How To: On-Chain AML Compliance - Noah Jelich | YieldBricks

hello hello uh nice to see you all here uh yeah so recently I've been working uh with a client on an rwa platform just like everyone and I have a few learnings from that that I would like to share uh and I hope they will actually be useful uh so these are the distilled learnings from yield bricks um by the way a little bit about me I'm an ex hacken uh security researcher I got out you know I exited the casino at the right time 120 projects no Miss issues uh I like testing I work with a few languages right now I'm mostly doing fuzz testing and like some obscure research uh I coade wasm COV with BOS from hacken and I'm also like the technical co-founder of field Bricks now uh and by the way I really like good public transport and bikes so Belgrade pretty good honestly pretty good uh now let's start with a short poll uh who here has like a project that needs a with the kyc process in place two three okay okay and who here thinks they may actually sort of need a kyc process okay uh so for some of you that don't have it other than you know comp Appliance reasons there there may be some other stuff that I may mention that could change your mind about that but let's start with an intro to kyc and uh AML stuff so first some acronyms because kyc loves acronyms uh know your customer antimony laundering really crucial one is ubo Ultimate beneficial owner and I guess peps politically exposed persons may be important but not so much you know in the Balkans uh so what is kyc it in short it's a process of uh verifying identities of clients and assessing risks of doing business with them and the goal is to prevent uh one of the major goals is to prevent your company being used for money laundering or illicit activities you know uh and if you look at uh crypto in general you will notice that binance got the fine in 2023 which is an order of magnetude bigger than the sum total of all the rest of the fines in the world for that year for AML so uh we can generally expect expect crypto companies to be like a massive Target for fines so you know just from a Financial Risk perspective it's uh it may be good to have kyc um in general globally and this sort of an average the following Industries will mostly be regulated that means Buon gambling and financial services uh crypto quite often is within like either Financial Services or gambling uh with various derivatives uh but even for non- legislated Industries uh or specific incorporations kyc can be very very useful if you're working in a risky industry or if you're just you know a risk risk averse or you have risk averse suppliers or if you're assessing customers with maybe large credit limits so we're going to be looking at lending and borrowing and you do not want to do that completely anonymously cuz uh yeah it's risky uh it's especially useful for people in crypto actually because uh it can save you a major loss like uh there's a lot of people uh it's a big difference whether you're trying to hire someone and you're hiring me no I a public person you know who I am you could probably find out where I live uh and I have a company incorporated in EU country and working with a completely Anonymous guy Sumer who you've never even seen the face of and uh one of those carries a certain amount of risk so just in general business making sure that you actually know who you're working with can lower your general risk uh because you can find out is this a reputable person with like a normal function and this is something good kyc providers will do for you they will figure out who this person really is they will tell you not just that yes this is John Smith they will tell you this is John Smith and he has these companies and he has this corporate whale to hide the ownership on the in these companies as well Etc they will give you a little bit of extra information if they can um so it can really reduce risk even if you if you're even if you're not just doing it to avoid fines uh but moving to fines what do you really need to be compliant well the basic info let's start from um from the top uh and by the way this not legal advice this is like vague again because local laws are going to be different and going to depend on place of business uh but for a company you're going to collect and verify the name the address of the office or place of business uh for proprietary companies so public companies of course they're public you know the board the director blah blah blah for proprietary ones you're going to need to verify the director um this is key like I mean in Serbia and Croatia Etc in most of Europe you have a public registry of companies and you can figure out who the director of anything is even if they're proprietary but go to Dubai and direct registry is private you cannot really figure out who the owner is it's somewhat Anonymous uh which is tricky uh and you know breaking the corporate veil finding ubos uh someone may have a net of you know fractional ownership to hide that they're really the person that has everything um and then for each of those ubos or directors you need to do the individual process which means name all the past names you know you need to know who they really are uh residental address uh or full address of principal place of business date of birth and then verifying all that collecting registered business information and checking sanction pep and terrorism lists uh so that's like the the Baseline here uh but enough about legal stuff let's move to legal stuff okay uh so yeah the kyc provider has them okay the kyc Prov okay we have to do the kyc with a kyc provider because I assume this list it's not something you're going to be doing manually it's a whole industry of having access to all sorts of information it's a data brokerage uh but talking about uh rwa so you see a lot of blockchain solves all the problems or of rwa and makes everything possible but realistically it's not quite like that the biggest problems of rwa uh or rather of fractionalized investing which is what's mostly being pushed uh is actually the fractionalization part where you have a ton of legal work and then you know blockchain is nothing special it's uh it's a it's a dummy representation of whatever the tricky stuff is how do you make sure that your incorporation and your legal side is actually compliant for money laundering that that it doesn't take risk upon you and that it is safe enough for your users and uh some more learnings from yield bricks so there's three main methods okay one that's been used a lot and hasn't really succeeded that much is spvs so special purpose vehicles in short I want to fractionalize this place so I make a company and the company owns this place and I have shares distributed but due to cost of incorporating that is usually going to be done in sanction list countries uh where it's somewhat cheaper or less regulated to do stuff like that uh and that creates a user safety issue because in case it goes belly up or gets Rock pulled or whatever uh it is very hard to sue someone in Pala okay uh and you need basic kyc for Investments or some sort of ownership scheme but it you're not really trying to be too compliant and Sal is capital gains in general uh so uh if you're doing if something happens you're going to be looking at a capital gains event um the other option uh is a regulated investment fund uh this this gets classified as a security uh which is something that you may want to avoid uh and honestly it's just use less for most investors because you need to be an accredited investor which based on country can be anywhere between you know 50 and 500k minimum investment uh so that's not really the people that want to do fractional investment um it doesn't really have an overlap with the target base but with more interest we get more advanced Solutions and thus we eventually get to the land borrow model uh so the land borrow model uh works like this uh one tricky thing about this is that you need a lot of capital because you need to be able to buy everything it is not Crow crowdfunding you cannot be like hey yeah we want to collect 500k here and then buy something no you need to have 500k buy something and then create a land borrow contract okay uh and the way it works is you are Distributing any yields as interest okay uh for uh property that you own uh kyc responsibility is shifted somewhat because it's not the security and because of some other stuff uh and it's going to vary by country but in general you're still going to want to be kyc compliant uh it has a low Capital barrier because no need to be an accredited investor so you can have like 500k um regarding safety it's much better for users uh because they can sue you they can sue you they can have a class action lawsuit if they want against you if something goes wrong because you can incorporate something like this in a much better country much easier uh so it makes it actually safer for users and does better for you because people will actually be using it um other than that you know uh it is also from the compliance side it allows you like a software AML dispute resolution uh because the land borrow relation is seen differently than like an ownership relation right uh like you know I borrowed 500k from someone is not the same as I sold something it's just slightly different and it minimizes the risk of business collapsing due to excessive AML finds that way um and it's pretty much what we are using at yield bricks uh and now onto the onchain implementation let me just check I I just barely have a timer okay um now for implementing this on crypto again crypto is not the important part here this would work just about fine with the database but it is very useful to save some banking fees and to make it more globally available because you're shifting some of the risk for doing business with you from yourselves to the user until regulation hits right uh so this part is more or less three things we have the ownership structure uh we have the compliance logic which can be around very Advanced and on chain it can also include some security features and then we have the kyc information uh and now you may be thinking okay there's just a gazillion rwa projects or like compliant projects and everyone's talking about kyc for years but this stuff is not really standardized that much uh or rather they are kyc providers with very good selling points but when you look into implementing any of this you're going to fairly quickly realize that uh there's a whole lot of stubs a whole lot of projects that were created and then just died with nobody really using them nobody supporting them that uh uh have some very proprietary specific feature set so let's start with the ownership structure uh we can choose what we want to go with we can go with like you know an on ethereum a few different standards uh nft standard is not great because it's going to incur fairly High transfer costs uh since it's you know mapping to IDs uh ERC 11155 is a bit more efficient but honestly it's not that supported and it doesn't bring massive advantages if you know how to use like a factory pattern uh in that case it's not that great uh so ERC 20 is looking pretty good but you know you're reading about and you're like okay there's this thing called ERC 3643 which is like a compliant token permissive token standard and you take a look at it uh but realistically it has a few problems uh mainly the fact that the company that made that is not terribly active and that it's pretty much just a very very very convoluted proprietary model so it's like uh for developers here it's like Java Factory pattern level of convoluted for no reason uh so they just went too far with that and it's like semiopen Source contracts with pretty much closed Source front end and everything so I'm not sure how it managed to get standardized like this seeing that it's literally just a proprietary product uh so not something we would use so that leaves us with erc20 as the only real option uh and then we have like uh the other parts which is the compliant logic and the kyc part so for compliance um um well uh you want you can do anything you want pretty much uh no standardization but what we went with was a a function that checks if something is transferable and then takes all the information it can get so that information is going to be who is transferring to who which token and how much of it okay and here we can add custom limitations we can say okay you know what we just got an order and nobody from Alaska can trade on our platform anymore we're just going to have to temporarily prevent those transfers and we can do a broad blocking like that uh using the kyc information that we have on chain uh or we can limit transfer amounts to I don't know based on uh General like un unmark transfer rules blah blah blah like stuff like that is available because you can Implement anything you want want at the compliance level um and it gives pretty granular control while minimizing risk to the company uh for kyc info we have uh well one unique thing which is we can have multiple wallets per customer which uh which can be tricky but honestly you just need to duplicate kyc info uh to each wallet and we need multi6 support so uh 1271 right uh is going to be a necessary implementation uh if we're going to be supporting signatures and standards like that uh for KYB right because we're not just going to be working with retail you're also going to try to work with uh businesses and for businesses you need to mirror you need to really replicate all the decision- making processes because at the end a person needs to be liable for something and that liability needs to be uh non-reputable uh so you need the same structure um you can get a lot of this kyc info on chain so as I mentioned granular control over country or transfer amounts or whatever you want um as well as eventually you know even travel rule implementation uh one thing that a lot of people forget is continuous monitoring so just because someone is not on a sanctions list today doesn't mean they will not run to Bosnia tomorrow um so that can also happen and finally we get to like the key thing which is security uh and here we have like um again no although it looks very mature and like there's a ton of projects building everything with so many readymade solutions there are not many real readymade solutions so you're going to want a good kyc data provider um those ones are not in general providing random data feeds on the blockchain as well there's like a a disjointed graph of uh good kyc providers that will actually get you all the good data about someone and the ones that do like some very basic verification but we'll put it on chain for you if you want real quality you're going to go with like a normal kyc provider that's targeting businesses and you're going to be putting that data on chain yourself so here you need to think again and this is why like you really need to be security-- minded because if you're putting stuff on chain if you're putting kyc data on chain now you're taking uh responsibility for how these people are allowed to do something uh so you want to make sure that is also secure uh in our case that means a decision to of of course use multix for the admin roles but also for any hot wallet such as a wallet that allows users to add kyc data on chain to rotate that Weekly uh and to just have it hardcoded that if it's older than a week if a private key is older than a week you cannot use it anymore uh as in you know for it's constantly rotating which uh also means uh and this is key that you have like a RPO uh that's a weak in short if you have a key leak if somebody hacks into your actual deployment where you're uh hot wallet is stored you're not going to be exposing yourself to any more than a week of data loss or a week of risk to people misusing kyc uh plus again granular control such uh such a regular rate of uh of rotation uh all ows you to also have like blacklists for the signer Keys which you can just broadly remove weeks of uh verified people in case you notice a problem without incurring you know the cost of reverifying 10,000 people so uh a lot of risk management there and uh this was like a mix of abstract and specific uh so I hope it was not too technical for everyone but our setup you can see it in on here so this is our website and there's a link to our repo there where you can get a bit more information in short our final setup and again maybe too technical depending on the audience is a beacon proxy to get maximal efficiency on the individual properties that we're tokenizing through a land borrow legal structure Incorporated in Dubai with a compliance module with rotating Keys handled by a multisig and uh sale and distribution separately handled to remove individual system risk uh which can also be all be explored in our GitHub repo for technical people that's it thank you and Q&A any questions yep hi uh thank you for this interesting presentation so in the in the last bit you mentioned uh kyc data on chain and you also talked about the the issues um involved with the KC providers now I'm coming from uh ver potential dis identity background and like one of the Grave mistakes that anyone in the industry tries to avoid is putting KC or user data on chain um so what exactly goes on chain and why so you're going to be putting the minimum amount that you need to uh uh to remove your risk you're going to need a country code on chain related to a wallet for a start uh because country level regulations are the ones that happen the most uh other than that you're just going to need some identifying hash so that's not going to be anything that can be you know just a hash of some identifying piece of data that could be an email or whatever uh something that you're really a user ID uh nothing more identifiable than that is needed so country in case you have some additional filtering for example somebody is on a pep list and you know get like a yeah I can no longer work with this person you're going to want that as well but you can you can mask some of this data again nothing on chain is really private but you can get around and mask this so you do not need too many broad uh things like do not put anything more than you need based on your current legal opinion for us that means country and anything else can be handled through you know blocking individual wallets or blocking signers Etc um and so you you mentioned hashes why don't you implement something let's say more advanced like BBS Plus or like Advanced signature schemes um hashing is fine for validating information I mean a hash and a signature provides you non- reputation and uh hides the information okay thank you thank you very much [Applause]