DeFi Regulation and DEXs - Opportunity or Threat? - Ingo Rübe (KILT Protocol) - TOKEN2049 London

thank you so good morning everyone i'm not talking too much about killed is basically providing decentralized identity and giving back sovereignty uh of their identities to the user but not only to users but of course also to things like in the iot business and today we're talking about default regulation and taxes opportunity or threat so you might have noticed or heard that there's a lot of regulation coming and some of the taxes actually came or quite a lot of taxes actually came up in the last couple of months and we're a little bit worried about what they should actually do and asked us if we could possibly help so what's actually happening is that decentralized exchanges and other d5 protocols will be pushed to identify their users because regulatory regulators want that and so the basic thing that you can do if you are a dex you can go either totally decentralized because then you're not a company and no one can actually regulate you and nobody's going to try to regulate you because you are not existent you're just something in the internet or if you are a little bit centralized you have to go the way to be regulated and this is what the dexas have to understand now there's two ways that they can go so now everyone could say well let's just go decentralized and don't care about it but actually there's quite a good reason for a dex to be a bit centralized not only that it was more convenient for the users but also there's a lot of money coming in to the space when it gets when it's getting regulated because uh the crypto market is now something like 2 trillion or so um and when you look at the finance market overall uh this is much much bigger right so why is the crypto market so relatively small it is because it's not regulated and because the big funds can't put their money in because they have to um comply to some standards which the crypto market doesn't have and if the crypto market gets those standards then there's huge um funds probably going to flow into the market so that could actually open regulated finance world for the crypto sector so it's a complicated decision for a decentralized finance project to either be regulated or be fully decentralized so and so now what we're trying to uh solve now um is that actually the taxes they are used to not knowing their customer this is part of their story they don't want to know their customer and now regulators come and say you have to know your customer and this is a little bit problematic for those guys because normally they don't even store data they don't have servers and they don't want to copy the problem that we had in normal finance that huge data ciders are emerging uh with lots of personal data where you have to take care of where you have to comply to things like the gdpr and stuff like that people the the dexa the decentralized phones don't want to store data so how can we do that what we suggest is that they would partner with trusted kyc provider which are also in a regulated infrastructure and use an infrastructure like kilt to get rid of the data an institution or an individual could then share an element with the of their identity with the dex and the dex would not establish a centralized data store avoiding privacy issues and stuff like that so if we would do something like that that would actually be a win-win-win-win situation because it would be less work for the decks because they don't have to buy all the centralized servers and make all the security measures around them the customers could be more confident the regulators would in the end be satisfied and it's also an additional business opportunity for the kyc providers um so let's first talk a little bit when to understand how that works let's talk a little bit about what is digital identity identity always consists of two things it's always an identifier and credentials think of your identity your identity is basically first an identifier that would be for example your face or your fingerprint or something which is totally decentralized because no government or institution ever gave your face to you you made it yourself um and then a copy or a picture of this phase is put on different credentials looks like for example your passport or your driver's license or something and those credentials they represent a power a right a duty or something that you have and they are issued by a trusted entity and they are linked to you by having a picture of your face by linking to your identifier so when you talk about identity it's always two things it's credentials like passports and it's an identifier like your face those two things are always needed when you have identity when we talk about digital identity this is a little bit more complicated because your face is not in the internet so first we have to build a decentralized identifier and there's a standard for that that's called decentralized identifiers the ids and that's a set of key pairs which is generated locally on your device that means means no one's giving it to you you create your identity yourself like you created your face yourself and the private key always remains with you of course and the public key can be stored and anchored on a public blockchain for example the kill blockchain to get together with additional information in a did document so what the kill blockchain basically does it stores the did documents which belong to your decentralized identifier this did document can easily be retrieved i'm going to show you on the next slide how that works and yeah let's just show it um so here we have the user creating for example in this boron wallet their own did they put it on the kill blockchain and then can it and then can be accessed by through many ways so for once there's the universal resolver which is the touch point for people who are completely outside blockchain so this is just a web socket where you can get the did documents if you are if that could be a dex probably not but maybe that would be rather a centralized exchange or something or a bank a dex which is connected to the pocket.ecosystem by the way we're part of the parker.ecosystem can either go directly on the kilt blockchain because we all have the sr25519 keys or it can use the polka dot mechanisms like xcm to access the did document here but there are also bridges in parker dot for example to the ethereum blockchain so if the dax lives on the ethereum blockchain it can also query the data from there through the bridge through the parker dot directly from kilt so basically everyone can access those did documents still the di the key of the did resides here with the user and is never shared to with anyone so what can we do with it next any third party application can send messages to a user's borrowing wallet and the user can decide to sign this message with the did making sure that exactly this did has signed this message so this is an important and easy feature where you can basically have do any kind of proof that you are the one owning this did how does that work for example here we have an ethereum decentralized application that sends a transaction to the user and says do you want to sign this transaction then the user looks at the transaction say yeah i want to sign and size it with a did and then sends it back to the ethereum dap and that can then store the signed transaction and the did which signed it on the ethereum blockchain now i have the proof on the ethereum blockchain that actually this user not knowing who this user is but exactly this user has signed this transaction that's basically the first step now let's do this a little bit more complicated and add verifiable credentials to it right now we have only the face right this phase sign this thing doesn't say a lot and it's not enough for regulators definitely so the user can also ask a trusted entity to issue verifiable credentials to their did and then they're linked electronically to this did the trusted entity would sign a verified verifiable credential with it with their d id and then send it to the user the user stores the verifiable credential locally so it's not somewhere out there in the internet where everybody can look at it it is locally on the computer of the user and then the user may decide to show it to someone just like you show you decide who you show your passport or your driver's license to you're not exhibiting somewhere so that everybody can look at it somebody asks you for your driver's license and then you decide if you show it right so this is the same mechanism so that could also work with the dax so what's happening in the verifiable credential case um first we all anchor rdid here the kyc provider anchors the id the user anchors the did and then the user claims at the kyoc provider please can you do a kyc process with me like checking my passport and stuff like that you all have done that 100 times and then this kyc provider would issue the verifiable credential to the user and then the verifiable credential is stored here and any time that the user has asked for a kyc credential can now say yeah here it is we don't have to go again to the next kfc provider and get this thing done again you have it once and you can use it multiple times for multiple purposes so and when you have this then you can actually go to the next step and say how do we use that uh with the dex so first we we we start at the decks and you want to do something maybe a big transaction in this decentralized exchange then the dex sends this transaction to you for signing so you sign it with your did but you also send your kyc verifiable credential with it also signed with your did now the dex can look at this message and find out a have you signed it b is this verifiable credential i need for kyc in there is it issued by a kyc provider which i trust this is just a trust relationship here the dotted line it's not something electronic and if they trust the kyc provider they can check on the killed blockchain if this verifiable credential is actually valid and if is it valid if it is valid then they can actually take this and execute the transaction and store the link to it on the ethereum blockchain for example so what you have now is that the dex which can compute but can but can't store or don't want to store so they can find out if the verifiable credential and the decks actually match each other if that if it is signed by a trusted entity and store it on the blockchain and then immediately forget about the transaction so they don't have to store anything because everything is already on chain because now last step when an authority should ever be really interested in this particular transaction then they can look it up on the ethereum blockchain and they can see which koc provider actually signed this thing and they see the did of the person who did the transaction and then they can ask the kyc provider in the end to disclose the information about this user the dex is not involved in this whole thing because they can prove that they did everything right and the kyc provider has to store the data of the users anyway so this is basically how you solve this problem the daxes don't have to store anything people who have destroyed anyway are used for this service that was basically what i had to say we have thank you i think we have four and a half more minutes if you have questions yes excellent presentation thank you so much let's put it over to the floor if anybody does have any questions my man let me get right over to you all right um so my question is where do zkps come into this equation in terms of being able to kind of remain entirely private verifying identity without relying on a central party so maybe having trusted parties in the first place but when you're abstracting this just using zkp's as your knowledge proves yeah so zero knowledge proves we work together with a partner company which provides zero knowledge proofs on top of kilt so this is possible so but the thing with zero knowledge proofs is normally it's not exact information so zero knowledge proof would be used for example in the situation where you want to go into a bar and you want to provide the information that you're over 18 but you don't want to provide your birth date right so you could actually have an application which there's a zero knowledge proof on what is inside the credential without sharing the credential itself but they are just sharing information which derives out of the credential that's possible yeah clear any other questions this morning let me get to uh this gentleman over here how are you doing this morning you well hi so whoa that's loud um so so with the verifiable credentials they'll they'll be verifiable but sometimes they'll be fake or synthetic identities and so is there a thought about what happens if a particular dex has a lot of transactions that are happening and a lot of those credentials turn out to be synthetic identities as opposed to real people yeah well if that happens then they would probably not have the so there's two lines of security in there right first the decks okay if the dex is criminal in a way um then how would they get the verifiable credential say because the very formal credential is signed by the kyc provider here right and say so you need a criminal kyc provider plus a criminal uh user plus a criminal dex okay then you can basically do something but it's getting harder and harder because this trusted entity kyc provider would probably not be so trusted after a while if that turns out and then they would probably lose all of their business because no one would ever pay them for providing kyc credentials anymore any other questions right beside me how are you great um quick question so you're part of the polkadot ecosystem does that mean you function on a power chain or power thread kind of system or yes we are right now we are on the kusama network we won i think slot number six of the pro chains a month ago and are happy power training producing blocks got it anybody else sir so sorry with decentralized exchanges is the current regulatory risk initially can you speak a bit louder with the decentralized exchanges there's the currently identified regulatory risk and then there's all of the future potential changes which might be kind of grandfathered onto those previously operating so one part of decentralization is this a lot of dex operators try to say anonymous the whole process right the people that produce the df they try and stay anonymous the entire way through to protect against future regulatory risk in this relationship with the kyc provider do they have to de-anonymize themselves to the kyc provider in your architecture thus kind of breaking away already from the perhaps decentralized goal that they might have yeah well so first of all you can be totally decentralized if you want to be totally decentralized if you choose to work together with kyc providers you will have to make your own assessment uh which chemist providers are um okay with the regulators in the particular jurisdiction you're in you probably is totally completely different from from asia to the us to uh to britain right so uh it will be different once so i don't see one kyc provider getting the whole market here because there's hundreds of them out there and they all have their legal papers which with some jurisdictions so i don't see a lot of centralization there of course it's not decentralized anymore totally right but this is sometimes the price we have to pay you