Crypto AML: a complex but worthy compliance effort

The Financial Action Task Force (FATF) will review in June 2020 the state of adoption and implementation of the anti-money laundering (AML) standard for virtual assets (VAs) and virtual asset service providers (VASPs) issued in June 2019. This includes the so-called Travel Rule, conceived to extend to VAs and VASPs the quality of transactional compliance achieved in the fiat transactions world with the SWIFT messaging system. The industry is currently dealing with the daunting task of creating the technology needed to enable full compliance. More time is needed to bring it to market and see it adopted. The regulators should be pragmatic during the transition phase and focus on creating a level playing field in order to minimise arbitrage opportunities. The industry will benefit materially from swift and seamless compliance because the Travel Rule establishes a distinction – in terms of compliance quality – between ubiquitously accepted fiat transactions and still largely mistrusted cryptofinance transactions.

Amongst the regulatory developments of the past few weeks, we highlight analyses from international and national regulators concerning retail central bank digital currency (CDBC) and analyses related to stablecoins.

In June 2019, the FATF extended to digital and crypto transactions the standards applicable to traditional banking transactions and typically complied with through the SWIFT messaging system. Rapid compliance is key to preventing money laundering activity via VAs and is desirable to enhance trust in the underlying blockchain technology and the cryptofinance applications it supports. These results will be achieved only if an international level playing field is ensured. Timing is of essence, and depends on when the required technology is made available. Initiatives are underway, including in particular in the Crypto Valley in Switzerland. It is however unlikely that operational readiness will be achieved by June 2020, when the FATF will review the state of play.

• The nature of the Travel Rule: The FATF, established in 1989 by the G7, implemented a comprehensive action plan to fight money laundering as early as 1990. Today, under the leadership of the G20, the FATF counts 39 member states and over 200 nations committed to implementing its 40 recommendations. In June 2019, the FATF adopted changes to the Interpretative Note to Recommendation #15 (dealing with new technologies) to clarify how the Recommendation should apply in relation to VAs1 and VASPs2. Among others, Interpretative Note 15 summarises the new requirements relating to Recommendation #16 (applicable to wire transfers – also known as the Travel Rule). Recommendation #16 now requires any VA transfer (minimum of USD/EUR 1,000) between a VASP and any other obliged entities to share
  1. the originator’s name,
  2. the originator’s account number,
  3. the originator’s physical address, national identity number or customer identification number, or date and place of birth,
  4. the beneficiary’s name, and
  5. the beneficiary’s account number.

Moreover, VASPs must be registered or licensed in the FATF member states and subject to the five-year records retention obligation. Lastly, the rule excludes transfers to and from unregulated wallet providers. In a nutshell, the Interpretative Note extends the traditional banking transaction regulations to digital and crypto transactions.

• Swift and seamless adoption: The FATF anticipated the monitoring of the implementation of the new requirements by countries and service providers and has informed its members that it would conduct a twelve-month review in June 2020. Countries have proceeded at different speeds in incorporating the rules into their national legislation and have also introduced variations to the rules. Thus, for instance, Switzerland does not allow exceptions related to unregulated wallets or minimum amount thresholds for transactions involving money transmission. The EU included the FATF rule in its Fifth Anti-Money Laundering Directive, which was recognizedrecognized lagging behind the international standard (regarding the scope of VAs and VASPs). Asian countries such as Singapore, Japan and South Korea have also taken action to incorporate the FATF rules into their legal frameworks. Swift implementation is key to preventing money laundering activity via VAs. The implementation must however also be widespread and seamless to prevent creating loopholes and arbitrage possibilities that would lower the effectiveness of the measure. Swift, full compliance is desirable because it will enhance trust in the underlying blockchain technology, its use and the cryptofinance applications it supports.
• The compliance challenge: Complying with the Travel Rule requires mirroring in the digital and crypto space the SWIFT transfers of data characterising transactions involving traditional financial instruments. As FINMAFINMA put it in August 2019, consistent with the FATF, it expects “information about the client and the beneficiary to be transmitted with token transfers in the same way as for bank transfers”. The technical challenge is to ensure immediate and secure transmission of such information. Of course, secure e-mail could be used and would meet all the criteria for secure and immediate transfer. But the financial community needs a more effective and scalable solution than bilateral e-mail exchange. No such system currently exists. Until the technical hurdle is overcome, regulators should demonstrate flexibility, pragmatism and proactivity in order not to negatively affect or unduly restrict the development of the nascent innovative digital and crypto finance.
• The Swiss Crypto Valley approach: The months following the changes made to the Interpretative Note to Recommendation 15 have witnessed many initiatives aimed at providing compliance solutions. In Switzerland’s Crypto Valley, a handful of companies came together under the name of OpenVASP to develop a compliance protocol based on a set of principles including decentralisation and openness, technological agnosticism, privacy by design, broad applicability, extensibility and efficiency of use. The authorities have been proactive in seeking dialogue with industry participants focused on early recognition of technically-driven compliance gaps in view of reviewing the Anti-Money Laundering Ordinance. The OpenVASP initiative is commendable particularly because it aims to preserve the decentralised nature of crypto-assets and the client data confidentiality of the transactions (via full encryption). The material results are expected during 2020.

In sum, the FATF Travel Rule, even if criticised by the industry at the time of its pronouncement, is pivotal for the future of cryptofinance because it establishes – in terms of compliance quality – a distinction between ubiquitously accepted fiat transactions and still largely mistrusted cryptofinance transactions. National regulators should proactively assist the process of defining and implementing the required technical solution, and work towards achieving a level playing field internationally with regard to content and timing.

The Bank for International Settlements (BIS) communicated its views on the design of a retail CBDC. The Bank of England (BoE) followed suit with an analysis of opportunities and challenges of retail CBDC. This may indicate that the timing for the first retail CBCD could be nearer than anticipated.

• The BIS sketched out some key technological design considerations for a retail CBDC in the event that a central bank decided to issue one. In particular, the design needs to balance the credibility of direct claims on the central bank with the benefits of using payment intermediaries. The retail CBDC must be secure and accessible, offer cash-like convenience and safeguard privacy.
• The BoE analysed retail CBDC, highlighting opportunities in terms of a more resilient payments landscape, characterised by faster, more efficient and reliable payments, and addressing the consequences of a decline in the use of physical cash. The BoE however also points to policy challenges and risks, including implications for the balance sheets of commercial banks and the BoE, for the amount of credit provided by banks to the wider economy, and for how it implements monetary policy and supports financial stability.

India has written history by lifting the banking ban on crypto. This opens up a huge crypto market.

• In April 2018, the Reserve Bank of India (RBI) issued a circular banning banks from providing services to crypto businesses. In March 2020, the Supreme Court of India ruled against the RBI’s banking ban, holding the circular which places a ban on the crypto industry as unconstitutional.

IOSCO joined the Financial Stability Board and other international standard setters in examining stablecoins. The BoE expressed concern that the credit supply could dry up if stablecoins began to mushroom.

• The IOSCO published a report entitled Global Stablecoin Initiatives that examines the regulatory issues arising from the use of global stablecoins and explores how existing IOSCO principles and standards could apply to these arrangements. The report finds that, depending on its structure, a global stablecoin may fall within the regulatory framework of securities markets.
• The BoE warned that, in a world where people move from holding all or much of the money now in ‘current accounts’ at banks to holding it in ‘stablecoin’ in virtual ‘wallets’ provided by non-banks, the supply of credit to the real economy through the banking system could become weaker or even disappear.

The FATF took stock of the growth in digital transactions and issued a standard for the use of digital identity systems in the context of customer due diligence.

• The FATF has published guidelines to assist governments, regulated entities and other relevant stakeholders in determining how digital ID systems can be used to conduct certain aspects of customer due diligence under FATF Recommendation 10. The FATF is convinced that the growth in digital financial transactions requires a better understanding of how individuals are being identified and verified in the world of digital financial services.

The maturity, sustainability and development of cryptofinance depends crucially on the broader financial community accepting the credibility of its underlying processes. Compliance with the FATF Travel Rule is a daunting task, yet worth the investment because it will deliver precisely such credibility in the area of cryptofinance transactions.

The flow of news over the past few weeks has shown that top national and international regulators are focusing their analyses on retail CBDC and on providing the correct framework for stablecoins.

¹VAs are defined as a digital representation of value that can be digitally traded or transferred and used for payment or investment purposes. The definition excludes digital representations of fiat currencies. ↵
²VASPs are defined as any natural or legal person who as a business conducts activities or operations for or on behalf of another natural or legal person including the exchange between VA and fiat currencies, the exchange between one or more forms of VA, the transfer of VAs, the safekeeping and/or administration of VAs or instruments enabling control over VAs, and the participation in and provision of financial services related to an issuer’s offer and/or sale of a VA. ↵