Travel Rule in Action: What Works, What Doesn't, and What's Next

Transcript

Thank you. Yes, if the speakers could come up. It was great to hear from Laura and it was great to also meet her um in person. It's great to have everybody here um representing all these different associations. Everybody who's here is going to be speaking to you from different vantage points and that's what we love to hear in these kinds of discussions because it's quite a complex topic when you go down to the details and um me personally this is quite a momentous um occasion because we have been talking within the industry for a long time about interoperability and these kinds of discussions can only really take place in person when you roll up the sleeves and just um a few moments ago behind closed doors we've

been having these discussions about how do we make things a little bit easier for the industry and that's really encouraging. So I would like to kick us off um just with a quick round of intros and then we'll we'll go into a bit more detail on um what's the state of play today and how do we move move forward to make things a little bit easier for our VASPs in terms of travel rule compliance. Ilia, you want to kick us off with an intro? Sure. My name is Ilia Brovin. I'm chief growth officer on Samsub. Samsub, we're probably the largest uh KYC provider out there.

Certainly in the crypto space. Besides uh KYC and IDV, KYB and everything that has to do with onboarding, we also provide a number of uh kind of ongoing monitoring solutions around anti- fraud and transaction monitoring. And one of those solutions is actually a travel rule which from the very beginning we've built as an aggregator uh based on an aggregator model. So we uh besides our own client base also integrate several other protocols and we are certainly huge proponents of interoperability uh on a protocol levels to make life easier for everybody. Awesome. Hi everyone.

Nice to meet you again. My name is Lauri Hildbrand and I um am a compliance officer at Coinbase where I've worked for the past seven years um including on uh the topic of travel rule and helping to build out trust which we just talked about for I think 90% of you that were here. stab. Thank you. Uh my name is Hio Wolf. I'm board member of Cryptovia Association and I'm CEO and co-founder of U- Hodler. So we are uh crypto asset service provider, virtual asset service provider, financial intermediary. So we have multiple registration licenses and that's why we have to use travel rule.

We have to be compliant with all travel rule requirements in Switzerland, in the European European Union and uh in other uh countries. So, and just on another note, it's quite a rare case to have two IAS on the panel. So, different different different conferences, quite a rare case. And also, it's nice because Chris and Laura, you look like sisters. Uh why especially because Chris has been working on travel rule on one side of the ocean and you've been working on travel rule on other side of the ocean. Mirror images. Yeah. So, it's so nice.

So, we have great composition of the panel. So, thank you. Good afternoon. My name is Philip Gospino. I'm co-founder and CEO at 21 Analytics. We are a vendor for Recte specialized in travel rule. That's why I'm here. Uh I my background is I work in crypto industry since 2014. Yeah, that's it. Great. Thank you. Well, Philip, let's start with you maybe in reverse order. Um I know that you are very often in contact with uh smaller startups and and also larger ones that are coming to you for the first time uh asking about travel rule and some of them are quite advanced in their knowledge and some of them know exactly

what they want and others maybe not so much. So what um what can you tell us a little bit about uh the process of working with firsttime VASPs and what makes for a good solution that's scalable? Yes. So what VAS often underestimate is how disruptive the introduction of travel rule is. It will change the user experience but also it will completely disrupt your business because you cannot just blindly send transactions back and forth. You really need to know where it goes. You need to understand you need to archive it and so on. And uh what usually vasps also underestimate is that uh the landscape of solutions is currently very fragmented. So no matter what you

choose, you will never reach all of your counterparties. And then you need to start to improvise. And there is like a tiny trick to make a small workaround. And that's if you start to accept self-hosted wallets only. It sounds a bit paradox because you um disrupt your original workflow completely. But because everyone can uh withdraw to their own wallet and you can always reach that through the proofs and so on, you end up having 100% of transactions going through and the next step I would recommend to do the vast tovast travel rule solutions. Yeah, we know historically uh that was especially at the beginning of the introduc the

introduction of the travel rule that was a bit of a workaround that some exchanges were using advising their clients to withdraw to private wallets. In the meantime, that's become quite complicated with all the due diligence for travel for private wallets. Um but yes, that's uh interesting insights from a somebody who's there. I think that's also how Bitstamp now got their Mika license. They only allow self-hosted wallets. Okay. Laura, we've we've just heard from you about trust. Um, what do you find are are some of the key elements that make for a good travel rule solution, which you've obviously baked into your solution, but what comes up again and again perhaps from the point of view of the regulator? What are they looking for and what are clients looking for in

terms of key features? Yeah. Yeah. So I think I think from a Coinbase perspective, we share somewhat of a unique perspective here because we are both of VASP with our own travel role obligations around the world in a variety of different jurisdictions um as well as um you know operating the trust solution and and engaging with really hundreds of VASPs every year uh to help them with their travel rule journeys. Um I think that the the few points that always come up are um around coverage. So, Avasp is hoping that when they can plug in a technical solution, um, that they are able to reach as many of their, you know, top counterparties as possible. And to Philip's point, there's

no silver bullet in travel rule. There's no one solution that you can implement that's going to give you 100% coverage simply because there are still jurisdictions all around the world that don't have travel rule requirements. And so, there are VASPs that are not participants in any solution. So a VASP can even go and plug in 10 different solutions and it's still not going to solve your your problem in 100% of of cases. So so coverage is really important. They want to know that they're getting the most bang for their buck that if they're going to spend, you know, time and effort doing a technical integration that it's going to really pay off and not disrupt the the transaction flows.

The second piece we hear kind of both internally as well as from other VASPs is they really want to ensure that the solution they're using is secure. So obviously there's a trade-off with you have to send your customer data all around the world um and so they really want to make sure that um whatever solution they're using both the transmission of the data is done in a secure way and that the VASP on the other side has gone through some level of vetting so that they don't have to on a bilateral basis go out to thousands of their counterparties and have to recreate um that diligence. Um I think from a regulator's perspective you know I think there's varying degrees out there. I know from a trust standpoint, we've always really reiterated that data security is so important in this space.

Um, you know, there's some regulators that I think care a lot about just coverage and making sure that, you know, 100% of VASPs flows are covered. Um, I think other regulators have been a little bit more flexible in understanding the data privacy and security challenges and the sunrise issues. Um, but I think at the end of the day, you know, we're all on the same page. We all want to fight financial crime and we don't want our exchanges to be exploited by bad actors. And so, um, we're really looking at how can we solve this in a in a way that, you know, acknowledges the reality that we're in, um, and the progress that we've made.

Thank you. Yeah. Ilia, how about you? You, um, I know that you have, um, had some implementation, um, experience or actually I would say quite a bit. What makes for, um, a good travel solution from your point of view and especially from a user experience point of view? what are you looking for and what have you considered in the past? So first of all uh as you know in Switzerland it's a must have since like 2021 four years already. So and uh since then we have our travel solution maybe uh speaking about early days it was not absolutely not convenient. So user experience was was like a disaster. So luckily we have now multiple options uh but at the same time we have multiple

challenges. So because uh we service uh quite a lot of customers from different jurisdictions like Switzerland, European Union, let's say Argentina for example um uh with uh quite different requirements from regulators but we being a Swiss or European Union company we have to follow the rules right so and the challenge is that there are different protocols like trust right or uh we have some aggregators like sumsup so we've been working with sumsup because they're helping us to aggregate different protocols. So and uh we need to orchestrate our direct integrations with providers like like trust and um we have to work with the aggregators and

support them to get more protocols on boarded uh to to the aggregation. So but the interesting thing is that um uh and as you know even in this audience we've been speaking about travel rule during the last five years even not four years but for the first like four years it was mostly like legal and compliance discussions all those chairs were covered with the legal guys speaking about just legal aspects of travel rule for some of us it was fun for some of us it was just something boring but the truth is that the real challenges started this year because VA wasps cusps banks, even banks faced a lot of a lot of issues like uh speaking about us like our customers faced some issues with Revolute. So topping up their accounts

at U-Hauler, they got some issues with stack transactions because trust is using one protocol or sorry Revolute is using one protocol uh we're using another protocol, right? So and this is a real challenge because it's a negative experience for the end users. It's some loss of revenues for us as a service provider. uh and this is like a big push. If it was before just a legal discussion, now it's real money and uh so we we are working with it with it by investing more and more funds in more integrations of different protocols. Um and I think um so we're quite advanced and I think we will polish it uh at the best possible way. But again now it's a

challenge and companies who will not solve this challenge most likely will need to stop operations simply. So and this is again not not about regulatory requirements already. It's about real money nowadays. Yeah. Yeah. I think it's uh some people may think it's as simple as um on our mobile phones when we have different applications for communicating with different parties but the implementation itself is extremely costly and like you said from a user experience it's a challenge. Ilia, let me turn to you. I know that you've made considerable efforts in terms of interoperability, trying like your counterparty, Ilia, to find different solutions to make it easier for your for for your clients. Tell us a little bit about your journey and how you've tackled this challenge.

Um it has taken certainly a lot of a lot of work and a lot of talking and uh you don't have that many gray hairs yet. So not not yet. But uh indeed like we are a global business so we everywhere. So in in APEC there are protocols that exist there European parties there's trust in the US. So uh of course we've had these conversations day one but you know everybody's trying kind of to develop their protocol and solution in a certain way and maybe interability is not their priority from day one. We've always known that we're not going to build just another protocol and compete with the others. We'd rather aggregate. So the challenges that we had are a reaching that type of of an agreement and

everybody has again their own uh view on on some aspects of it. Uh technically because everybody has built their protocol in a vacuum like how they think it should be done. Every integration is super custom. Uh that's the second challenge and then uh and then once you do these two I think and then you have like the challenges that are a little bit more predictable but they still to be solved right if you operate across the globe then your counterpart is another jurisdiction and so slightly different rules need to apply. So what we've tried to do is effectively kind of take all of that load from our customers and and solve it for them. Oh sounds amazing. Please tell us how you

solve. Well, I mean there is a there is the uh product layer which applies the rules, the logic and the different bundles to different jurisdictions. So you can take into account so effectively in my ideal world our customer says oh I need the bundle for UAE var enabled or I need a bundle for MAS and Singapore enabled and then it just works out of the box at least 90% of it. And then the next layer once you do all of that is that well and then can we deliver the message that we can orchestrate the different protocols to send and receive messages from all of those and I think we're kind of we've made a good progress along the journey and hoping to make even more progress now that you know as

was mentioned now that the regulators are actually focusing on this working we have some extra support uh from both customers and and the regulators that this needs to be solved ultimately. Great. So building an orchestration layer bringing all the protocols together helping our clients to talk to to each other through various channels. And there's another thing is like um each each protocol or solution they also have their own ideas of how interperability should be solved by releasing their own versions of you know tru Laura mentioned trust hub right but then not benny said there's a tap protocol and and so on so forth so you kind of come they all come up with different proposals and then effectively

we need to kind of integrate the different ones so but I think uh now that everybody understands this is a a big big hurdle and challenge uh the minds are being put together now to kind of solve it. Okay. So, Philip, let's let's put ourselves in the shoes of the people who have to make this decision about these various tools um and and models available or coming to a service provider that is helping them to bridge the gap between the different solutions. What what should a consu what should a VASP um be thinking of in terms of the criteria that they're looking at? And I'm thinking particularly about centralization versus decentralization models or other types of criterias that stand out to you as being very relevant

in the decision of of how to select the best solution. Yeah, I think um we have a variety of solutions with different properties. Centralized solutions have the issue that you need to go through a vetting and application process. you have a third party dependency where you need to wait for them to act. Uh we had some customers coming to us because they just lost patience. The process was too long. Uh so this is uh one common problem that we can see also with central solutions especially nowadays with all these tariffs and retailer measures.

We have seen for example that the EU was considering to maybe tax US companies that are providing uh tech services or cloud services here. I I know that Microsoft cloud pulled out of a university um in China. So all these uh dependencies that you have with a centralized solution nowadays also impose a risk that you need to take account of. And also decentralized solutions kind of have also attached a bit of a issue with interoperability because also there you're kind of um have a third party risk that they will um implement the things they uh have scheduled in time right and if we

contrast this with open protocols then you are in your your own boss you can and in your own pace uh implement these solutions or you can come to a vendor that implements it for for you and uh there you don't have all these uh issues with going through application process because it's permissionless everyone can implement it even centralized solutions can implement an open protocol and I always like to uh contrast these things um with an example from the real world so email is an open protocol and if I have an outlook.com account at Microsoft I can send you an email to your gmail.com account which is Google and it just

works. And then on the other hand, we have centralized solutions like uh Telegram, WhatsApp, uh WeChat, Facebook chat and so on. And we see that until today they don't interoperate but actually they're getting more and more of these things on my phone and I think no one enjoys that, right? wants to reconcile all these things and so I believe the future will be an open protocol that uh well established can only agree so being like a customer of all those protocols it's such a pain to work with number of protocols it's huge budget different standards so we need an email standard open protocol for

travel rule so yeah there's an open protocol called TRP that is even better than email because it's fully encrypted and secure My view if I can add to that is that I think ultimately it will come kind of come to that. Yes. either that by there being one protocol or maybe them being sort of fully interoperable and that you don't even care sort of is there one protocol of five as long as you can plug into that global network from any point of view like you said with any type of like Philip said with any type of client you know so like our client effectively would deliver a whole bunch of

functionality maybe like a lot of stuff that Outlook would have right but then somebody else will say Well, I'll build my own email server and do it all ourselves and somebody will use another one. So that's ultimately and then we will be competing not on the basis of you know which what's your coverage. It's going to be global. It's just like which functions, which support, what service, what price do you want to pay because Gmail is free, right? But corporate Gmail is not free. uh or if you use Outlook and even more functionality, it's you pay something for that and that will be a free choice then for for everybody. What do you think about that Laura? So I think I think there's definitely merit to open decentralized protocols and I think when

we set out to build trust we tried to look at how can we create kind of a hybrid model because I think the challenge we saw at the time when we started building trust was that although the decentralized protocols from a data sharing standpoint that that was you know the approach we wanted to take. I think there were certain elements of travel rule compliance, particularly around um counterparty identification and then data security and having some standards around who you're sharing data with and what type of vetting they've been subject to that we really wanted to build uh more functionality around. Um I think at the time, you know, we because we were in the early days of of travel rule, um you know, we didn't see a lot of VASPs out there in the ecosystem

using these decentralized open protocols. Um, you know, I think at the time if if everyone was on TRP and we could easily plug in TRP, that would be like magic solution our problems. Um, you know, again, I think from our standpoint trying to convince our own security team internally that we were just going to start sending out travel rule data to counterparties around the world without having things like actual proof that the counterparty on the other side owns that wallet address or that they've gone through some sort of onboarding review um was really a hard no. Um, and so we we really thought about, okay, from a VASP perspective, like what do we need to get comfortable to be able to actually share that data?

Um, and how do we do it in an efficient way where every VASP isn't having to go out there and do that themselves? Because then we end up where, you know, the banks are, where everyone has their own standard of due diligence from a compliance standpoint, from a data security standpoint, and it becomes very inefficient when I'm sending out thousands of DDQs to all of my counterparties, and so is Ilia and so is, you know, every other exchange. And so we thought how can we leverage kind of independent third party relationships to help do this on behalf of the entire industry um and and build some real infrastructure around travel rule. I think you guys were in a very unique position to be able to do that. You definitely had uh the volume and you had the funds and you had well not not necessarily the regulatory pressure but

you definitely had the the will to to do it. I think that that was present in maybe other industries um but maybe the funds were missing or other elements. So it was probably a good coincidence that everything came together for you guys to push that forward. And I'm really happy to see from a from a Swiss perspective or from an EU perspective more and more opportunities now to interoperate with with trust um and have those discussions about interoperability. So maybe just to close it off and leave a little bit of time for any questions that anybody might have. Um what what is in your view I mean we've talked a lot about what the challenges are, what clients are looking for, what makes for a good solution.

What's in your view necessary to be able to get to this um level where we have a standard that everybody can adhere to and you know everybody inter interoperability can become a reality. Where should we go from here? So we actually uh we spent more than an hour in the meeting room upstairs today uh speaking exactly about this from practical practical perspective. So we we were speaking about how to integrate different protocols and seems like we have a solution. So, we just need to spend a bit more time, right? So, and we'll have it. So, you heard it here, ladies and gentlemen. Tune in next year.

We'll be presenting our brand new solution. We'll see. If only it were that easy. Funded by Coinbase. Thank you very much. Yeah. So, it's it's it's it's an evolution, right? So, we're just pushing this evolution. We're contributing to this evolution and uh we will be there for sure because it's must have, right? The only problem, sorry, I will be again speaking about challenges. The only problem uh is costs because uh being uh financial institutions so you have to invest a lot in in different kind of compliance tools right KYC IML tools different kind of transactional monitoring chain analysis and now travel rule right so plus we have karp now speaking about reporting standards so

even like midsize uh crypto as a service provider nowadays pays like hundreds of thousands dollars or franks or euros on an annual basis What does it mean? That means that at the end of the day all those costs will come to the end users. This is extremely bad, right? So and uh we need to be very cautious with two things. User experience and we spoke about open protocols all these kind of integrations and second costs. So this is I think very very important. So Philip well I think um what was needs to just need to con carefully plan that is I think uh the most

important thing to uh outline all the various scenarios that can happen and um I may I can repeat one more time just self-hosted wallet selfost wallet selfhost wallets That's what will get you started. Yes. Thanks. Yeah, it's it's it's definitely a one approach and I think a lot of people are thinking about that for sure. Yeah, I'm happy to jump in. You know, I think I think right now there's a lot of talk around interoperability and and you know, it's something that we've always been open to and and are definitely um you know, continuing to explore. I just want to like caution that and this is what we've really re reiterated to

regulators is that interoperability is not synonymous with coverage and so you know although interoperability can be a tool that can help achieve coverage we've also found from our perspective at trust that over the past several years it's been of higher value to us to invest in growing the trust solution on boarding more members and building the features that they're that they need and that they're asking for. um in order for them to meet their their needs. So, it's definitely something that we want to pursue. Had a lot of great conversations earlier. Um and you know, at the end of the day, we want to make sure that we preserve the very important privacy, security, and kind of core principles that um really were were how we founded

trust in the first place. And so I think as an industry, yeah, we're we're kind of at a crossroads of figuring out as more and more countries do implement travel rule. Um really how this is going to play out over the next few years. So exciting time, good good time to be in compliance, a lot of lot of job security, I I suppose, but um yeah. Yeah, I think from a commercial perspective and also as a user and putting myself in your shoes, I can totally understand, you know, why that would be the logical sort of next step is to improve the product that you're developing if you have the volume. I think just the the risk there that I would caution is is that, you know, if we build the one solution that everybody's using, it may be effective, but it does expose everybody to, you

know, geopolitical risk. And that's I think why we continue to invest our time in alternative solutions to make sure that we're not centralizing you know a very decentralized concept or ethos in the hands of you know sorry to say but one American company that or yeah that it's that is subject to some vulnerabilities politically. So I think that's why we continue even though that makes complete sense we continue to spend some energy and burn some calories to to to develop other solutions. Final word from your side. what's what's needed to move forward. Uh well, I I would want to echo what Ilia said about just overall compliance costs because look, compliance and laws are have not emerged in the decentralized era of

blockchain. And so we actually just generally marrying a concept that is offchain centralized asks for the right to audit trail and everything. And we're trying to marry it with a concept that is kind of anarchist a little bit, right? You know, it's like we want to be totally anonymous, completely decentralized. So I think there's going to be a balance and I think part of it is the price that the industry is paying for increasing adoption is kind of incorporating some of this pre-blockchain principles into the work. The other aspect is cost of course right and I think that's actually where I think and why we're building our our product overall as this like end to end compliance platform right starting

with you know KYC trans rule transaction monitoring because actually as you said like this is cost this is actually not bringing you extra revenue or anything right and so our view is it would be much more efficient to kind of get it in one place these things talk to each other and therefore are able to deliver much better value uh for the money and kind of make things simpler. So I hope as we can as we continue these discussions that that vision will continue to be realized and we certainly seen this uh in our customers and you maybe can get a little bit attest to that right you use our KYC services and the travel rule and that because it is more more convenient. It would be so

nice to have non-for-profit organization driving development of such things. Absolutely. Okay, I think our time's up. Um, do we have time just for maybe one or two questions? One question. One question. Who's the lucky person? Oh, Max. A question, right? Not not a political statement, right? Okay. Sounds like a great plan, but you mentioned that it would be kind of problematic organiz Sure.

Sure. We have to catch that counter is either Yeah. No, I'm I'm glad you asked the question because I I did want to clarify this. So, trust itself is a decentralized solution in the sense that all of the information that's being shared is sent peer-to-peer. So the only centralized component of trust is that we have a bulletin board that helps members actually identify counterparty wallet addresses in a way that's 100% accurate where they don't have to rely on blockchain analytics or asking their

customer. So right now in the industry that is what most VASPs are left with of just having to ask their customer or check on chain analysis like who do we think this wallet belongs to and they're then going and sending their customer data out on that basis. So we Coinbase operates the bulletin board to help uh identify addresses, but the entity trust itself is not like a a separate legal entity. So there's just basically a centralized contract that all of the members sign to join this coalition. And although Coinbase has volunteered to operate that that only centralized component of the bulletin board, we can pass that ownership of the bulletin board to any member within trust. So this idea that it's all being kind of

centralized with one legal entity. Um although we've kind of volunteered and taken on the role of the operator to date that can easily be moved to any other VASP in the network. Um and so I think some of that centralization risk was really what we were trying to avoid. And at the end of the day the actual transmission of the data is sent peer-to-peer through the the open internet. And so that that's really why we wanted to make this solution resilient and not uh subject to like a single point of failure across the industry. I think um trust and tp are actually very similar in the architecture. The only difference is that the bulletin board the centralized bulletin board is replaced with a concept called travel address and it works like an iban where if you paste that then it identifies

immediately the counterparty vasp and the account of the beneficiary and so this solution is also solved but in a decentralized manner. Two really great solutions for very complicated problems. Thank you everybody for your attention. Thank you to our