Navigating The Travel Rule in UAE's Cryptocurrency Landscape

During a webinar hosted by VAF Compliance and organized by Unlock, Gilson Costa, CEO of VAF Compliance, moderated a panel discussion wherein industry experts discussed the origin, significance, and challenges of the Travel Rule, with a particular focus on the UAE crypto landscape.

The origin of the travel rule can be traced back to the recommendations of the Financial Action Task Force (FATF). The travel rule is one sub-element of these recommendations, known FATF Recommendation 16, and applies to the context of crypto.

In traditional finance, transactions pass through systems like SWIFT, requiring the transfer of specific information to prevent financial crimes. Similarly, the travel rule serves as the equivalent requirement in the crypto space, aiming to combat money laundering and terrorist financing.

Concerns about anti-money laundering (AML) and compliance in crypto arise from the goal of combating financial crimes. Samir Safar-Aly, Financial Regulatory, Compliance & Investigations Counsel at Baker McKenzie, highlights that both crypto and traditional finance can be associated with facilitating illicit activities. Therefore, understanding the position of the travel rule in the crypto and AML landscapes is crucial for VASPs as well as other participants involved in cross-border transactions facilitated by VASPs.

Navigating the Technical Challenges of the Crypto Travel Rule

From a technical standpoint, cryptocurrencies present significant differences compared to traditional fiat systems, particularly in terms of standardized methods for transactions. In response to this disparity, regulators have intervened to combat misconduct in crypto operations, as recommended by FATF.

Harm Aarts, Co-founder and Chief of Product at 21 Analytics, highlights the challenge of machine-to-machine communication in effectively transferring beneficiary and originator information. Switzerland enforced the travel rule, mandating VASPs to comply, but cross-jurisdictional transactions add complexity. Most Swiss VASPs avoid transferring coins to other VASPs, bypassing the travel rule, which raises concerns about ownership claims for self-hosted or unhosted wallets. To address this, Switzerland implemented the Satoshi test for verification, ensuring authenticity and mitigating potential dishonesty or mistakes.

Implementing the data gathering and transmission process becomes increasingly complex due to various challenges specific to the crypto space. Harm mentions the "sunrise issue", where compliance with the travel rule is required, but counterparties in other jurisdictions lack the same obligation. The "VASP discovery" problem also arises when a user wants to withdraw coins to an address with an unknown owner, necessitating a discovery process.

Navigating Commercial Realities: Streamlining Compliance in the Crypto Industry

Andrew Kimbrough, Senior Manager at XWISS AG, focuses on the practical objective of combating money laundering and streamlining the process of filing suspicious activity reports (SARs) in the crypto industry. Unlike the traditional fiat space with established procedures for information exchange, the crypto space often involves unregulated entities exchanging information. Verifying control over unhosted wallets poses a challenge for Virtual Asset Service Providers (VASPs).

Verification processes vary among regulators and individual VASPs, introducing complexity within the industry. In Switzerland, banks are allowed to whitelist wallets for a limited period, while different jurisdictions may have different approaches. Risk appetite also influences verification requirements, with some firms demanding verification for every transaction. Inconsistencies and unclear regulations further complicate matters, necessitating meticulous documentation of procedures and consultation with regulators or law firms for guidance.

Samir examines compliance from a commercial standpoint, highlighting the practical implications of sanctions. For instance, a UAE-based bank without U.S. ownership or control may need to comply with U.S. OFAC sanctions due to "commercial realities." Commercial agreements often require adherence to U.S. sanctions for U.S. dollar clearing or access through a U.S. dollar clearing bank. This scenario highlights the need to address the sunrise issue promptly, considering practical implications over purely legal perspectives.

Regulatory Harmonization: The Widespread Impact of the Travel Rule

Referring to Samir's concept of "commercial reality," Harm asserts that the travel rule holds a contagious influence. If a VASP operates in Seychelles, for instance, but conducts business with entities situated in Dubai, compliance with the travel rule becomes imperative as failing to do so would result in users' transactions being rejected. Therefore, commercial reality necessitates this adherence without escape.

Regulators are increasingly aware and exploring possibilities like the aforementioned Satoshi test in the crypto space. Harm expects the existing knowledge gap to diminish as regulators actively engage and learn from each other. Currently, different jurisdictions have varying travel rule thresholds for virtual asset transfers, but Harm predicts a future where everyone defaults to zero.

Disparity in Regulatory Treatment: Apprehensive Regulators

Soham Panchamiya, an Associate at Reed Smith, notes the lack of equivalence in financial services regulations between crypto and traditional finance (TradFi). This disparity is not solely due to the different nature of activities in the crypto industry. The issue stems from regulators' apprehension due to their limited understanding of crypto, understaffed and underpaid workforce, and high turnover rates, says Soham. He emphasizes that the challenge lies in regulators struggling to comprehend and adapt to the crypto landscape, rather than how they interpret the regulations.

The UAE's Progressive Stance on Crypto Regulation: Navigating the Sunrise Issue and Beyond

In most jurisdictions, finding regulators who both understand crypto and are willing to take a clear stance on it is quite rare, Soham noted. However, he believes that the UAE is fortunate in this regard. Notably, figures like Peter Loo and Malcolm Wright at the Virtual Asset Regulatory Authority (VARA), as well as Brian Biagabi and Brian Yeoh at the Financial Services Regulatory Authority (FSRA), have taken bold positions on crypto and engage in open and transparent discussions with firms regarding policies, the travel rule, and technological capabilities. This enables firms to communicate their limitations in dealing with certain types of Virtual Asset Service Providers (VASPs), minimizing the sunrise issue.

To address the sunrise issue, companies in jurisdictions without travel rule adherence typically establish a de minimis threshold for compliance. In the UAE, for instance, the threshold is 3,500 AED, while FATF regulators require compliance for amounts above 1,000 EUR. If a jurisdiction does not adhere to the travel rule, companies often choose not to engage with counterparties from that jurisdiction, effectively creating a barrier.

Some companies even establish separate structures, one regulated and one unregulated. However, as seen in the ongoing SEC proceedings against Binance, separating regulated and unregulated entities can introduce uncertainty and necessitate the development of new rules using existing ones, adapted in a more efficient manner, according to Soham.

Addressing FATF Guidelines in Crypto Compliance: Segregation as a Solution

Soham highlights the importance of referring to your regulatory authority's adopted rules within the FATF guidelines. For instance, the UAE's VARA regulations have adopted the FATF guidelines which entail collecting originator and beneficiary information. The information needs to be recorded for regulatory review in the annual report.

However, as pointed out by Harm, technological challenges of implementing this surface when the beneficiary is an unhosted wallet without associated identity information. Currently, the solution involves distinguishing crypto companies that operate within KYC/AML frameworks and those that do not. Non-compliant entities are facing increasing difficulties in finding suitable jurisdictions, leading to the popularity of lenient regulatory jurisdictions. Thus, Soham suggests segregation as a solution.