The Crypto Travel Rule in Bitso

Regulators worldwide have interpreted and applied the recommendations of the FATF for the Travel Rule differently:

• Distinct enforcement dates.
• Varying Travel Rule thresholds.
• Contrasting requirements for the originator and beneficiary information.
• Diverse approaches to dealing with transactions to unhosted or non-custodial wallets.

Bitso asks you to comply with the Travel Rule (TR) when sending to or receiving from non-Bitso accounts digital assets in amounts greater than or equal to 1,000 euros (or equivalent in cryptocurrency), and the Rule takes effect on September 28, 2022.

Sending Digital Assets

When sending virtual assets out of your Bitso account, you need to provide details about both the beneficiary and the VASP receiving the assets and undergo additional checks. Bitso shares your and the beneficiary’s information with the VASP receiving the assets. You need to agree in Terms and Conditions to the disclosure of your information with beneficiary VASPs.

For a beneficiary stored in Bitso’s system, you only need to provide the TR information once. The next time you send assets to this created beneficiary, Bitso identifies that you have previously provided information about that beneficiary and omits the Travel Rule flow.

Receiving Digital Assets

When receiving assets, the information exchange occurs similarly; the VASP sending the assets shares with Bitso the originator’s information and yours as beneficiary.

When receiving a deposit above 1,000 euros from a non-custodial wallet, Compliance will request from you:

• The originator's name
• One of the following
• Address
• National ID
• Customer ID
• Date and place of birth

What Sending and Receiving VASP Need to Do

Figure 1 depicts the different parties and operations involved in a transaction that needs to comply with the Travel Rule. The core transfer is between the Originating Customer (User A) and the Beneficiary Customer (User B), who can be the same person.

Before the network performs the underlying settlement transaction on the blockchain, the VASP responsible for sending the crypto is required to transmit defined customer and transaction data to the VASP receiving the crypto, who decides whether or not it accepts the transaction before it is sent.

Then, Bitso executes the transaction when the receiving VASP sends a confirmation about the assets' movement. This confirmation might take up to 24 hours. However, if the VASP receiving the assets does not confirm within this period and the VASP has a low- or medium-risk rating, then Bitso broadcasts the transaction to the blockchain. Whereas, in the case of a high-risk rated VASP, the transaction does not go. VASP rating is very dynamic.

The Rule requires Bitso to introduce additional checks around these transactions, which means the withdrawal takes some time to complete. The best case scenario can be a process that lasts 10 minutes, but the worst case scenario is a transaction that might take up to 24 hours to complete.

Knowing where customers send crypto to and receive crypto from ensures proper customer identification and enables Bitso to apply more robust KYC policies and practices, which leads to higher customer confidence and promotes trust in the crypto industry. A safer crypto ecosystem safeguards users against malicious addresses and protects their funds.

Information Needed

The former explanations show that a core aspect of TR compliance is the mandatory collection, verification, transmission, and storage of information about the originator and the beneficiary of the transaction.

The information that the sending VASP needs to obtain and transmit to the receiving VASP in a Travel Rule complaint transaction includes primarily:

• Digital asset to be transferred
• Amount of asset to be transferred
• Originating customer information
• Beneficiary customer information

The following table details the customer information needed:

This interVASP information exchange follows the InterVASP Messaging Standards IVMS 101, a widely-adopted universal message standard for communicating required originator and beneficiary information between VASPs.

BItso works alongside a third-party provider to meet its Travel Rule obligations. This third-party has developed an open-source Crypto Travel Rule compliance solution, a privacy-preserving platform that meets the highest data privacy and security standards. This platform aids VASPs in interacting with one another securely and complying with the General Data Protection Regulation (GDPR). This partnership helps Bitso to provide you with a smooth experience in which data is stored securely and things run seamlessly in the background.