Crypto assets have been outside the control of regulatory authorities for many years. There has been an increasing trend of regulation in recent years to regulate the cryptoasset sector. The main source of these regulations in the international arena is the recommendations of FATF (Financial Action Task Force). Developed countries have started to establish a legal basis for cryptocurrency exchanges. At the same time, crypto asset service providers are held liable in terms of money laundering and terrorism financing (AML/CFT) legislation.
One of the most important rules in the set of legislation is the rule that regulates the international flow of funds known as the “Travel Rule”. The application of this rule to the crypto-asset sector is an important development that can prevent the use of crypto-assets for illegal purposes such as evading legal obligations, criminal activities, and can bring a significant change and transformation to the sector.
FATF Guidances
The FATF began publishing AML/CFT regulatory recommendations on virtual/crypto assets in 2015 with the text “Guidance for a Risk-Based Approach to Virtual Currencies”, and these recommendations were finalized in 2021. The “Travel Rule” rule entered the FATF recommendation set for the first time with the text “Guidance for a Risk-Based Approach to Virtual Assets (VAs) and Virtual Asset Service Providers (VASPs)” published in July 2019. This guideline published showed that FATF approached virtual assets with a more inclusive perspective compared to the previous guideline. Subsequently, the FATF published the draft 12-month review report in June 2020 and an update of the 2019 Guidelines in March 2021. Finally, in October 2021, the guideline was updated as “Updated Guidance for a risk-based approach to VAs and VASPs” (Guidance 2021).
“Virtual asset service providers” (VASP) within the scope of the Guidance 2021 include any natural or legal person who conducts one or more of the following activities or operations for or on behalf of another natural or legal person:
- Exchange between virtual assets and fiat currencies;
- Exchange between one or more forms of virtual assets;
- Transfer of virtual assets; and
- Safekeeping and/or administration of virtual assets or instruments enabling control over virtual assets;
- Participation in and provision of financial services related to an issuer’s offer and/or sale of a virtual asset.
Accordingly, different business lines such as crypto currency exchanges, custodial wallet service providers, virtual asset transfer service providers, crypto currency ATM operators will be within the scope of the regulations to be published by local authorities. P2P, DApps, and DeFi virtual asset platforms will not be considered VASPs directly, but will only be considered VASPs in certain circumstances.
Travel Rule is as defined the obligation to obtain, hold, and transmit required originator and beneficiary information, immediately and securely, when conducting VA transfers (Recommendation 16).
The ordering institution must obtain and hold,
- originator’s name (i.e., the sending person’s accurate (i.e. verified) full name);
- originator’s account number where such an account is used to process the transaction. In the VA context, this could mean the “wallet address” of the VA;
- originator’s physical (geographical) address, or national identity number, or customer identification number (i.e., not a transaction number) that uniquely identifies the originator to the ordering institution, or date and place of birth. For transmitting the geographical address of the originator, that means the address which has been verified for accuracy by the originator VASP as part of its KYC process;
- beneficiary’s name (i.e., the name of the person who is identified by the originator as the receiver of the VA transfer). This is not required to be verified by the ordering institution for accuracy, but should be reviewed for the purpose of suspicious transaction monitoring and sanction screening; and
- beneficiary account number where such an account is used to process the transaction. In the VA context, this could mean the “wallet address” of the VA.
The beneficiary institution must obtain from the originator institution and hold,
- originator’s name (i.e., the sending person’s name). The beneficiary institution does not need to verify the originator’s name for accuracy, but should review it for the purpose of suspicious transaction monitoring and sanction screening;
- originator’s account number where such an account is used to process the transaction. In the VA context, this could mean the “wallet address” of the VA;
- originator’s physical (geographical) address, or national identity number, or customer identification number (i.e., not a transaction number) that uniquely identifies the originator to the ordering institution, or date and place of birth;
- beneficiary’s name (i.e., the name of the person who is identified by the originator as the receiver of the VA transfer). The beneficiary institution must verify the beneficiary’s name for accuracy if the name of their customer has not been previously verified. Thus the beneficiary institution can confirm if the beneficiary’s name and account number they obtain from the ordering institution match with the beneficiary institution’s verified customer data; and
- beneficiary’s account number where such an account is used to process the transaction. In the VA context, this could mean the “wallet address” of the VA.
The requirements of Recommendation 16 apply to VASPs whenever their transactions, whether in fiat currency or VA, involve:
- a traditional wire transfer,
- a VA transfer between a VASP and another obliged entity (e.g., between two VASPs or between a VASP and another obliged entity, such as a bank or other financial institution), or
- a VA transfer between a VASP and a non-obliged entity (i.e., an unhosted wallet).
FATF recommends a threshold value of 1,000 EUR/USD to enforce the rule. The threshold value of the rule, which is within the scope of the Bank Secrecy Act in the USA and also applied to virtual assets, was reduced from 3,000 USD to 250 USD in 2021.
After the FATF recommendation text, some countries such as Singapore, Switzerland, Hong Kong banned cryptocurrency exchanges from trading without a “Travel Rule” license. Some countries, such as Japan, Canada, South Korea, and Germany, have also published their regulations. In the USA, technically, there is no need for a new regulation, the rule is already in force.
Travel Rule Application: Problems and Expectations
Crypto/virtual assets are assets that, by their nature, contain features that can be perceived as contradictory to each other, such as transparency and privacy. In traditional financial services, information about the financial institution where the beneficiary’s account is held during the wire transfer is also received by the institution ordering the transaction. However, in crypto assets, transfers are carried out between wallets.
For a VASP to transmit the required information to another VASP however, it is necessary for them to identify their counterparty VASP. A VASP would also need to conduct due diligence on their counterparty VASP before they transmit the required information to avoid dealing with illicit actors or sanctioned actors unknowingly.
Ordering VASP should determine;
- Determine whether the VA transfer is with a counterparty VASP
- Identify the counterparty VASP, as a VASP only knows the “name” of the counterparty VASP following the previous phase.
- Assess whether the counterparty VASP is an eligible counterparty to send customer data to and to have a business relationship with.
To carry out these controls, it is necessary to conduct a risk analysis of the VASP, the counterparty to the transaction, and as well as to perform a risk analysis of the wallet, which is the beneficiary of the transaction.
To solve these problems, SWIFT-like protocols have already been developed by different platforms or collaborations. The most common of these protocols are TRP, OpenVASP, USTRWG/TRUST, TR Now, Sygna, TRISA, Shyft, TrasnactID, VerifyVASP, and CipherTrace Traveler. Transaction messages used by these protocols must be interoperable. With the widespread use of these protocols, secure and fully compliant virtual/crypto asset transfers between VASPs will be possible.
Cryptocurrency exchanges and other crypto/virtual asset service providers that are not integrated with these protocols will not be able to integrate into the global system and trade with fiat money in particular. Organizations that develop these protocols cooperate with blockchain analytics companies such as Chainanalysis, ChiperTrace, Elliptic, and analyze crypto currency exchanges and subject them to risk analysis in terms of AML / CFT applications. Blockchain analytics firms provide VASP and wallet risk analysis services, too.
Exchanges that do not implement the “Travel Rule” will only be able to continue their existence as DEX-type exchanges, but among these, the large ones will not be able to avoid the supervision of the authorities for a long time.
The second important problem will be experienced in the time that will pass until the teh travel rule are included in the legislative set by the local authorities. FATF expects the rule to come into effect as soon as possible. FATF states that countries may wish to take a staged approach to enforcement of travel rule requirements to ensure that their VASPs have sufficient time to implement the necessary systems, but should continue to ensure that VASPs have alternative measures in place to suitably mitigate the ML/TF risks arising from VA transfers in the interim.
According to the Guidance 2021, 32 out of 38 FATF members have made AML/CFT regulations regarding virtual assets, while only 15 of them have included the “Travel Rule” in their regulatory set. Some of these 15 countries have set a transition period, while in some of them the “Travel Rule” is fully implemented. Countries are implementing their AML/CFT frameworks for VASPs at different paces. This means that some jurisdictions will require their VASPs to comply with the travel rule prior to other jurisdictions (i.e., the ‘sunrise problem’). This can be a challenge for VASPs regarding what approach they should take in dealing with VASPs located in jurisdictions where the travel rule is not yet in force. Countries that have not implemented the rule are expected to take measures to reduce the risks that may arise.
With the “Travel Rule”, one of the biggest obstacles to the integration of the crypto asset market with the traditional financial system will be removed. With the reduction of regulation and compliance risk, the crypto-asset sector will reach the banking system more effectively. It will also make it easier for institutional investors to accept investments in crypto assets as an asset class.
Summary
The coming years will be the period when regulations regarding crypto/virtual assets are increasingly on the agenda. The “Travel Rule” is still being implemented in a small number of countries and will be one of the most important issues on the agenda in the coming period. Various protocols have been developed for the implementation of the rule, and the implementation of the rule will be facilitated by the production of standardized messaging by these protocols. In addition, the prevalence of VASP and wallet analysis solutions will be a complementary element. Ultimately, the “Travel Rule” will be established as the market rule, and the establishment of this rule will support the healthy growth of the crypto asset market.
Resources
FATF, (2019). “Guidance for a Risk-Based Approach to Virtual Assets (VAs) and Virtual Asset Service Providers (VASPs)”, 2019 https://www.fatf-gafi.org/publications/fatfrecommendations/documents/guidance-rba-virtual-assets.html
FATF, (2021). “Updated Guidance for a Risk-Based Approach to Virtual Assets and Virtual Asset Service Providers”. https://www.fatf-gafi.org/publications/fatfrecommendations/documents/guidance-rba-virtual-assets-2021.html
Notabene, The State of Crypto Travel Rule Compliance Report. https://notabene.id/state-of-crypto-travel-rule-compliance-report
