By Seth Hertlein, VP Global Head of Policy at Ledger

Find our full report here.

The Transfer of Funds Regulation (TFR) is Europe’s implementation of the Financial Action Task Force’s (FATF) so-called “Travel Rule.” According to lawmakers, the TFR legislation seeks to address the risk of money laundering through digital assets. 

However, as our policy paper explains, it would do little to address actual risk, and could potentially drive millions of law-abiding citizens from engaging in safer, more secure financial transactions, which is a hallmark of the crypto industry.

Under TFR, cryptocurrency exchanges would be required to collect unprecedented amounts of private information about any party to a transaction with an exchange – customers and non-customers alike – which would ultimately be nearly every EU citizen using cryptocurrency or digital assets. Even for small transactions between friends, neighbors, family members, or small businesses, exchanges would be required to collect and verify names, addresses, passport information and more, from every individual participating.

For Pascal Gauthier, founder and CEO of Ledger, “The reality is that the draft TFR legislation won’t protect individuals at all – it will simply burden every EU citizen and small business, and drag Europe even farther behind competing economies who have chosen to engage in crypto regulation in a much more sensible way. The alternative policy proposal we released today seeks to address Parliament and regulatory concerns about AML and sanctions, but also allows EU citizens and companies to continue to participate in a thriving, growing global economic market.”

Our policy paper entitled “How Can Europe Lead Innovation and Win Web3? Ledger’s 4 Recommendations for EU Policymakers” brings together key arguments highlighting why the EU’s Transfer of Funds Regulation (TFR) is unjustified. Among them:

1- Money laundering is a problem, but it’s not a crypto problem.

Money laundering is a legitimate problem. Money laundering through cryptocurrencies, however, is a tiny fraction of the illicit volume moved through the financial system. According to data from a recent study by Chainalysis, the amount of money laundered through cryptocurrencies amounts to just 0.009% of global GDP, while the United Nations Office on Drugs and Crime estimates that 2% to 5% of global GDP is laundered through the traditional financial system in fiat currencies.

2- Blockchain provides a highly effective crime fighting tool. A tool Europe is about to give up.

Money launderers vastly prefer using banks and government-issued money than blockchain networks and cryptocurrencies. It is not hard to understand why: blockchain networks create an immutable public record of transactions which is imminently traceable. By utilizing the transparency of blockchain, law enforcement agencies have racked up impressive wins against cybercriminals such as the recent takedown of the Hydra darknet market and the disruption and recovery of the Colonial Pipeline ransomware attack.

3- Blockchain is a poor tool for sanctions evasion, and the Russians know it.

At least some of the impetus for the TFR’s unprecedentedly rushed legislative process was generalized fears that Russia would turn to crypto to evade sanctions imposed by the West in response to its invasion of Ukraine, as opposed to actual AML/CFT considerations. Despite the unsubstantiated allegations by some senior EU officials, such baseless fears simply have not materialized, a fact repeated consistently by the U.S. government and even the IMF.

4- Privacy is a fundamental right in Europe. The TFR violates it. 

Privacy in the EU is a fundamental right enshrined in numerous founding documents of the Union, including the EU Charter of Fundamental Rights. A recent ruling from the European Court of Justice struck down a very similar mass surveillance and bulk data collection directive for the telecommunications industry on privacy grounds. We see little to differentiate the TFR from the precedent in that case.

5- The TFR would violate Europeans’ right to privacy in new and dangerous ways.

We are concerned about the TFR’s increase in government-mandated collection of data about law-abiding Europeans and the attendant increase in risk to which it would expose them. The TFR would require a dramatic increase in the collection and reporting of sensitive financial information, including personally identifiable information (PII), of parties and counterparties to transactions, to various AML authorities. We believe most Europeans would view the government’s ability to track every financial transaction they make in real time without appropriate legal process as a shocking invasion of privacy.

6- The TFR would put Europeans at great risk of cybercrime and physical harm.

The TFR-mandated collection and retention of PII coupled with blockchain information will create giant troves of valuable data across both government agencies and CASPs. Inevitably, this will increase both the frequency and severity of hacks, data breaches, and leaks. Once a criminal who knows someone’s blockchain address and their home address, they could see exactly how much crypto someone owns and choose either to attack them virtually, through hacking, phishing or other online frauds, or physically, by means of robbery, kidnapping, and extortion.

7- MiCA and the TFR would irreparably cede leadership of Web3 economies to the US, UK and Asia, and make Europe permanently uncompetitive.

In terms of global economic competitiveness, Europe is in a precarious position. The United States and China account for 76 of the world’s 100 most valuable firms. In 2000, Europe had 41 of the top 100 companies, down to just 15 today. None of the 20 largest tech companies are European. As global competitors invest in innovation, the EU rushes to regulate. This has happened before in other industries, and the result in Web3 will be no different. The U.S. and Asia will continue to dominate. For example, over 99.7% of stablecoins currently in circulation are denominated in U.S. dollars, and less than 0.3% in euros. MiCA will virtually ensure the U.S. retains its lead.

The Web3 ideals of freedom, privacy, and self-determination are the same democratic values that underpin all European society. The TFR, on the other hand, is a step toward the Chinese model of surveillance, censorship, and technology-enabled population control. 

The four recommendations that follow are the immediate first steps the government should take to seize the Web3 opportunity before it is irretrievably lost: 

A prime example is the so-called “Travel Rule” reporting threshold. FATF recommends that inter-VASP (Virtual Asset Service Provider) transfers of more than €1,000 be accompanied by identifying information of the sender and recipient. Many prominent countries, however, set their Travel Rule threshold well above FATF’s recommendation, including the U.S. ($3,000), Hong Kong ($8,000), and Canada ($10,000), while the TFR would set Europe’s threshold at zero. This divergence gives North American VASPs a competitive advantage and would put EU VASPs at a competitive disadvantage.

The TFR expansion should be completely reimagined and redesigned to harness the inherent transparency of blockchain technology and realize the full benefits of blockchain analytics. Instead of burying EU law enforcement agencies under mountains of useless TFR transaction reports, law enforcement should be equipped with and receive training on blockchain analytics tools, enabling them to conduct investigations in real time using publicly-available blockchain data. 

MiCA is not as problematic as the TFR on privacy grounds, but it may be worse for Europe’s overall competitiveness. It is well known that MiCA was Europe’s response to the threat of Libra, the 2019 stablecoin project from Facebook. While the Libra project is now defunct, MiCA has mutated far beyond its original intent. To preserve Europe’s competitiveness, MiCA should be reconceived with a primary focus on enhancing Europe’s Web3 competitiveness. MiCA should focus on the centralized parts of the Web3 ecosystem and should be developed in partnership with technical experts to ensure the regulation achieves its intended purpose while minimizing unintended consequences.

The current system of centralized identification credentialing and processing is prone to exploits and vulnerabilities. Large honeypots of valuable information held within single-point-of-failure architectures makes for easy pickings for cybercriminals. The frequency of data breaches, identity theft, and misuse of personal data is what prompted the EU to pursue individual sovereignty measures like the GDPR in the first place. Rather than concentrating data and power in ineffective government AML authorities, the EU should instead seek to empower individuals. Self-sovereign identity is the concept that individuals should hold their own digital credentials the same way they hold their physical credentials – in their own wallet. Europe should embrace this technology and invest in its development as it has the potential to enhance financial freedom while impeding financial crime.

We appeal to policymakers to not give in to fear or seek comfort in ever greater government controls, but instead to trust in the goodness of citizens and to empower them to make their own decisions. Regulation is often the easiest answer, even if it makes things worse, but the rewards of a truly free and open society are manifold and too great to ignore. Ledger stands for freedom.

186 +