TRUST: The Industry's Solution to Its Travel Rule Problems

Transcript

the industry and regulators try to work around that and find out how to regulate in order to avoid financial crime, right? Like rules put being put in place and rules like the travel rule, right? And we've brought you an amazing person, Laura Hildebrand from Coinbase who leads a team actually fighting uh financial crime and she has some thoughts to share with you around trust and around the travel rule problem. So please put your hands together, a round of applause to Laura on stage. Thank you.

All right. Hi everyone. Awesome. So, my name is Laura Hildebrand and I am a compliance officer at Coinbase and one of the co-founders of Trust. Trust stands for the travel rule universal solution technology. Um, and I've had the privilege over the past seven years of helping to design and build trust at Coinbase. So, just of curiosity, how many in this room are familiar with the travel rule? Okay, great. Good. Good deal of the room. Um so just as as background for those of you who are not as familiar um the travel rule is a set of regulations that has long applied to the fiat tradi world. Um information that banks are

required to share with one another when you are sending funds from one financial institution to another. So over the past um several years regulators have begun implementing travel rule requirements for crypto all around the world. Um really a lot of this began back in 2019 with the FATIFF, the Financial Action Task Force. Um and then a number of different jurisdictions including the US, Switzerland, Singapore, and many more starting to um adopt travel rule requirements for crypto along with VASP licensing requirements. Um and so really what we've set out to build with Trust is very similar to what the banks built with Swift back in the 1970s. So the banks built a coalition to essentially

replace some of the very unreliable and manual systems that they used to use for international payments. Um similarly, trust 50 years later um was formed by a coalition of VASPs including Coinbase and many other leading exchanges to really solve for how do we uh comply with the travel rule for crypto which inherently is very different than bank wires and uh traditional fiat payments. Um so what we did is we came together and we built an industry-ledd solution. Um we really took the approach of how as an industry can we collectively solve this challenge? Um and how can we do so in a way that's really built by VASPs and for VASPs and prioritizes uh uh customer data security and data privacy.

Um because at the end of the day with travel rule compliance because we are obligated to send our very sensitive customer information, their name, their physical address out to exchanges all around the world which are subject to very different licensing regimes if at all. Um we really wanted to make sure that our very sensitive customer information was being protected both in the actual transmission stage and then how it would be treated by that institution on the other side. Um, so we've built trust and it's become one of the largest networks um, from a travel rule standpoint in all of crypto. Um, we've taken an industry-ledd uh, perspective here. Um, although I work for Coinbase, um, this is really a coalition of VASPs that came together um, to take an industry-ledd

notfor-profit approach. So, we've taken a very different um, perspective than some of the vendors in this space. Um, we felt like as an industry, we know our needs best. We know how to protect our customer data and so we wanted to apply those principles to how we solve for travel rule compliance. Um again everything we've done we've really approached through the lens of data security and privacy. It's really at the core of everything we've built that we'll talk about today. Um including the counterparty identification mechanism that we built which was one of the core challenges that we had to solve in order to figure out you know is the transaction even travel rule eligible and if so where do we actually send the information and how do we send it?

So here is a look um at our global membership. Um so we uh launched trust initially in 2022 with just around 20 members. Um in just a few short years we have expanded to 144 members across 28 different countries. Um we're really proud of this network that we've built. Um, we have many of the largest and most trusted players from all around the world. Um, including Coinbase, Kraken, Fidelity, Robin Hood, Revolute, Gemini, the list goes on and on. Really vast from all different jurisdictions. Um, 28 jurisdictions here. Some of the largest include the EU, the UK, the United States. Um, and then we're seeing lots of new jurisdictions come online as

regulators in those countries start to implement travel rule requirements. Um we really feel that the success we've had um with the industry's adoption of trust is because of this vast blood approach that we've taken and the emphasis on data privacy and data security. Um we've even attracted some of the largest banks around the world. Um as you can imagine they have a very high standard when it comes to choosing um solutions to partner with and so we're very excited to share that. Um our members also include entities like BNY, Bank of New York Melon, um Fidelity, PayPal etc. So really really great progress in just a few short years. Um and I'm sure as you can imagine um you know all of us up here are competitors and so if you can imagine sitting down

with one of your competitors to negotiate a contract and build some sort of mutual technical solution that is quite difficult as it is but when you take lawyers and engineers from dozens of your competitors hundreds obviously it's it's a big challenge to get everyone on the same page. And I think I I probably earned an honorary law degree from from these negotiations. So um trust has really uh you know not only helped the industry solve a very complex challenge with travel role but it has built trust amongst the industry pun intended.

Awesome. So looking at the actual challenges that we had to solve when building um trust to solve for travel rule. There were kind of three core issues or or challenges that we were looking to to solve. The first is counterparty identification. So, I'm sure as most know in this room, when it comes to crypto, customers are accustomed to telling you, "Here's the Bitcoin wallet address that I'm going to send to. Please send my funds out." Well, there's no inherent mechanism in the blockchain networks um to actually figure out who owns that particular address, whether that wallet belongs to another VASP or to a self-hosted wallet.

There's no central source of truth. And while there are tools like blockchain analytics, they're not comprehensive. they're not 100% accurate and they don't solve for things like brand new addresses. So we we first had to figure out a way and a mechanism to build to securely identify wallet address ownership with 100% accuracy. The next was secure data sharing. So while the banks have had networks like Swift, Fedwire for decades that enable the actual transmission of this data, there was no infrastructure in crypto to actually send this information. So we had to um envision and design this architecture in a way where we could um on a decentralized basis share travel rule information so that we avoided

creating a central honeypot of travel rule information that would be an attractive target for hackers. And then third we have to figure out how do we actually do due diligence on our counterparties. Um, you know, in banking there's the Wolfsburg DEQ and then every bank has their own gold standard where they add, you know, their own 150 questions. You know, in crypto, everyone is subject to a very different licensing regime. They're subject to different regulatory requirements. And so, we had to build out a way that we could do sufficient due diligence on our members from both a compliance as well as a data security and privacy standpoint to make sure that they're actually going to safeguard the travel world data appropriately.

um really critical to solve for these things because the last thing you want with travel rule is sending your customers very sensitive PII data to the wrong counterparty. Um we definitely see that happening in the industry and so really core to us to build in these very important security and privacy uh protections. So quick overview of trust and how we actually solve for these challenges. Um the first around counterparty identification. So we took the approach here of creating um a secure way that VASPs could actually share their addresses their their crypto wallet addresses that they use with one another in a hashed format and where they have to actually provide a digital signature to cryptographically prove those are

their addresses. So, we really wanted to take kind of a crypto first approach here and leverage um the very powerful tools that cryptography offers to be able to actually definitively prove that if hey, Kraken says this is their their address that it actually is their wallet address. The next was the secure data sharing. Um so, you know, there's plenty of methods out there in the world to share data securely and so we didn't want to reinvent the wheel here. Um, we leverage encrypted peer-to-peer data sharing channels through API where Coinbase can directly connect with Kraken or Gemini or PayPal, encrypt the data with that counterparty's public key and then share that information with them directly. That allows us to again avoid centralizing data and sharing that

data with thirdparty vendors that not only um creates again an attractive target for hackers but also can act as a single point of failure for the entire crypto industry. Um third uh one of the things that we most recently built for trust um over the past year is what we call the trust hub email flow. Um this is acknowledging the fact that trust members and vasps around the world they need to have as wide of a net as possible to be able to send travel rule data. Um including with non-rust members. So for reasons like the fact that there are so many jurisdictions that still don't actually have travel rule requirements in place or there are VASPs out there in the ecosystem that use alternative travel rule solutions. We built TrustHub to enable our members to be able to still

automatically share data with those counterparties that are not in trust in a way that still upholds the very important security and privacy controls that we built into trust. And then finally, we built our legal and governance framework that both um serves as a means to conduct due diligence on our members through the support of a third party that is neutral and independent. Um as well as a centralized legal contract that all members sign in order to join that governs how they use the solution. Um and then our cost model which we've again taken a a very different approach here where we um really try and make trust as affordable as possible. um including we recently launched over the past year a model where we offer trust for free um to smaller and startup vast because at the

end of the day here um we really want to help the entire industry achieve um compliance with the travel rule um and and I think we've uh built a great solution to do that. So um that is a bit more about trust. We'll talk more about it on our upcoming panel um around the challenges of travel rule. We feel that with trust, we've been able to help the industry move from zero compliance a few years ago to really substantial compliance in just a few short years without compromising um our data uh our customers data and their privacy. So, thank you all.

[Applause]