EN | AML, KYC and On-Chain Compliance – What’s Next for Crypto Regulation? | MERGE Madrid 2025

So I would kindly ask um every speaker to briefly introduce him herself uh as well when I address the first question to you. So I'm turning to Thomas now and we had some very interesting discussion about balancing KYC with privacy rights. Um I personally think this is a very important topic that um gets easily out of sight than merely focusing on fighting crime. Um, so I was very pleased to learn that you share the vision of leveraging privacy enhancing tools um to protect privacy. Um, so Tom, please let us know what you would advise to focus on.

Wonderful. Thank you very much for for having us having us here at Merge. So great to see everyone. I'm Thomas just as a quick introduction to to everyone. Uh, currently responsible for our exciting partnerships here at Sumsub.

uh leveraging KYC but also trying to push the boundaries on where it's a where it's used and how it's used within the industry and especially web 3 as we move forward as well when we talk about AML and we talk about KYC the privacy dimension um often can let's say disappear behind of course the fight crime narrative that we see today um and of course the real sort of game should be we work we work within the the realm of privacy we work within the realm of concern there um rather rather than against it. Um the frameworks like like of course the GDPR uh make this very clear. Data minimization and proportionality are of the utmost uh let's say focus. They aren't optional. They're legally binding principles uh in today's day and age.

Even the financial action task force, the FATF as well um has acknowledged that a riskbased approach, let's say, must still respect privacy and data um concerns as well. uh and that gives us legal and privacy well legal and privacy room to explore let's say privacy enhancing compliance solutions. Um some of these might be zero knowledge proof ZKP others might be let's say um of course the the the scope of selective disclosure not giving everything away um when providing information such as your age or whether or not you're um 18 or over or of course whether or not you're on a sanctioned list as well. So that's a brief input from my side. would love to hand it back to you and I can go in a bit more detail.

Yeah, I actually had some discussion yesterday. Yeah.

Um about the question, how can zero knowledge proof actually serve KYC purposes?

Um so I think there seems to be some discussion around it and that's maybe anchored uh in our current laws. So maybe we even need to rethink um you know what's legally possible today.

Well, yeah, absolutely. I mean zero knowledge proof at the end of the day um allows the KYC of the user um I mean they go pretty far in terms of mathematically proving that an individual um actually or an individual or transaction actually meets a certain requirement we're talking about actually from the point of view of an attestation um taking a biometric check of an individual deleting that data keeping the hash on chain and that being used of course regulatory bodies um that we have now um won't be accepting anything across these guidelines but this is specifically when we're talking about use case applicable to non-regulated institutions and web 3 as well.

So, uh I actually recognize that um the crypto space is very different from traditional finance and uh so Jacob turning to you um could you share some insights uh from your perspective as blockchain analysis company? Um did you recognize differences in handling of financial crime in the crypto space compared to the traditional finance?

Sure. Thanks, Nina. And first of all, thank you for to Merch Madrid. Uh, everybody for coming and waking up early. I'm sure everybody had a late night yesterday.

So, I appreciate you all being here. Uh, my name is Jacob Cohen. I am the director for Ebedia in Latin America for TRM Labs. Uh, we're one of the largest blockchain intelligence companies, right? Um, which again, what do we do?

We do two things primarily. One, we collect intelligence or information about what's happening on the different blockchains, right? We we tie addresses, wallet addresses, right, to real world entities. Uh again, whether those are legitimate entities, regulated entities like a Binance, B2ME, etc. or whether it's illicit activity, darknet markets, financing on terrorism, etc.

We do the intelligence piece and then we do the analytics piece as well, right? We provide analytical tools. So whether you're an exchange, you're a regulator, a law enforcement agency, you're investigating, you know, the underlying potential crime associated with transactional activity on the blockchains. Um so going to like the the the question, it's a very good question. Um I worked at Fininsen, the Treasury Department for about eight years before joining uh TRM.

So I've kind of seen how the sausage is made uh if I if I can use that American expression uh on both sides. And so um I think there's a huge difference, right? Um I often like to say that I work for a u private sector crypto financial intelligence unit right because because the the fact that this the the public nature of the blockchain right we we're the ones who are first seeing right the risks right and the crime crimes being committed so we don't there aren't this I mean you obviously have reporting entities like like a Binance right regulated entities that's that see suspicious activity and report it right but we're the ones who often are the ones finding that first right and then are able to then analyze that information and provide like really valuable insights where and so we're basically almost decentralizing the information like who are we we're a private sector company and we can see exactly what the risks are today in real time of Binance of B2 or buy bit whoever we can see that today like you know in real time whereas in the in the traditional space right like it's it's very uh kind of centralized siloed right um you're like you you the from a regulatory perspective for like a public sector perspective, um you're completely beholden to what the bank reports, right? Do they have an effective compliance program, right? Are they able to detect the the particular illicit activity?

And then okay, then we file a report with the appropriate like regulator, the FIU in the particular jurisdiction. Um and we all know that, you know, public sector agencies typically are strapped for resources. So um so again so I think there's a real opportunity from what what I've seen the last um I don't know I've been in the space for about like six years now but I think you can actually get to I mean um we're talking about fat fat standards and effectiveness right um I think you can actually get to effectiveness in this space because of the transparency of the blockchain whereas in the traditional space it is just extremely extremely difficult um I think to do

okay so um may I dare to go so far to claim claim that maybe KYC isn't that important in the future anymore because the real um insights are delivered via monitoring. Um so that you can actually you know instead of forcing everybody to do KYC to prevent bad actors to access the system maybe can leverage more the technology to then find the things going wrong and then chase specifically those bad actors instead of

Yeah. Yeah. No, that's a great question. Um, I've heard that argument a lot in the past. I think that um I think at some point you do need KYC obviously because that is the way that a law enforcement agency right that is that is combating financial crime um is going to be able to identify who is ultimately behind the illicit activity.

So at some point you need you definitely need KYC whether you do it with pseudo knowledge proofs you know however you do that with technology like great and maximizing privacy awesome. Um, but you know, I think there is the question of, well, do you really need KYC for somebody that's only going, this gets to the, I'm not going to get into sort of the financial inclusion components, right? But like, do you really need KYC on somebody that's just conducting, let's say, less than $1,000 like transaction? Uh, yeah, transactions, right? Um, because then if you are doing your your job monitoring that that transaction activity, then you're able to identify, okay, there's something fishy here.

Let me, you know, maybe get that KYC at that at that point. Um, etc. So, I think there You definitely I think the short answer is you definitely need it at some point but I think there are ways of of uh being more nuanced and intelligent about how you deploy kind of you know the KYC need.

Yeah I can truly sit on that. Jose turning to you maybe um you can also quickly introduce yourself and um give us a brief update of the regulatory trends that you recognized in Spain lately.

Thank you very much Nina. Thank you very much for the audience. As Nina said, I'm Jose coming from FINRE 360, which is a law firm and consultancy firm specialized on financial regulation. Within the financial regulation area, we cover very deeply anti-moneyaundering regulations. So basically in a nutshell we help institutions to adapt and to comply with the financial regulations existing and answer the questions and try to h achieve a balance between business and regulation which is very very difficult.

So in a nutshell this is our this is my introduction. I've been practicing law because I'm a lawyer for more than 20 years and I have this experience also in the AML area. Of course, my experience on on blockchain and crypto is is is not so so much for the because this is a relatively new area of business. So, so answering your question, uh, Nenina, basically the trends that we identify now in Spain is first more supervision on the crypto area. I mean, this is a very clear trend.

The indeed to provide you with an example, uh crypto providers registered with the Bank of Spain were required to answer a very very comprehensive and exhaustive questioner by 30 September. This questioner which goes into a lot of detail like how many employees have have you trained, how many findings you have got from your auditors, who is your auditor etc. Erh will help bank of Spain and will help the Spanish equities market authority to address their supervision actions. Okay. And it is true that in Spain we have not seen yet h public sanctions for not compliance or not complying with AML regulations and we believe that this is going to change sooner rather than later because authorities are putting a lot of stress a lot of focus on on on this area.

So this is first trend. Second trend thematic reviews. In the old days we see like Bank of Spain, SElak, SElack is a Spanish financial intelligence unit like doing a very comprehensive audit from like the beginning from the end of the of the regulation. More and more we are seeing thematic reviews like I want to erh understand how you are training employees how you are training the first line uh of defense of the institution. Erh, I want to see uh how are you doing the detail on boarding.

For instance, to provide you with an example, the Spanish securities markets authority is conducting now a thematic review on digital on boarding only. Okay. So this is a very very clear trend also and I would say that cooperation between authorities. The authorities in Spain are entered into a new cooperation arrangements between SELAC, CNN, Bank of Spain and Seblak. Erh this is also very clear and uh to finish erh my my topic another uh very clear trend is that the Spanish securities markets authority which is the authority in Spain on which the mika providers are going to be registered.

Okay. and and they are being supervised for uh compliance with conduct rules uh with this authority. The security markets authority has now a specific unit h dealing only with AML. So h there is no longer need like for SELAC which is the Spanish financial intelligence unit to go into the institution. Now the conduct authority which is the CNV in Spain will conduct also the AML review.

Okay. It has a specific unit dedicated to this. So this is a also a very clear trend existing now in Spain.

Wow. That's that's quite a lot. uh de la Mata I'm really pleased to have you on the panel as well and um we discussed beforehand that uh you could maybe uh complement all these explanations with the latest trends in Latin America and after that I would actually like to open to all of you the question how do we finally create a functioning collaboration structure for nationals I think that's really important because some part of the AML regulation I think is actually due to the fact that this collaboration doesn't really work very well. But prior to that, you know, any thing to add from a Latin American perspective?

Yes, I mean, we're in a Well, thank you very much, Merch. Thank you, Nina. Uh, this is awesome to be with you. um as a Latin America is uh getting there in the sense of getting regulation and supervisory authorities ready to monitor and control um crypto activity. So I think they are now very much aware that they are eventually being used uh for regulatory arbitrage or bypassing harder jurisdictions and they want to avoid that.

Uh and so now we're seeing in the next six months we will see several jurisdictions uh bringing out uh specific regulation on crypto AML and and also setting up or putting in place uh better qualified uh regulatory and uh and teams supervisory teams uh and and also more expertise in the FIUS. uh we as blockchain intelligence were working already since several years where a consultancy on strategy business and regulatory issues and we work a lot with the private sector with financial institutions but very much also with regulators and supervisors we're now very much working since the last uh two years uh in Latin America in seven countries in in Latin America with the with the regulators and supervisors and they are now seeing that they are getting many of these countries countries are getting many remittances from the US especially and also partly Europe but mainly the US uh on on stable coins or other crypto uh assets. So there's there's capital coming in uh they don't want to prevent it or so uh it's it's important to you know allow this transfer money transfer means uh to reach the country uh and at the same time they are facing uh these issues and in parallel uh financial institutions are also worried because they don't have uh clear understanding of what these supervisory authorities and fius are expecting from them in terms of KYC and monitoring ing systems because nothing is really officially in place, but at the same time they're kind of expected to manage it um on like on the go.

Do you see any effort to harmonize this upcoming regulation throughout Latin America or is it a mere national effort uh per country? Well, at this uh block intent is working in seven jurisdictions and we are trying to really do apply a harmonized approach. Um and I can link that to your second question on cooperation because one of the main key point I mean main pain points um of the work of FIUS in general and you know investigation and monitoring and investigation is basically that they trace with all these tools uh some some of them can use them uh have the budget others do not have the budget but they're working on asking for the budget and we're also pushing ing uh to to make it clear that they actually would benefit from having powerful tools.

Um but then they trace and then they and then you know money goes fast and of course now with a AI tools in place as well it goes very fast. So it changes jurisdiction so quickly that they trace and even and then they end up in a point where they need the cooperation of another country and and there is no structure that allows it. It is very much on an hog basis. It's like I know this guy from my conference somewhere. I mean uh sorry to say it that way but it's really it's really the case.

So um sometimes it works and very often it doesn't and the money flies away again. So I think it is key essential uh and we're working on it ourselves building uh either informal bridges or formal structures to share information reach get the cooperation of another jurisdiction in also in different layers uh among fius mainly uh or supervisors um but also with uh exchanges and you know casps basically um from other jurisdictions,

okay?

Um because sometimes they need their cooperation and they don't have ways to reach them or they don't have the power to get the answer and it gets lost and this is really then useless because you have as you say all this data, all these KYC efforts, all this money is spent in you know uh you know and I know you're very worried and we've discussed that and you have very good data on that. Um and at the end of the day when they are when they are um investigating and following the money and they manage to get they they cannot do anything. So it's um useless effort basically.

So taking a look at uh the remaining time we were very very uh nicely asked not to overstep the time granted by that I mean very quick round. Um would you like to add something any recommendation to the fuse or to the regulators what you see? It was very very interesting from Jacob's point earlier of course you talked on I've touched on KYC being a necessity right um as we move forward towards the the scope as I mentioned of maybe ZKP but more so zero not zero knowledge proof sorry um more so selective disclosure where maybe you don't need to give up every let's say morsal facet of information around your entire being within one one flow and you can actually go through and maybe just prove specific facts as I mentioned over 18 as one um that you've maybe done a transaction at a certain date and proved that your AML is complete. But from a legal and policy perspective as well, the next step will need to be recognition from of course the regulators and also um industries in certain jurisdictions. And I mean that that would be the future of treating cryptographic proofs uh as evidenced within certain KYC steps but also within certain transactions as well.

But the challenge there is of course the interoperability. Um right now making sure identity proofs and attestations um are recognized across jurisdictions across legal boundaries in LATAM as well as in here in Europe as well will be difficult with um common standards needing to align privacy preserving KYC needing of course to um to be let's say secure as well. Um and there's that's where collaboration matters and these conversations matter too. Yeah.

Thank you very much Tom. Jacob. Uh I'll try to be brief. Uh yeah, I think with blockchain technology again because this information is publicly available, there's ample opportunity to collaborate across um FIUs, law enforcement agencies, regulators, right? Because now you're speaking from the same sheet of music, right?

They're all seeing the same hash. They're all seeing the same risk. So I think particularly efforts like AMLA, hopefully that here in Europe, hopefully that will help, you know, um kind of go toward that effectiveness and do better at information sharing, which I think is challenging in the traditional space. Uh, and then Latin America, uh, frankly still pretty far behind regulatory. They're catching up.

FIUs, they need training. They need resources. We're still not there yet.

Thank you, Jose.

Yeah. Well, my takeaway will be uh, you know, that in Europe, we have a new um, AML package that will become enforced or enforcable in 2027, which it seems that it's too far, but it's too close. So start adapting to a new regulation because we have a new authority in Europe the AMLA which is now alive and will start its supervisory actions in 2028.

Okay. And as per the European banking authority report published yesterday the cooperation is working. The improve the improvement has been a lot h because of supervisory college and bilateral arrangements between countries. So the cooperation is is working it seems.

Yeah.

Thank you very much uh Jose Judina Tom for these contributions and um maybe we leave some time at least for the audience here. If you have questions gladly come up to us. Thank you.