New EU rules could threaten your security – What you need to know

The Financial Action Task Force’s travel rule, designed to combat money laundering and terrorist financing, is at the heart of the debate over the balance between regulatory oversight and privacy. Financial institutions, including virtual asset service providers, must collect Know Your Customer information and share it with other institutions involved in the transaction.

Initially introduced for traditional finance in 2012, the rule has now been extended to Bitcoin transactions. Critics argue that applying this rule to Bitcoin undermines its principles of privacy and financial freedom, while introducing new risks and unintended consequences.

Based in Paris, France, the FATF is a non-elected international organization established by the G7 countries in 1989. Over the decades, its mandate has expanded to include a 2019 initiative aimed at responding to perceived “threats” to the integrity of the financial system. This expansion has brought bitcoin and other digital assets under the purview of the FATF, viewing them as potential threats to the established financial order. Countries refusing to comply with FATF recommendations risk being excluded from the global financial network.

Unlike other digital assets often grouped under the umbrella of “cryptocurrency”, bitcoin is distinguished by its decentralized and immutable ledger. As the first widely adopted digital currency, bitcoin was designed to operate outside the control of centralized authorities. Its pseudonymous nature ensures that transactions are visible on the blockchain, but without revealing sensitive personal data. This transparency already provides a certain level of accountability while preserving individual privacy, making FATF measures redundant and misaligned.

Bitcoin is not just another “crypto asset.” It is a protocol with the clear goal of serving as a decentralized, censorship-resistant monetary network. Applying the FATF Travel Rule to bitcoin undermines its core principles, particularly its emphasis on user privacy and financial freedom. This regulatory push risks turning bitcoin into a new instrument of surveillance, eroding the very freedoms it was created to protect.

Privacy and security

Bitcoin users already face challenges in protecting their financial privacy. The travel rule requires verifying wallet ownership and collecting personal data. This conflicts with the fundamental idea of ​​Bitcoin, which is to allow individuals to control their finances without intermediaries. Requiring compliance could push users toward centralized custodians, exposing them to risks such as hacking, data breaches and authoritarian surveillance.

The erosion of privacy remains the most controversial issue. Importantly, the Travel Rule requires VASPs to transmit KYC data to other VASPs with whom their customers transact, just as in the traditional application of the rule to financial institutions. High-profile data breaches have become increasingly common.

Aggregating personal and transactional data across multiple custodians increases the risk of misuse, whether through hacking or unauthorized surveillance. For individuals, this process involves communicating personal information to a growing list of third parties, increasing exposure to identity theft and loss of autonomy.

Critics say these measures are excessive, especially given the pseudonymous nature of Bitcoin transactions. Unlike the United States, where exemptions exist for small transactions, the European Union’s stricter implementation effectively requires reporting for almost all transactions. This requirement captures legitimate users and creates barriers to entry for those seeking financial independence through Bitcoin.

Regulatory burdens The UK formalized the Travel Rule on September 1, 2023 through amendments to the Anti-Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017. Meanwhile, the European Union has incorporated the Travel Rule into the Funds Transfer Regulation, requiring compliance of cryptoassets. service providers by December 30, 2024 under its Crypto-Asset Markets Regulation, also known as MiCA. Both the Funds Transfer Regulation and the MiCA were officially published in the Official Journal of the EU on June 9, 2023 and are both expected to apply from December 30, 2024.

The UK’s approach adapts the Travel Rule to its existing anti-money laundering framework. The EU is integrating the Travel Rule into its MiCA framework, creating specific rules for digital assets.

The Travel Rule also introduced compliance burdens that disproportionately affect small institutions and businesses. Although some countries have implemented thresholds for collecting additional information, the rule requires compliance with all transfers of virtual assets in terms of data transfer, regardless of the transaction amount. These measures aim to improve transparency but also increase operational costs for startups and small entities, favoring established players who can absorb expenses and leaving little room for newcomers.

This implementation undermines financial inclusion, a key promise of Bitcoin. By introducing barriers such as identity verification and proof of address ownership, the rule alienates those living under authoritarian governments and the underbanked populations who will benefit most from decentralized financial systems.

Lessons from traditional finance

Initially implemented in traditional finance more than ten years ago, the Travel Rule aimed to combat money laundering. However, his record remains unimpressive. Studies consistently estimate that global money laundering in the traditional financial sector accounts for 2 to 5 percent of GDP, a range unchanged since 1998. This stagnation raises questions about the rule’s effectiveness in combating illicit financial activity. .

Requests under Germany’s Freedom of Information Act have revealed no substantial evidence linking compliance with travel rules to reducing money laundering, as FragDenStaat documents. While the FOIA was designed to evaluate the effectiveness of AML programs in general, by comparing data before and after the application of the Travel Rule, the response demonstrated that German law enforcement lacks data on the overall effectiveness of AML programs. This lack of centralized data casts doubt on the success of the rule.

Centralizing KYC data creates a single point of failure, making it a target for cyberattacks. High-profile breaches, such as those of Equifax in 2017 and India’s Aadhaar system, exposed sensitive information of millions of people, leading to identity theft and financial fraud. In high-risk jurisdictions, centralized databases pose additional risks, as authoritarian regimes or criminal groups could exploit data leaks to target individuals. Sharing KYC information could expose donors to NGOs located in high-risk regions, such as Venezuela, to similar risks, potentially compromising user security rather than improving it.

FATF-inspired regulations have led to changes in how unhosted wallets are treated. The UK initially proposed collecting detailed data on all transactions involving unhosted wallets, but later softened its stance due to industry pushback. HM Treasury recognized that requiring information for all unhosted portfolio transactions would impose disproportionate burdens without obvious benefits. This example shows how FATF recommendations can lead to overly intrusive measures that can harm privacy-focused innovations, even in well-regulated markets.

Pakistan is an example of how pressure from the FATF can lead to outright bans. Pakistan’s finance minister recently said cryptocurrencies “will never be legal” due to FATF requirements. This harsh approach stifles business and pushes legitimate financial activity underground, undermining the FATF’s stated goals of transparency and combating illicit financing.

Decentralized solutions, like blockchain-based KYC systems, reduce single points of failure and improve privacy. Without these measures being adopted, centralized storage will continue to put individuals at risk, particularly in vulnerable regions.

A balanced approach

The scope and implementation of the Travel Rule continues to be the subject of discussion. Exemptions for small transactions, similar to those in the United States, could reduce compliance burdens while maintaining the rule’s objectives. Technology solutions such as zero-knowledge proofs can provide ways to comply with regulations while protecting user privacy.

Transparency and accountability are important to the effectiveness of the rule. Widespread adoption would benefit from clear evidence of its impact, with independent studies and publicly available data helping to inform future policy decisions.

In its current form, the FATF Travel Rule serves as a cautionary tale about how well-intentioned policies can go wrong. As the debate continues, stakeholders must collaborate to ensure the future of finance remains open, inclusive and supportive of business.