Crypto and the Travel Rule: What’s Going On?

The substantial growth of crypto assets in recent years has created notable regulatory hurdles. In October 2022, the Financial Stability Board (FSB) published findings of a survey of 24 FSB member entities, including 23 national authorities and the European Commission, along with 24 non-member jurisdictions represented in the FSB’s Regional Consultative Groups (RCGs).^[1]

Fifteen FSB members and 10 RCG jurisdictions indicated they had implemented or had plans to enhance regulation in the crypto sector. Among the 70 cryptocurrency-related regulations issued by global supervisors, 49 are amendments to existing regulations, with only 21 being entirely new.

Image

_{Note: “N/A” reflects that the issued standard or guidance reported by respondents is not classified into either of the two categories.
Source: FSB}

Additionally, approximately one-third of survey respondents said they had introduced a definition for “crypto asset,” with 13 jurisdictions establishing definitions for “security tokens” and “payment tokens.”

Regarding the primary regulatory areas affecting crypto assets, the anti-money laundering/combating the financing of terrorism (AML/CFT) framework appears to receive the most coverage, followed by transparency issues and the protection of crypto-asset holders.

Image

_{Source: FSB}

In assessing these survey results, clarity and consistency emerge as fundamental themes. In alignment with this, the FSB finalised its regulatory framework for crypto asset activities in July 2023. The framework includes high-level recommendations for regulating and supervising stablecoins and crypto assets more broadly. The FSB also enshrined the principle of “same activity, same risk, same regulation” within this framework to guide future standard-setting endeavours.^[2]

Notably, the European Union has enacted new regulations, such as the transfer of funds regulation (TFR)^[3] and the Markets in Crypto-Assets Regulation (MiCAR).^[4] These regulations mark the first harmonised cross-border regulatory frameworks in the crypto-asset industry.

These significant strides not only demonstrate a commitment to tackling challenges but also aim to cultivate a favourable regulatory landscape that fosters innovation and security within the crypto ecosystem. In summary, the regulatory environment is evolving, presenting new opportunities for the industry while offering a clearer and more reliable framework for market participants.

In the realm of combating financial crime, Virtual Asset Service Providers (VASPs) face a primary obligation: implementing the Travel Rule.

To gain insight into the current state of affairs, it’s beneficial to take a step back to 1990 when the Financial Action Task Force (FATF) first introduced its 40 Recommendations to combat money laundering and terrorist financing. These recommendations underwent revisions in 1996 and gained endorsement from 130 countries, thereby establishing them as an international standard. Among them, Recommendation 16 proposed global standards for funds transfers, commonly referred to as the Travel Rule. It mandates that financial institutions identify both the sender and recipient of each transfer and provide accompanying data necessary for their identification.

Subsequently, in 2006 and 2015 the European Union adopted earlier versions of the TFR,^[5] essentially the European counterpart to the Travel Rule. These measures aimed to harmonise the European approach and align legislation with Recommendation 16.

In 2019 and 2021, the FATF broadened the scope of Recommendation 16, extending the definition of financial institutions to include VASPs. This expansion led to the issuance of specific guidance,^[6] prompting the European Union to enact a new fund transfer regulation in May 2023; this regulation mandates compliance with the Travel Rule for all European crypto operators, referred to as crypto asset service providers (CASPs), as defined by the TFR and MiCAR, by the end of 2024.

With the introduction of the new TFR, the European Banking Authority (EBA) was tasked with issuing guidelines to assist CASPs in implementing these standards, particularly in cases where originator or beneficiary information is lacking or incomplete. This includes operations involving decentralised finance (DeFi), such as transactions with self-hosted addresses on blockchain. In November 2023, the EBA initiated its first consultations on the Travel Rule Guidelines,^[7] demonstrating Europe’s commitment to the effective and harmonised implementation of the new regulation.

The Travel Rule, as outlined by the FATF, emphasises the collection of vital information such as the originator’s name and physical address (or other unique identifiers like national identity numbers, customer identification numbers or dates of birth), as well as the beneficiary’s name and the account numbers of both parties involved in the transaction (i.e., the blockchain address in a crypto-asset transfer).

Image

For traditional banking and financial institutions,8 compliance with the Travel Rule is essential when engaging in crypto-related services, including custody or management of crypto-asset transfers between or from other VASPs. As previously mentioned, the Travel Rule aims to align AML/CFT standards related to crypto assets with those already established for fiat transactions.

Addressing the Travel Rule poses challenges that can be categorised into three main areas:

• Timing differences in implementation (“sunrise issue”)  
  Regulatory adoption occurs at varying times across different jurisdictions, leading to the “sunrise issue.” This discrepancy in timing can result in arbitrage, compliance complexity, uncertainty and high compliance costs when operating cross-border.
• Hybrid approaches across jurisdictions  
  Divergent and sometimes inconsistent approaches taken by different jurisdictions in implementing the Travel Rule create another obstacle. These differences may involve defining a de minimis threshold, addressing privacy concerns and managing DeFi-related transactions.
• Definition of the technological solution  
  Selecting a suitable technology solution, or a combination of multiple solutions, to ensure compliance with FATF requirements and local regulations poses the third challenge. Choosing an effective technological approach is crucial to navigating the complexities of the Travel Rule successfully.

In this ever-evolving landscape, addressing the challenges of the Travel Rule demands not only a profound understanding of regulations, but also flexibility and technological innovation to adapt to the rapid changes in the crypto ecosystem overall.

As previously mentioned, one of the foremost challenges within the crypto ecosystem is regulatory in nature. This challenge is particularly evident in the implementation of the Travel Rule, where we observe varying timelines across countries, often accompanied by transitional periods.

Regarding this issue, the FATF, in its 2023 annual update on the implementation of the Travel Rule,^[9] reported limited progress. It noted that 54 percent of participants (73 out of 135 jurisdictions), up to that point, had not taken any action to implement the Travel Rule.

The FATF’s update noted that while 35 jurisdictions had enacted specific regulations to ensure implementation, 27 others were in the process of adopting regulations. The FATF also highlighted some developments, primarily related to the enactment of the TFR at the European level, which increased the number of jurisdictions with specific regulations in this area to 58.

Consistent with the 2022 report, the FATF also revealed in 2023 that only 21 percent of jurisdictions (13 out of 62 respondents) indicated they had issued recommendations or findings or taken action against VASPs for failing to align with Travel Rule requirements.

Image

_{Source: FATF}

On March 28, 2024, the FATF released a report detailing the implementation status of FATF standards concerning crypto assets and VASPs across 58 jurisdictions deemed particularly relevant to these activities. This list comprises 38 FATF member countries and an additional 20 jurisdictions identified due to their significant trading volumes.^[10]

Image

_{Source: FATF}

In addition to the aforementioned findings, the report evaluates each jurisdiction’s compliance with Recommendation 15, providing ratings and the year of assessment. Notably, the Bahamas stands out as the only country on the list deemed fully compliant, based on an assessment conducted in 2022.

In the context of approaches to the Travel Rule, one of the primary divergences pertains to the application of varying de minimis thresholds. It is crucial to recall that the FATF Recommendations stipulate a threshold of USD/EUR 1.000 for the implementation of the Travel Rule.

According to the FATF’s July 2023 report, of the 62 jurisdictions that expressed a stance on the de minimis threshold, 32 percent indicated that they had already implemented or intended to introduce a de minimis threshold set at USD/EUR 1.000. Meanwhile, 58 percent planned to introduce a lower threshold or EUR 0 threshold, and 8 percent aim to implement a higher threshold than the one proposed by the FATF.

For instance, in the United States, the threshold is set at USD 3.000, while the TFR establishes a Europe-wide threshold of EUR 0. Similarly, Canada has also established a threshold of 0 CAD 0.

Image

_{Source: FATF}

These differences in de minimis thresholds underscore the variety of approaches taken globally, with some jurisdictions adhering to the FATF Recommendations while others preferring to adjust these thresholds according to their own requirements and regulatory environments. The definition and implementation of these thresholds are crucial aspects in the harmonisation of international practices under the Travel Rule.

Further exploration of the disparities between the Travel Rule governed by the FATF and the TFR reveals some notable differences, despite their overall alignment.

First, the TFR distinguishes between crypto-asset transfers involving blockchain (or distributed ledger technology, DLT) and those that do not. In the former case, it is necessary to collect the DLT address (i.e., the alphanumeric code on the blockchain from/to which the crypto-assets are transmitted), while in the latter case, the crypto-asset account held by the VASP is required.

Specifically, the TFR mandates the transmission of a more comprehensive array of data regarding the originator, encompassing the address (including the country name), the personal identification document number and the customer identification number. While the FATF does not mandate the inclusion of all these details, it stipulates the presence of at least one of the following:

Image

In contrast, the FATF does not provide detailed use cases for geographic addresses, unlike the EBA Guidelines under consultation, which clarify that if the originator is:^[11]

• an individual, the place of habitual residence should be shared.
• a vulnerable person, the address from other available documentation should also be shared.
• a legal entity, the address of the registered office should be shared.

Similarly, the EBA Guidelines under consultation state that in the case of bundled crypto-asset transfers, it is mandatory to transmit information on all originators unless there are technical limitations preventing the transmission of such data. In contrast, the FATF does not provide corresponding guidance on this scenario.

Regarding transfers to/from DeFi, i.e. self-hosted addresses, the FATF emphasises the importance of obtaining and transmitting accurate beneficiary information, acknowledging that the methods of obtaining this information may vary among jurisdictions.

On this issue, the TFR and the EBA Guidelines in consultation introduce additional arrangements, such as:

• Using blockchain analytics tools, third-party data providers, etc., to identify transactions involving DeFi in real-time before executing the transfer by the originator’s VASP and before crediting the funds by the beneficiary’s VASP, as well as verifying the information received from the originator through such tools;
• For crypto-asset transfers exceeding EUR 1.000, verifying the ownership of the self-hosted address (e.g., through the use of the aforementioned tools, signing the transaction with the private key pair in both the account and the wallet, etc.).

In practical terms, this implies that if a person (who has an account with a VASP) intends to transfer EUR 1.000 to another person (e.g., his brother with a self-hosted address), the transferring person’s VASP must verify the identity of the recipient and demonstrate the ownership and control of their DeFi address.

As previously mentioned, the technical methods for conducting such analyses are not exhaustively defined, and the EBA provides only some guidance.^[12]

It is essential to recognise that one method does not preclude others. A VASP can offer its users one, multiple or all of the available methods.

Image

Choosing the right tool or integrated solution for monitoring crypto-asset transactions requires careful consideration.

The FATF has acknowledged significant progress in recent years in the development and adoption of technology solutions in this area. However, further improvements are necessary to ensure that these solutions are comprehensive, interoperable and adaptable to national requirements.

Currently, supporting solutions in the market can be broadly categorised into two main groups:

• Blockchain analytics tools     
  These tools analyse and monitor blockchain data, wallets, DeFi addresses and related transactions. Their primary aim is to mitigate the risks associated with money laundering, terrorist financing, and violations or circumventions of international sanctions.
• Travel Rule protocols     
  These tools and protocols are designed to facilitate the transmission of originator and beneficiary data in compliance with the Travel Rule.

The synergistic integration of both categories of tools enables a holistic approach to monitoring crypto-asset transactions, effectively addressing both financial crime risk management and Travel Rule-specific challenges.

The Blockchain Analytics Tool

The blockchain operates on a principle of pseudonymity rather than anonymity.

While the identity of the crypto-asset holder behind a specific transaction, wallet or DeFi address may remain unknown, every movement on the blockchain is meticulously recorded. Transaction data such as the amount, time, currency, DeFi wallet/address of sender and recipient, along with other elements involved in the wallet/address DeFi (current balance, entries, exits, etc.), are all traceable and visible to anyone on a public blockchain.

Blockchain analytics tools leverage this wealth of available data to track transactions, cluster DeFi wallets/addresses (i.e., associate DeFi wallets/addresses that appear to be controlled by the same individual within the same cluster), link clusters to the real-world entities behind them, categorise the services offered by each cluster by assigning specific risk levels, and identify direct and indirect exposure between two or more clusters.^[13]

Numerous tools are currently available, including but not limited to free options like Etherscan and Blockchain.com to licensed solutions such as Chainalysis, TRM Labs and Elliptic, among others.^[14]

Travel Rule Protocols

Since the inception of the Travel Rule, several protocols have emerged to facilitate compliant and secure information exchange between VASPs. Among the notable commercial solutions are Sygna Protocol, VerifyVASP, TRISA, Shyft, and TRUST. Additionally, the Travel Rule Protocol (TRP), an open-source protocol developed in 2020 by a private consortium including ING, Standard Chartered and BitGO, has gained significant traction.

Despite the variety of protocols available, a primary challenge identified by the FATF and European regulations is the lack of interoperability among them. Unlike fiat transactions, which utilise SWIFT as the dominant network for exchanging financial information, a comparable global standard for exchanging information between VASPs has yet to emerge for crypto asset transactions. This lack of interoperability among the various Travel Rule protocols impedes efficient data utilisation and the broader adoption of Travel Rule requirements.^[15]

In this regard, the current state of Travel Rule protocols can be likened to social messaging platforms: while one can exchange messages, audio and media within a platform, cross-platform communication remains a challenge.

To mitigate these limitations, both the FATF and the EBA Guidelines in consultation acknowledge the existing constraints of these solutions, including potential technical limitations that could impede the transmission of originator and beneficiary information. Consequently, European regulations will not introduce a transitional regime until 2025, ensuring the possibility of utilising infrastructure or services that may not fully meet all information transmission requirements.