The “Serious Series” is an initiative started by Zano’s Community Manager Gigabyted, whereby community members, privacy advocates, crypto enthusiasts, traders, devs and industry insiders gather in the Zano Discord server for an in-depth discussion of a particular hot topic in the world of privacy-preserving digital currencies (for brevity’s sake, hereby referred to as “privacy coins”).
“I want to kinda break the perception that people cant contribute to a project without being developers… plus we will all learn from others”. — Gigabyted
It’s an opportunity to chat, share ideas, vent, and explore a subject with like-minded people. A mutual-learning experience with the dual purpose of helping the Zano team stay up to date as it strives to position itself at the vanguard of the industry.
Serious Series Disclaimer
N.B. Zano Auditable Wallets were a very new feature at the time of the discussion. What was variously referred to as an “audit key” or “tracking key” is officially named a “tracking seed” in the Zano documentation and protocol.
The Topic: Regulators vs Privacy-preserving Digital Currencies
The topic for the first Serious Series discussion was inspired by the recent news that the “United States Internal Revenue Service has announced a bounty of up to $625,000 to anyone who can crack Monero’s privacy”.
Former Monero lead maintainer Riccardo ‘Fluffy Pony’ Spagni seemed unfazed, claiming “cryptographers and researchers are always going to be one step ahead on privacy.” Zano project lead, and original CryptoNote developer, Andrey Sabelnikov agrees:
“I would say at this moment cryptographers are ahead and far away from regulators, since there is nothing [that] can be done with ring signature to my knowledge, they simply can’t deanonymise it, and even if they ban it from classic centralized exchanges, there are still wrapped tokens and a growing DEX infrastructure, which will provide liquidity one way or another.” — crypto_zoidberg
AML, KYC, FML
But offering rewards for breaking their untraceability, or banning them entirely, aren’t the only ways for agencies and regulators to bring “privacy coins” to heel. A raft of new Anti-Money Laundering (AML) regulations have appeared in recent years.
Most relevant to cryptocurrency exchange owners is what’s become known as the “Funds Travel Rule”. The rule, issued by the US Treasury Department’s Financial Crimes Enforcement Network (FinCEN), actually went into effect in May of 1996, but it was the guidance issued in May 2019 that made clear the Travel Rule would subsequently apply to businesses “Involving Convertible Virtual Currencies” (i.e. exchanges and custodial services).
ExchangeOwner#1 (who asked not to be named in the article) explained the requirements:
“So when you move any crypto out of an exchange, to another exchange, the transaction is sent and your information is meant to be sent as well, i.e. who you are, where the crypto is coming from (exchange / address) and where it is going to. Also your KYC status / info etc can make up part of that information as well.”
Exchanges under EU jurisdiction have another set of regulations to contend with. The fifth iteration of the EU’s anti-money laundering directive (5AMLD) went into force in January this year, with its extended scope now covering certain crypto-asset businesses. Notably, for now, and as distinct from the “Funds Travel Rule”, it only applies to businesses offering crypto-to-fiat conversions.
“To combat the risks related to the anonymity, national Financial Intelligence Units (FIUs) should be able to obtain information allowing them to associate virtual currency addresses to the identity of the owner of virtual currency.” — EU Directive 2018/843
Obviously, questions arise with regard to privacy coins. If one of the goals of the reworked directive is to allow for addresses to be associated with owners’ identities, will regulators be satisfied with exchange reports showing withdrawals to CryptoNote addresses? Given the stealth address technology and ring signatures that make tracing the coins beyond that point all but impossible, it seems unlikely.
The Perkins Coie Report
In an attempt to bring some clarity to these new Anti-Money Laundering regulations, Monero and Tari Labs engaged the services of international law firm Perkins Coie LLP to produce a whitepaper with guidance for exchanges.
Tari Labs was quick to trumpet the core conclusion that “Regulated financial institutions can comply with AML obligations when supporting privacy tokens. Period.” — Tari Blog Post
Still, it’s not all sunshine and fluffy ponies. The report suggests that to ensure future regulatory compliance, exchanges may have to perform enhanced due diligence for transactions with a higher inherent AML risk. So before processing transactions above a certain threshold value, or transactions involving “privacy coins”, exchanges should require supplemental information, such as the name, address and contact information for the recipient and the purpose of the transaction.
It’s a meaningful amount of potentially sensitive information, which makes the positive response to the report from some parts of the community, all the more perplexing. Perhaps some see it as an acceptable trade-off for having the convenience of centralized exchanges as on-ramps, or to maintain the exposure that being listed on centralized exchanges provides. Once those coins are in your own wallet, there’s no tracking them from that point onward anyway, right?
De Good, de Bad and Delisted
Despite the report’s optimistic tone, and the generally enthusiastic community response, it seems many exchange owners aren’t convinced. Since non-compliance could result in a fine, or even the loss of their license, it’s no surprise that so many exchanges are erring on the side of caution. Whether it’s because they fear the consequences of misinterpreting the regulations, or because they don’t believe the cost of the infrastructural changes can be justified, exchanges in various parts of the world have chosen to remove all privacy coins from their platforms. [e.g. 1, 2, 3, 4, 5, 6].
We were lucky enough to have two exchange operators in the chat who shared their direct experiences with regulatory compliance. They provided particularly helpful insights so they’ve been quoted at length.
“From a business perspective, we have to comply with rules and regulations or we face issues. Some issues might be as inconsequential as a fine or as much as prison time.” — ExchangeOwner#1
He went on to explain what having to follow essentially the “same rules” as banks entails:
“So when you move any crypto out of an exchange, to another exchange, the transaction is sent and your information is meant to be sent as well, i.e. who you are, where the crypto is coming from (exchange / address) and where it is going to. Also your KYC status / info etc can make up part of that information as well. … The problem is, for exchanges to follow those same rules is hard.” — ExchangeOwner#1
Eric Cook of qTrade, at the time “deep into renovating [their] compliance program”, stated that KYC alone “is a challenge”.
“Nobody wants to provide documents & selfies, its a chore. More than that, people prefer to be anonymous on the internet on principle, or to avoid interference from corrupt governments, or any number of other reasons OTOH, some of those reasons are money laundering, terrorist financing, and other illegal activity. Our own personal ethics require us to take steps to not support these activities, and we also don’t want to get shut down by the government. . . . privacy coins . . . may become more of an issue with the ‘travel rule’, as [ExchangeOwner#1] discussed above. There currently is no system for crypto that’d allow complying with that rule — so suffice it to say there are a lot of challenges and long way to go before it is actually used/enforced. The bigger exchanges are working on it, but haven’t yet agreed on a system” — Eric Cook (qTrade.io)
So it could be as simple as that. Exchanges are delisting privacy coins because, even if they wanted to support them, they don’t know how compliance can even be achieved. Eric went on to explain more about the unworkability of the new requirements:
“One of the main points I discussed with a service provider was that we’re “meant” to know where funds are going. Exchange to exchange is easy, since addresses can easily be registered within the systems, but if you are moving funds to a non-custodial wallet, i.e. your own wallet that you control, or a friend etc, then WE are meant to get info from you to confirm who the transaction is going to, which means a user “should” sign some kind of message to verify ownership… How stupid is that?!
I asked, so, what if I want to pay someone in a shop, or online for goods, and pay directly from my wallet on exchange. Am I meant to ask the shop to sign a message? Thats never going to happen… So the system breaks down, its stupid, and I doubt many exchanges will make their users do that kind of thing.” — Eric Cook (qTrade.io)
So, to summarize:
- Exchanges need a reliable way to determine the recipient of “high-risk” transactions (which must also tell them if its another Financial Institution).
- Exchanges need to put in place a (preferably standardized) system that shares in a timely manner the necessary information when a transaction recipient is another Financial Institution.
All this is all the more problematic for privacy coins, which to varying degrees limit the information that can be obtained through on-chain analysis. And it seems unlikely that customers will be any more eager to cooperate than they have been with helping meet KYC requirements. You can see how exchanges (especially smaller ones) have their work cut out for them.
Zano’s Auditable Wallets — Can They Help?
So where does Zano fit into this BRAVE New World? As far as compliance goes, Zano may actually present exchanges with less of a challenge than many other cryptocurrencies, thanks in part to how its address scheme works, and thanks in part to a new feature: Auditable Wallets.
The Travel Rule mentioned above, at the very least would require Financial Institutions (FI) to maintain records of transactions involving other FIs. So before anything else, they need a way to reliably detect such transactions.
Detecting Inter-exchange Transactions (Funds Travel Rule)
Obviously exchanges can’t put their licenses on the line by assuming their clients will always faithfully report whenever a withdrawal is going to another exchange, so what can they do? In this case, Zano may actually be much simpler to deal with than most other (including CryptoNote) currencies.
Let me explain why. The obvious way in which exchanges could detect inter-exchange transactions is for them to maintain a single, shared database containing all addresses they generate for their customers. In the case of Bitcoin, every customer is normally provided with one or more unique addresses, which would require a shared database with a potentially enormous number of addresses being updated and accessed constantly. With Zano, on the other hand, exchanges tend to use one wallet with a single public address. Each customer, rather than having a unique address (as with Bitcoin et al.), are allocated a payment ID that is bundled and encoded with the public address into an Integrated Address. So the same public address is used for all deposits.
Why is this important? Well, in the case of a shared database of exchange-owned addresses, for Zano, exchanges would only have to share the single public address from which each customer’s Integrated Address would later be derived. A far smaller amount of data requiring far, far less frequent updates. An Integrated Address is easily decomposed into its constituent public address and payment ID using the split_integrated_address JSON RPC call. So if the returned public address belongs to another exchange (i.e. is in the shared database), in accordance with the regulations some information must be forwarded.
Record Keeping and Reporting
Most CryptoNote currencies can be described as “private, optionally transparent”, in that a “View Key” can be shared which makes visible all incoming transactions to the corresponding address. Outgoing transactions, however, cannot be reliably viewed.
This is one area in which Zano’s Auditable Wallets might be of help to exchanges. An Auditable Wallet is made visible by sharing a “Tracking Seed”, which allows a third party to see all incoming and outgoing transactions to/from the wallet. So a Tracking Seed could be shared with the relevant regulatory agency to allow them to independently verify the authenticity of any Zano transactions reported.
Lower AML Risk
Many exchanges list Zcash while only utilizing their (transparent) t-addresses. T-addresses are as transparent as Bitcoin addresses, and so presumably are considered lower risk, meaning enhanced AML measures aren’t required.
Something similar can be achieved using Zano Auditable Wallets. All Auditable Wallet addresses have a unique prefix (“aZx”), so exchanges can easily insist that only auditable wallet addresses be used for withdrawals. They could even oblige users to submit the corresponding tracking seed (which makes visible all incoming and outgoing transactions). Then, if required to by law, they could share it with the relevant regulatory agency. This may seem somewhat extreme from an exchange user’s perspective, but it’s actually no more information than Bitcoin traders are sharing on the average KYC-enabled exchange.
To protect their data from that point onwards, users could maintain an Auditable Wallet specifically as an exchange interface (the Zano GUI supports multi-wallet management anyway). They’d only have to pay the minimal transaction fee to later move the coins to an ordinary wallet and begin using their Zano with the comprehensive level of privacy we’ve all come to expect.
If the legal departments are satisfied that Bitcoin et al., Zcash using t-addresses and wrapped versions of privacy coins are not of sufficient risk to justify removing them from their platforms, then it stands to reason that the above-mentioned scheme using Zano Auditable Wallets, which gives exchanges access to the same amount of information, should be considered equally acceptable.
So as you can see, Zano (and in particular Auditable Wallets) present solutions to some of the challenges facing centralized exchanges that want to support privacy coins while maintaining regulatory compliance. But only if the regulations are enforced in a sane manner — in a manner appropriate to the technologies they’re being applied to. If, as assumed by qTrade’s Eric above, exchanges must also somehow prove that withdrawals did NOT go to another financial institution, things become a whole lot trickier. In fact, for the vast majority of cryptocurrencies, meeting such a requirement simply isn’t possible.
From my cold, dead hands
Many chat participants expressed outright disdain for the new regulations.
As a crypto enthusiast and user, I hate these rules. It makes me laugh really, with regards to banking, because there is so much corruption in banking, so much money laundering, terrorist financing, drug money being rinsed by HSBC etc… double standards and completely ridiculous! — ExchangeOwner#1
Another member mentioned seeing the regulations as part of a growing and inescapable trend of comprehensive data-gathering, as exemplified by Digital ID schemes such as id2020:
“. . . it will basically take all your users accounts ID resume, job bank, work sites, preference and log pw for all sites hash n send in a [bitcoin transaction].” — Voon
So if privacy coins such as Zano can help exchanges comply… a little protocol tweak here, a little compromise there, should they? Should they be complicit in the great data-grab if it helps bag them a few more elusive exchange listings?
These new regulations, aside from being unclear and potentially unworkable, go against what might be considered the original spirit of crypto and demand a level of information gathering that is completely antithetical to the purpose of privacy-protecting currencies. But there’s a non-ideological, simpler, and perhaps more compelling argument for opposing them.
We’ve seen the trouble that centralized exchanges have had in guarding their funds in the past… what’s to say they’ll do any better with their client data? Let’s be clear, they’ll have your name, address, probably a photo ID and a whole lot of info on how much crypto you potentially hold. And they’ll hold that data for up to 5 years. It’s a treasure trove for would-be scammers (or any thug with a $5 wrench).
Case in point — users whose details were in the recent LEDGER database leak are already receiving phishing phone calls and one customer was allegedly threatened with home invasion. With the need for exchanges to pass KYC details for every exchange-to-exchange transaction, the number of potential points of vulnerability or failure will only increase.
So where can users trade these coins without such unnecessary risks? Several users, including one of our centralized exchange owners, suggested that the answer is Decentralized Exchanges (DEXs) — exchanges that allow trades between users without third party involvement.
I wonder if it might be a good idea for developers to look at ways to allow users to interact with decentralsied [sic] markets… avoid all of the regulation! — qTrade Eric
With the rate at which the delistings keep coming, DEX’s may soon be the only option that truly private currencies have left.
Conclusion
Throwing money at the problem it isn’t going to change the inviolability of the cryptography and mathematics underpinning ring signatures and stealth address technology. And when either Zano or Monero (or both) release their log-size ring-signature schemes, such efforts will only be all the more futile. As the Riccardo rightly said “cryptographers and researchers are always going to be one step ahead on privacy.”
Nevertheless, whether by offering rewards for compromising the protocols or by demanding comprehensive data gathering from exchanges, the SEC and the like are clearly determined to lift the veil. If you’re transacting with privacy coins, then they want to know (all) about it. Hence the new regulations. But the fact that a law firm had to be hired to interpret them, and the fact that the resulting paper spans 41 pages, speaks to their overall lack of clarity. What is clear is that they seem to be demanding levels of insight that it will be extremely difficult for crypto-asset businesses to provide. Perhaps, to this day they, they don’t fully understand what they’re dealing with and are trying to push banking regulations onto an industry where they just don’t fit. Or maybe, as our anonymous exchange operator suggested, it’s all just an attempt to hobble a growing sector they see as a threat:
The regulators are doing all this in the guise of “anti-terrorism” and “anti money-laundering” but I think its just an attempt to make crypto harder to use… —ExchangeOwner#1
In any case, it’s little wonder that exchange owners, rather than try to decipher the jumble of legalese (or rely on someone else’s interpretation of it), are choosing to play it safe. When even accidental non-compliance could lose them their licenses, what choice do they really have?
There’s always been something of an ideological split at the heart of our movement. A tension between the often opposing forces of the desire to profit and the desire to empower. It seems with every step towards mainstream acceptance we relinquish something more. True “privacy coins”, digital cash systems, those curious currencies that still put stock in the old-fashioned notion of fungibility, are being pushed underground.
The Net treats censorship as a defect and routes around it.
- John Gilmore
Projects such as ours aim to build the tools to power a decentralized economy that protects participants’ financial data (and consequently, their personal safety). As such, we treat coercive attempts to strip people of their financial privacy as a defect, and will route around it.
With both Zano and Monero racing to deploy Atomic Swaps, it’s only a matter of time before said coins are integrated with DEXs and users can freely exchange them without having to give up wads of sensitive personal information. The answer to the over-regulation of centralized exchanges, is to take them out of the equation.
A big thank you to everyone who took part in the discussion, especially our exchange operators whose first-hand insights were particularly illuminating, and apologies for the delay in the completion and publication of the summary (this festive season was especially festive ??????).
The subject of our next privacy powwow is yet to be decided (probably something related to DeFi and wrapped tokens). Check the Zano Discord server for confirmation of the subject, date and time. Hope to see you all there!
Join the Zano Discord server: https://discordapp.com/invite/wE3rmYY
And if you’re an exchange owner who wants to discuss integrating Zano Auditable Wallets into your service — send us an email ([email protected]).
