Impact of Transfer of Funds Regulation in EU | European Blockchain Convention

Congratulations. Greetings to everyone. Thank you for coming. And to everyone outside this room, know this—this is the best panel of the entire conference. So you better come in.

Come in and take your seats. Say that again . Yes. Everyone outside this room outside this room , come inside, because the best panel is about to begin. Let's go.

Once again, loud applause. Thank you. OK. OK. It's very nice to be here again.

This is my fourth or fifth time at the European Blockchain Convention. I also want to thank Victoria and her entire team again for the great work you do. The tenth issue is a wonderful result. So thank you again for inviting us. I am Thomas Astati.

I am the Head of Regulatory Affairs at Blockchain for Europe, a trade association based in Brussels. We are a long-standing partner of the European Blockchain Convention. So I'm very happy to be here again and very happy to be on stage with extremely knowledgeable experts on the topic that we're going to be discussing today -- the remittance regulation, also known as the " also known as the " travel rule, travel rule, " but we'll discuss all of that in detail. If we have time, you can ask questions at the end . We want it to feel more like a conversation than a regular performance.

So I will let my panelists introduce themselves so I don't make any mistakes in pronunciation or positions. So, Lana, the floor is yours. Hello everyone. I am very happy to be here. My name is Lana Schwartzman.

I lead the regulatory and compliance department at Notabene. I am also a former compliance director for two different crypto companies, which is quite interesting. I'm glad to be here to talk about this topic talk about this topic . Wonderful, Elsa. My name is Elsa Madrol.

I am the General Manager of VerifyVASP in the EMEA region. VerifyVASP is a travel policy solutions provider headquartered in Singapore with offices in Tokyo and Paris. We have been working with the “ travel rule” in Asia for several years now. So we can talk about some lessons learned. Thank you.

And now Kelly. Congratulations. I'm Kelly Fennick. I am a partner at MK Fintech Partners Limited. MK Fintech is part of the Michael Kipriano Group and I help clients through the application process for any fintech license, as well as providing ongoing advice and holding key positions within these organizations.

Perfectly. Thank you all. And as you can see, the title here refers to the regulation on transfers of funds, a very important piece of legislation passed in Brussels. Well, so I'll take some credit for that. But this is a very important document, and it concerns the so- called " transfer rule."

Let's try to understand what this rule is, and maybe Kelly, you can briefly tell our audience what it actually means and how it is implemented in different jurisdictions. Of course. So, first of all, the Of course. So, first of all, the “ transfer rule” originated as a recommendation from the FATF—the Financial Action Task Force on Money Laundering. FATF is an intergovernmental organization, and I'm not sure if everyone knows about it.

It was created in 1989 by the G7 countries to set international standards for combating money laundering and terrorist financing. One such international standard is the Guidelines for Countries on Combating Money Laundering and the Financing of Terrorism. One such recommendation is recommendation No. 16, which is the " transfer rule." Initially, the “ transfer rule."

Initially, the “ transfer rule transfer rule ” was aimed at financial institutions that make wire transfers to collect certain information about the sender and recipient, and these recommendations are constantly updated in line with new financial risks. One of them concerned cryptoassets. Recommendation #16 now applies not only to financial institutions, but also to CASPs— service providers associated with cryptoassets, when sending and receiving them. Ahem. The EU adopted Recommendation No.

16 through a regulation on information accompanying transfers of funds. This regulation clearly defines what information must be collected. I think it's worth mentioning who this rule does not apply to. First apply to. First , if CASP does not participate in the transfer, the rule does not apply.

If it is a transfer between two CASPs on their own behalf CASPs on their own behalf , without involving other parties, it is also exempt from the rule. It simply does not apply. But once a CASP intervenes in a transaction , servicing a third party, the “ transfer rule” comes into play. There is a certain amount of information that needs to be collected. To summarize: if you are the sender's CASP, you must collect the following data: name, primary account ID, crypto wallet address, as well as physical address, place, and date of birth.

And this needs to be done for both the sender and the recipient. Have I answered your question or should I continue? You did a great job with No, because I could go on, but I don't want to. No, maybe if you want to quickly summarize...So, we're talking about the regulations for transferring funds now.

So transferring funds now. So , the implementation of the travel rule in the EU, but of course, as we said, it's being implemented around the world by many different jurisdictions. We'll delve a little deeper with Lana and Elsa, but maybe you want to give us some quick hints as to what you think the main differences are? Good. Well, first of all, our rule, the EU travel rule regarding the EU regulation, applies from December 30 of this year.

So time is running out. As for, let's say , the first thing that comes to mind is the US, it's important to mention that they've been applying this rule for several years now. Um, since 2013, maybe even earlier. No, I think it was 2013, but they, for example, have a threshold, and that threshold is $3,000, whereas in the EU there is no such threshold: for all transfers of crypto assets, the rule applies... I think in the EU it does, if you want to continue.

I just wanted to add one more additional point to this. I think it's important to note that since you were talking about exclusion, on the inclusion side: it's not just about whether you are a CASP in the EU, but also whether you have customers in the EU. Right. This is a very important reminder, and I think it's just an important point to remember when looking at the European Union, right? That is, it is not only a matter of when European legislation applies to your services.

This is not only if you are registered in the EU, but also if you are trying to provide services to European citizens. So this is a very important principle in European law that is worth remembering. Maybe let's delve a little deeper into other jurisdictions. I think in preparation for these conversations, we have, of course, looked at some of the major jurisdictions and some of the significant differences that we see between those regulatory approaches and that in the EU. So maybe let's start with Elsa, if you want to give us a quick overview of the differences from Singapore's approach.

Yes, thank you. It is perhaps worth mentioning that the idea of ​​harmonizing with FATF is that regulators adhere to a minimum set of standards. So, this explains the differences between different jurisdictions, because as long as the standards are met at a minimum, it is considered agreed upon, and then any variations are possible. I think it's important to note that the US probably doesn't quite meet FATF standards yet, if only because the $3,000 threshold is not agreed upon. So these are some of the things we're looking forward to in the US, but Lana will talk about that in more detail.

So, from Singapore's perspective, indeed, between 2020 and 2022, the PSA law was implemented in phases. They have a very progressive approach. This phased process was completed in 2022. They are very open to collaborating with the private sector and are constantly accepting feedback. They were a little slow to start accepting applications and issuing licenses as they tried to better understand the pain points and nuances of the industry.

They have largely caught up now, so the licensing process is ongoing. Compliance is achieved through official reports and observations. To date, only one field visit has been conducted, organized by MAS for all market participants. Additionally, this also happens through licensing. That is, compliance through licensing means that organizations may not obtain a license for various reasons, and the " for various reasons, and the " travel rule" travel rule" may be one of them.

In that case, MAS encourages you to contact one of their trusted "travel rule" service providers, two of whom are with us on this stage today. We feel quite happy about this. But continuing with their latest recommendations, one of the challenges they faced was demonstrating what it means to be " means to be " immediate and safe." That is, information transfer must be instant and secure. So we await guidance on these two topics, as well as on counterparty due diligence (VASP).

This was applied everywhere. In some countries, the concept of due diligence of VASP counterparties is implicit. In other countries it is very clearly defined. And in some countries, this is not mentioned at all , and this is something that needs attention. OK.

So, we already see some differences between the approach chosen in Singapore and that applied in the EU. But given the rather positive approach that Elsa just told us about, as well as the openness to dialogue with the industry, I think we will see some differences. When we talk about the United States approach, Alan, what do you think, give us an overview of the main differences in the US? Certainly. So, Certainly.

So, first, let's clarify the so- called " travel rule", which in the USA is called " which in the USA is called " funds transfer". It is fully applicable in the US, and it began its journey through the Treasury Department back in 1996, when it was applied to fiat and bank transfers as part of accounting rules. Back then, banks and financial institutions were required to collect and store this information on transfers over $3,000. Then, in 2019, FinCEN updated its guidance, effectively stating that this same “ travel rule” and “ travel rule” and “ transfer of funds” also apply to cryptocurrency transactions. So starting in 2019, they made this pretty clear in their guidelines.

It's interesting to see that despite their clarity— despite their clarity— and despite the fact that I personally spoke with them to make sure I did n't miss anything —it's quite interesting to see that there are certain industry associations and major exchanges in the US that believe that this rule should not, in fact, apply to crypto. Because cryptocurrency supposedly does not fall under the definition of money. So they are looking for loopholes in this. However, a proposed rulemaking is planned for July next year, which will definitively clarify that in the context of money for accounting purposes and the “ travel rule”, this will also apply to cryptocurrency transfers. I also know that during various on-site inspections, as well as annual audits conducted to monitor compliance, attention is paid everywhere to the " attention is paid everywhere to the " travel rule."

Everyone checks the effectiveness of this rule, and if you don't follow it, you will be held accountable. Of course. So we see that, of course, the “travel rule” can be quite difficult to enforce, but it also provides legal certainty for users, operators, and providers who know they are adhering to a very important set of rules, which ultimately helps with the overall oversight of crypto asset transactions, right? But, of course, there are differences in these approaches, as we can see. And if we go back to the EU, maybe Lano, you could tell us a little bit about these, uh, stricter requirements, because the EU approach is very, very, uh, prescriptive in a way, right?

It defines clear, er, essentially requirements that must be followed. What is your opinion on this your opinion on this ? Do you think this is beneficial for the industry, or is it actually hindering processes, services, and innovation in this area? Listen, everyone complains that we lack regulatory clarity, and here you go . You have it here .

You have it here , don't you? So yes, it's clearly spelled out, and it's damn difficult to switch between reading the TFR and the EBA guidelines EBA guidelines , and, you know, going through the differences between them and highlighting all the points, but the clarity is there. They specify exactly what they want and exactly how they want to see it. For example, if you look at, um, the requirements for handling, uh, missing information, and also reporting non-compliance, and when you think about it as a kind of triangle: on one side, missing information, on the other side, information, on the other side, reporting non-compliance. All of this really leads to understanding the importance of responding, that it's not enough to just, um, send a transfer under the travel rule, you also have to respond to them.

Um, extremely important. So there's a lot of clarity on this, and I even included a quote here because you shouldn't just take my word for it. I, I want to, I want to go to the original source very quickly, if you allow me. Um, in the TFR, in paragraph 28, they say, um, that cryptoasset service providers must ensure that the originator and beneficiary information is not missing or incomplete. And in paragraph 53 of the TFR they say that in order to, the TFR they say that in order to, uh, ensure rapid action, uh, in combating money laundering and terrorist financing, uh, CASPs and payment service providers must respond promptly to requests for information.

So this is extremely important, and, uh, maybe very quickly: what does this look like in context? So they are very clear in the EU. Um, if you're, um, within the union, you have three days, essentially, to respond to requests for missing information. If your counterparty is outside the EU, uh, it's within 5 days. Um, and if you compare it to different jurisdictions different jurisdictions , um, if you look at, for example, the UK or Canada, they say about missing information something like " something like " reasonable term" or something like that.

Again , here it's clear, so you know what it means, while in others they say "if it's reasonable." And then customers ask us, "Which is reasonable, right?" Uh, Singapore, as Elsa mentioned about Singapore, there are three days there; you actually have to provide an answer regarding the missing information. Of course. Well, I think Of course.

Well, I think we're also starting to hear about some difficulties, of course, right? This is an important foundation, and as Lana said, it's not just about sending information. I think transfer rules are primarily a collaboration between different entities and providers, right? There must be communication between these two providers to ensure that the data about the sender and recipient, or the beneficiary and the initiator of the transfer, is collected. And before we get to the challenges, Kelly, I don't know if you have any thoughts on this; If you would like to get involved, please join any of these threads any of these threads .

Okay, okay. Okay, otherwise Okay, otherwise , let's hear about these challenges. Do you think there are any difficulties now when we look at the impact of TFR in Europe? What are these challenges? I think we just mentioned one, maybe Elsa, do you want to elaborate a little bit on that, regarding the feedback?

I think there are a lot of challenges . Uh, I think one of the first think one of the first ... a little less if they work with us, right? This is the main point. So, you know, from a VASP perspective, one of the first challenges is analyzing all of your legal entities.

Where are they located? How are the rules of transfer interpreted in various places? Uh, we have some difficulties with how the different protocols work. We all work very work very differently. It is sometimes difficult for us to fully understand each other.

So I sympathize with the audience who is trying to understand us. Uh, but it affects everything. So, Verify VASP uses a virtual private network. Uh, on the subject of checks that actually come in, we use an API. So you call the API and you have a 100% guarantee that it will happen.

This is not the case if you use an open source protocol. But one of the disadvantages of using our network is that your counterparty must be part of this network. Uh, we can't transact with anyone outside of this network outside of this network . So, you know, on the one hand, we are as compliant as possible and we work super fast we work super fast . On the other hand, we are not connected to everyone not connected to everyone .

Um, there's no other set of problems, and there's no provider that has an absolutely perfect solution. I was recently at a conference where someone asked one of the regulators: when will the EU have an open- source protocol for travel rules that everyone can use? You know, in the context of GDPR and DORA, an open source protocol available to everyone available to everyone is a utopia. This will not happen. True.

True. So, there are many problems. Well, to reduce these problems, I think it would be a good idea for CASP to use more than one solution. Wouldn't you agree with that? So I think in the context of DORA, it's the Digital Operational Resilience Act Operational Resilience Act , which will actually go into effect 18 days after the funds transfer regulations.

This is another big headache for future CASPs in the EU. Of the many things they'll have to do to prove operational resilience operational resilience , which is, you know, not just fighting cyber threats, but actually being able to survive them. One of the things they need to do is manage and understand the risks from all their suppliers, including indirect suppliers and indirect risks. That's right. So in the context of the travel rule, if you think about a CASP, a newly licensed CASP, once they become one, DORA applies immediately.

Now they really need to think carefully about due diligence on suppliers and go a little further than necessary. So this introduces the concept of a critical ICT ICT service provider. This is not a new concept. It exists in other regions as well, but you become a critical ICT ICT service provider if your client, your VASP or in this case CASP, truly cannot function without you. So, if you have a CASP that has connected one travel policy solution provider and doesn't have a contingency plan in place and that solution fails, you're in trouble.

You are in a critical situation. Yes. So we believe, whether it is fair or not, that travel policy service providers will eventually be recognized as critical ICT ICT service providers, either by CASPs themselves or by regulators, and this will trigger audits, oversight, etc. You really want your travel policy provider to invest in cybersecurity, IT, and be audit-ready. I think this will level the playing field a bit , because I don't think the number of providers we see today will stay the same will stay the same .

This is important for business continuity because you won't be able to provide services without this solution, so if one fails, you definitely need the other to work. Yes, definitely. And I would say, on the topic of DORA, you get what you pay for, right? There are costs for our companies. Having infrastructure, secure infrastructure, to comply with DORA and other regulations, having all the security practices, passing SOC 2 and all these security audits.

Because you realize the importance of having a critical supplier like us. And this is definitely not something worth saving on. When I was the Chief Compliance Officer and the Travel Rule requirements came into effect , this was not where I tried to save money, given the importance of the issue. Regarding the challenges we mentioned, closed and open networks, open networks, of course, each of them has its own set of problems. I think one of the advantages of open networks is the aspect of reachability, because ultimately you need to interact with your counterparties.

You need them, as I just mentioned, to pass the TFR. They should respond to your messages. You should be able to send your messages. And I think this is becoming a very important holistic industry concept that many are starting to realize. We can mention the collaboration and interaction that happens behind the scenes to develop the industry between Verify VASP and Notabene, because even as critical suppliers, we understand the importance of this.

And maybe I want to touch on one of the challenges that customers constantly ask about , and that we've discussed in industry associations, very quickly, industry associations, very quickly, is the concept of verification for third-party standalone wallets standalone wallets . By the way, we had the pleasure of having a conversation with Joanna from EBA conversation with Joanna from EBA , and I asked her this question. I said we hear a lot from our customers. Initially, there was an understanding that information should only be collected for third-party non-custodial wallets. But when reviewing the EBA recommendations, there are comments about verification.

So, to shed some light on this , I thought it would be great to share this with the audience for those who didn't hear her answer, where she essentially pointed to Article 198 in the TFR, as one would expect from a regulator to answer my question with a link to the article. So, that's normal. But all kidding aside , it all comes down to various risk mitigation measures. And also to apply a risk-based approach to these various identification and verification measures. You can also look at the origin or purpose of the transfer purpose of the transfer .

You can continue to perform ongoing monitoring. This really creates a space where you can be creative. Or, if you don't want to get creative, we at Notabene recently announced at our summit that we have support for third-party non-custodial wallets that will simply solve this problem for you. Yes. I love it when my job as a moderator is to have my panelists just keep debating, talking, and answering all our questions.

This is great. Thank you, friends. I think we heard some very interesting topics. I think at the end we even took a little look at the structure of DORA, which is not the topic of today's discussion, but is actually a very important piece of legislation that makes up the entire digital finance structure that we have implemented in the European Union. So this is important to remember.

But then again , we also heard about new challenges when it comes to how to implement third-party verification for non-custodial wallets. And I think we can wrap up with a few final remarks, but it already shows that the industry is working together, trying to collaborate, trying to be creative, as Lana said, to find solutions, technological solutions technological solutions , that allow us to meet these stringent requirements; but as we discussed earlier, it makes sense and should make our crypto space a little more secure. So on that note, a few closing remarks from our three panelists. What would you like to focus on as the main takeaway that our audience should go home with, thinking, "Wow, this panel discussion was so great." Well, I'll share what I think is the best remark I've heard from EBA, because I think it's worth repeating.

Joanna said: don't wait. Yes, the deadline is December 30 of this year. If you start thinking about it in just two weeks, good luck to you. You should already be in the process of communicating with providers or have everything set up. Don't delay.

Thank you, Elsa. One of the most interesting presentations I've given recently was on the findings of the implementation of the " implementation of the " travel rule" travel rule" to a group of law enforcement officers . And that's actually quite exciting. There's a reason why we do all this, right? Our members receive reports of suspicious wallet addresses.

Fraud is on the rise, as everyone knows, and we've seen a dramatic drop in impersonation among our members as their identities are tied to the wallets they use. However, we have noticed an increase in the number of virtual asset scams. These are counterfeit coins, but the same attackers, so thanks to digital fingerprints, this becomes a very effective tool. So there is a good reason for this. It's not just a hassle for everyone and an additional expense.

Once the “ travel rule” is in place in enough jurisdictions and everyone starts working together working together , we will need to share this information with other providers, law enforcement, etc. This will be a very interesting time will be a very interesting time . OK. Let's stop there . That's right.

In short, my advice is to view the “ advice is to view the “ travel rule” as something worth adopting, not as yet another rule that causes dread due to a bunch of requirements. Prevention is better than cure. If you start preparing now, set up processes, and find the right solutions, it will be easier for you to run your business and it won't be something to fear. So prepare, organize in advance, and your processes will adjust naturally, instead of doing everything in a hurry and then fixing a bunch of mistakes. OK.

I think that's where we can wrap up these wonderful speeches, and it seems we've all got our " homework," right? You just heard that you need to prepare, to be ready; Deadlines are approaching. But you're in luck, because there are some great travel experts on the scene who you can turn to for any information. You can always talk to me if you want to know anything about Brussels and EU politics, and, well, we can end with a round of applause for our panelists . Thank you to everyone who listened to us, and thank you again to Victoria and her team for a great 10th European Blockchain Conference Blockchain Conference .

Thank you all. Enjoy the rest of the conference.