J1 AG 03 Xavier Lavayssière Regulatory framework for blockchain payments

hello everyone thank you for coming this morning and I turning this particular session with all the choices you have for today so I'm gonna give you a talk about blockchain payments and regulation just upfront I would like to mention the three point I would like you to go away from this session with the first one is there is an ongoing revolution in in the payment industry and and dark chains are just a part of it and so the topic is we need to be competitive with all the player in that field - in order to take part of this payment revolution and at the moment we don't have the most market power in among the players in that field so we need to be aware of that even if the technology is eloquent and probably efficient secondly the second point I would like to go with is that a regulation not just a set of rules that are set in stones and you have to follow at the end of the product on the contrary I engage you to think a front about regulation because it is as well an opportunity especially for the kind of technology we are working with and it's also something that's about to evolve like all the regulators everywhere in the world are watching the space and trying to adapt that legislation so it's not only a question of looking at what are the rules we need to follow it's like to understand what are the rules why they exist and what can we propose either by proposing new rules and also by proposing how all or technology provides the same services then then the objective of the regulation and and thirdly I think we really need to have global initiatives about regulation in the blockchain space but that takes into account all the local specificities like each region has a different way of approaching the regulation and and different objectives and we need to take that into account I see and I participate in many think tank and groups about that and and I feel like often it's a failure of like trying to design a generic set of rules and principles that don't apply to each specific region it's necessary so a few words on me I used this to the computer science and and and and businesspeople Clos which at the time didn't make sense so it was definitely an error of of choices but no it seems to be quite useful so I'm glad of that currently I'm working in in different activities the main one is I'm working for a research group called production perspectives which this institution is part of the clam and also surfs I which is a laboratory center as I do and also participate in a group that that's called math contract Academy it's a think tank about a blockchain and law and we have been working on that in the over the past months and also consider a constituency activity so a few words about payments so a payment it's pretty straightforward is you have a product we'd like to buy for instance and ask him and you just want to send money in exchange for the good and and that's what you want to do the process is generally you contact your bank and you say you won't I want to make that payment with this person the payment is arranged between the bank and the bank then the merchant the payment has been processed as you know it's always more complicated than that the banks don't operate the payments among themselves they have service provider that the one that actually makes the transfer and actually it's more complicated than that because this between this payment service providers that there are many steps to that's the error in the middle that then makes the payment process but also there are additional services for instance when you trigger the payment it might not be just you paying with your card that's triggering the payment you might be using for instance Apple pay and so Apple pay is another company that will is going to contact your bank and and tell so that's the first symbol on the left it's going to tell you about okay this person wants to make this payment and then your bank is going to contact the service provider that's gonna send the transaction and then it's gonna go to the bank of your match and we're gonna get back and that's still a simplified version also with with this complex ecosystem there is a lot of people will get paid and a lot of different fees they get paid you pay for having credit card so monthly fee usually like the bank pays the service providers the bank pays also a fee to the credit card company like this MasterCard for having a license and and and the merchant also is paying their bank for doing that so that's how the process is messy but also it's becoming more messy because we have new players coming in that field this is driven by the customer that wants new services they want new payments that are more easy and faster and and and so you have new new product and and startups coming in the space you have also a lot of players that that are consumer brands like for instance Starbucks or any supermarket that want to get involved in that space so the proposed cuts and the card and payment system and they try to also participate in that do you have all the fintechs also the Gotham so I mentioned Apple pay but all of them are providing different payment solutions and as well as manufacturer of the mobile phones of the of any IOT device that that also gets involved in the payment so the space is becoming more complicated so far a Bitcoin transaction seems way more simple you just are directly in sending the transaction and actually that's basically it but in real life it gets also more complicated for instance when merchant is accepting Bitcoin usually they use also a service provider that's gonna be the one that's received actually the bitcoins and then send them the money to that bank account and that's just a bit of it but what's even more interesting with what we can do with with with blockchain technologies is this smart contract vision I'm sure some of you have read Nick Szabo paper on smart contracts who has okay cool a fair amount what's really clear in his paper so what's fascinating is Nick Szabo paper was writen way before Bitcoin in the 90s and he's explaining his vision of smart contract and he explained that the vision of smart contract is is to have a system like a vending machine that makes that - to retrieve the physical good you won't like when when you're buying a chocolate bear power you you you can add the chocolate bar bar only if you make the payments and also the person who is selling the trade bar knows that you can't retrieve the chocolate bar and unless you have made the payment so so that's simplifying all the processes we have seen before in in the sense that you design once how it's going to be working the payment processing and and then it's going to be working again and again in in the same and enforced way so that's one of the really interesting kind of solution we are able to provide using if your own technologies so let's move on what are the key regulatory objectives regarding the payment industry the first one I see to guarantee payments so this is a first challenge as you have many players involved in in payments you need to make sure that the payments are done and well done so the challenge is to mitigate the operational risks but also to assess liability for instance if a payment doesn't go through with responsible at who is in charge of sending again the information who is going to have to pay the customer if there has been a failure in general we expect that whatever happens in the back end anyway the payment is going to go through and and they are going to solve among themselves that but then that's a huge legal complexity to make to make organize all all those participants the second category of of object regulatory objectives are to protect user data as you have also many players participate in make sure that the data of the customer is protected and actually it's becoming more and more challenging because each of the participant of each of the search providers is actually having all the information about your data and and and about this specific payment but also sometimes about your bank accounts and and prior payment so that that's a huge risk and it's increasing exponentially with with the has many player upcoming in a space so it's both like legal objective but also to make sure that the data is securely stored and then the last two categories well the first one is pretty big is to avoid illicit activities so that's what we mentioned by anti-money laundering so each time somebody has used money for illicit activities they shouldn't be so easily able to reuse I mean in the regular regular markets also terrorism financing that has become pretty huge over the last year's for instance in Paris we had the Paris attack in 2015 and in the following month there has been many working groups in enhancing the capability to identify money that comes from from terrorist activity because that's what has been financing some some of the activity that was responsible for the attacks and also illicit among other illicit activities there is tax fraud this could be a category by itself and especially when we talk about payment there are a general question of taxation just to clear the scope there are two basic text I could apply when every time you make a payment the first one is v80 so it's when you buy a good you usually have to pay a certain percentage for for for those states and and the other one is income tax so the income tax is a bit more tricky is because as you bought your cryptocurrency and was just a mini of payments at the moment you you're reading in your cryptocurrency you actually might be doing a benefit compared to the price you buy you bought your cryptocurrency in the first place and so at that moment when you're making that penalty you should have you should take that into account and and report it at the end of the year for your income tax and for those two categories then the question and the legal description and it's different depending on on the country is to assess like at which moment are you buying a good so is the cryptocurrency the good or is the end service you're buying the good so that's for VI T and on the opposite side for income tax is when are you making benefit on vegibot and so then promotes a fair and open markets there's definitely a more European centric actually the two lower points are a more European so because one of the purposes of the regulation especially in this industry is to allow to have new participant and a vivid market so I'm gonna pretend a few regulation about the US Canada and Europe which have a bit more but but it's just a few a small overview so in the u.s. it's been clarified in 2013 by the Financial Crimes enforcement Network which is a Department of the Treasury Department that's when you exchanges and everybody does doing payment processing Bitcoin should be considered as a money transmitter this has two consequences being a money transmitter it's also considered as money services business which require them to be registered at the federal level and to comply with certain lists of obligations the money transmitter also in impose them if they want to operate in a specific state to get a registration in each of those states and this is actually a pretty huge challenge for for a lot of companies because you have to go to each week later of each of the so it's 950 states and the territories and and so it costs literally a hundred of thousands of dollars to get all this registration done a pretty comprehensive law about money laundering in 2014 that really clarified that dealing with virtual currencies you are considered as a money service business so the same you have then to go to a registration with reporting obligations or reporting obligation is every time you see a suspicious payment you should be reporting it and especially you have a specific kind of people like foreigners and that that our and also people in a high office in an administration that should you when they are there is a special payment you need to to report more when good thing that makes Canada regulation and and it's pretty general in over different regulation they have is that they make a lot of aspects pretty explicit when in most countries you have to deal yourself for instance the ID requirements like in in most countries you impose the person doing the payments to to do some highways heat you know that customer and and make some assessment on what they are we do but usually there are not really specific rules I say that when do you know exactly with your customer and when you don't and in getting the Canada its explicit like you need this kind of paper and this kind of information and and then you have a good you can see that you know with your customer and tax is as I mentioned every time you do a purchase it's considered as a butter transaction and then you have to pay an income tax regarding the budget keeper until money-laundering you have a directive in 2015 which impose the same kind of rules or risk assessment due diligence on your on your consumer there is also a central beneficial ownership registry that's pretty interesting is the idea is to have for every legal entity with the final owner of this legal entity because often you have different layers of shadow legal entity and is difficult to know who is actually making the payments and so they have a central registry to try to do that it's I think done at each state level and they try to have some organization also on the vit side of things it's been clarified by by a court ruling in 2015 and and explaining what was payment and and and actually the case was somebody who was buying Bitcoin and reselling them online and the question was was his activity service that was taxable by vit and it was considered that he was just providing a payment services payment service entering in a specific category that made that it wasn't subject to vit also on the privacy side in Europe we have the GDP are are probably probably all I've heard about it at this stage it's gonna come into force the 25th of May this is a really interesting piece of legislation because actually it's it's it's probably one of the laws that requires the most to developers to be aware of it because it's not just a rule you have to respect in the end it's every time you're processing that either that has some personal interest so that about a specific person you need basically to tag your data and know where is the data about this specific person in order to be able to retrieve it if the user demands it in order to be able to delete it in the end so obviously when we are dealing with if you're on project that's also a challenge because you need to think on how you're gonna store the data about what your user and and personal data is not only the name like it's been a long trend of court ruling that that explained that personal data is anything that also identified somebody if you have a lot of information about somebody like that the placement or all the payments at some point you you able to identify this person and and then you have to to oblige respect to zeros then you have also the other side of European legislation that that's that's particularly relevant for that is the PSD to the PSD to is the ID more generally - so it's about payments services providers but but more specifically it's also designed to try to open the market in in this field and to force banks to have more accessible that are entry points for startups so I understood that there are limitations because for instance the regression doesn't specify how available should be the data what are the IP is requirements how fast should be data and that that's at the moment for bid a lot of new entrants to participate and engage but ideally you would have the bank that all the accounts and and and hello anybody and any other service to provide connection with the information they have and and to treat your payments and and so so what is missing at this stage in the space for having put useful payment solutions so what's missing is privacy solutions so I know there are many project working on that but it's still a huge challenge because every time you're making a payment or and especially once we will enter the idea of micro payments and streaming payment so recurrent payment on an ongoing basis you're going to be about you're gonna need to be able to make sure that this data is not publicly available because it is private data this is just the example of the a tree city consumption you know there are few startups that are working on using blockchain to make payments every time you you're buying from your neighbor the energy from the Sun our solar panel so you could have micropayments a system to just pay pay the electricity as it comes but then you need to make sure that all the dues payments are not publicly available a second a big challenge and I really feel like that that's something missing is cyber physical security we have currently I think one company that that's in that space kind of and and to me it's main challenge because what we are dealing with these systems were so sure the blockchain makes the the transaction and the ledger coherent and and and provide security at this level but then what's weaker is all the endpoints in a regular banking solution you have the bank that is like a castle and they have all the information of the users and they get they give the accesses but the control where installed the data and and the entry point is control internally by the bank but in induction system nobody is controlling with making a transaction with adding a transaction who's reading information also and and if we want to have solutions and many use case I hear especially anything that's involved with IOT we involved at some point we have a physical device that's going to record some information that's going to process the payments I need to you need to make sure that this physical device don't get corrupted so there are many solutions and and and and existing research and and also companies like but but this is a huge space for for any solution that would use theorem for any kind of payment then identity and notification when we mention in PSD to for instance it forces all the the participants and the service providers to identification safe too you know as I mentioned like that you have the the liability issue you need to mature every time with interactive with Wu so it's not only the user so the identity solution I see at the moment I really like just I have my own identity on the Russian that's something useful sure but but then we need also to have a lot of more efficient solutions on if we have a particular service provider at some point like how we can make sure that and that's it's this identity the only relying on being about to sign transaction doesn't suit in a lot of use cases then also international initiatives I'm really surprised how many regulators and and also even initiatives are just focusing on on one country when one region and trying to develop their own own regulatory framework when when we are talking about payments we need to have in little purple solution and so any any regulatory ID should be working at more international level it's also working in in having the existing mystic orders for instance in the energy industry you have a lot of players that are not only in the payments but also like with producing electricity with managing the lines with and and so if we won't be able to use the option technologies in in large in industries we need to have work with existing players and and to in order to develop a coherent solution I see many too many startups just trying to develop a solution that's nice that's fantastic but if it's not implemented with all the existing players it's never going to work and then of course there are the scalability solutions but I'm sure we have a lot of talks in this conference about this but this is definitely a challenge for using meaningfully payments thank you for your time