about these uh stricter requirements because the eu's approach is very very uh pres prescriptive in a way right it defines clear um basically requirements that needs to be complied with what's your take on that do you think that is helpful for the industry or is actually

hindering the processes and services and innovation in this space look everybody complains that we don't have regulatory Clarity and here there you go you have it here right so yes it's explicit and it's complicated as hell to go between reading the the TFR and the ebaa guidelines um and making you know going through the differences between the two and highlighting all the points but you have the clarity they specify exactly what they want and exactly how they want to see it for example when you look at um the requirements for handling uh Missing information as well on reporting of non-compliance and when you kind of think of it as a as like almost like a

triangle on one side missing information on the other side reporting of non-compliance all of that really kind of leads up to the point of the importance of responding that it's not just enough to um to send the travel rule transfer you have to respond to them as well um super important so there's a lot of clarity on that and I actually put in here just to quote because I don't take my word for it I I want I want to really go to the source just super quickly if you'll allow me to um in the TFR under paragraph 28 they say um crypto asset service providers should ensure that the information on the originator and the beneficiary is not missing or incomplete and in paragraph 53 of the TFR they say to uh

enable a prompt action uh to be taken in the fight against anti-money laundering and terrorist financing uh casps and payment service providers should respond promptly to request for information so super important and uh maybe super quickly what does that look like in context so they're very explicit in the EU um if you um are in within the union you have to you have three days basically to respond for requests for missing information if your counterpart is outside of the EU uh it's within 5 days um and then across different jurisdictions um if you look at for example UK or Canada they say for missing information it's like reasonable

whatever again here it's explicit so you know what that means and others they say whatever reasonable is and then I have customers asking us well what is reasonable right um and Singapore um as alsoa hit up on on Singapore um there's three days you basically have to respond to missing information all right well I think we also start to hear about a few challenges of course right so it is an important framework and as Lana was saying is not just about sending information I think the travel rule framework is really all about cooperation between different entities and providers right there needs to be this communication between these two providers to make sure that the

information about the sender and receiver or beneficiary and originator of a certain transfer are collected and before we go into the challenges I don't know Kelly if you had any thoughts on any of this if you wanted to jump in on uh feel free to jump in on any of these topics as well okay and otherwise uh let's let's hear about these challenges do you think there are some challenges now when looking at the impact of the TFR in Europe what are these challenges I think we just mentioned one or maybe Elsa you want to expand a bit on that on the on the return messages I think there there are lots of challenges um uh I think one of the first CH but less if they work with us right that's the whole point so

you know from a vast perspective one of the first challenges is looking at all of your entities where are they located what does the travel rule how is the travel rule being interpreted in those in those locations um we've got some challenges in terms of how the different protocols work we all work very differently we sometimes have a hard time completely understanding each others so my heart goes out to the audience and trying to understand us um but it affects everything so verifi vas runs a uh virtual private Network um on the topic of uh you know uh verifications um actually arriving uh we use an API so you call the API you have 100% guaranteed that that that will

happen that is not the case if you're using an open source protocol but one of the downsides of using our network is that your counter party has got to be part of the network um we cannot transact with anyone outside of that Network so you know on the one hand we're Ultra compliant and super fast on the other we're not connected to everyone um not has a different set of of uh of challenges and there's not one provider out there that's got the absolute perfect solution I was at a conference recently where somebody posted a question to one of The Regulators saying when is the EU going to have an open- Source protocol for travel rule that everybody can use you know in context of gdpr and Dora an open- Source protocol that everybody

can use is is Utopia it's not going to happen right right so there are a lot of challenges well to reduce those Challen es I think it would be a good idea for uh casps to come up to use more than one solution wouldn't you agree with that so I think that in the context of Dora so um Dora is the digital um operational resilience act that will actually uh kick in 18 days after the transfer funds regulation um is another very large headache for uh aspiring casps in in in the EU um of the many many things they're going to have to do to prove um

operational resilience which is you know not just fighting cyber security threats but actually being able to survive cyber security threats one of the things they have to do is manage and understand the risks across all of their vendor all of their potential vendors um including indirect vendors and indirect risks that's right so in the context of the travel rule if you think of a of a of a Casp so a newly licensed Casp as soon as they become a Casp Dora applies immediately they now have to really think through vendor due diligence and and take it the extra mile so uh then it introduces the concept of critical ICT service provider um this is not a New Concept it exists in in other regions as well but you become a critical ICT

service provider if your client your your vasp in this case or Casp in this case um really cannot function without you now if you have a Casp that's on boarded one solution provider for travel Rule and has no contingency plan and that travel rule solution goes down you're in trouble you're in a critical situation yeah so we believe um rightly or wrongly that you know travelable service providers will eventually be deemed critical ICT service providers either by the casts themselves or by the regulators and that will bring with it audits oversight uh you know you really want your travel R service provider to have uh invested in uh you know cyber security it be be comfortable with

audits um I think that's going to level the playing field a little bit because I don't think the number of providers that you see today will will continue to exist for business continuity purposes it's essential because you won't be a a Casp won't be able to offer their service without this solution in place so if one goes down you definitely need another to be able to operate yeah absolutely and uh I would say just on on the topic of dor a little bit um you know you kind of pay what you get for right like there's a cost for our companies having the infrastructure the secure infrastructure in place uh to be compliant with door to be compliant with

other regulations to have all the security practices in place to be able to uh go through sock 2 to go through kind of all of these security audits right because because you realize the importance of having um uh a critical vent such as us and it's definitely not something that you'd want to cut Corners it's definitely not something when when I was a chief compliance officer and travel R came into place that was not the place that I was looking to cut a quarter because of like the importance um of it um and then I think generally on kind of what we brought up on the some of the challenges and and uh close networks open networks um absolutely

they each come with their own set of challenges um I think one of the advantages of course of uh open networks is the reachability aspect because at the end of the day you need to reach your counterparties you need them as I just mentioned going through the TFR they need to respond to your messages you have to be able to send to your messages um and I think that becomes a really important um holistic industry concept that many are starting to realize um I think we we can mention you know there's collaboration um and cooperation happening uh kind of behind the scenes to uplift the industry between verify vasp and and not of Ven because we um you know just even even as such critical

vendors realize the importance of something as this um and then maybe just super quickly um I just want to hit upon one of the challenges that we're seeing that I'm hearing from customers that are asking us all the time and also from um industry associations such which as ours where we had to discuss this is the concept um of verification in third-party self-hosted wallets um and actually um we had the pleasure of having a fireside chat with Joanna from EA and um I asked her this question I said we hear a lot from our customers um originally there was an understanding that you only need to collect um the information for self uh for third party

self-hosted wallets but when looking through the EA guidelines there's a notice there of verification so you know to provide some light on that and I figure it'd be great to share this with the audience for those that didn't hear her answer um where she basically pointed to um article 19a in the TFR as of course you would expect a regulator to answer my question with uh um a reference to an article so that's fine but old drug Society you know it's basically comes down to different mitigating measures um and also so having a risk-based approach to those different measures around identity and verification um you can also look at the origin of the destination or of the

transfer you can continue to conduct ongoing monitoring um so this really creates kind of uh an area where you can potentially get creative um or if you don't want to get creative um we Nota Ben um recently announced at our Summit that we do have support for thirdparty self-posted wallets that will just take care of that problem for you I love when uh my job as a moderator when my panelists just keep debating and talking and going covering all our questions that's amazing thank you guys uh I think we heard some very interesting topics I think at the end we even gave you a bit of a glimpse into the the Dora framework which is not the topic of today debate

but is actually a very important piece of legislation which composes the whole digital Finance framework that we introduce in the European Union so some something important to to keep in mind there uh but then again we also heard about these new challenges when it comes to how to implement the thirdparty verification for self-hosted wallets and well I think what's and we can conclude with a few final remarks but I think that already shows that the industry is working together is trying to cooperate is trying to be creative as Lana was saying to come up with Solutions technological solutions that allow to comply with these strict requirements but as we discussed earlier which makes sense and should make our whole crypto

space a bit more safer so on this notes some final remarks from our three panelists what would you like to focus on as the final takeaway that our audience should be leaving with and be like wow that panel was so good well I'll share what I thought was the best remark that um I heard from ABBA um because I think it's worth repeating um Joanna said do not wait yes the deadline is December 30th of this year um if you only going to start thinking about this 2 weeks before good luck like you should be in a really good process now uh of talking to Providers or having things already up and running you don't want to wait thank you Elsa um

one of the most exciting uh presentations that I've given in recent times has been on some of the takeaways from travelable implement ation uh to a bunch of Law Enforcement Officers um and it's actually quite exciting there's a reason we're doing all of this y right so uh we uh our members get reported uh you know scammy wallet addresses um scams are on the rise as everybody knows and we're now able to see that there's been an absolute collapse in impersonation scams amongst our members because they can't because they've got their identity you know linked to to to to whatever wet they used um um what we have seen though is an increase in the number of virtual asset scams so you

know fake coins but it's the same perpetrators and so actually through digital fingerprinting Etc it can become very powerful so there is a reason for all this it's not just a massive pain for everyone and and just costs involved once the travel rule will be live in enough jurisdictions and everybody's working together we need to be sharing you know this kind of Intel with other Pro other providers law enforcement Etc it will be very exciting that's right stopping those actors that's right well to keep it short um my advice would be to look at the travel rule as something you want to embrace rather as another another rule where oh my god there are lots of requirements um and prevention is better than cure so if you start

preparing and organizing yourself on now get your processes in place get the right Solutions uh things will be easier for you to operate your business and then it isn't something which you fear so prepare get organized from before and your processes will smoothen out naturally rather than do everything in a rush and then have to treat all the errors from before all right so I think we can uh conclude on these great remarks and I think we all have some homeworks also right you just heard you have to get prepared you have to be ready the deadlines are coming up but you're lucky because you have some great travel rout providers here on stage that you can talk to if you need any

information you can always talk to me if you want to know anything about russels and the EU policy landscape and uh well we can conclude here with a big round of applause for our panelists thanks everyone for listening to us and thanks again to Victorian our team for a great 10th edition of the European blockchain convention thanks everyone enjoy the rest of the conference