The European Banking Authority (EBA) has launched another consultation around implementing the Travel Rule for anti money laundering (AML) relating to crypto-asset transfers. A consultation in June was around the due diligence required on counterparties. Today’s consultation is about what data should be communicated, and the steps service providers should take if the data is not available.
Four new pieces of EU legislation were passed on anti money laundering earlier this year. Together they bring the activities of crypto-asset service providers (CASPs) into scope and require them to include information about the sender and beneficiary. As previously reported the legislation has no de minimis. So the travel rule applies to a ten cent transfer.
AML and self hosted wallets
One of the more topical aspects is the treatment of self hosted wallets. According to the legislation, P2P transfers between self hosted wallets are out of the scope of the travel rule because there’s no CASP involved.
If a CASP is involved in a transaction with a self hosted wallet, they have to comply with the travel rule if the transfer is over €1,000. The previous EBA consultation highlighted that usually enhanced due diligence has to be performed on the self hosted wallet. In case you wondered, that’s far more than asking you to verify your identity.
Today’s consultation outlines how the CASP should verify the owner of the self hosted wallet is the sender or receiver. They have to perform at least two of these steps:
- advanced analytical tools
- unattended verifications such as a live photo with some way of proving it is current
- verification of identity in person
- sending of a predefined amount from and to the self-hosted address
- signing of a message in the account and wallet software, which can be done through the key associated with the transfer
- requesting the customer to digitally sign a specific message into the account and wallet software with the key corresponding to that address
- other suitable technical means as long as they allow for reliable and secure assessment and the CASP is fully satisfied that it knows who owns or controls the address.
If two steps are not enough to prove ownership, they have to take additional steps.
The consultation is open until January 3.
