Paying By The Rules: Cryptoassets, The CARF And The 'Travel Rule'

In light of global conflicts and the financial crime risks associated with cryptoassets, governments around the world are looking for ways to monitor, track and record crypto transactions to minimise the risk of money laundering and fraud.

Two of the most prominent phrases ringing in the ears of finance professionals and traders in recent months have been the Crypto-Asset Reporting Framework (CARF) and the FATF 'Travel Rule.' The process of implementing these schemes into domestic legislation has now begun; a clear understanding of the compliance requirements demanded by both will soon be vital to Virtual Asset Service Providers (VASPs) including exchanges and custodians, founders, token issuers, trust and corporate service providers, and their legal advisers.

The CARF

The OECD have promoted international regulations in recent years to combat tax evasion, with their flagship initiative, the Common Reporting Standard (CRS) requiring financial institutions to collect data on their customers so that it can be reported to their local tax authority (which will exchange such data with the tax authority where the account holder is relevant). Almost every major economy (except for the United States) has signed up to the CRS.

The OECD are looking to extend the CRS to cryptoassets. But more importantly, they have separately introduced a new regime under the CARF which applies to Reporting Crypto-Asset Service Providers (RCASPs). The OECD published a consultation on the CARF in the Spring of 2022, before publishing the framework in October 2022.

In short, RCASPs are any service providers that provide a service effectuating exchange transactions on behalf of customers. The definition of RCASP would certainly include exchanges, brokers, ATMs and many types of token issuers, but notably not custodians. Individuals or entities who make available a decentralised ‘trading platform’ (such as a decentralised exchange or lending platform) could also be an RCASP, if such a platform enables customers to effectuate exchange transactions. Specialist advice is recommended on this subject.

As an RCASP, a company would have certain due diligence and reporting obligations, particularly for individuals who are resident in a foreign jurisdiction which has itself implemented the CARF. Reportable individuals (known as 'Reportable Users') will need to provide to a RCASP the following information:

1. Name;
2. Address;
3. Jurisdiction(s) of residence (self-certified);
4. Tax ID number(s); and
5. Date and place of birth.

RCASPs are also required to report details of the transaction effected, including:

1. The type of asset and its full name;
2. The aggregate gross amounts received and paid including the number of units of the relevant cryptoasset (converted to fiat currency values); and
3. The aggregate fair market value, including the aggregate number of units of the relevant cryptoasset, in respect of acquisitions and disposals (converted to fiat currency values); and
4. The aggregate fair market value, including the aggregate number of units of the relevant cryptoasset, in respect of ‘reportable retail payment transactions’ (bringing into scope a scenario whereby a merchant accepts cryptoassets as payment over a de minimis threshold).

In the original consultation it appeared that wallet addresses would also be disclosable, but in the final framework that wallet address disclosure is not required.

The FATF 'Travel Rule'

Since its conception in 1989, the FATF has worked to develop policies with an aim to combat money laundering and terrorist financing (ML/TF) at an international level. In 2012, its official list of Recommendations was codified, and these are now adhered to in legislative form by its 39 members.

Recommendation 16 (the 'Travel Rule') provides guidance on protection against weapons of mass destruction, corruption and wire transfers. In June 2019, the FATF updated R16 to incorporate new rules surrounding virtual assets, offering recommendations on how its members should seek to regulate businesses and entities connected to cryptoassets, as well as placing AML obligations on VASPs. This guidance has been further updated on two separate occasions in March and October 2021.

There is some awareness by the HM Treasury in the UK that implementation of these regulations will not be easy, and that existing AML obligations would not necessarily transfer seamlessly to cryptoassets by virtue of their nuances as compared to fiat currency. Instead, the adoption of the Recommendations in this area are guided by a general principle that the 'application of the travel rule should be consistent across the financial services industry, regardless of the technology being used to facilitate transfers' (Amendments to the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 Statutory Instrument 2022).

Whilst the background to the Travel Rule provides some context to its seemingly onerous obligations, VASPs primarily need to be aware of their new reporting and AML obligations, which are as follows:

• The Travel Rule provides that whenever cryptoassets valued over a certain threshold (typically US$/EUR 1,000) are sent between two parties, two things must happen:
  • The VASP of the sender must communicate certain transactional and personal information relating to the sender to the VASP of the buyer; and
  • The buyer VASP must reciprocate by sending certain transactional information and personal details of the buyer to the VASP of the sender.

• The Travel Rule applies to VASPs for transactions involving:
  • A traditional wire transfer;
  • Transfers between regulated entities (i.e. two VASPs or a VASP and a bank); and/or
  • Transfers between a VASP and unregulated entities (i.e. an 'unhosted' wallet).

• A VASP would need to provide the following:
  • The name of the originator;
  • The originator account number where such an account is used to process the transaction (for a virtual asset the FATF suggests that this might mean the wallet address);
  • The originator’s address or national identity number, or customer identification number, or date and place of birth (the address which has been verified for accuracy by the originator as part of its KYC process);
  • The name of the beneficiary, being the person identified by the originator as receiving the transfer; and
  • The beneficiary account number where such an account is used to process the transaction (i.e., a wallet address).

• For transfers under the threshold, the FATF suggests that VASPs should still collect:
  • The name of the originator and the beneficiary; and
  • The virtual asset wallet address for each of them or a 'unique transaction reference number.'

The FATF have sought to challenge head-on the conceptual and practical difficulties presented by decentralised exchanges and other iterations of decentralised finance (DeFi). Even though decentralised exchanges may lack any form of legal structure, the FATF states that creators, owners and operators of decentralised platforms may nonetheless fall within the VASP definition where providing or actively facilitating VASP services (even where other parties are also involved, or the process is partially automated through smart contracts). We have witnessed in practice that decentralised exchanges often desire to be treated as VASPs in any event (for reputational, banking and other reasons).

Conclusion

It is widely agreed that increased regulation of cryptoassets is vital for the continued advancement of the industry, especially after the failures in both DeFi and CeFi in 2022. As adoption of cryptoassets continues to grow (especially amongst institutional investors), so do the rules and restrictions that surround them. Whilst these might seem restrictive for businesses (particularly those without an established customer base), they are designed with the intention of promoting fair, legal and healthy business and as a way of bringing virtual assets in line with existing methods of trade. In truth, any VASP who has already conducted their AML/KYC checks (as they should be doing) should not encounter material difficulties in implementing these new initiatives, but the nuances of cryptoassets and technological challenges will make this process painful for some VASPs.

James Brockhurst
James is a Partner with the firm, specialising in trusts, estate planning, UK tax and cryptoassets.

Oliver James
Trainee Solicitor