The Unseen Backbone: Compliance & Transaction Monitoring in Web3 Banking

Transcript

Great. So, next up um the unseen backbone compliance transaction monitoring in web three banking. This is a very relevant very interesting topic. to I'm glad to welcome on stage an esteemed panel of experts starting off in Julia Bondareno from samsub Lucas Bchart from 21 analytics Dr. Del from Miracle Science, Dominic Hoffman from NME, Daniel Rosa from Banker Zaratini and the moderator for this panel will be Ekatarina Anthony.

Eatin is also board member, fellow board member of the crypto valley association and the chair of the AML and compliance working group in the crypto valley association. The floor is yours. Enjoy. Thank you very much for great introduction. Um hi everyone. Uh good afternoon. Um let's try to make compliance uh not only boring thing but also fun. I ask my colleagues of the session to be creative today. Just a couple words from my side. when in 2017 I start to work with crypto and uh to do compliance um people really especially

bankers they were if they know you are from compliance and you do crypto they just take a distance 15 mters they don't want to talk to you and you feel like you are very different today they really want to talk to you and they invite you for lunches just to get some insight how to manage crypto and how to help clients And I think it's great we have today experts from the different parts of industry, people who produce reports and uh people who work with real clients in banks. And uh I suggest we uh you know we go one by one you can introduce yourself uh in the same time you can already give your idea about uh what basically for you web3 banking and

compliance for web three do we really have compliance and web3 banking we start uh from Dominic okay thank you very much everyone and for having me here uh my name is Dominic I'm a legal partner at MME I'm in the crypto space since 2016. So had the chance to like start with the initial wave of of the ICOs of the big layer one foundations and grow more and more into regulated business as well and hence learn a bit from the entire journey from there was almost no regulation to more and more sophisticated compliance regulatory frameworks applicable and for me as a lawyer and as like the standard should be it's techneutral so there is

no like web three banking or web 3 compliance per se but the technology has specific speific challenges and specific solutions it can provide for compliance work. So I would say it's tech neutral but always with this technological understanding you need to have of how web 3 really functions to apply the rules. Hello to everybody. My name is Dan Rosa and I work as a director in the private banking department of bankazaratini Lugano. Um since 2017 I have been in charge of a specific desk that deals with blockchain related uh clients. Uh

what is web3 banking? Uh features that traditional banks struggle to understand. We are here to help you. I hope. Okay. I'm Lucas. I work in Bitcoin since 2014. And I say Bitcoin because back then there was no crypto and definitely no web 3. That's all. And we like to make up new terms every few years for the same stuff. I think this is rather not helpful. Um five years ago I've started a company called 21 analytics where we do software for travel rule everything transfer in out. um have a tech background like most people that are in Bitcoin for a bit longer and uh yeah web three

[Music] banking in let's say Bitcoin banking makes it a bit easier also if you hear before most banks actually they at least start with crypto that's what they do it's also easier to understand but in general it's doesn't matter which asset it is at least according to FINMA same should all be the same but uh maybe in practice Not so much. Yeah, I'm sure we get into that. Okay, Julia. Thank you. My name is Julia. I'm here with Sam. We are provider for banks for crypto companies and we started um also already many years ago with crypto companies as a QAC provider just on boarding parts.

But now looking at how web 3 evolves, how important is to see what happens beyond on boarding, we are also discovering um web 3 space and showing how companies can comply it. So we are partnering uh with clients and partners like America science and 21 analytics and others just to provide the solution for web3 banking which will help them to understand better what is happening with the money inside the institution and when it's leave the institutions also what is happening there. So three for us I think it's um the big field of opportunity which is often confused uh between different parties. So someone

just relate only to crypto when speak about bet 3. Some others think that it's purely defy in protocols technical stuff which is not related to any other activities. So for me I think I'm here to define it with you. Yeah. Hi everyone. My name is Yusttos. Uh I come from a research advisory background. uh been in the blockchain analytics space since uh 2021 and um yeah looking forward to this discussion I think uh echoing all the other thoughts I think web 3 there's not an official definition for web free banking yet so for me it's about the intersection I think between on and offramp and web 3 experiences I think the two haven't been seamlessly linked

just yet and I think we're seeing that interception starting to build out as we see wallets natively offering on and off ramping opportunities so looking forward to the discussion Great. So what I understand from your introductions we have a crypto banking so we should not deny it. The question is uh how to deal with it and we have maybe not majority minority of banks who already trying to deal with uh crypto and they all a bit scared they don't have enough resources and I immediately think about AI why don't we just teach AI to do this and uh we can just sit here talk and they it will check millions of clients per per minute I don't know and give us all the

information statistic and block uh transactions Sounds a bit uh you know like a future but uh maybe it's a real uh situation for us maybe in five years. So what do you think about automation and uh possibility uh you know for on boarding and transaction do you do you see any challenges or is it possible just to automate everything would of course be amazing if you could do it. Um but to to be honest the point is a bit with the with all the AI applications you need to uh be able to explain how it works and to be able to like supervise the results of of the

AI tools and that's also like a requirement FINMA has already um published in this regard for AI in finance in general and it's in line with global regulatory efforts but what I think it's a it will be a staggered approach so first you can start with simple tasks that someone also in the traditional words would have to uh supervise. So where you can say okay I need to look at the result and I still need to uh double check. So then you can like save the first step and then on and on the better the tools get the better supervisory like controls get you can automate more and more and it's also something I think we come to on later very important that also regulation and compliance adopts technology so to make

it smarter there are new possibilities and I think you can win a lot by applying new technologies to compliance and make it really efficient. I think it's a it's a good point. Daniellea, you work in a bank. Is regulation for example in Switzerland allowed you to automate uh compliance for and to be more friendly with crypto on boarding. Uh I know that uh you work with Swiss Banking Association. Uh you help a lot uh with new guidance for uh banks. Maybe you give give us couple words about it.

Yes. Yes, of course. So our crypto activities began in 2017 uh when we uh started meeting the first clients that had an exos with blockchain. already. Then the big challenge of those years was to figure out how to deal with new digital business models and also how to integrate their specific features into a banking environment that needed to comply with fast evolving regulation.

Being part of the crypto valley ecosystem was a big support because we had the possibility to exchange our views to interact with other stakeholders and also to share concerns. Thanks to these interactions, we were able to adopt our first internal directive for the on boarding of token issuers, exchanges and cryptoreated clients already in 2018. um let's say that thanks to our practical approach and uh indepth u knowledge the Swiss banking association uh invited us to contribute to the

revision of their guidelines for the opening of account in favor of blockchain companies. uh they had released the first edition just a few months earlier and we joined the group in order to uh provide additional guidance uh specific instructions tangible instruction to banks for the onboarding of cryptoreated uh client. uh it was six years ago and now six years later I can tell you that I find those guidelines to be still relevant because still today they provide valuable valuable insight. The situation

has completely evolved. The landscape today is completely different with the rise of defy and the consolidation of web3. Additional challenges emerge. However, uh the compliance people I know has the least bored people I know because they really love this part of their job to to always face and overcome uh challenges. Of course also an alignment of views of the industry in order to work together towards standardized solution is also quite quite important and I would also would like to stress the big effort and work

of this sector association as crypto association but not only. Thank you very much. I think that uh we need to look at this guidance again and maybe they need to be maybe updated on a yearly basis because we have so many changes all the time and I know that painful uh topic is for us transactions especially in Switzerland because we are very different from many jurisdictions even we are more strict than FATF suggest us to be and um Lucas I think you can say some words about uh what can we expect and um in terms of travel rules and monitoring the transactions what's your opinion will the technology win or

regulation well let me go back to the AI question quickly because I often see on LinkedIn influencers about software engineers going to be obsolete because of AI those influencers are usually not software engineers so me as another compliance person I'm going to say now compliance people are going to be obsolete thanks to AI no I'm just joking Uh I think it's a good addition like with the software engineers if you don't know what you're doing it's not going to be good enough. You still need to be an expert. So at least for now and for a very long time probably. Um yeah travel rule I mean is the same as every year. It's it's very much a pain for everybody involved especially in Switzerland. I

mean I say that on panels all the time. Finma really hurt our industry by enforcing it just on Swiss players. Do we have Finma here? I mean they probably hear that before from me so it doesn't matter. Um by enforcing it only on Swiss players who are based in Switzerland and all the other players being Crock and Binance all the big ones can serve Swiss customers don't have to follow the rules. So it's really like hurting ourselves. While the EU at least said like okay if you have customers in the EU you need to follow EU rules. Okay, the EU can also enforce it much better than we can probably, but this really hurt our industry. I do not think it was a coinc or I mean it was an accident. They

really knew what they're doing or at least they could undo it if they wouldn't know. And um yeah, it doesn't look like this is going to change anytime soon. Although there is there are I mean but if we look at uh let's say escape Switzerland uh in EU do we really see the usage of travel rules intensively and maybe we explain to people from banks what does it mean travel rules just couple words oh yeah I mean it's just if you transact from one financial entity to another you also need to send along originator and beneficiary information so what you put in your IBAN name and address that goes through Zift or SIP or whatever that's built in in Bitcoin it's not built built in. So you but you still need to send this information. It's not really what

Satoshi imagined but of course the regulator said you transfer assets from one place to another. You need to do the same doesn't matter what the asset is. So it's also another surprise from compliance point of view. It's good idea to have it like a swift but we don't uh make it for everyone the same. We still have different providers and we can uh be uh you know like create creative. It's not like one one entity control everything. Yes, this is this is good. But as I understand we still not progressing. Yeah. With the travel rules which which big help for compliance but not there is progress but I mean EU at least it helps Switzerland that the EU players

also have to do it but a lot of them are rather relaxed still. Yeah. I think it's because of grandfathering. um part when they say yeah we're taking it into force so now everyone should be compliant like since December last year but then like oh wait in Europe we have so many countries and they're so different let's give one country is like 18 months then others 12 months others 6 months some others nine months so it's really confusing sunrise effect even for the com like technological companies when um you at the transaction you want um to verify it according to the rules but different

countries adopting it differently. So one was can be compliant other will not have adopted technology and the technology is not implemented then they needs to uh adop like use this risk based approach and then question again what is risk based approach should we consider this transaction high or not high because even like thresholds for the transactions are different I guess you can also just yeah but for the grandfathering I mean it applies to Mika but not to TFR at least in our opinion but this is always depending which company you ask most of them I mean the smaller crypto companies you know sometimes five employees 10 employees they're going to avoid it as long as possible because it's also al always a

question should the company be regulated by this rule travel rule omea or not and then we need also to group them between each other so who is regulated when the transaction apply like should be checked and when it's not so for instance when it's but but do you think that regulator the role of regulator to control uh when we do something. They need to control if we do it right, if we comply, if we do all the checks but not at the beginning. Yes. Just before we start to do anything they will come back to you later in it just uh sometimes I feel like compliance officer also that we have uh too much regulation that it's prevent from starting business and uh it's a question what's going on globally. you travel a

lot and what's a I also know that for many people it's a black box you know how we identify wallets how we uh basically allocate the risk and what's your experience uh where what is the direction with compliance in the in the in area of wallets and uh identifying and uh how we uh tackle defy for banking Yeah, I think that's a really good question. Um, considering that like the Trevor rule basically tries to make the whole blockchain world transparent and understanding like which wallet belongs to which owner, whether it's a private wallet or an exchange made owner, the

whole infrastructure of the blockchain was set up to not provide that information to begin with. So, we're really trying to turn the system upside down and I think that's a huge challenge on compliance people trying to really implement the transparency that wasn't intended to be there in the first place. So, you know, I think it was a bit rushed to expect the enforcer of Trevor to be perfect to begin with, but now I think there's more and more systems like sums up um 21 analytics and other providers trying to help with this um to provide this transparency and the exchange of information between service providers. And um yeah, when it comes to web 3, I mean, web 3 was meant to be a a DeFi space, a space where people have a completely different experience by showing their identity via the wallet.

And I think this connection with the travel rule kind of bridges that um transition where your identity is linked to your wallet now versus your wallet being something that is not associated with you. So that's interesting from a compliance standpoint. But this is a good question maybe Dominic to you as you are a lawyer. Uh what's uh how we can bridge real banking sector with defy for me sometimes I I I don't understand how we can technologically wise regulatory wise because defy by default is not regulated.

Exactly. Good question. So what we see and it's it's a global challenge. So we have often contact with a lot of projects which are located outside of Switzerland and they often face the same problems and in case of DeFi the main issue is anonymity and source of funds. So if you have like a credentially supervised institution, you have an issue to interact directly with something where you don't know who is behind this and where the fonts are deriving from. And generally there are like two layers to differentiate. One layer is a institution interacting itself with DeFi. That's quite difficult at the moment due to like the due diligence duties they have to identify the counterparties to know with whom they work. Um, here you can work for

instance with closed pools. That's not so interesting outside of the institutional world because you want to get as much liquidity into it as you as you can. But also uh new ideas are coming up about zero knowledge proofs where you can at least ensure that only verified persons are in the pool. You don't know all of them but you know a certain standard has been um been applied. And that's something interesting to discuss with regulators how this could be evolved. But other than that as a credential supervised institution now you have an issue if you want to directly engage. The second thing is if you um have clients which have interacted with DeFi and you want to onboard their fonts, you also need to

check their source of funds um you make have to make a wallet uh checks um where the fonts were, whether they have been tainted and there is always a bit of thing how deep all these chain analysis tools really go into the D5 space. So do they just pose a flag has interacted with a lot of DeFi? you have a flag and you don't know what should I do shall I onboard it or not and likely not if you don't have the resources to go deeper into it um or will there be like a more detailed assessment because also within the pools you can check where the for sources of the funds in the pools where have they come from are they fonts which have been derived from a hack or from from fraud and you can get a lot of

information out of the blockchain and that's so interesting of the blockchain um technology there is a lot solutions in the technology to a lot of compliance pro problems which I would propose should be more and more leveraged to really bring that on. You can look very deep into these pools and also I once tried to argue that there are even dogmatic rules which say you can't even do money laundering with the D5 pool because it's just one additional step on a paper trail that doesn't really obiscate anything. But of course for regulators there needs to be more confidence in that. But when you list all these requirements, I just imagine if you are normal compliance officer in a bank for example, how can you deal

with all this? You need a special knowledge. It's absolutely like a new profession. So we will see that we will have a shift in what will be the requirements for the compliance officer in in the future. So maybe Daniela, how the bank uh preparing for this? Do you have a like send people to the IT schools or what's happening really? Okay, thank you for this uh question. When we started uh offering um services to crypto clients, we got a lot of criticism from fellow bankers and we really struggle to convey the message and how transaction monitoring works in

uh web 3. So uh a important caveat I'm not a compliance person so forgive me in advance if I'm not using appropriate terminology. So um KYT monitoring and risk assessment are fundamental aspect of compliance along with KYC. This is the case when banks are involved in cryptoto crypto transactions, but also when they accept fiat transactions as a conversion of um of crypto of of trades as a traditional bank aiming to transition towards a more hybrid model by integrating web three uh features. uh

we seek the opportunity to offer to our clients the possibility to deposit crypto inside their bank account. In order to be prepared, we have already drafted an internal directive already audited by Ersten Young uh that outlines specific uh crypto compliance measures to be uh carried out. And this directive already serves as a reference when we accept um crypto related fiat transactions. So uh KYT uh monitoring is performed through the uh

use of crypto forensic tools. So um we do evaluate uh the uh history uh the transaction history of the wallet in order to make a risk assessment. Uh we do evaluate several risk dimensions uh including direct and indirect exposures to scams to darknet to ransomware illicit addresses sanctions and embargos just to name um a few. uh and when a blockchain address uh interact with a centralized entity, it is also important to make a due

diligence and a risk assessment on this centralized identity uh entity. It goes without saying that with the rise of defy, the situation becomes even more complex. So when a blockchain address has been exposed to a certain degree of defy, of course additional uh evaluation needs to be uh made. We tend we tend to um apply a case by case approach and when we find blind spots we usually combine traditional compliance. So it's always

important to understand source of wealth, source of fund and having a clear indication of the client himself. And we combine these traditional compliance checks with enhanced uh KT monitoring in order to be able to detect specific pattern behaviors and transaction history checks. Thank you. Yeah, I I think I would like to add on this because so Mo Science is a blockchain analytics provider and like one of our key challenges is helping the people to use the tool like effectively and I think the point that was just made uh by Daniela is that you know that's a

really steep learning curve for a lot of people and there's trainings available but yet like being able to have a sound judgment based on what you see on chain is really difficult like Dominic mentioned especially when it comes to DeFi when you have someone that you know has done memecoin trading maybe he's been active on various DeFi pools. If you come to a bank today and say, "Hey, I made you know 100,000 in the past 12 months on trading, on dexes, on arbitrage, that's a really difficult thing to prove." And then having a compliance person verify even if you come up with your full spreadsheet of transaction hashes, it's still a really really big uplift. So I think automation and having abilities to make this crosschecking easier is really essential to allow people to you know have the

chance to become part of the the the banking services to then have the ability to prove themselves and also to scale like the official transaction monitoring programs like when you ask CEOs you know what's the key challenge in compliance is scalability because you don't want to have 500 people working in compliance you want to have 500 people working in like revenue generating aspect. So I think that's a really interesting point you made in your what I hear we need automate and outsource right. So Julia you I think sums up is very successful case because uh I I try to subscribe to your services I waiting already one week to get the answer. Um it's because you're overloaded right?

No. Yeah I'm deeply sorry even our automation has a line because we also need to do due diligence. No, it's it's it's a good sign. You know, you are very in demand. I'm not criticizing you. It's crazy. Now we're over 1,000 people and demand generation is working well and then it's all stuck on the compliance as well. We're doing due diligence still sometimes really for a long time because um of the demand but again coming back to the automation and also like mentioning AI it can simplify work of the compliance teams and there are tools that can combine different solutions in one place and all risk like um approach can on m metrics and everything that are

used by compliance people can be put into the policies but still I personally believe that we cannot fully get rid of compliance people because we need someone to put this policy in the AI tool and we need someone to carry this responsibility and this is the key I guess um direction where we as a provider going. So we want to make compliance people life easier. So they don't take all these hashtags and don't look at this. They just write policies, automate them, prove that it's working policy and just control what is happening again being more scalable in

that regard. Yeah, the regulation uh suggest us that uh there is a compliance person, it's responsible person. It's a final decision maker. But I still believe you know if you have uh 10 or clients like in private banking you do it not on the active mode but if you have thousand clients per day I'm sure you have to automate. I can't imagine the IML officer sitting and just clicking in each you know case uh because he has to prove thousand of the cases in one hour. It's not possible. So I still believe we can get to the point that the regulator will approve automated IML officer which will be AI probably and smart contract would be

cool then for our companies I think it's just a fantasy but Lucas because you are IT related person tell us will we have the IML officer who will be artificial intelligent I mean who will pay the fine in the end you know if something goes wrong uh the owner of the business of course. Okay. And he will go to prison if something wrong. It's it's his responsibility. But the question is how we make the process automated and then it's a scaring because if we can automate everything when we have a consolidation of the market because we don't need a lot of uh institutes right to provide services probably I think if you now as a bank

focus on what is really decentralized finance meaning no website no CEO no mailbox there's only one that's bitcoin right if you only focus on bitcoin which is like we hear from bank 88% of their traffic anyway or if they're what people buy, then it's much easier. You can automate so much more. H you don't have all this. The risk scores are much easier. Everything gets much easier if you just focus on Bitcoin and you also make the most money with Bitcoin. So, as a Swiss bank, I just focus on that and you capture most of the market and you leave the Trump tokens to Binance and uh the others.

Yes. then you can also have a way more automated compliance. Sounds good. I think we have I can see four minutes left. What I suggest each of you just give the uh maybe advice uh to the industry uh just short one. We start with Dominic again. Thanks. So my advice or wish so to speak would be um regulation is coming more and more. It's a global phenomenon. So we also had calls with Cayman councils which said okay this company we cannot set up in Cayman because of the compliance issues.

So it's coming globally and I think it's very important at the moment that we build smart regulation. So we take it as an entrepreneurial challenge. We don't say it should be as low as possible. No it should be efficient but it should not hamper innovation. It should not hamper business. we should leverage all technological um elements which we have what the blockchain provides what AI automation provides and to find a solution and to build solutions which make a very sound compliance possible and on the regulatory side it would be very great to have like an openness to think in this new possibilities as well.

So not to go much lower than today, but to find another way to to achieve the same result more smarter and more efficiently. Daniela. Uh, my advice to the web three banking industry is to leverage technology to enhance KT monitoring, to work together towards standardized compliance solutions, and to collaborate with regulators when possible. I would say if you're a bank that does crypto but do not allow for transfer in and out meaning only custody and brokerage you are not offering anything

that is more interesting than just an ETF okay a Bitcoin ETF I mean you giving advice investment advice to compliance people I I agree with Lucas I also totally agree with Lucas but um I will give Another advice that we need to build feedback with regulator with banks with technologies that they use how is it working does it actually working well for everyone what's works well what's worked bad and don't be afraid to experiment and then just to say like yeah we tried maybe it didn't work as we expected but still we are on the right direction so I think this is um what I

would suggest Um yeah advice I I think one thing I'd like to address to the banking or financial institutions in the room is that I think web 3 sounds really scary but actually when you work with the web free companies a lot of them doing transaction monitoring already uh to give an example uh we did an integration one of the leading web 3 wallets they're screening every transaction that happens either on their routing contract for staking or swapping so you know there's obligations as soon as there's custody and I think when you talk to wallet developers, developers um are really focusing on attack but then there's also the evolution of you know you have to really make sure that any money that is being used by your wallet is also safe

and sound to use and I think that will help with the connection bringing web free and banking together like understanding that there is actually alignment of what the eventual standard will be so I think that is something I'd like to put out here which is more of an insight rather than like a direct recommendation but I think it shows that you know there will be one understand that one day we're on the right track and I think web 3 will be safe to use moving forward. All right. Uh let me conclude. Um I we don't give financial advice but ETF is a good uh thing to consider you know not because of compliance just in general and um I think that the uh tools like sama or uh any other tools will uh

evolved and uh probably take more roles in the uh current u on boarding and monitoring where the banks they don't need to probably hire a lot of people. They can just outsource uh the compliance function and uh automate it as much as possible. But we can't probably automate everything. We still need human uh factor. We need to have people sitting and controlling the technology and um yeah and we need to use technology in a wise way. And what is important uh we have to uh communicate with regulators and try to develop uh

more more let's say applicable possible standards which uh not only uh looks good on paper but we can use on a in a practical experience. Yeah. So it's a zero minutes now. So, thank you very much for being here and I enjoying talking to you guys. Thank you. Thank you.