Implementing Compliance for DeFi | Abdul Rahman

good afternoon everybody uh my name is Abdul rakman and the title of my talk for today is uh implementing compliance in defi so I wanted to start with a definition first for defi or what genuine defi means um and I think everybody's aware of this this is just a slight review as we sort of set the stage for how we can Implement compliance um users engage in self-directed transactions uh they maintain independent control the transactions occur on chain and one thing that's key here is really the punchline is decentralized infrastructure without compromising user privacy so really the theme of The Talk today is can we apply what we understand as comp I to defi without infringing upon a user's privacy or by violating uh what privacy is as we understand it so now that we've set the stage of sort of um you know what we're going to talk about I think it's important that we motivate why we need this to happen uh and so I'll just say in Blunt terms Defi and crypto has been seriously victimized by many many bad actors over the past 10 15 years and continues to be as you can see the uptick from 2021 to 2022 in 2023 and hopefully not in 2024 where a lot of dii protocols crypto infrastructure uh Etc was really uh been the victim of large scale theft uh which possibly could have been prevented by both a combination of security controls along with compliance so even though compliance is not the end all be all it's not the actual complete answer it is part of the solution for what we want to look at and what motivates this and I could have built this slide with like about 50 different things but I just chose the top six hacks and I and only thing that I really want to point out is recency and dollar amount so these are not things like $40 out of the ATM these are nine figure transactions where very very sophisticated nation states advanced trans persistent threats have targeted weak infrastructures poor security controls lack of compliance uh to basically make away with a lot of good people's hard-earned money and when that happens the government gets involved and typically what's happened over the past 60 years in central exchanges there have been more emphasis on compliance and so even though this is not the end all Beall and Central exchanges do get hacked I think for what we all can agree on today we lack some key aspects uh in in our current community that we could make do with so this is the why right so now we want to talk a little bit more about what is our current understanding of this so hopefully everybody is not allergic to this slide or it gets completely runoff I don't see anyone running away immediately but what we mean by compliance is really alignment with the banking secrecy Act and the banking secrecy Act is older than me um it's been around president nxen you know 1970 and so I wanted to basically focus on instead of talking about its long history what are the core elements to be in compliance or in alignment with BSA number one you need a compliance officer you need a human being that's responsible for compliance for your project your infrastructure number two you have to build risk assessments you have to complete them number three you have to have policies and procedures related to anti-money laundering AML you have to maintain and monitor this program and you have to implement customer due diligence which is the equivalent of going to a bank account and getting kyc giving your driver's license and so forth now if you look at the previous slide where a lot of money has been made off and more will probably happen the actual controls for security along with compliance may not stop everything but according to what we have today we we lack a lot of infrastructure on the compliance and security side that could help thw this however in order to apply compliance to this the current state of affairs is that we would sacrifice privacy okay so I was originally just going to have the figure here with no words to kind of illustrate how do you launder money right and so the idea around laundering money um is essentially a person uses a series of intermediaries to convert from one form of currency to another hands this off to another person that really does something in an opposite direction right and so for anti-money laundering you want to essentially address um concealing funds acquired through illicit means uh and some of these illicit means do harm to individuals do harm to critical infrastructure and Key Resources whether it's Transportation food and water um these institutions these financial institutions today use kyc heavily to really vet individuals that show up into the ecosystem and then finally this anti-money laundering act which is in alignment with BSA that I mentioned previously is about identifying tracking and Reporting transactions so a key element for compliance that I mentioned in addition to the previous five is you want to be able to have some kind of monitoring program for transactions so this is key as we move forward so really the first sort of hypothesis we have is can we uh arrive at genuine defi without sort of compromising an individual's privacy wall of text I've been sort of criticized on this but there's a couple things that you should know that are key I put these in a different sort of font when you see currency exchanges it means custody when you see administrator or Administration it means issuing and redeeming and if ever you take custody of a currency or you issue and redeem it in other words you wrap a token what the current compliance infrastructure in the US says today is you need to register as a money service business or a money transmitting business and this is interesting because today there's a lot of projects that have not done that and so typically as we've seen sanction in the first you know slide first few slides where there were six different hacking attempts those particular projects may not have been as rigorously involved in both security controls and compliance from this perspective travel rule compliance uh 2019 finen issued guidance stating this travel rule applies to what we'll call virtual currency transactions so this is not fiat currency this is something that is the equivalent of Fiat which is virtual currency and whether you decide to take custody of it or you issue or redeem it um this travel rule uh is applicable um and this anti-money money laundering countering the financing of terrorism regulations are all under this notion of banking secrecy act and so customer due diligence monitoring transactions report suspicious activities and compliance so these are some of the ingredients that you need to achieve compliance FF recommendations uh guidance basically suggesting that virtual assets and vasp align with BSA um and and so there are gray areas here that have to be negotiated but if you're all the way to the left meaning you're not even doing any of these things it uh you're you're operating on risk and likely the security controls for your project are probably not going to be capable of withstanding uh nation state or AP type of attacks uh it was suggested that maybe we talk a little bit about some attempts right so in the Box on the left what I've tried to do is gather the requirements for compliance right and and so in simple terms if we were to list these out we talked about MSB we talked about anti-money laundering program we talked about reporting we talked about sharing customer information for transactions at a certain amount in the US if you go into the bank and you try to withdraw or deposit over $10,000 they write an S for you or basically you need to register with the government um you have to conduct customer due diligence kyc and kyt so how do you conduct these things from a requirements side on compliance without infringing on privacy in this in the context of genuine Defi and so there have been several projects that made these attempts in the past and what they've done is they have either um built up restricted liquidity pools or they have empowered tokenization or they have different kind of app chain services but the key thing here is protecting transactions validating transactions determine whether this is suspicious and being able to intersect that with enough kyc to maintain genuine defi so there is a path even though it's small where you can actually maintain genuine defi while also preserving privacy and so as I kind of round out I've kind of H highlighted in red what are some of the key elements that you could include to achieve this balance right and this balance is achieved really by maybe leveraging um kind of intelligence software to provide near realtime risk assessments um overseeing exposure um sdn lists ofac lists and other lists for money laundering fraud and other things uh enabling SCP screening of risk exposure a lot of the compliance regulations are about assessing risk again implementing continuous monitoring looking at transaction flow evaluating transaction flow assessing it determining if there is a risk or associated with transactions and then once you do that once you've assessed that a transaction is suspicious do you have the capabilities within your Tech or can you partner with individ with groups or projects that can dynamically update whether individuals have good transactions or potentially um are co-mingling with bad transactions um and this is really this no notion of what are called Association sets which are fundamentally white and black lists and they give you the ability to mitigate risk of co-mingling suspicious funds uh in very unique ways so these are some of the elements that uh compliance would need to bring to the table intermingled with technology and Def today from a technical perspective that could help us to achieve what we're talking about uh in the long run of bringing more rigorous compliance while maintaining genuine di5 and finally I've achieved the end I wanted to leave a little bit of time for questions if there any um please do ask yes great um that's a great question so Oxo is uh provides defi guard rails we are an association set provider um right now we are presently integrated with privacy pools uh this week privacy pools will be achieved on mainnet uh privacy pools consists of several components a relayer a contract and an asp and the ASP is the white listing and blacklisting function and essentially as transactions are about about to be relayed into the defi ecosystem they are passed to Oxo where we determine the suspiciousness or risk assessment of those particular transactions and then provide that information to the relayer and based upon whether they are suspicious or not we add them to an inclusion list or we you know add them to an exclusion list and this type of transaction flow analysis uh is the first of its kind in the industry uh so we're the first company that's really the ASP that's out there first really trying to push the envelope yes um that's a great question okay it's telling me I got seven minutes so I'm going to use like a minute or two for this one um if you if you subtract out the fear of going to prison and I found out yesterday what prison means prison means going to an establishment that's not your house over a year right jail is under a year if you remove all of those things right and you look at sort of the legal framework that exists for things like taking custody right where you you basically want to move uh a currency from one place to another via relayer or you do Administration like you wrap a token you have to register as a money service business which immediately means that you need to pay for hire and support and nurture a compliance team to do all of the auditing and logging that I mentioned now from a technical perspective right maintaining a relayer or wrapping tokens are things that technical teams are doing in Spades there are plenty of projects doing that however the ability for um you know native web three applications uh decentralized exchanges or protocols to interact with Oxbo we have to become a money service broker a money service provider money transmitting business in order to wrap a token legitimately so that other protocols and dexes can use it so the main Gap is the time it takes and the effort it takes to become an MSB to be legitimate without the fear of going to prison in order to do that I don't think that there are extensive technical challenges I think it's really balancing the compliance part with the continuous monitoring with what you need to do to nurture and sustain um uh a money service business compliance team and that really is in a situation for example um and I don't know if it's really been done but how do you file a sar in crypto how do you do how do you do something like that someone's going to move around 10 eth right that's like 30k I got to file a sar for them well is there an automatic way to do that and do people really want to do that so legitimately what does that mean and so working with the government means kind of dealing with and I said that there the BSA is 1970 it's older than me um so you know part of that is really trying to get a clear clear understanding of what is enough while not you know issuing this you know privacy issue essentially to kind of you know go further not everybody wants to kyc that wants to come into the ecosystem no one wants to scan in their um you know driver's license so this gets to the use of within Oxo we're using um zero knowledge proofs um to essentially support uh the Privacy pool ecosystem for wh listing and black listing and we think that going down this path will is necessary right if you looked at like the third slide you know there's six major hacks over 420 million uh I mean that's not like a movie it's not like Netflix and chill kind of money that's like that's serious cash and that's represents a lot of people's potential earn money but just think of its a situation where it's someone's retirement or another you know organization that wants wants to put their 401K in into defi how would they go about doing it they need to have a mechanism that's compliant so I know I gave you the kitchen sink I still got three and a half minutes so more questions yes that's a great question and um I won't waste my precious time telling you that I'm an expert on gdpr and others but one of my colleagues uh if we meet out in the back we could talk a little bit more about that but essentially from a gdpr perspective data privacy officer same types of things we have almost I don't want to say exact parity but we have things that are equivalent I don't want to say they're completely Apples to Apples but if we crack the code on continuous monitoring of transactions to mitigate risk we have the ability to do auditing monitoring archiving reporting I think we have enough but there will be gaps and so we could probably talk about it after um but but I don't want to blow smoke or anything thank you and I was told to prepare for someone asking me a question about Europe but I summarily uh you know blew it off I apologize for that okay I got two and a half minutes we've been getting some softballs uh any more questions uh this is a mean by the way that wanted to be private so that's my uh meme for this so I just want to say thanks to aan for uh this the jacket's really dope too everybody