ZK11: Securing Tomorrow: A Deep Dive into ZK for Automated Regulatory Compliance - Maya Krasovsky

Transcript

[Music] all right hi my name is Maya I'm really excited to present to you today securing tomorrow a deep dive into ZK for automated Regulatory Compliance um this is going to be a workshop so I'm going to have you guys do a few exercises and activities and um I know it's the last presentation of the day so please feel free to ask questions as we go along um it's going to be the least technical presentation at ck11 I so hope so feel free to give your technical mind a break and embrace the

world of Regulation law um all right without further Ado welcome um law and regulation um you know crypto and blockchain is a subversive technology ideally we're building a new Financial Paradigm that does away with a lot of central tenants that make up key financial institutions and that governments then leverage in order to you know control populations um so there's naturally going to be apprehension when we're talking about

hey we should listen to what Regulators have to say because so far Financial regulations have been you know iffy questionable uh you know we've had laws passed like DOD Frank and other regulations after the 2008 financial crisis um that a lot of us believe haven't addressed a lot of key issues um and so we're building something new but uh um yeah this is the overview of the presentation I'm going to kind of walk you guys through why we should care what the regulatory landscape is looking like uh

with an examination of some key regulations uh the intersection of zero knowledge proofs uh with compliance with automated compliance uh going to have you guys do an exercise at the end progress in future directions including regul that are coming up the pipeline and the applicability of those regulations to what we'll be building and yeah I think then we'll be good to wrap it up okay okay so introduction guys they're on to us they

know what's up uh we're going to examine the general data protection regulation that uh EU lawmakers have come up with but there's really no point in saying lawmakers don't know what they're talking about and they can't touch us they do and they have research groups dedicated to examining um issues of compliance in a blockchain um and the intersection with blockchain technology um increasingly data privacy issues and potential mitigation strategies are being researched and you know decentralized Technologies are really

being viewed as the future of technology compliance right um distributed Technologies are spreading so are devices you know the blockchain technology Cloud Market size is forecasted to be worth nearly a trillion dollar by 2030 it's starting to pose an existential threat to some financial institutions especially in developing countries but moreover uh as blockchains store private information and relay private information uh including about the actors that interact with them uh it's peing the interest of lawmakers because

suddenly our interactions fall under the scope of different laws uh yeah there are also more phones than there are people worldwide uh and that's just continuing to increase uh the more devices that there are the more that we interact digitally um the more we're going to spend our lives in these digital Worlds the more we're going to have to take one another into account and play play nicely and so far there are enforcement agencies that that come into play yeah so yeah more people than ever interacting with one another through

smart devices blockchains and onchain transactions are growing at a rapid pace and as blockchain spread so their applications in the apps on them you know we're going to be spreading Financial history credentials and disseminating onchain activities who else cares about financial history credentials Financial transactions governments Regulators guys it's coming it's here and here's why we should align right yeah governments for the longest time haven't really played nicely but they are there to enforce some you know values that we can all rally behind like

privacy security sovereignty and verifiability Truth telling um they're also interested in in you know um enabling more complex and secure applications uh for people to interact with one another and for governments to interact with their citizens how many of us have been victims of bureaucracies DMVs and so on also finally Bad actors do exist uh money laundering is a a serious problem that you know blockchain mitigates um but increasingly onchain activity is going to be made up of

social apps and other more complex applications and we want to keep one another safe especially as we start to tie our financial history with our online activity Market opportunity compliance is a$ 13 billion business in Europe alone and programmable programmable compliance spreads across systems from blockchains two Enterprise Solutions if you bring Enterprises on board multi-billion dollar companies you're going to foster blockchain adoption and that's going to lead to the development of more fun stuff right there's more value in the ecosystem everybody

needs finally if the carrots weren't enough there are fines uh Regulators are really cracking down on tech companies for breaching data privacy laws and regulations um you know I I'm going to point to this one excerpt that the Unstoppable Force gdpr has compelled companies to comply with new data privacy regulations if they want to do business in the European Union compliance with gdpr is not optional since violations can result in colossal penalties of up to 20 million EUR uh or 4% of global Revenue whichever is greater if you're running nodes in

the Europe Union you are going to fall under gdpr and right now they're not necessarily going after the little guy but the little guy is growing and the little guy is starting to perform more complex uh operations and bring on board more complex Stadium which leads us to regulatory landscape overview right that's kind of the primer privacy laws are decentralized too as you can see um in all of these countries just about uh someone is running a node um

someone is mining Bitcoin someone is mining ethereum in all of these countries as well there are privacy laws and as you can see by the coloration they vary from heavy to robust to moderate to limited but as Citizens began to begin to spend more time online um you know this doesn't really show the temporal AIS but at first what was really read was just Europe just Europe and the US relatively given Hippa but the stringency has been spreading across Asia across Latin America and every single year more

countries pick up on cues of other countries um as you're starting to deal with global dissemination of information um the bar should be to comply with the heaviest regulations uh because those are going to be the regulations everywhere eventually and you don't really uh want to be tracking the IP addresses of the people running your Tech right so this is actually a really great overview of the different uh regulatory uh you know laws in in the US in Europe in Asia in Latin America and

Africa um and we'll be honing in on a few of these but just wanted to to to demonstrate that right more and more countries are also going to start stipulating data residency laws so that means wherever data resides and if it enters the border of a country it is going to fall under under the scope of said country um right so any questions so far all right in that case let's look at some key

regulations so gdpr gdpr is offers the most comprehensive protection of data rights within the EU right and here are some key premises that we're going to become familiar with as they apply to a blockchain uh context right so how do you start to regulate data well first you're going to need a subject that is going to be able to be held liable and you know is going to interact with the regulatory body in this case that's the data controller and that's who subjects address to enforce

their rights um traditionally a data controller can be something like meta can be something like Google and it has been for the longest time next we have data reg gdpr stipulates that you and you and you and you have the right to delete and erase any of the data that you don't want out there just because you give someone your data doesn't mean that you can't say hey raise it and they have to comply additionally personal data should be amendable so should be changeable uh then there's minimal data

processing which means there is a minimal handling of data um this really stipulates that um whenever a data controller has your data they should not be performing excessive and egregious operations on it here you can have a relative and an absolute view right so an absolute view is any operation over my personal data that I do not consent to for instance computation over it encryption over it is excessive then you have a relative view of look actually when I hand over my data I agree to I agree to its encryption and I agree to its

management um but I you know the lines the lines are a little blurred who knows how much um consent I give beyond that point finally there are requirements around crossb transfer so if you are transferring data into Europe or outside of Europe um or between different organizations you have to comply with certain regulations including you know disclosure of data being transferred uh across borders and um you if you have incoming data into the European Union it also has to

fall under the scope of gdpr so it has to be compliant uh so something very similar is modeled in the US which is the CCPA and that is uh comprehensive data protection in California other US states are following suit again there's kind of a domino effect with stringent regulation spreading across the world uh and the key premises here are kind of in line with the gdpr so consumer rights you have the right to know what personal information is being collected sold or shared and the right to access personal

information data erer data security requirements businesses must Implement reasonable security measures to safeguard consumer personal information against data bres and disclosure crossborder dat transfer so as we can see while gdpr and CCPA are independent we start to see concurrent themes emerging so right these key points on data point data erer are here to stay right now when we think about compliance in a blockchain context suddenly all of that is flipped on its

head instead of one controller we have joint controllers many players many different people running many different blockchain nodes and running different protocols where you earlier had data erer now you have immutability guys we have a permanent record and it's and it's here to stay uh where you had minimal processing you have data replication and processing on different computers and if earlier you had to to you know play careful um when transmitting data across borders we've finally allowed for seamless crossborder transfer of

information incling financial information now this may vary between private and public blockchains right we can argue that actually we can limit some of this right set of joint controllers maybe we like maybe we have like to agreed upon parties maybe instead of immutability we have selective eraser um and all of that can really take off on private blockchains but um bringing the next billion users on board is possible through public blockchains and you know going back to

the values L want to increase the sovereignty of individuals so we're going to be dealing mainly with publics so this brings us to our first activity guys this is what we're up against on the top we have regulation on the bottom we have the blockchain context now I'm going to ask I'm going to ask you guys to come up with in at least three of these circles um and I'll pass around the mic ways that zero knowledge proofs could potentially promote

synergies [Music] so for instance I'll I'll throw one out for data eras what if we could have zero knowledge proofs verifying that data was erased or certain blocks were erased on a blockchain right um or that uh Within data servers certain information has been erased and we can generate a proof of that without revealing private or confidential information so that is one work around uh but okay I'm going to set a timer for like a minute and see what you guys come up

with right yeah feel free to talk to one another and so on yeah like turn to the person sitting to your left right to your yeah don't think it makes

sense for you probably know

[Music] teolog fincial sector so I'm all

right few more few more seconds and then I'll pass the micro I guys I'm going to pass the micro

room oh y okay perfect so uh let's start from this side of the room and then we oh okay we really enjoyed it so I don't one comment I will make as you said at the beginning that Regulators know their stuff and what was really interesting to me is I'm Canadian and I met with all the Canadian Regulators um right after FTX collapsed as a way to like show a tech forward positive face to Regulators as they tried to pretty much to story us not only do they know all of this

stuff one of The Regulators told me that she just built a Unis swap training bot just to play around with it like they're even building yeah I'm not sure if you reach or whatever but as one time I had uh in terms of data raure and mutability I'm not thinking of it in terms of having data actually be removed from from from public lers because um I think more importantly is that whatever data is there is unusable like for example in in in in perfectly hiding manners using commitments or something like that so

that even if it's public forever it's unusable in a sense something that I I had a very similar thought um but a variation on it which is that even if you encrypt your data you shouldn't post the cipher tax on chain instead you should post an ephemeral encryption key on chain and rotate the key frequently um and this pattern provides you forward secrecy in the sense that if your encryption key is ever exposed then in the first case all your Cipher text

would become pin text but in the second case um it wouldn't matter because you would have already moved to a fresh encryption key [Music] so I was a bit surprised about the one-sided focus on like data privacy regulation do you have any thoughts on like for example antitrust regulation that affects sensitive information shared by businesses and the second comment I feel that getting the highest level of privacy is not so much the issue anymore so we have cach we have tornado cash I

think the real issue is that regulation also has another side that Demands a lot of accountability and transparency like AML CFT uh Basel 3 any some liquidity requirements on exchanges and I feel that The Clash is that The Regulators they don't give a constructive idea on how to solve this apparent conflict between on the one side you need to hide the data and on the other side they need the data to verify that you're compliant and I think it's exactly this tension where ckps can help although it's not always completely clear where you put the balance yeah totally um that that's that's coming up so um we will talk a

little bit about zcash and AML and kyc as well um but this is this is kind of like um just an exercise for how zkp can offer some synergies right because like look this is a pretty broad problem that eventually all chains are going to have to run up against when it comes to handling data like this is a fundamental this is a fundamental problem uh especially if we're then talking about kyc and AML right uh to have kyc and AML on chain we're going to have to bring uh

private identity credentials on chain once you bring them on chain if I can make the case that you are running my passport information through joint controllers in a way that I can't ask you to erase it through your decentralized replication and processing uh you know blockchain while sending it all over the world I have a pretty strong case that you're in violation of gdpr you're in violation of CCPA and I can prosecute you right now lawmakers haven't really gone that route because so far Financial transactions have been coursing through

blockchains not so much personal identifiers but exactly to your point we're entering an era where all of this information is going to start flowing through blockchains and even more data um and if we're talking about you know onchain compute and onchain Ai and on chain ml that's even going to be more data rich and yeah so these are see the these are some things I was thinking like right ckp is a data eraser maybe we could have like clients and dkps of like clients that um min minimize uh data

replication data processing and we could also like play nicely and maybe someone could build something like this a compliance uh you know verification protocol for crossb transfers uh that has to do with uh pinning GPS coordinates um that's all doable maybe one question on the C piece of data eria so what exactly do you understand under so I would say that proving that I deleted something from my file system is impossible but what I can do and what I've seen also published is that you can retrospectively remove data from a block

and insert instead a proof that like removing this does not affect any future transaction because I mean if you remove like a receipt of a spend utxo then this is obviously something that tempers with the current state as well but you can if it's about for example identity data that you just use to prove some authorization then basically this does not necessarily remove something that affects the current State anymore and therefore you can bridge this evident Gap that you get in the hash links through a z knowledge proof that whatever you removed is not problematic yes that that exactly uh that that would be the Practical implementation I'm uh

not going to go too much into the but EXA and your name is johanes exactly what johanes said uh right because you yeah that's how you do um so DK's intersection with compliance this is kind of this is this is now the field that we're in um and here we're going to start talking about key financial regulators and as we're as we're talking about them we're going to hone in on the US because as earlier said whatever the stringent regulation is other countries tend to follow that

is generally the trajectory and the US is kind of the center of the world for Capital markets at the moment we're we're changing right so ofac is the office of foreign assets a control and finsen is the financial crimes enforcement Network and their key premises is you have the right to know your your customer and you should know your customer before engaging in transactions with them so imagine that me and Tura are about to you know sell a backpack or turn on to say I'm going to sell you a backpack if that backpack turns out it has like explosives in it I can't say I didn't know I didn't know or if it turns

out turnon was like blacklisted and I've done business with him I have to know like customer and so you know we're going to have to start thinking about bringing [Music] um interacting with data sets that contain personal information including blocklists next we have anti-money laundering going back to the backpack now what if I say hey teron I look it's really hard for me to get Rubes right now could you stuff that backpack with rubles except the rubles maybe is an onchain transaction and he's purposefully trying to launder

money out out of the country or let's say out of a business uh that falls in scope and that would be prosecuted by these agencies illicit Finance uh Finance mitigations so anything you can think of from like you know theft and otherist activities prevention of unlawful actors from accessing funds customer due diligence and all of this in line with data protection regulations so we're building off of this to get to now what The Regulators expect to prosecute Bad actors

meanwhile we also have something else that Regulators are really caring about so on the finance side right we're talking kyc ml on the health side and also treatment of sensitive information um one of the best kind of bodies of Regulation out there is Hippa um and hipa is the health insurance portability and accountability act now it key premises are protection of medical records Securities and identifiers rules um so all of this is kind of talking about securing personal identifiable

information and um this is also highly enforceable so you know Finance kyc ml sensitive information um sensitive information protections um right so you have rights for how your data is used and then we get to zkps and look they're offering private verifi ability of data and private verifiability of operations collected on the data uh which can enable gated access to data in line with things like Hippa that seek to protect sensitive information um in line with let's say uh databases of block

lists that governments have um that now let's say you can you can generate a proof that someone is on a block list without necessarily revealing contents of The Blacklist selective disclosure of data and the anonymization of actors there's a tension right so as much as it can help at the same time privacy kind of stands in the way of transaction monitoring and maintaining customer records um so it's a case study uh a good case study for this is

zcash which illustrates both the pros and the cons so zcash came under us and uh in and EU and international scrutiny when it turns out that it was violating AML and kyc and enabling money laundering through its private transactions this is a case that uh lawmakers ended up making that by confiscating the privacy of the individuals interacting with one another on the network uh zcash was promoting money laundering um you know this is kind of how it's being looked at now and increasingly how more and more

um ZK rollups and ZK chains may be scrutinized right and it added a compliance burd for zcash companies operating in multiple jurisdictions so applications aren't really safe here either if you have a tension between privacy maintaining customer records and transaction monitoring maintaining customer records and transaction monitoring have to be factored otherwise you will end up in some Cash's so in blockchain context people are really thinking about

this and saying okay so how do we maintain access for for Regulators how do we make sure that we're not enabling money laundering and that um you know only verified persons are interacting with one another uh this is actually uh a great breakdown of a privacy protocol that was implemented um and um more to follow so you can say that funds can be deposited if funds are not from a sanction address from an address that received the funds from a regulated Financial intermediary meanwhile funds can be withdrawn if they're not from a sanctioned address or from a sanctioned address in the transaction is to get

anonymized or from the address that received the funds from a regulated Financial Jer the question is where do the lists of sanctioned addresses live how do we have access to them right uh these are great questions to ask potentially a Synergy that that could be had is you know uh governments and Regulators ultimately hold on to those databases and we can request proofs before interacting with let's say someone wants to transact on a certain chain that you know they're not on

L um but this requires coordination between different identity protocols um and synchronization with uh with Regulators so hopefully if anyone's going to Washington or to other regulatory bodies we can start to ask questions about look actually we can build these privacy protocols but we want to make sure we're not on the hook for uh address is how can we work with you right other thing that we really can't shake our head at is say ah well whatever you know uh findes can and will be

imposed uh if this is if this is ignored so just keeping that in the top of our minds also uh if we're thinking about holding on to sensitive information such as databases of let's say blacklisted individuals a concern here is civil resistance right if we're not implementing like a joint controller approach we're thinking about how can we minimize a certain Vector of attack and how can governments likewise minimize a vector of attack if they're going to be um sending out further information um I think a very solid solution is

is government agency sending proofs um to uh to blockchains and other entities that request them bring us to right so to achieve privacy protocols we need identity information to dra with blockchains need proofs of personhood right so in order to make sure that you're you're a person you are who you say you are I'm not on the hook for laundering money with Tron how do I make sure teron is who he says he is and

let's say after I found the proof back from the government that Turon is not on any black list that they might have how do I know that Turon is a person that regiz person so there are several ways there's bi electric verification and worldcoin is really a Pioneer with this where you know uh they have biometric verification uh the data ised about your irises a hash a hash is generated from that it's a unique identifier the iris information is deleted you go on with your day um another uh potential is demonstrations of humanik activity on

social media or on right so we can generate proofs that oh this you know these interactions or this interaction in graph corresponds to a unique person and as artificial intelligence grows more advanced this is going to be more looked into right now like a good example is getcoin and getcoin password that when you link your Twitter to it they're analyzing it for humanik activity to say yeah to go this looks like a reasonable follow account this probably a person um social media and finally we can have proof generation on device side data right so

we all use face ID or if we have Androids maybe we tap our tap our fingers or you know uh the phone interacts less enough maybe we can generate proofs of personhood uh on on the device side so I have a few problems with biometric verification right if you're just storing the hashes there's a case to be made first that it's not truly decentralized right they actually have a certain database that stores these IR hash functions that makes it vulnerable to maybe a civil attack and as Quantum

Computing takes off uh Quantum computing promises to eventually be able to kind of reverse andine those hates all of this is potential right some some argue know uh but these are these are some noes asymmetric encryption [Music] definitely right um well I I'll take I'll take the point um but we'll see um also absolute versus relative legal approaches uh right as to data

processing even though this doesn't necessarily correspond to personal information there is a case to be made that they are still processing um even as the hash or uh your biometric information um when it comes to social media and demonstration of human like activity here we have questions of accuracy and verifiability of models for congruence right um CU that can say yeah I'm running a model and it tells you with 99% accuracy that this is a person uh we're probably going to want to have like a certain standard for those types

of models going to want to verify that they're doing what they say they do um and it seems like proof generation on device side data is really the way to go again there are more devices than there are people our devices are what we interact with every day and there are increasing ways even uh through through Zer knowledge virtual machines uh through other proof generation mechanisms to securely generate a proof of data containment on your pH another bonus point is proof of humanity uh now this is a novel approach where actually um where people vouch like

verifi people that somebody saw and said these are people people say oh this is also a person and you start to have this network of people vouching for one another and so the network grows um it's an interesting case study uh but it seems that proof generation on device side data is the most scalable option yes there is also a fourth approach that is worth mentioning um because so we've had a few discussions also this morning when we were talking about ZK passports and the like so the problem is that with generative AI all of the biometric and activity based verification of humanity

is somewhat vulnerable so we've seen this also already by security agencies in Europe that for example image or video identification that is based on AI is basically being ruled out as unsecure in the health sector and so I believe we should rather look into digital identities issued by governments that are based on cryptography natively like for instance digital ID cards which have a crypto chip which can generate digital signatures and this has the huge benefit that as opposed to for example the orb you don't only get a proof of uniqueness

that basically you can use for air drops and the like but also that at the time where you generate the signature there is a lot of evidence that it's still the original owner because for instance so I've been in touch with the European Central Bank talking about like private payment systems and their major concern is that even if you implement a system with limits like turnover limit of ,000 a month that there could be a black market for Unique identities so you basically pay 100 people in uh in the poorer country to register with the orb ask them to give you their secret keys and then you have access to 100 accounts and you can circumvent all of those reasonable limits that you would impose

and if you anchor this instead to an government issued ID this has the advantage that it is now suddenly not an isolated means of authentication but that giving somebody else access to your ID card also excludes you from using the ID card in other context and makes you vulnerable to abuses of the ID card for I don't know any other crime that you can do in their name and so this All or Nothing transferability is very helpful because the more privacy you have the higher the guarantees need to be that this identity was not shared or sold or whatever on the black market totally

um yeah um so actually uh I'll Spotlight these two projects at the end I would love for you to be in touch with the team at Holland that's doing exactly that they've been working actually with Bitcoin and um also they've been they've been in talks with Regulators because they they care about uh basically first onchain voting then eventually offchain voting uh they're doing exactly that when it comes to generating provs based on existing um passports and IDs that have uh have chips have chips and biometric data in

them um that I would say though um they consider that to be proof ation on device side data because uh the passport credential and that data has to live on your phone for it to be compliant either on your phone or on a data or on a government device otherwise you're liable for uh giving that data out and potentially somebody imputing you so like an a compromise that's kind of being struck right now is okay your passport lives on your phone we can

generate proofs of it but no one physically and and so on um but that that's I'm I'm so glad that the European Central Bank is is on to this because actually some of the stories are harrowing about the people running around I think we shouldn't overestimate that so some people are interested it's not like the it's not in the bank so they are still stuck with the anonymity vouchers which is the most privacy guarantees you can sure um all right guys so just like a little exercise right uh when you're working with personal

device encrypted centralized database of blockchain room uh turn to your neighbors and collaborate in small groups to develop a prototype privacy preserving application using ckps so identify practical use case like just throw something out there Healthcare data shareing Financial transactions design an application architecture that incorporates zp for data protection so that can it sounds it doesn't have to be really robust but you know maybe it can be generating proofs uh in on a encrypted centralized database of healthcare data um and validate the applications

compliance with relevant regulatory requirements um so ideally you guys would do this exercise now or just throw out some ideas that have been maybe stewing in your head as the presentation's gone on um but I think it's also a relatively good framework to think about building and developing privacy protocols right regulation should be baked in and you should be thinking about personal devices encrypted centralized databases blockchain noes as falling under you know different uh different Juris

Pruden okay so does anyone have any ideas I mean I would think with Health healthc Care regulations especially as they stand now data is very much so all or nothing and it's I mean kind of a little bit in the Stone Age is nice that there's privacy but also the mechanisms are um not modern at all and so especially with zkps or just a lot of any cryptographic magic you can tailor what am I trying to say you can tailor the use or the disclosure of the data to what's actually needed rather

than kind of like All or Nothing Like especially um if you're sharing it in the US between medical institutions again all or nothing if you're trying to convince a doctor that you have or don't have something it's not just that it's your entire history and a bunch of extra things that go along with it which is why everything Hippa is mostly All or Nothing um and I would assume that with this you can have actually like much better health care because you don't need to disclose so much information question to that so but we're uh um where would that Healthcare data live in this case uh primary care provider okay so I mean like you do trust your

doctor like there is that one thing the point of H isn't to like keep your health data from your doctor but it's to keep your doctor or someone else from leaking it or just doing things that you don't consent to so yeah yeah may I ask you so what I don't understand in the health sector is where very viability is so so if I don't need to check the correctness of the data then we don't need ckps so the question would be basically where in today's interaction in the medical sector does for example a doctor really need to prove that a statement about a more detailed record they made in the past that they now

reveal of subset of that because today I would expect that an insurance would just believe what the doctor says they don't need verifiability that this is derived from I don't know a digitally signed statement by this very same doctor ibe don't understand you the question specifically but I would assume that there's always medal going on somewhere so veril always need so I was wondering basically in which scenarios do you have is the prover different from the attester because if the approver is the attester then it's somewhat meaningless because then they can just sign a new

statement with a subset of the claims and you don't need a zkp you just send whatever you want to send I would be completely sharp to my head maybe some kind of partition between the doctor and the um institution that the doctor's with or something mes around I'm not by no means am I of expert on the Heth infrastructure but I don't know because sometimes confused so there are scientific papers being written about users now suddenly proving the correctness of their um of their history of I don't know illnesses and I was wondering so what would be the incentive for the user to cheat when they click

when they give this to to a hospital that treats them yeah I gu you said I mean maybe it can also give people Prov over their own data but original statements coming from doctor you or theor there's one use case I came across um whereby this hospital was um trying to assess um how good an image classification software was so um on the one hand the hospital doesn't want to hand over like private lung EX rise but

on the other hand the um modeling company doesn't want to hand over their proprietary model um and so this is um one so this use case is like try before you buy which allows um the hospital to like P compete on private data um without handing it over but this this isn't done with um ZK piece as we're familiar with it's done with interactive zero knowledge so that's one possible use case I interesting use case not related to healthcare but just something that's

I feel a little bit um so we've been building some sort of like it's related to compliant but more just a a zero knowledge representation of an entity's balance sheet and you can kind of Imagine like these big exchanges and custodians and ETFs uh naturally have a lot of inflows and outflows on them um and in many cases some of the reporting requirements around them are pretty standardized in the traditional space but it doesn't really so much apply in the um like if you want a def if if you're using a defi protocol or if you're in a kind of like the more digital native side so we've been building up this protocol out um with a little bit of help from coinbase um where basically you can like construct um a zero knowledge representation of

that balance sheet the nature of the assets the time Horizons on certain kind of like liabilities on that asset as well as um any transactions coming in and out we're now at the stage where we can actually very close but build it out on a per block basis so you know if the minute some sort of transaction happens at Flags one of these CES Flags you can imagine it being an AML kyc flag that can kind of be triggered immediately the issue that we're seeing now is that almost every single one of the big custodians are very keen in this concept and really want to work with it they'll only really pull the trigger when there's like a requirement from a regulator so one of the areas that we've been like kind of keen to discuss more kind of openly on a regulator Road TR is

how how do we actually pull this out uh so much so that a regulator would actually be interested in it and we kind of think that that will take many many many more years even though they're like building Unis ons they're going to take a while before they kind of understand the Nots and how that works yeah uh guys we're we're almost at we're at time so we're wrapping up future directions what I wanted to touch on is like look actually there's more regulations coming verifiable compliance with data regulations during inference for AI and ml uh models um fully homomorphic encryption depending on regulat uh regulatory approval relative

versus absolute approach can be very promising for suddenly saying actually um we're not storing personal information we're storing these completely uh indecipherable apoll uh and there's a lot of international catchup happening with stringent regulations so the time for that is now right we have the AI act and security of processing article 32 gdpr ties in quite nicely with f conclusion regulation is coming let's see where we can work with some projects of note that have really been handling this head-on Hollin ZK pass um I would definitely look into them for identity

uh related um Cutting Edge zero knowledge implementations and that is all that is all for today uh thank you sorry my voice is