[trustless://eil] Panel - Banks won’t go onchain until we fix privacy

Transcript

Um so welcome everybody before you all introduce yourself I want to give some context about this panel. So in my eyes and this is a personal opinion the big promise of Ethereum is going to be when it becomes the new financial rails for the world which means like it or not banks institutions places with big money the consumer side just like in the regular world of B2B or B2C usually B2B is the more interesting one that works doubly so when you're talking with pure money so um we need to talk about how do we get banks themselves and big institutions on chain? What is currently blocking that and how do we get there?

So, I'll start by letting each one of you introduce yourself. Let's start from Yakub and work our way back. >> Thanks. Um, thanks Tom. Hi, I'm Jak. Uh, I work for UBS which is one of the say biggest banks in the world like headquarter in Switzerland but we're obviously across across the whole world. Um I had the digital asset risk management practice out of out of Switzerland looking really across the whole spectrum of digital asset topics uh from the angle of risk management how to build the proper frameworks capabilities but also at a core of what I do is look ahead and basically how can we innovate and be part of the community uh Ethereum and across uh so crypto

community and really be part of the dialogue. So I'm really happy to be invited here. It's also a good sign that banks can have a discussion on those topics. So looking forward and to this discussion and any discussion afterwards. Hi, I'm Amsa work for ABNR, one of the big Dutch uh banks. I started within risk management. So same sort of background like Yakub. uh but also I uh I became active in in the crypto community uh investing in crypto and after a couple of years I made the switch to innovation department so we're looking at tokenization we're looking also starting to look in crypto so it's all uh all kinds of topics so stable

coins tokenized money market funds and our aim is to do as much as possible on public chains >> hi uh I'm Frederick I work at the foundation as the protocol security lead. I also co-chared the trillion dollar security initiative that uh the EF has been working on for uh for a few months now. Um that's where I met actually all three of all three of you through that project. So yeah, super super happy that we started the trillion dollar security project and were able to kind of get these conversations going.

>> Uh I'm Eric. I'm the VP of technology at Fireblocks. Um we're not a bank and we're not Ethereum. We're sort of the layer in the middle. Uh we provide uh a lot of different technologies including uh custody technology and like technology for payments tokenization. A lot of the use cases that we I think as an ecosystem want the traditional finance to adopt on the blockchain. We're basically helping them do this uh in and we basically believe in a lot of kind of like the same values that come from the blockchain world. So like we provide it in the self- custody for them, right? And then there we're probably going to be talking a lot about how it moves forward to other people from that point.

>> Yeah, I think we have a very varied uh lineup here. H also my name is Tomman. I'm with the EF with the account and chain abstraction team working on 4337 and EIL and well the trustless conference as well. I do product. Um so if you don't mind I actually want to jump right into something which I think is the kind of the interesting take here which is when I I think the big topic here is around privacy and so do you see the lack of privacy on blockchains as a problem for banks? I assume it is. But like will you only adopt private networks or privacy

preserving networks or even just public ones without privacy? How do you see kind of that adoption working out as we move forward? >> I'll try to start. I mean for for me the first question is what really privacy is and without probably giving any definition because I guess everyone has or would have it its own definition right it's more a matter of choice um than than really universal privacy when you apply this I mean it's and then it's equal along all the users of let's say Ethereum right and it's also same for for the banks um as a global bank we operate in so many different

jurisdiction That leads to tremendous complexity when it comes to what privacy is and how do we protect our own privacy, our privacy of our clients, privacy of any counterparties that we interact. It's a complex ecosystem, right? So there will never in my view will be one answer to that that question. Um and when it comes to choice then to to the other part of the question I think there is a world where all the all the different DT blockchain solutions can coexist and it will need to always be a choice of an institution a client or any any participant of the ecosystem to choose what it's right for for them. Um and that's kind of the

approach that UBS is is taking. We are exploring various use cases and various applications of the technology being both on public Ethereum but also looking at more private solutions and trying to figure it out what works best for us for our clients keeping obviously the the privacy of the information uh very closely in mind. >> Yeah, for us uh it's more or less the same. So it's also about uh compliancy to regulations.

So you don't want to uh be caught in u in in such situations that you can be front run or back run and it's for yourself as a bank not really nice if you get in such a situation but it's also um that the regulator they don't like that that that things happen that everything is exposed on chain and especially if you look at individual clients I I work with a lot of data with uh retail clients so if all their transaction all their intent is publicly uh known. Yeah, that that's not good also for the protection of the client.

So for example, you don't want to have client get uh wrench attacked because they did something on chain. So therefore the option to have things uh private that that should always be possible. So pure public that's a difficult case I think for banks but uh there should be uh yeah a mod modular option to have privacy. So a take on this uh some there were a lot of companies that believed that private blockchains are going to win because that's the only kind of blockchains that finance will adopt. Uh most of those companies are closed now. Uh because there was no adoption happening there.

Um and I think part of this is because uh I don't think banks are looking for a better database. Uh database are actually pretty good. Um so I think the important question is why do banks and financial institution even go on the blockchain and I there's probably a lot of answers but like I think one of this is they actually want the blockchain right they actually want the things that they get from there the ability to collaborate with other maybe even banks in a permissionless matter or in a not controlled matter by one of them and maybe they want access to liquidity that doesn't necessarily exist on their specific uh ecosystem. system. Maybe they want crossborder access when they only operate on some locations, right?

There's a lot of things I think banks are and again traditional institutions in finance in general go on chain because they see value in it and so I don't think they'll be segregated but for some cases they do need privacy right for some situations they do need more privacy than the blockchain gives right now and I think a core question um which comes to also this is like is it a blockchain level privacy or is it an above blockchain level privacy Because if your use case is just move money on the same chain, then maybe chain level privacy gives you the solution. But if your use case actually requires you to go between multiple chains,

the privacy on the same chain doesn't help. Sometimes it even like bad for you because it means once you bridge you lose privacy. So like like it can create a situation what if the privacy layer on this blockchain is not compatible with the privacy layer on the other blockchain. So I think there's merit actually to do on top of blockchain privacy uh like higher level privacy solutions as well. So but I think it's an interesting space of design. Um yeah um the EF is not a bank but I've talked with quite a few banks um in the trillion dollar security initiative and um I think one question is also what is privacy? Um this is the definition that

differs quite a lot between who you speak with. For some people that means complete privacy with uh what you're doing uh what kind of funds you have etc. While for many institutions that's not the type of privacy they're looking for as in like complete privacy. But what they do need is the privacy like you mentioned for for the customers and so forth. um but still having the ability to uh to understand what their customers is doing without actually displaying it to the public um and for for that I don't believe you need a complete privacy chain basically I think this is something that can be done um with what we have here

>> yeah I think Frederick touched on an important point where we're talking about privacy there's the bank's privacy uh towards other banks or other entities in general where they want to keep maybe their you know what they're doing internally transaction wise uh private and keeping the user's privacy and the user visa v the bank like their interaction with the bank and there's a lot of you're right there's a lot of ways to kind of think about privacy and what it means and I think [clears throat] one of the more promising technologies that you hear a lot about in that regard is zero knowledge so zk proofs and using that to kind of like having that maybe that happy middle ground where you can just kind of be private when you want to and not private when you don't. I'd love to hear your thoughts on how does ZK would

play into this in the future. >> Yeah. So, so for example, I would say with ZK, so instead of uh now you have a customer, he makes a connection with a third party and then somewhere the data is is uh yeah obtained uh from from all the customers and the data is sort of stored in a centralized uh uh place. But if you use CK, you can make use of selective disclosure. So you just ask him, yeah, is he above 18? Is he accredited investor? And uh maybe he's a he's a Dutch citizen. So only the least necessary information that's that's just uh possible to send without even storing the information in a centralized

database. I think at the end this is at least as a starting point this going to be the most kind of powerful use case that you can then build on top right if if I look at UBS working with across various tokenized securities and various distribution models it's it's always a question we want to enable the efficiency and peer-to-peer but at the same time we don't want to have access to all the information because it might not be desired from regulatory perspective uh so we need to understand to to your point the identity or certain suitability criteria of the client or an investor of a product um without really revealing any of the identity of of that. And this is a very powerful thing

with like a solution would be with the zero knowledge proofs and something that we're very strongly thinking about. Um but as obviously there's always a question like is this just the one use case that we're solving for or there is really something that can work at scale right and if we think about um I know exchange of stable coins in a regulated marketplace in Switzerland for example and whether rather than using a proper blacklisting or whitelisting approach whether you can add scale use your knowledge proofs so we can I think first step is really to test it on single very concrete cases and in a second stage think how to bring this at proper scale.

>> Um I I wouldn't limit this to a ZK question. I think I would say there's like two kinds of privacy at least in my basic thinking about it. There's like architectural privacy like I have data. I'm just not sharing it with you. I'm just not saying it that architecturally I decide this data is here, this data is here. Um and there's cryptographic uh privacy. When you say you, you mean the the bank or the user or both? >> Either or. General definition, right? And there's cryptographic privacy where there's like a bunch of like building blocks, right? There's like the Z, there's ZK, there's MPC, there's FHE, uh maybe obfuscation some days. Uh um so I think that uh uh we're going to see a lot of

cryptographic privacy usage across all of the use cases, right? like uh a lot of people are now waking up to to or not now but like in the last couple of years to ZK privacy but like Fireblocks we've been doing NPC privacy for a very long time right like uh you have a wallet there might be 50 people involved in the process of signing it but you don't know any of that you just see an ECDSA signature at the end and the privacy is not protected via architecture it's protected within with it like cryptography and zikk gives you a different kind of cryptographic privacy um but like you would like We need to understand the alternative of these people signing and single CDSA is like a multisig where you actually know there's 50 people signing and you know maybe the

rules that dictate who is signing each one of those transactions right so like uh this is something that like we believe in in a meaningful way is that giving that privacy to an institution is important. I think banks would have a very hard time adopting uh a process where their entire like a technology where their entire process is visible on chain to their competitors to attackers like you know so I think that's also a level of privacy I think the discovery of cryptographic privacy is like programmable cryptography in general is a huge change in the world and it's going to touch so many different things outside of blockchain too. So, oh sorry.

>> Yeah. Yeah. I was just going to say that speaking with these institutions etc. they are showing a lot of interest in CK privacy. Um they just have they tend to have a hard time grasping the concept and kind of like you say it's having a hard time to deploy and to to use it etc. So something that's being done is that uh Etherealize is uh working to kind of kickstart this process um and be able to provide this kind of let's say Lego blocks to institutions so that they can start enjoying privacy uh on chain in an easy way basically.

>> Can I just add something here? Um I I think it's on on one hand the challenges of adoption within traditional financial institutions is one thing right but I think even if we push for the adoption from institutional side there's always that regulatory oversight that or dialogue that needs to happen right so there is I would say within like it's a triparty discussion always it's kind of call it the crypto community let's put it that way categorize it for a second like this there is a trfy and there are regulators and if there is a kind of a willingness to have such a triparty discussion maybe in the context of ZK proves um that's how this topic can really success succeed right so it's not

only about technology but also acceptance of the regulators which we just need to live with >> yeah you actually kind of like jumped started to my next question which was actually yeah I was going to ask a little bit about the regulators themselves because like you said and you put it very very nicely about the fact that it's like a three the trillemma I would of like institutional adoption because yes obviously the crypto community is like all in on this banks are like well there's money to be made so yeah we like it and regulators like like pump your brakes right it's like always about that so the question is like for instance do do you think regulators actually want ZK proofs and all this privacy or or is too much privacy becomes like suspicious in their

eyes at some point like we we are kind of like I think the crypto community obviously and I think banks as well are kind of trying to see maybe from the users the individual's perspective saying maybe he doesn't want to share this with the whole world he can share it with us that's fine but not with the whole world but maybe the regulator is a little bit like uh not happy too much with that and I would say also there's a lot of other problems when you do decide let's say bank A decides to adopt privacy in one manner another bank decides to do it in another manner and you can have situations like where like one jurisdiction demands transparency for AML and stuff like that while another like mandates like more data minimization like GDP um GDPR. So like those are like I think the challenges around privacy.

So I'm kind of wondering like in terms of the regulation what are your thoughts on that? >> Yeah, I think that that's indeed one of the biggest challenges right now. So it's also like now I'm I'm from the EU. So you think okay you have the micro regulation and that's for all the 27 countries but within each jurisdiction within each country that's how they look at certain things it's totally different and some countries some regulators they have more understanding of of certain areas uh like for example ZK fully homomorphic encryption they understand it but other ones like for example the Dutch regulators it depends some of them are still like okay what what's this exactly and they're still at the stage of you So the technology of 2017 for

example so they still think in that way. So it's all about education also from outside and uh it's not al also not only just uh the regulator but also internally so within banks the the people who understand this technology that's yeah less than 1% I would say at this moment. Um maybe I'll ask like who here wants complete privacy like uh feels like they should have complete complete privacy? Okay, we have a few people. Who wants complete complete privacy for the terrorist planning an attack or their house? Okay, less people uh actually none. Okay, so like privacy is nuanced, right? Like it's that there's topics

that are not nuanced. uh uh there's rights that are not nuanced and there's rights that are nuanced and I think we need to understand that uh uh first of all regulators definitely think at privacy as a nuance thing by the way it's not like regulars hate privacy again there's like regulators who actually push for privacy but like it's definitely nuanced it's definitely much more use case specific and I think to some extent we all have choice each one of us chooses do we build a technology that thinks about privacy as this given right but understanding it will be used a lot for malicious actions versus people who say I want to build the kind

of privacy technology that acknowledges that privacy has also like less desirable aspects and tries to build around that I think there's a lot of promise in the in those places uh and it's probably going to be a tug and pull between people that want more privacy and people that want full transparency which by the way is helpful, you know, uh um like sunlight, uh you know, is is is great in that sense of being able to uncover what's happening in dark places. Um so I I I really see a lot of promise in those places where somebody designs and it's like in innovation space, right? Like the regulators are not going to invent it, by the way. Like for anybody who's thinking the regulator will come and invent the new way of

doing privacy that's good, not going to happen. We need to invent it and then we need to help the regulator understand why what we're inventing is actually good for people, good for humanity, good for their country and everything around it so that they help us like make it happen. >> Is that their consideration really? >> What do you mean? >> Hopefully that's their consideration. >> I Yeah, I Yeah, like listen, I've I've talked to quite a few regulators. I'm not going to say each and every single one of them is perfect. But generally speaking, a lot of them are people that just want to like, you know, protect and make sure things work well. And a lot of them have been bruised by a lot of things that happened in the past. Uh and so they're like not going to go through

that again, you know, like they make sure this doesn't happen again. And that's why the it's like a hard work to get them to accept things. Uh and it's hard because it should be hard. Sometimes it's too hard. And again, there are regulators that are not doing their job in the way they should be, right? Uh but like when they are, they're basically sometimes slightly hard partners. But uh I think for this ecosystem to succeed in like, you know, to bring in the massive financial uh ecosystem into the blockchain, it's something somebody here has to do, right? Like some of the people you have to put effort into this. There's a lot of good people that put effort into improving regulation around

cryptography, cryptocurrencies and cryptography and lately there has been more success, right? That there's more success in getting them on our side. >> Um, yeah, I just want to say that I I do think that you we need to think about privacy, but we should not take into consideration that sure it could be used by bad people if there is privacy. I think we should design it after the good people. Um for example, I am quite a strong proposer to chat control within the European Union.

Um which you know the official intent is that you know this will prevent people from uh from sending bad images etc uh over chat. But that also means that you know people who are not actually sending that will be affected by it and I think those to just take the bad people into account I think we need to be very careful about that. I a lot of a lot was said but just one thing by coming back to the bit of the original question I think regulators from my experience also talking to to to

quite a bunch um they're not there yet like they I don't I never heard a question about I mean maybe sporadically about zero knowledge proofs um it doesn't mean that they would not like the concept it's it's basically the regulators will come very often with with a And it's up to the call it the broader market participants to identify what is really the root cause of that problem and what is the concern and help build a solution right and it doesn't like the regulators will not give us all the solutions. They will give us a framework principles potentially if we're lucky and all the industry participants have

to work towards like educating the regulators building solutions for that and zero knowledge group might be one of those in terms of privacy might not there are various others that maybe we'll touch upon um but that's why the dialogue needs to continue and there is that educational element but needs obviously willingness from from everyone including banks to participate in that dialogue Yeah, I I definitely agree. We need to be much better when it comes to uh educating people. I think this is something that, you know, now is being done with the chat control. A lot of people are pushing back on it, which is awesome. It's not just a few people.

It's many many people in in this uh in this ecosystem that are pushing back on it. And we need to be as good as explaining uh privacy so that we don't end up having that uh regulated as well. >> Yeah. By the way, something cool that happened is that the United States regulators understood they actually have competition, right? And this is like a transition that happened in the last year. They were like, "Wait a sec, other regulations are allowing this. We're not allowing a lot of things. We're losing the market." And so like they also have some pressure there, right? again on some things depends but like they have some pressure there where wait a sec this is a very global ecosystem and maybe if we're not facilitating it in a bad way right we're not facilitating the

good parts of this ecosystem we will just lose the ecosystem to others like to their competitors so I think that's also something good that's like playing on the ecosystem side uh so like it's a very complex situation >> yeah I agree I my point was always when people would ask like you know years ago what happens if everybody bans it all the countries I always say it's like, you know, there's this kind of like game theory in place where it's a pull and pull and there you're not going to have the whole world agreeing on something. They can't agree on things that like we might think all thing that are, you know, good like I don't know things like around environment or nuclear weapons or whatever things that are like very dangerous to us. So when it comes to money, I don't see like all nations

agreeing on how we do stuff like that. So I was never really concerned about like them everybody banning it all at once. Um, going back to like this is less about the regulators, more about maybe the banks themselves. Do you see banks ever supporting full self-custody for the for the people for the individuals? Is that because we're talking about trustlessness? Yeah. Sorry, I'm pointing this at you guys because also because I know Fireblocks does in a sense self- custody you would say, right? It's like not exactly self- custody because you can help them out with the NPC, but it's close to self- custody as possible, right? and like you can't take it without them if they don't it's like you can help them but I'm wondering if banks in the kind of if that's ever going to happen where users

will have complete self- custody. I don't I don't know if it's going to be UBS position or my own view, but >> yeahition no official position. I I I know joking a bit but I think that at the end this is one of the value propositions of let's say decentralized network right and self- custody peer-to-peer exchange it's at its core right so there will be a world where I mean the banks will need to accept this that this is this is the reality whether they're going to support and find a way how to support their clients in self- custody maybe I don't know it's but at its to one of the the points that I trying to make early is all about choice and the

banks will need to also enable that choice whether they support it or they not and they they provide the custodial services for various range of digital assets um that's probably given we do that already UBS and many other banks do that but how to support properly more complex models with also the component of self custody or full cell custody um I don't know when this will happen it's also comes down regulatory uh various regulatory concerns around self-custody. Um but it again to another point, we should not preclude the industry including banks to think how this could really be enabled.

>> Yeah, I think there's also a usability problem here. Anybody who ever, you know, dealt with a self-custodial wallet knows that if the user kind of loses their key, then they come to the bank and say like, "Hey, I lost my key." And they don't want to hear the bank saying something like, "Oh, I'm sorry. It's just like self custody. >> It's not our problem. It's you self custody, right? No, but it's we have in big scheme of things and again uh maybe not everyone thinks that but banks at it core have also duty of care towards their client and it's also regulatory driven. Um so in your case how if it's our client and the client decides to self custody how we can support him on what level so that things like I lost my keys like I don't cannot access my assets does not happen right

like self custody first of all it's a legal term right like custody is a legal term and we need to be like we use it in this technical way when we talk about custody in the blockchain technology space for banks it's a legal liability there's like a lot of things they need to to a lot of definitions how it has to work. So like just want to acknowledge that for a second that it's not we're not exactly talking about the same thing. Uh but like uh if you mentioned not like an official Fireblocks thing but like my opinion I actually think Fireblocks this is one of the big roles that we play in the ecosystem. I think uh to some people it was like they were thinking that banks will go from being custodians in traditional world to like being uh fully everything on chain just

like me trading on unis swap and what we believe in is that there's like this a lot of uh uh gray in the middle and also there's a lot of process so like we shouldn't expect any serial institution to jump from zero to one what we expect them. What what I think will happen over time is that different dynamics of the market, some of them internal desire, some of them is financial pressure, some of them is like maybe competitive pressure will get them to adopt more and more of the onchain technologies in at their own pace and maybe some banks are faster, some are slower but like what I think is great about like our position in this ecosystem is that if you want to

create a custodial wallet right to your user, so you are a and you have a million users and if you want to create a custodial uh uh uh wallet for each one of them and then at some point you want to create a non-custodial wallet for each one of them. It's like a couple parameters on an API, right? You get the same infrastructure, you get the same process, you get a lot of the same stuff. So I would argue that it would be much easier for somebody that already starts to use the system in this way to slowly move towards things that are more again same for trading. You want to trade you have a you have an account on a centralized exchange you want to trade on a decentralized exchange. It can be just a few parameters on a on a on an

API call right so like that makes it much much easier. Obviously you have a lot of processes internally but I think that's like you know I do see a role to play there and I do see that there will be more and more adoption in some use cases not in all of them in some places custodial uh wallets it's just the best solution and that's okay >> when it comes to maybe the knowledge of of the clients right I mean as in the same way as when banks let's say banks sell financial products they need to verify whether clients have specific knowledge and experience in dealing with certain products Maybe in the same way the banks will need to verify whether the client actually has knowledge and experience to certain extent to call it self- custody. I know that it's like it's not a legal term, right? Self-

custody their assets. Um just out of out of the box maybe not sure if that's going to ever happen, but maybe that's the way to go. >> So instead of like an accredited investor like a responsible keyholder or something like that. So before we wrap up because we only have a few minutes left and there might be questions from the audience. I just want to kind of like in the nature of this conference which is trustless um I'm also wondering like um is it I'm I assume it's important for institutions that the infrastructure at the lowest level i.e. Ethereum probably that seems to be the case remains as trustless as possible.

What would be a deal breaker for for you guys if suddenly like this happened on Ethereum in terms of like uh okay we can't use this chain anymore as like the substrate of the financial rails I think something like uh like a full roll back of uh of the state that yeah at at at this stage of of the maturity of the chain yeah that that means it's not really uh trustless so that's that's a real deal breaker. Yeah. >> Okay. Anyone else?

>> I mean it's to to a bit that point. I think what what we're also looking at is basically to understand the whole like across various levels. What is the kind of the governance setup of of of a blockchain? What are the the kind of centralization vectors or decentralization vectors and also trying to find a bit of the sweet sweet spot. a bit to to that that point is basically would not accept maybe too much centralization and then someone taking a decisions maybe not in context of Ethereum specifically but other blockchains to make certain changes state of the blockchain that would influence us or or our clients there's the other spectrum of full decentralization what what it means right maybe on a different point to make um I think we would never accept not to

be able to make choices how we protect data how we how we interact with the blockchain, right? Um if that's taken that like you lose that trustlessness and flexibility and that would not kind of be the the desired, right? So we still want to choose kind of maybe with whom we want to interact on the blockchain. Even though on that foundational layer it's open permissionless but then being bound by specific risk appetite, jurisdictional requirements, we want to make a choice with whom and how we interact on that permissionless uh layer.

>> All right. Um do we have any questions? >> No, we don't have time. >> Okay. >> Well, thank you so much for joining us. I think this was very insightful into like where we can go from here in terms of uh onchain adoption in institutions and uh thank you very much. >> Thank you. >> Thank you. >> Thank you.