red 
Many UK crypto firms have struggled with the operational challenges of implementing the Travel Rules obligations since they became mandatory in September 2023.
To support this, the CryptoUK Travel Policy Good Practice Guide (TRGPG) on operational implementation and challenges has been published today.
Elliptic and Notabene chaired the CryptoUK Travel Rules Working Group. We were involved in all the steps leading up to the legislation and guidance, and felt that further support from good industry practice was needed as firms wanted to comply and learn from each other. The guide provides a detailed overview of how Task Force members are managing compliance amid regulatory disharmony and offers valuable guidance for addressing the associated challenges.
Key features of the Good Practice Guide to Travel Rules
The guide explores:
- VASP counterparty due diligence considerations
- Regulatory obligations and approaches to the operationalization of withdrawal and deposit flows
- Regulatory framework for non-hosted wallets, including associated risks and potential mitigations
For background, the relevant timeframes and background guidance and legislation in the UK were:
- August 17, 2023: The FCA has set out expectations of VASPs in the UK who comply with the Travel Rules
- end of August 2023: JMLSG (The Joint Money Laundering Steering Group) industry guidance published.
- September 1, 2023: The UK Travel Rules Act came into force (note that the EU Travel Rules obligations will come into force on 30 December 2024)
What is the travel rule?
In short, the Travel Rule refers to the sending of principal and beneficiary data between VASPs (Virtual Property Service Providers), i.e. crypto firms, and assessment of control of unhosted wallets based on risk thresholds established in legislation. The purpose of this is to provide law enforcement with the ability to track bad actors while minimizing the risk of a ‘tip’ on that bad actor.
Some of the operational challenges
The Travel Rules Working Group identified a number of challenges and solutions which are outlined in the TRGPG. Some of the challenges:
- Regulatory fragmentation this leads to the sunrise problem. We appreciate that this challenge is not a simple one to solve, but rather a matter for supervisors to take a common sense and pragmatic approach to overseeing the Travel Rules.
- Lack of interoperability of the Travel Rule solution. There are many on the market and although some work towards greater interoperability is progressing, this ultimate goal is still a long way off.
- Lack of Legal Entity Identifier (LEI) and harmonized client identifiers. Addressing this on a global scale would significantly address the challenges facing crypto firms. This is clearly not something that the industry can solve and we would ask bodies like the FATF to step forward and coordinate to provide a standard approach that could be accepted through the future development of FATF Recommendation 16. This is, in essence, a straightforward regulatory ‘fix’ that can address many industry costs and errors, resulting in a more efficient and effective way of achieving some of the objectives of the travel rules.
What does this mean for crypto firms?
Elliptic’s wallet verification, transaction monitoring and VASP due diligence solutions should be considered as part of an overall Travel Rule compliance solution, working in conjunction with a travel rule solution provider. However, it does not offer a “plumbing” for the transfer of data between VASPs, in accordance with the obligations of the Travel Rules.
Our tools will be able to provide information on whether a transaction is likely to be a non-hosted wallet or a centralized exchange. This can be used to verify information from the customer. However, this will not give you information to which legal entity you are transferring (no analytics provider can do this due to the nature of the VASP global wallet infrastructure). Here you will need the Travel Solution Provider to identify the legal entity you are transferring to or receiving from.
It would also be used to assess financial crime risk in the normal way in relation to a transaction, but is more relevant to some Travel Rule obligations when dealing with non-host wallets.
Through integration with our travel partners, you will be able to:
- Identify wallets and verify wallet types (including non-custodial ones), as well as collect missing data to form travel rule transfers (this solution uses integration with our Elliptic Lens API).
- Identify counterparty institutions and perform due diligence on them.
- Send and receive travel rule data with the exchange of the other party regardless of the underlying protocol.
For example, the Notabena solution can be leveraged as part of this engagement. The Notabene solution can be accessed via an API and a friendly user interface (via our dashboards). There is also a front-end component (‘widget’) that can be embedded in the bank’s withdrawal or deposit screens [if applicable]or the bank may choose to use Notabene’s front-end APIs.
If you have any questions regarding TRGPG or any other points related to the Travel Rules, please contact.
Compliance with EMEA regulations
