Three years after The Financial Action Task Force (FATF) released its original guidance on virtual assets, it published a ‘Targeted Update on Implementation of FATF’s Standards on Virtual Assets (VAs) and Virtual Assets Service Providers (VASPs).’ The new report includes an overview of areas in which countries and the sector have progressed and ongoing implementation concerns. Check out our four key findings from the FATF’s Targeted Update on Implementation. 

At the end of the report, the FATF published a non-exhaustive list of questions that two leading jurisdictions reported useful in dialogue to foster the functional improvement of solutions (page 26, Box 1.) We answer these questions below. 

Interoperability with other Travel Rule solution tools

1. Is the tool/solution interoperable with other tools?

Yes. Notabene is a protocol-agnostic Travel Rule solution. One of the differences between what we do and what a protocol does is that we primarily provide a software as a service (SaaS) solution to VASPs and Financial Institutions (FI) for implementing and operationalizing the Travel Rule. 

We believe that ultimately the industry needs a Travel Rule messaging protocol open to all VASPs or interoperability between a few that allows VASPs maximum reachability. In the absence of that today, we have built a universal Travel Rule protocol gateway. 

As we work on integrating with every live Travel Rule protocol, our protocol gateway ensures that our customers can reach the most expansive network of counterparty VASPs through our platform. In addition, Notabene offers an interoperability model for VASPs that are: 

• Not yet live with any Travel Rule solution, or 
• Using a protocol that is not yet integrated with Notabene. 

Our free Sunrise plan allows VASPs to receive and manage Travel Rule transfers from Notabene customers using our all-in-one dashboard. 

2. What kind of interoperability is embedded within your tool, and when will interoperability testing be conducted?

E.g. pilot test, functional test, capacity stress test, live data test, tested data scope, and tested VASPs. 

At Notabene, we aim to provide a solution that enables our customers to reach any VASP using any Travel Rule solution worldwide. This starts by using industry standards like IVMS101 for the messaging structure and a willingness to integrate with other solutions/protocols that go live. Additionally, we support various encryption standards, which are imperative to being protocol agnostic.

Our agile development team ensures that our back-end can communicate with other solutions in a way that requires the least amount of development work by our customers. Our customers deploy the enclave servers, set up end-points and certificates, etc. On the other hand, Notabene securely handles the data collection, VASP identification, and sending of the Travel Rule data transfer through those means.

3. What kind of interoperability testing has been conducted? E.g., pilot test, functional test, capacity stress test, live data test, tested data scope, and tested VASPs. 

Currently, we support TRP and OpenVASP and are in late discussion with providers like VerifyVASP, TRUST, and others about adding support. We are active in various technical and standards working groups where protocol interoperability is evaluated and will soon be conducted. 

‍

Timing and scope of Travel Rule data submission 

4. Could the tool/solution enable VASPs to submit Travel Rule data for small value VA transfers (i.e., below USD1,000/EUR 1,000) to accommodate varying threshold requirements across jurisdictions? 

Yes. Notabene reflects the requirements implemented across jurisdictions in terms of applicable thresholds and scope of required Originator and Beneficiary information in Travel Rule transaction flows. Also, per FATF requirements, the Notabene tool allows VASPs to collect counterparty information for every transaction, regardless of the threshold, and store it for data-collection purposes.

Notabene customers can:

• Collect the required information about the Beneficiary.
• Transmit all required Originator and Beneficiary information to the Counterparty VASP, considering the transaction amount and applicable threshold.
• Optionally transmit further Originator and Beneficiary information if the Counterparty VASP’s jurisdiction requires it.
  
  

5. Does the tool/solution cover all VA types?

Yes. Notabene covers all virtual asset types, as long as it is possible to convert the VA value to FIAT value to enable the threshold validation. Our CoinGecko integration instantly verifies the exchange rate when a user begins a withdrawal request.

6. Does it enable receiving VASPs to obtain and handle a reasonably large volume of transactions from multiple destinations in a secure and stable manner?

Yes. Processing Travel Rule transfers at scale is only possible through automation.

Notabene’s Rules Engine allows our customers to process outgoing/incoming Travel Rule transactions automatically based on several criteria, most relevantly:

• Sanction screening results on Beneficiary/Originator counterparty.
• The risk score of counterparty destination/origin wallet address according to blockchain analytics.
• Trusted/non-trusted jurisdictions.
• Trusted/non-trusted VASPs.

Notabene’s customers can also automate the beneficiary name matching process, i.e., cross-checking the beneficiary information received in a Travel Rule transfer and made available via webhook against internal know-your-customer (KYC) records. Our customers can also automate the wallet ownership check when transacting with unhosted wallets.

7. Does the tool/solution provide a function that allows an originator VASP to choose not to send Travel Rule data to a counterparty VASP?

Possible scenarios include the originator VASP needs to avoid providing financial services to certain sanctioned jurisdictions, high TF/PF risk areas, or lower levels of DPP regulation jurisdiction.

Yes. Our Rules Engine allows our customers to automatically cancel/reject any transactions going to/coming from non-trusted VASPs (e.g., due to sanctions or deficient data protection frameworks) or VASPs located in high-risk jurisdictions. Compliance Teams can also make an ad-hoc assessment to determine whether or not a Travel Rule data transfer should go through. In addition, the funds can then be automatically blocked from being sent to the Beneficiary. 

Click here to read what Notabene customers can do today to block transactions to sanctioned individuals.

Recordkeeping and transaction monitoring

8. What function does the tool/solution provide to facilitate recordkeeping and transaction monitoring (retaining data for 5 years/ allow user VASPs to download data)?

An overview of Notabene’s approach to recordkeeping and transaction monitoring:

• Our customers receive a copy of the entire Travel Rule payload when it is created and with every status update through a webhook. Additionally, we retain a copy of the records for as long as they are a customer or as long as their jurisdiction allows. If our solution is no longer required to retain a copy, customers can download a full copy of their Travel Rule payload into CSV. 
• The Notabene dashboard also includes Travel Rule performance metrics, allowing the VASP to track several key data points (such as the rate of non-custodial transactions, rate of accepted and rejected transactions, time to response, etc.). We will roll out additional data analytics tools in the coming months to support further reporting.
• VASPs can import Travel Rule data into transaction monitoring and market surveillance systems. The reverse also applies: transaction risk data can be imported to Notabene to support better Travel Rule data flows.

‍
Want to learn more? Book a demo to speak to sales.

The Travel Rule, like the sun, rises at different times around the world. Navigating the “sunrise issue” - the period where Travel Rule enforcement is staggered globally - presents unique challenges for Virtual Asset Service Providers (VASPs).

Given the borderless nature of crypto transactions, achieving full compliance becomes a complex task for VASPs, particularly those operating in jurisdictions where the Travel Rule is already enforced. They may face hurdles in executing or receiving responses to Travel Rule transfers from counterparts in locations where enforcement is still pending.

VASPs often grapple with premature requests for Travel Rule data transfers before implementing compliance measures. Those in early-enforcing countries may also find maintaining business relationships with counterparts in late-enforcing nations challenging. As FATF guidelines allow VASPs to require Travel Rule compliance even from jurisdictions where the rule is yet to be enforced, a proactive approach to compliance is crucial for all involved parties.

How is the sunrise period currently affecting VASPs?

The sunrise period remains one of the top three hindrances to complying with the Travel Rule, as reported by our survey respondents. 

As demonstrated in Chapter 2 of Notabene’s 2023 State of Crypto Travel Rule Compliance Report, many VASPs claim to be compliant but are not fulfilling the required pre-transaction obligations”; VASPs are in different stages of compliance: a substantial percentage (34.8%) are not yet complying at all. 

Those that are complying are in different phases - some comply pre-transaction (20.3%), others post-transaction (11.6%), and some currently respond to Travel Rule transfers but are not yet sending (18.8%). 

The above data shows that during the sunrise period, VASPs take a phased approach to compliance with Travel Rule obligations. Rather than jumping from not complying to being fully compliant, VASPs go through different stages, making a smoother and more successful rollout. 

What are the main challenges that compliant VASPs face when transacting with non-compliant VASPs?

Three main challenges that compliant VASPs face when transacting with non-compliant VASPs are as follows:

‍

1. Complying with the obligation to send a Travel Rule data transfer: 

If a Beneficiary VASP is unprepared for Travel Rule transfers, Originator VASPs may struggle to meet the core obligation of sending the required originator and beneficiary information with each transaction. Depending on a VASP's policies and local regulations, they might not process a transaction in these scenarios. 

However, most VASPs remain flexible, with 41.2% taking a risk-based approach to transactions if a Travel Rule message can't be sent, 37.3% allowing transactions regardless, and 7.8% disallowing transactions to proceed unless a Travel Rule message can be sent to the beneficiary VASP.

2. Identifying the counterparty VASP and managing counterparty risk: Without a confirmation of correct counterparty identification, the initiating VASP may need to rely on third-party data, like blockchain analytics, to decide whether to proceed with the transaction, potentially risking interaction with sanctioned VASPs.
   
   
3. Effective sanction screening/risk management on counterparty customer: Without a response or a Travel Rule message from a non-compliant VASP, the compliant VASP lacks verified information about the counterparty customer. This significantly impedes effective sanction screening and risk management processes.

As previously mentioned, most VASPs today still transact even without receiving a response from the beneficiary VASP confirming that they correctly identified the counterparty to that transaction and verifying the identity of the counterparty end customer. 

12% of VASPs only allow a transaction if they receive a response from the beneficiary VASP. The rest either do not wait for a response (22%), proceed in case they have not received a response within a specific timeframe (14%), or do not connect Travel Rule and transaction flows at all (52%) (see key finding 8 in chapter 2).

Ultimately, these challenges may result in the compliant VASP not being able to transact with counterparties that do not engage in Travel Rule flows. This is already the case for a minority of VASPs, as mentioned above. 

To learn more about how the sunrise period affects VASPs, download Notabene’s 2023 State of Crypto Travel Rule Compliance Report.

What is the FATF’s stance on the Crypto Travel Rule’s “sunrise issue”?

To mitigate risks during this period, the FATF suggests several measures that VASPs can implement to comply with Travel Rule requirements regardless of the stages of compliance at which their counterparties operate. 

Regardless of the regulation in a certain country, a VASP may implement robust control measures to comply with the travel rule requirements. Examples include VASPs restricting VA transfers to within their customer base (i.e., internal transfers of VAs within the same VASP), only allowing confirmed first-party transfers outside of their customer base (i.e., the originator and the beneficiary are confirmed to be the same person) and enhanced monitoring of transactions. (Emphasis added) [1] 

In its Targeted Update published in June 2022,  FATF recognizes the compliance hindrances of the sunrise period and highlights how different jurisdictions have been approaching those issues. [2]

However, FATF now pushes for a broad and rapid introduction of Travel Rule requirements as the ultimate solution to the sunrise issue: 

Going forward, broad and rapid introduction of the Travel Rule can reduce the scale of the sunrise issues and provide additional incentives for industry to accelerate compliance. [3] 

‍

What is the business impact of the Crypto Travel Rule’s “sunrise issue?”

Ultimately, the phenomenon of compliant VASPs restricting transactions with noncompliant VASPs carries a negative business impact for both sides. This impact is already being felt by 7.8% of the respondent VASPs, who have reported that they only allow transactions if they can send a Travel Rule message to the beneficiary VASP. It also impacts another 12% of VASPs that only allow a transaction if they receive a response from the beneficiary VASP  (see key finding 4). 

To mitigate the negative business impact on the industry and sustain the international nature of the crypto, VASPs could take a proactive approach and start complying as soon as possible, regardless of the stage of adoption of the Travel Rule in the jurisdiction where they are based. 

The survey responses show that VASPs are currently in very different implementation stages. However, the majority aim to be fully compliant in 2023 (see key finding 1). 

From the policymaker's perspective, it is essential to provide regulated VASPs with a clear framework for compliance with the Travel Rule, [4] VASPs in jurisdictions that do not provide a clear path toward Travel Rule compliance will ultimately face difficulties in interacting with compliant VASPs, which, in turn, will result in the jurisdictions becoming less competitive venues for crypto businesses. 

How does Notabene solve the Crypto Travel Rule’s “sunrise issue?”

Notabene has introduced a phased approach for Travel Rule implementation to assist VASPs seeking to simplify compliance and manage the "sunrise issue."

SAFE Implementation phases minimize operational risk and provide analytics to guide users through the Travel Rule rollout. This strategy allows customers to meet regulatory guidelines while tailoring their risk-based approach over time. 

Notabene's SafeTransact platform provides industry-unique support for multiple legal entities, facilitating seamless expansion into multiple jurisdictions without the headache of legal and compliance issues.
‍

‍

Notably, the first phase requires minimal technical integration and can be completed within a week. 

To assist businesses in navigating Travel Rule compliance, Notabene offers a free SafeTransact-Rise plan. This plan requires no integration, enabling users to immediately benefit from advanced compliance features.

SAFE Implementation phases are part of Notabene's broader efforts to support customers with regulatory compliance, recognizing the complexity and dynamic nature of regulatory compliance. We are dedicated to providing our customers with the necessary tools and expertise, constantly updating our solutions to meet the latest regulatory requirements, with a team of experts ready to answer any questions.

‍

{{cta-learnmore13="/cta-components"}}

‍

Navigating the intricate challenges of the Travel Rule’s “sunrise issue” is a dynamic journey. As shown, the disparate stages of compliance among VASPs have significant business implications and impact on maintaining the international nature of crypto. A proactive stance towards compliance is the key to mitigating this effect, a strategy exemplified by Notabene’s phased approach to Travel Rule implementation. A harmonized global adoption of the Travel Rule will minimize the sunrise issue and provide a firm foundation for the continued growth and maturation of the crypto industry. 

In the data requirements for Originator and Beneficiary VASPs in the crypto Travel Rule, VASPs must legally identify each other and route the required transaction information to the appropriate VASP. Many VASPs have entities in more than one jurisdiction, and customers or blockchain analytics services likely won’t be able to determine which entity should receive the transaction. As crypto transactions are inherently cross-jurisdictional, using a unified, secure method of VASP name-matching supports seamless Travel Rule data transfers. Decentralized Identifiers (DIDs) present an answer to this problem.

This article dives into DIDs and how Notabene’s market-leading Travel Rule compliance solution uses this innovative technology to identify VASPs.

What are DIDs?

Globally, individuals and companies use unique identifiers in various contexts: phone numbers, email addresses, social media usernames, ID numbers (for passports, driver’s licenses, tax IDs, health insurance), and product identifiers (serial numbers, barcodes, RFIDs). Additionally, each website has a globally unique URL.

External agencies control most globally unique identifiers; they decide what they refer to and when to cancel them. They're only valuable in specific contexts and by unelected bodies. Traditional unique identifiers may reveal private info and can be fraudulently copied and used by a third party, resulting in "identity theft."

DIDs are a component of a more extensive system — the Verifiable Credentials ecosystem — and are defined in this specification as a novel type of cryptographically verifiable globally unique identifier. DIDs are designed to enable individuals and organizations to generate their own trusted identifiers and prove control over them through authentication using cryptographic proofs, such as digital signatures. The World Wide Web Consortium defines a DID as: “A globally unique persistent identifier that does not require a centralized registration authority because it is generated and/or registered cryptographically.”

DIDs are entity-controlled, and each entity can have as many DIDs as it needs to keep its identities, personas, and interactions separate as desired. These identifiers can be used in a way that makes sense for each situation. They make it possible for entities to interact with other people, institutions, or systems that need them to identify themselves or the objects under their control. DIDs also allow entities to decide how much personal or private information should be shared without depending on a central authority to guarantee the continued existence of the identifier. 

How do DIDs work?

A DID is a simple text string consisting of three parts:

1. the DID URI scheme identifier,
2. the identifier for the DID method, and
3. the DID method-specific identifier.

Building an Ethereum DID is equal to making an asymmetric key pair. As a mathematical relation between the DID hash and its public key exists, the hash can be derived from a public key and vice versa.

• DID ~= public key

‍

‍

DIDs are resolvable to DID documents. A DID URL extends the syntax of a basic DID to include other standard URI parts like path, query, and fragment in order to find a specific resource, like a cryptographic public key inside a DID document or a resource outside of the DID document. DIDs create an ecosystem/protocol for cryptographically secure data exchange, verification, and more. Anyone can create a DID because they are self-managed, open-sourced, and decentralized. Learn more on the W3 website.

‍

How are DIDs used in relation to Travel Rule/VASP communication?

When Alice sends a transaction to Bob, she likely doesn’t know if his account is with Bitstamp Singapore, Bitstamp USA, or any other Bitstamp entity. She simply inputs his alphanumeric address and sends the transaction. A normal crypto transaction flow puts the onus on providers to determine which entity controls Bob’s address.

Leveraging DIDs, Bitstamp would create separate DIDs for each entity, which removes the VASP name-matching operational friction without asking the end user to submit unknown information.

‍

‍

DIDs allow for the following in relation to Travel Rule compliance:

• Matching a blockchain address to the correct VASP entity.
  Blockchain analytics services only return the VASP name. Having a separate DID for each entity solves difficult counterparty identification by returning Bitstamp EU, Bitstamp DE, or Bitstamp USA, etc.
• Using DIDs to define a standard market practice for including legal entity identifiers (LEIs) in payment messages as recommended by the FATF.
  FATF notes that LEIs could be used as additional information in payment messages without changing the current message structure. (FATF 2021b, p. 60, para 189)
  
• Creating a decentralized SWIFT code network.
  The traditional banking world uses SWIFT codes to identify companies. Keeping in line with the ethos of the industry, DIDs can be used as a standardized decentralized way to identify VASP entities.

‍

How does Notabene use DIDs?

We use DIDs as LEIs for every crypto company or financial institution in our Notabene VASP Network. DIDs allow companies to create separate identities for each entity, meaning that if there are 10 Bitstamp entities, each one would have its own DID. DIDs cut out the painstaking process of name-matching during regulated data transfers. 

In the Travel Rule context, DIDs resolve into a document that specifies:

• VASP website
• VASP’s public key
• Which protocol a VASP supports, etc.

‍

Who provides DIDs for Notabene?

We work closely with Veramo to encrypt the personally identifiable information (PII) data flow for VASP-to-VASP communication. Veramo is a JavaScript framework that simplifies the use of cryptographically verifiable data in software applications.

How the PII Escrow flow works:

• Veramo securely encrypts PII data flow when sending Travel Rule data transfers from VASP A to VASP B.
• Only the Beneficiary VASP can decrypt the data.
• This supplies security and comfort because, in any event of a data leak, no one can decrypt it but the recipient.

Hybrid PII Encryption flow:

• The Originator VASP sends two versions of the Travel Rule data transfer, one for us to decrypt and one for the Beneficiary VASP.
• Notabene accesses the version intended for us to perform sanction screening.
• As a SOC2-compliant company, we use unique keys per customer to minimize potential hacking cases, leaks, etc.

End-user data security and privacy are a part of our fundamental values at Notabene. Our SafePII service presents a unique data escrow system for safely transmitting encrypted customer information only when a beneficiary institution confirms ownership of a blockchain address and fulfills specific rules. Currently, Notabene securely stores PII during the hybrid PII encryption flow. However, customers are open to running their own PII service. Learn more about Notabene’s commitment to security.

June’s VASP Directory Report is filled with exciting updates. Before you hop in, be sure to check out our mission and vision and learn more about Notabene. 

At Notabene, we’re on a mission to make crypto transactions a part of the everyday economy. Our market-leading solution allows financial institutions to manage regulatory and counterparty risk in crypto transactions—creating the last needed connection between the traditional financial industry and the crypto industry. Financial institutions and crypto exchanges use our first-to-market FATF Travel Rule solution to identify virtual asset accounts, perform mandated VASP due diligence, and manage regulatory and counterparty risks from one holistic dashboard.

In June, we saw a 12% increase in VASPs signed up in the directory to a total of 898 VASPs. The number of in-network VASPs, actively managing their accounts increased by another 12%. SuperVASPs increased by 8.8% in June. Activity window: May 25-June 25. Find more details below. 

Click here to view Notabene's VASP Directory Activity | May 2022.

Continued activity through the industry downturn

Although the total value of all cryptocurrencies on the market has recently dropped below $1 trillion, down from $3 trillion in November 2021, taking transaction volume down with it, we’re noticing very little impact on growth and activity in Notabene’s directory. Industry players are taking this downtime to ramp up their compliance journeys and strengthen their compliance stack.

Additionally, Estonia’s enforcement date recently passed on June 15th, prompting a record number of Estonian VASPs to sign up to the directory, and become SuperVASPs (verified profile, claimed, and in-network) in record time. This region-specific uptake shows that VASPs will turn to the most accessible place to comply when the pressure is on.

VASP Directory Activity 

Notabene provides its customers and crypto companies widely with a directory to build verified business profiles, share metrics around Travel Rule adoption, and perform counterparty due diligence to establish trusted bilateral relationships.

Directory data is available to any VASP that signs up for Notabene as a paid customer or as part of the free Sunrise Plan. Below, we share some highlights.

1. 898 VASPs are in the directory, and 224 have earned in-network badges

The number of VASPs who actively manage their profiles has grown by 12% since May to 224 VASPs indicating that even during a downturn in the market, companies continue to invest in their compliance stack and focus on Travel Rule adoption. VASPs with “In-Network,” badges have an active administrator and will be responsive to incoming Travel Rule data transactions.

‍

2. Originator VASPs have sent transactions to 138 Beneficiary VASPs in June

This month, Originator VASPs have sent Travel Rule data transfers to a record number of 138 Beneficiary VASPs. As Originator VASPs ramp up transfers to their counterparties, Beneficiary VASPs can now subscribe to Notabene’s Sunrise Plan and respond to incoming transfers for free.

‍

‍

3. Both retail and institutional VASPs have joined the Notabene directory in the last 30 days.

Notable new VASP profiles include:

• Bitstamp Europe S.A.
• Coinmetro
• Orbital
• Cross River Bank
• Crypto2cash
• Hash Blockchain Limited
• Eurogroup technologies OU
• CoinField
• The Merkle Group
• PureFi
• Great South Gate Asset Management
• Kriptomat
• Paus
• SpectroCoin

‍

4. Eighty-three companies have received a SuperVASP badge.

Since May, the number of SuperVASPs has increased by 8.8% to 83 companies. A "SuperVASP" badge indicates company profiles that are:
✅verified
✅claimed
✅in-network 

‍

‍

Join in on the action! Sign up for a VASP Directory profile today.

As Notabene continues to grow at rocket speed, we continue to add features to help our clients roll out their Travel Rule compliance plans. This release allows you and your team to stay on track with your Travel Rule rollout, adds a new blockchain analytics provider–Coinfirm–to our marketplace to ease VASP discoverability, and allows easier management of transactions in your dashboard.

1. Coinfirm Analytics

Joint customers can now link their Coinfirm blockchain analytics account to Notabene. This feature helps VASPs with two things:

• Automatically Identify VASPs based on the counterparty's blockchain addresses
• Set up rules to automatically accept or decline transactions based on blockchain addresses' risk scores

Access this feature on your Notabene Dashboard > Company Profile Name > Marketplace.

‍

2. Filter transactions by status

Clients can now filter transactions by the current Travel Rule status on the dashboard. This feature allows Compliance Teams to determine which transactions are actionable quickly. 

Available statuses:

• Sent
• New
• Canceled
• Acknowledge
• Incomplete
• Missing Beneficiary Data
• Accepted
• Rejected
• Declined

Access this feature in the Transactions dashboard > ‘Filter by.’ 

‍

3. Confirm previous transactions in one click

Are you overwhelmed with the amount of pending incoming transactions? Clean up your transaction dashboard with one click!

When a customer provides a list of blockchain addresses to Notabene, every receiving blockchain address of an incoming transaction is checked against that list. This feature lets customers auto-confirm that their incoming transactions are intended for them.

Ways to upload a list of blockchain addresses to our Travel Rule compliance platform:

• Uploading an address book
• Adding an address webhook
• Manually registering a blockchain address

To Manually register blockchain addresses:

1. Go to the Notabene dashboard
2. Click your company logo in the top right corner
3. Select ‘Uploads’
4. Follow the instructions

It has now been three years since the Financial Action Task Force (FATF) extended its anti-money laundering and counter-terrorist financing (AML/CTF) Standards to financial activities involving Virtual Assets (VAs) and Virtual Asset Service Providers (VASPs) to respond to the threat of criminal and terrorist misuse.

FATF's recently released ‘Targeted Update on Implementation of FATF’s Standards on VAs and VASPs, provides an overview of areas of progress that countries and the industry have made and continued implementation gaps and concerns.

Travel Rule Highlights:

• The FATF reflects on the progression of the private sector in a positive light. The document highlights the progress on developing and implementing Travel Rule solutions, and the final conclusion is that both countries and the industry need to move faster to ensure global application of the Travel Rule.
• The FATF reports that only 29 countries have implemented the Travel Rule requirement, and even fewer are actively enforcing it.
• The FATF urges countries to implement and enforce the Travel Rule to resolve the sunrise issue that slows the industry adoption rate of solutions.
• The report also calls on the private sector to accelerate the interoperability of Travel Rule solutions.

Below, we share our 4 key takeaways.

1. The FATF acknowledges the progress of VASPs in implementing the Travel Rule, sometimes ahead of legislators

The FATF notes that since June 2021, jurisdictions have made limited progress in implementing and enforcing the Travel Rule. 

Notabene’s commentary:

Conversely, especially in the second quarter of 2022, Notabene has seen a peak increase in Travel Rule adoption by VASPs. This willingness to comply is also explicitly acknowledged by the FATF. In many cases, this increase was directly attributable to regulatory urgency, with Travel Rule requirements coming into force in different jurisdictions (most notably, Estonia, where Travel Rule came into force on June 15th, and Japan’s April 2022 enforcement date. However, we understand that Japan’s Financial Services Agency allows softer, tiered enforcement). 

We have seen that VASPs are also primarily motivated by counterparty urgency. VASPs are looking to become compliant with Travel Rule to continue transacting with their counterparties based in jurisdictions where Travel Rule is already in force. Complying with the Travel Rule is increasingly being perceived as a competitive advantage.

2. Effective Travel Rule compliance requires global, interoperable, and nuanced Travel Rule solutions rather than regional and closed networks

The FATF stresses that global implementation and full compliance with FATF Standards require interoperability between Travel Rule solutions. A closed network approach where transmission of Travel Rule information is dependent on the approval of the network members or a third party hampers a global and effective approach to Travel Rule compliance.

Notabene’s commentary: 

Notabene is an open network. We do not act as gatekeepers and believe each VASP should be able to decide who to transact with and share Travel Rule information. Additionally, Notabene is a protocol-agnostic solution. To ensure that our customers can reach the most expansive network of counterparty VASPs through Notabene, we work on integrating with any live Travel Rule messaging protocols. Acknowledging the importance of interoperability, integrating with existing Travel Rule protocols is Notabene’s main priority in the product roadmap. 

The FATF recognizes that Travel Rule needs to be implemented at a global level, despite the differences in how each jurisdiction handles different Travel Rule components - the FATF highlights, in particular, the differences in how each jurisdiction approaches:

• Whether a de minimis threshold applies and the transaction amount that triggers Travel Rule requirements;
• The compatibilization between Travel Rule obligations and data protection frameworks; 
• Transactions with unhosted wallets;
• The scope of information that must be transmitted.

Notabene’s global Travel Rule solution accounts for jurisdictional nuances:

Crypto enables a global and borderless financial industry, and the design of crypto compliance solutions should help preserve this characteristic while accounting for the specificities that might exist in different jurisdictions.

Our solution achieves this by reflecting the requirements of different jurisdictions (in terms of the de minimis threshold that applies, if any, the scope of the required information about the originator and beneficiary customers and requirements applicable to transactions with unhosted wallets) in our systems and product offerings. A validation mechanism ensures that any Travel Rule transfer includes all the needed information according to the jurisdiction of the Originator VASP and issues warnings in case the requirements applicable to the Beneficiary VASP are more comprehensive. 

3. The FATF reports that most jurisdictions choose not to exclude unregulated VASPs from legal transaction flows

19.a‍

“22 out of 32 jurisdictions have decided to allow domestic VASPs to transact with any foreign VASP, whether they are licenced/registered or not,”

and

19.b

“most jurisdictions have decided to require domestic VASPs to apply the Travel Rule with all foreign VASPs, whether or not they are registered/licensed or have similar Travel Rule requirements .”

Notabene’s commentary: 

We are pleased to see this trend, as measures restricting transactions or Travel Rule flows with unregulated VASPs might have unintended consequences. On the one hand, this can result in excluding VASPs located in jurisdictions that do not yet offer robust frameworks to regulate the crypto industry and register/license crypto firms, regardless of how robust the VASP’s compliance program is. 

According to the FATF, “only 12 jurisdictions out of 53 (23%) have been assessed as largely compliant with R.15 [i.e., with the AML/CTF Standards for VAs and VASPs]”, which implies that this could potentially affect a large number of VASPs. 

The private sector, under close monitoring of the competent supervisory authorities, is better positioned to determine whether or not to transact with certain counterparties following a risk-based approach that takes into consideration the specificities of their businesses, the due diligence performed on these counterparties, and the risks associated with a particular transaction. 

This is, in fact, one of the advantages of the Travel Rule - it allows VASPs to manage risk at the transaction level and adopt a more targeted approach when enforcing restrictions, and avoid blanket exclusions that can be disproportionate depending on the context. 

On the other hand, restricting Travel Rule flows with unregulated VASPs is counterproductive. Presumably, managing counterparty risk is particularly relevant when transacting with unregulated VASPs, and that is better achieved by engaging in Travel Rule flows with those VASPs. Of course, performing appropriate counterparty VASP due diligence on the counterparty VASP before transacting and sharing Travel Rule information is a central element of the process. 

4. Rapid and broad enforcement of Travel Rule requirements across jurisdictions is key to overcoming the sunrise issue.

The Travel Rule was first introduced in the FATF Standards in June 2019. Since then, Travel Rule requirements have been transposed to national frameworks at different speeds across jurisdictions. This poses a challenge for VASPs that are already required to comply when interacting with counterparties based in jurisdictions where regulators might not even have passed Travel Rule into law. In these cases, counterparties are often unprepared to send, receive and process Travel Rule transfers. Even if their compliance teams are willing to collaborate, finding resources to engage in compliance processes that are not yet mandatory in their jurisdiction is a difficult sell internally.

To account for this, VASPs are often granted generous grace periods to comply in full, take a phased approach to compliance, or apply alternative risk mitigation measures in cases where Travel Rule flows cannot be completed successfully. 

The private sector has expressed that, although this flexibility is helpful, the industry can only overcome the sunrise issue with rapid and broad enforcement of the Travel Rule across jurisdictions.

At Notabene, one of our core product design principles is to ensure our customers are  able to achieve phased compliance even if a transaction’s counterparty had no Travel Rule compliance solution in place. Hence, we have launched a free plan (Sunrise Plan) for companies to securely and privately respond to pending Travel Rule data transfers. This plan grants access to our powerful Travel Rule compliance dashboard, allowing Compliance Officers to set up secure automated compliance workflows and benefit from our award-winning integrations with blockchain analytics and sanctions screening providers–even if they are not yet ready to integrate a Travel Rule solution.

In July 2021, the European Commission submitted a legislative proposal for a regulation on information accompanying transfers of funds and certain crypto-assets - the “Transfer of Funds Regulation.”

Subsequently, the EU Parliament reviewed the proposal and, in April 2022, adopted a Report expressing its first reading position. The Report introduced quite a few changes to the text initially proposed by the Commission. The Commission, the Council, and the Parliament then initiated trilogues–informal meetings between representatives of the three bodies to reach a provisional agreement acceptable to both the Parliament and the Council. The Commission acts as a mediator of the discussion.

All parties finally reached a consensus on June 29th, 2022, which leads us to the final step of the legislative process: the formal approval of the Regulation by the Parliament and Council.

Below we summarize key points:

*Please note that where the Financial Action Task Force (FATF) uses VASPs (virtual asset service providers), the European Parliament uses CASPs (crypto asset service providers.)

1. The Travel Rule will not apply to peer-to-peer transactions.

The EU Parliament states:

The rules do not apply to person-to-person transfers conducted without a provider, such as bitcoins trading platforms, or among providers acting on their own behalf.

‍
The FATF and local regulators have generally focused on enforcing AML/CTF controls on transactions that involve intermediaries, such as VASPs or other obliged entities. Thus, crypto transfers between unhosted wallets, so-called peer-to-peer transactions, are not explicitly covered by AML/CTF rules. This is in line with the regulatory paradigm of placing obligations on intermediaries rather than on individuals themselves.

The FATF opens the door to a future change of paradigm in case there is a distinct trend toward P2P transactions, as this would necessarily hurt the effectiveness of the AML/CTF frameworks as they exist today. The time for such a shift is not now, as:

• The available data on the P2P market is not reliable enough to make an informed policy decision.
• The intermediated transactions are still relevant enough to allow for effective implementation of the standards.
• P2P transactions that are visible on public ledgers enable financial analysis and law enforcement investigations.

2. Transfers between CASPs and unhosted wallets of third parties will be subject to enhanced due diligence measures. As a result of the trilogue negotiations, verifying the identity of a third-party beneficial owner is no longer mandatory. 

In its first reading of the Report, the EU Parliament proposed that CASPs should be required to verify the identity of a third-party beneficial owner of the unhosted wallet to/from which funds are sent. Due to the trilogue negotiations, we welcome that this is no longer proposed as a mandatory requirement.
‍
Although this is technically possible to do this with existing technology, it is unlikely that, with today’s adoption, CASPs will manage to implement these processes while ensuring that this does not cause undue delay to the execution of the transfers - a stated goal in the TFR. Until portable digital identities are widely adopted - which is an effort that the EU is leading with initiatives such as the eIDAS - verifying the identity of a third-party beneficial owner of the unhosted wallet to/from which funds are sent is a process that introduces significant friction in the transaction flow.

At least in the short/medium term, such a requirement would push CASPs only to allow first-party transfers to or from unhosted wallets (i.e., transfers to and from the wallets of their own customers).

3. Transfers of over 1000 euros between CASPs and unhosted wallets of their customers will trigger the obligation to verify whether the CASP’s customer effectively owns or controls the unhosted wallet.

Instead of relying on the self-declaration that a wallet belongs to the end customer, CASPs should verify beneficial ownership. This can be done by triggering the customer to perform a wallet ownership proof while in an authenticated session (therefore establishing a link between the identity and the wallet.)

The requirement to verify first-party ownership of the wallet is most helpful when there is also a requirement to verify the identity of a third-party beneficial owner (which, as said below, is not the approach of the EU). In those cases, the CASP must verify beneficial ownership. This ensures that the customer does not bypass the third-party verification requirement by falsely declaring they are transacting with their own wallet.

Nevertheless, this measure makes transaction risk management more robust by the following:

• CASPs can take a risk-based approach that facilitates transaction flows with unhosted wallets of their own customers and apply enhanced due diligence measures when transacting with third-party wallets;
• This will also bring additional data points that CASPs can rely on to evaluate and monitor customer risk. 

It’s also worth noting that different methods for wallet ownership verification will have additional integration costs and impact the user journey and drop-off rates. Some practices with a lower economic burden of implementation, like the Satoshi Test, have a more significant impact/friction on the user journey, which could lead to higher attrition and overall higher economic loss (this method requires users to perform a transaction and entails dead-end scenarios such as no funds being available on the wallet, etc.)

How Notabene verifies beneficial owners of unhosted wallets:

Notabene uses cryptographic signatures as proof. There is a considerable technical burden in integrating with private wallets for these purposes due to the variety of private wallets. If CASPs want to ensure wide coverage to allow their users to perform proof regardless of the private wallet provider they are using, then the CASP would need to integrate with several different providers. 

However, some aggregators, such as WalletConnect, can lower the effort significantly. Notabene integrates only with Metamask and WalletConnect, for instance. Using cryptographic signature aggregators should allow the proof process to scale fairly seamlessly, thus allowing smaller and larger CASPs to roll it out. 

4. Negotiators agreed that the set-up of a public register for non-compliant and non-supervised CASPs would be covered in the Markets in Crypto-assets rules (MiCA), currently being negotiated.

From our perspective, the public register list should be used to support CASPs’ counterparty due diligence processes rather than as a list that CASPs are required to enforce blindly. 

The European private sector, under close monitoring of the competent supervisory authorities, is better positioned to determine whether or not to transact with certain counterparties following a risk-based approach that takes into consideration the specificities of their businesses, the due diligence performed on these counterparties, and the risks associated with a particular transaction. 

This is, in fact, one of the advantages of the Travel Rule - it allows CASPs to manage risk at the transaction level and adopt a more targeted approach when enforcing restrictions, and avoid blanket exclusions that can be disproportionate depending on the context. 

Another question is what is meant by non-compliant and non-supervised CASPs. Recital 34a and Article 18aa of the Transfer of Funds Regulation (in the version proposed by the EU Parliament’s first reading Report) prevent CASPs from transacting with counterparties that are not established in any jurisdiction and are unaffiliated with a regulated entity. Our reading of the criteria is that it is cumulative - i.e., a CASP that is correctly established in a particular jurisdiction but is not regulated (e.g., due to the lack of a regulatory framework applicable to CASPs in that jurisdiction) would not be deemed a non-compliant CASP. 

We hope the reading of the MiCA text that is finally approved clarifies this aspect and avoids the exclusion of CASPs located in jurisdictions that do not yet offer robust frameworks to regulate the crypto industry and register/license crypto firms. According to the FATF, “only 12 jurisdictions out of 53 (23%) have been assessed as largely compliant with R.15 [i.e., with the AML/CTF Standards for VAs and CASPs]”, which implies that this could potentially affect a large number of CASPs.

Finally, it is of paramount importance (i) that the process to include CASPs in this list is adversarial and involves the CASPs at issue and that (ii) CASPs can request to be taken out of the list in light of implemented improvements.

Since our inception, Notabene’s mission has been to enable safe, secure, and private crypto transactions. From day one, we’ve prioritized a pragmatic approach to Travel Rule compliance and were the first to introduce a solution that solves the Sunrise issue. TR:Now is part of our proprietary protocol switch that connects our clients to the broadest number of counterparties. 

Implementing the Travel Rule brings novel complexity, and it requires ongoing assistance to set up new compliance and operational processes. One of our core principles was that if a VASP’s counterparty was not ready to be fully compliant, they could at least respond to transactions using our universal protocol switch. If a transaction’s counterparty had no compliance solution in place to respond, our customers should still be able to achieve phased compliance by sending the mandated Travel Rule data transfer. 

Today, major crypto exchanges and financial institutions worldwide use our end-to-end solution to send and receive Travel Rule data transfers across 210+ exchanges. We’ve achieved a high level of success, we have a response rate of over 50%, and we have maximum reachability in the market. 

With hundreds of exchanges using our VASP Directory to send and receive compliant transfers, and more coming live daily, we’ve gleaned two significant takeaways:

• There is a willingness to comply. Many companies are willing to respond to Travel Rule transactions before their prospective enforcement date. But they need easy tools to do so.
• Reachability is key. Initiating and sending transfers to an expansive list of VASPs is crucial to Travel Rule compliance.

These learnings have led us to launch a free and secure plan that solves the Sunrise issue. 

Introducing SafeTransact-Rise

Our customers’ success is critical — and they cannot succeed if their counterparties don’t have the tools readily available to respond to them. Hence, we have launched a free plan for companies to securely and privately respond to pending Travel Rule data transfers. This plan grants access to our powerful Travel Rule compliance dashboard, allowing Compliance Officers to set up secure automated compliance workflows, and benefit from our award-winning integrations with blockchain analytics and sanctions screening providers. 

How to sign up:

Any VASP can sign up. After going through the Notabene verification process, new VASPs can either claim their profile from our Directory or set up a new one:

1. Create your company profile
   Login to the VASP & Crypto Company Directory and follow the verification steps. Once verified, share your profile with your counterparties to alert them that you are ready to receive Travel Rule data transfers.
2. Access the Travel Rule dashboard
3. Manage transfer flow using the rules engine and bulk action functionalities.
4. Store data transfers from your compliant counterparties. Review, store and respond to transfers from your counterparties. 

SafeTransact-Rise users will be able to:

• Perform mandated VASP due diligence

We’ve partnered with VASPnet to provide comprehensive regulatory information and incorporation information on 800+ VASPs. Additionally, Compliance Officers can request the industry-standard due diligence questionnaire from counterparties and automate or block transactions accordingly using the Rules Engine.

• Respond to unlimited Travel Rule data transfers

We want our customers to win. To gain their operational licenses in their registered jurisdictions and maintain global transactions to worldwide counterparties. When their counterparties sign up for sunrise, they can respond to unlimited Travel Rule data transfers, as well as….

• Send transfers up to 10k USD.

To extend the sunrise benefit to the entire market, we added the capability to send transfers up to 10k USD. 

What does the Sunrise Plan mean for the crypto market?

Notabene’s Sunrise Plan addresses one of the top issues keeping VASPs from adhering to the mandated regulation. In our 2023 State of Crypto Travel Rule Compliance Report, respondents pointed to the Sunrise Period as one of the top two hindrances to Travel Rule adoption. 

Additionally, the FATF acknowledged the Sunrise issue in section 201of its Updated Guidance [OCT 2021] while also stating that the sunrise period should not preclude VASPs from implementing “robust control measures to comply with the Travel Rule requirements.” This research led us to launch the Sunrise plan. Enrolled VASPs can respond to and send a limited number of Travel Rule data transfers today.

Notabene’s client Luno receives its in-principle approval to provide crypto services in Singapore.

What happens next?

Notabene’s SafeTransact-Rise facilitating Travel Rule compliance for our customers is just the beginning. Once successfully onboarded, new members benefit from our ancillary services, including compliance webinars and access to our Travel Rule certification program that help our clients learn how to scale responses, kickstart transaction flows, and introduce proper compliance flows. 

Once ready, Sunrise users can choose to upgrade their subscription to a paid plan and start integrating the Travel Rule for more fully automated transfers.

{{cta-bookademo="/cta-components"}}

In a previous webinar, FATF’s Final Guidance for Virtual Assets and VASPs. What now?, Bitso’s Chief Compliance Officer, Patricia Risso, shared her personal experience with Travel Rule implementation. Bitso is a global crypto platform with operations in Latin America, operating in the Gibraltar jurisdiction. Bitso is a client of Notabene.

How does the Travel Rule impact your business?

From a business perspective, it will be challenging in terms of time, how you can deliver, and how long it will take to sign-up. From a business perspective, one of our primary concerns is the Travel Rule data transfers that we will be receiving. Bitso’s regulators are in Gibraltar; we have to adhere by June 2022. We must ensure that we align ourselves with the data requirements for our home jurisdiction and counterparty jurisdictions as well. 

Right now, the FATF requires the collection of an ID, address, or account number, which represents a challenge to transacting with a counterparty jurisdiction that might require the assembly of data points from the beneficiary. That could create inconsistencies and friction.

From a VASP perspective, we’re focused on the practicalities of implementing various requirements from jurisdictions and dealing with that friction within the codebase.

Dealing with incoming transfers from VASPs that have not implemented the Travel Rule

As incoming transactions from VASPs that have not implemented the Travel Rule will automatically be routed to our high-risk and monitoring systems, our queuing system will increase exponentially, which means more manual interaction. 

Receiving these transfers prompts many questions:

• What do we do in these cases?
• Do we have the risk appetite to accept these transactions? 
• What is the Travel Rule enforcement mandate date of the jurisdiction of each transaction? 

The sunrise issue brings forth implementation concerns:

• When do we go live? 

Implementing a staged approach to Travel Rule compliance for our end users

We need to understand how Travel Rule compliance impacts our clients; this is our key priority. I think the FATF is great, and I can understand what it’s trying to achieve in terms of transparency in AML, CTF, proliferation financing, etc. That’s the positive side. 

Conversely, like any other company, we also have day-to-day challenges with users sending assets to unhosted wallets and getting the address wrong. Adding beneficiary details to the mixture will increase user friction. We are concerned that our average user might not understand the implications of the Travel Rule. There will be teething issues during the education phase, which will impact our users to a certain extent, as happened with SWIFT.

As we advance, this pushes the implication to the content and marketing teams, who now have to educate our users about what is needed to send a transaction. Their knowledge will be critical when dealing with a retail mass market of VASPs such as FinCEN. 

Travel Rule compliance ensures VASPs’ future

Travel Rule requirements will give our users confidence in what we’re trying to achieve as an ecosystem. Our goal in the crypto space is for the last one to be financially included. As an industry, we must ensure that we are aligned and not just criticized by the rest of the financial services sector in terms of how we’re going forward to mitigate money laundering risks and terrorist financing risks, and proliferation financing. And that is why we decided to have our Gibraltar license to operate as well, to comply with the industry’s highest standards while giving confidence to the users and the financial ecosystem. 

When FATF first rolled out the Travel Rule, the industry waited for the other shoe to drop. Yet now, it’s becoming very evident: the FATF and the Travel Rule will be here to stay. Either you embrace it, or you don’t, and if you don’t embrace it, you won’t have a place within the VASP ecosystem. Per FATF, VASPs are recommended to stop interacting with VASPs that do not comply. They will essentially be phased out.

Challenges with rolling out Travel Rule compliance

Operational: It’s always challenging when something gets rolled out initially because you’ve got the key stakeholders of the business saying, Okay, now we’re going to do this? How is this going to affect our users? From a compliance perspective? 

Compliance Team: Most of our compliance team at Bitso comes from either a banking or an e-money background. The Travel Rule just made sense to us; we were very used to it as a department. Now, the challenges of rolling it out are another thing. Compliance teams are not formed of techies or engineers. They’re composed of compliance officers, analysts, and people who may not necessarily have a technical skill set. We needed a user-friendly solution that allowed us to be efficient as an organization. 

Choosing a Travel Rule solution: Bitso’s journey 

Bitso has a long history of leveraging adherence to international requirements and standards. Now, Travel Rule implementation changes will impact our operational capability.  We spent 18 months talking to different (Travel Rule solution) providers. I’ve been in some meetings learning about membership-based protocols that were not agnostic.

We want, and what the industry is craving for, is that agnostic solution that allows all of us to interact. Crypto is not about exclusion; it is about inclusion. That is the point of the ecosystem. Inclusion is at the forefront of the minds of Bitso founders, especially our CTO. The crypto ecosystem is supposed to interact and help, by all means, meet the requirements — but let’s do this intelligently. Let’s shift the organization and the industry from going down a “SWIFT” path. 

There are elements in different jurisdictions still being developed, and not many products reflect those elements. So that presented another challenge: going to many meetings where no one had a beta version, just a wire chart. When choosing a solution, we wanted to know if the solution was:

• An open-sourced industry alliance network, a closed network, or a commercial solution.
• Interoperable with various protocols and Travel Rule solutions.
• Live and in production.

When we first met with Notabene, we realized that their Travel Rule compliance solution ticked every single box. We’ve made the correct decision with onboarding to Notabene, and to be quite honest, it was a massive relief for all of us. It’s a very public record; we’ve signed up with Notabene, and I’m very thankful for that. 

Going forward, I think that we’ll be testing for a while. We will spend a lot of time testing to ensure that we don’t burden the ultimate user. We want to ensure that our users get used to the new requirements, so we’re making the transmission of beneficiary data optional until they are used to it. So this is kind of the trajectory that we want to follow, which also tracks us to meet our local regulatory redline in June 2022.

‍

‍

May’s VASP Directory Report is filled with exciting updates. Before you hop in, be sure to check out our mission and vision and learn more about Notabene. 

At Notabene, we’re on a mission to make crypto transactions a part of the everyday economy. Our solution allows financial institutions to manage regulatory and counterparty risk in crypto transactions–creating the last needed connection between the traditional financial industry and the crypto industry. Financial institutions and crypto exchanges use our first-to-market FATF Travel Rule solution to identify virtual asset accounts, perform mandated VASP due diligence, and manage regulatory and counterparty risks from one holistic dashboard.

Rising trend: VASPs moving from waiting on the sidelines to easing into compliance

We’re noticing a trend: companies are thwarting the compliance inertia and are coming live globally with Travel Rule. Statistics from our VASP Directory, taken between April 25 - May 25, show that VASPs are beginning to send and respond to transfers on a large scale. As the industry starts moving quickly towards an inflection point with Travel Rule compliant transaction flows, individual VASPs look to monitor the status of adoption among their counterparties and are deciding accordingly how to transact with them.

VASP Directory Activity 

Notabene provides its customers with a directory to build verified profiles, share metrics around Travel Rule adoption, and perform counterparty due diligence to establish trusted bilateral relationships. Directory data is available to any VASP that signs up for Notabene—both as a paid customer or as part of the free Sunrise Plan.

Below, we share some highlights.

1. More than 800 VASPs are now set up in the Notabene network

The number of VASPs who actively manage their profiles has grown by 2633% since Jan 2022, which is a good indication of how the overall market is speeding up Travel Rule adoption. These VASPs include companies who are actively sending or responding to transfers, but also ones who have set up their profiles to get ready to start receiving.

‍

2. Over 220 VASPs have earned an In-Network badge

VASPs that claim their profile are considered “In-Network,” which means that their account has an active administrator and will be responsive to incoming Travel Rule data transactions.

‍

3. Some of the largest exchanges globally have claimed their profiles since Jan 2022

“Claimed” status signifies that these companies are ready to start sending and receiving transfers via Notabene’s VASP directory.

Standout companies include:

• Valr
• Diginex
• Diginex (Singapore)
• Binance
• OKX
• Celsius Network (UK)
• CoinDCX
• Luno
• FTX
• OSL (Hong Kong)
• Matrixport

4. Activity among VASPs has increased drastically, with transfers happening between more than 160 exchanges

‍

5. 76 companies have received a SuperVASP badge

‍
Taking it a step further, we reward VASPs with a “SuperVASP” badge if they are:
✅ verified
✅ claimed
✅ in-network 

‍

‍

6. VASPs are increasingly starting to respond to counterparties—with Notabene customers on average having a 50% response rate

We increasingly see companies using Notabene tools to scale responses-even before they roll out their Travel Rule integration.

Power responders include:

• Luno
• Binance
• PDAX

‍

‍

{{cta-notabene-network="/cta-components"}}

‍Hi everyone!

We’re excited to share our most recent release with you. This release brings operational metrics to the compliance dashboard, a seamless login experience, free sanction screening from TRM, and much more. 

1. Receive weekly notifications about pending Travel Rule data transfers in your dashboard

A weekly email summary of pending Travel Rule data transfers

Our customers will receive weekly email notifications with an overview of pending transactions in their compliance dashboard. This email alerts them of incoming and outgoing data transfers that require their manual review. With a less-invasive email cadence, Compliance Officers can monitor the number of pending transactions and mitigate their workload by adjusting appropriate rules. 

‍

‍

2. Receive an alert when an outgoing transaction is missing required counterparty data

In-app and API popups when an outgoing transaction is missing mandated data in the Beneficiary VASP’s jurisdiction.

Notabene’s compliance software now highlights the fields that are missing data required in the Beneficiary VASP’s jurisdiction. Our customers will receive a preemptive warning when we suspect that the Beneficiary VASP may decline a transfer due to missing fields.” This feature removes the risk of having data transfers declined due to missing information. 

While filling out this data is optional, it allows the Originator VASP to mitigate the risk of the transfer being declined and speeds up the transfer response rate. This update offers enhanced visibility into which data is required depending on the Originator VASP’s and Beneficiary VASP’s jurisdictions.

How it works:

‍

‍

While creating a Travel Rule transfer manually, customers will be able to see a warning when the Beneficiary VASP might decline a transfer due to missing fields. As a Beneficiary VASP, you’ll also be able to see which data is missing in your incoming transfer and is required by your jurisdiction. 

‍

3. Secure and seamless login experience

This feature integrates Auth0, bringing the security of Client ID/Client Secret without passwords. 

From now on, you can log in to Notabene with Google or using our magic link functionality.

How it works:

1. Navigate to the login page
2. You will be redirected to the Auth0 login page, where you can log in with Google or an email address
3. Singing in with Google takes you directly to the compliance dashboard
   3a. Signing in with your email address sends you a login link
   3b. Clicking the link takes you to your compliance dashboard

4. We automatically confirm your company’s blockchain addresses

Today, we make it even easier for our customers to automatically confirm that they are an intended Beneficiary of an incoming Travel Rule data transfer. 

We’ve integrated a simple webhook that allows you to confirm a receiving blockchain address against an up-to-date list of your company’s operational blockchain addresses. No need to upload or register a new list every time it changes. This reduces the risk of confirming a data transfer that was not intended for them and speeds up the transfer response time.

5. View metrics on your compliance dashboard

Today, our customers can see a list of exciting metrics, including how many transactions are initiated, sent, received, and accepted/rejected by their counterparty VASP.

We wanted to enable our customers to be able to surface their data and be able to make decisions based on their Travel Rule data. You will see the dashboard available under the “Dashboard Tab”. Metrics are broken out by Outgoing and Incoming. Outgoing is focused on transaction data that you have sent. Incoming is focused on data for transactions that have come from other VASPs. 

We've integrated metrics on total Travel Rule transactions, Response Rate and Success Rate on the Outgoing and Incoming Transaction pages. We think users will love being able to see all their data and utilize it to make decisions. 

6. We offer a free plan to your counterparties

This feature helps our customers collect the missing Travel Rule data transfer for incoming transactions. 

For every incoming transaction above the Travel Rule threshold, Notabene will attempt to identify the Originator VASP and send an automated email requesting a Travel Rule data transfer. 

The recipient will receive a link to sign up for our Sunrise Plan–a free plan that allows our customer’s counterparties to send and respond to Travel Rule data transfers. We will then prompt them to fill in the missing Travel Rule information on said blockchain transaction. 

The moment a Travel Rule data transfer is sent, the information automatically updates in the Beneficiary VASP’s dashboard.

How it works:

‍

‍

7. Free sanction screening from TRM 

Our partners at TRM Labs have shipped a free, API-based screening tool. The blockchain analytics provider created this tool specifically for members of the crypto ecosystem who wish to be alerted when sanctioned crypto addresses are engaging with their platforms, including addresses linked to newly sanctioned Russian designated individuals and entities. 

How to turn on this feature: 

1. Login to your Notabene Dashboard
2. Navigate to the Marketplace located at the top right-hand corner
3. Select the TRM tab
4. Navigate to the TRM Sanction Screen
5. Follow the instructions to get an API key 
6. Paste the API key into the form
7. Link the accounts. 

‍

When you view the details of your next transaction, the ‘Address Sanctioned’ field will return ‘YES’ or ‘NO.’

On April 6, 2022, the EU Parliament approved the text of the EU regulation on information accompanying transfers of funds and certain crypto-assets.

The authors felt that the previous European Commission package of proposals to improve the Union’s AML/CFT rules could use further strengthening to reflect the specific characteristics of crypto-assets better. In attempts to improve the Transfer of Funds Regulation to help protect EU citizens from crime and terrorism, this draft puts forth the following key proposals:

1. Removing exemptions based on the value of the transfer. 
2. Applying Travel Rule to transfers from/to un-hosted wallets, when involving a VASP or other obliged entity 
3. Know your transaction - VASPs should also be expected to obtain information on the source and destination of crypto-assets involved in a transfer.
4. Counterparty due diligence and protection of personal information - VASPs should assess the Counterparty VASP’s data protection policies and decide whether to send their customer’s PII (pre-transaction.) 
5. The European Banking Authority (EBA) to maintain a public register of non-compliant crypto-asset service providers.
6. Decoupling this current recast proposal from the AML package and linking it to the existing Anti-money laundering directive (AMLD) framework to speed adoption. 

The approved text will still be subject to negotiations between the EU Parliament, Council and European Commission, which may prompt changes to the proposed wording.

We’ve summarized our key highlights below.

1. Transmission of Travel Rule information is required for all blockchain transactions, regardless of the amount.

A limited scope of data can be transmitted if the transaction is below EUR 1000 and the transacting VASPs are within the European Union.

‍

Pg 53. 

  Article 14.

‍

Notabene’s comment: The decision to not differentiate the requirements applicable to transactions below and above EUR 1,000 facilitates the operationalization of the Travel Rule for VASPs. Monitoring whether the threshold is being circumvented by breaking down one transaction into several can be a cumbersome task that is avoided with the introduction of this provision. However, an approach that requires a broader scope of information to be transmitted above EUR 1,000 and a limited scope below that threshold may strike a better balance between AML/CTF objectives and data protection goals. Additionally, VASPs may consider it more cumbersome to carry out Travel Rule obligations under EUR 1000, given perceived resource intensity.

2. Travel Rule information does not need to be shared if the Originator VASP considers the Counterparty VASP not to apply suitable data protection measures.

An exception applies if, according to the assessment of the Originator VASP considering the criteria proposed by the EBA, the Counterparty VASP is deemed not to apply suitable data protection measures. The Travel Rule information does not need to be shared in these cases. However, VASPs shall apply alternative risk mitigation measures according to guidance issued by the EBA.

Article 14.4a

Article 14.4b

Notabene’s comment: This brings forth and centers data protection guidelines into the Travel Rule. Some questions remain around the appropriate alternative measures to be taken by a VASP and whether they should allow transactions of funds with said Counterparty VASP, but these could be clarified through the EBA guidelines mandated under Article 14.4b, which is a new instrument that we welcome!

3. VASPs must screen the Originator and Beneficiary customers against relevant sanction lists before allowing the transaction to go through.

‍

Article 14/5a

Article 16/2a

Article 14/6a 

‍

Notabene’s comment: Travel Rule is an excellent way for crypto companies to identify and potentially block transactions to sanctioned parties. However, a high rate of false positives is expected when screening counterparties of a transaction. In this context, we welcome the acknowledgment in Article 14/6a that VASPs can rely on their counterparties for this process. By delegating sanction screening to the VASP that has a better resolution on the identity of the end customer at issue, this process becomes more effective, and false positives can be settled with more confidence. 

4. When conducting transactions with unhosted wallets, VASPs are required to verify the identity of the respective beneficial owner.

Article 14/5b

‍

Notabene comment: If the proposed provision is adopted as is, at least in the short/medium term, we foresee that this requirement will push VASPs to only allow first-party transfers to or from unhosted wallets (i.e., transfers to and from the wallets of their own customers). This is already the trend in jurisdictions like Singapore. With this, the third-party identity verification requirement is easily circumvented: the customer can transfer funds to their own wallet and subsequently to the third-party wallet. This will create a blindspot that backfires on the regulatory goals: the VASP will have less visibility on the transactions between their customers and unhosted wallets controlled by third parties. 

5. VASPs are obliged to report incoming transactions from unhosted wallets above EUR 1000 to competent authorities.

Amendment 1

Notabene’s comment: This obligation assumes transactions with unhosted wallets inherently carry more risks. We believe that end-user privacy should be considered, especially as this threshold is inconsistent with reporting guidelines above 10K EUR. Additionally, this requirement would flood competent authorities with notifications of transactions that are mostly legitimate, making it difficult to leverage the cooperation with authorities for actually detecting and preventing illicit activity. An approach that requires VASP to make their own risk assessment and resort to competent authorities when suspicious activity is detected makes for a more efficient system and is more in line with data privacy protection goals. 

Interested in learning how this proposed regulation impacts your Travel Rule obligations in your jurisdiction? Book a demo with our sales team.