Zano Serious Series #1: Regulators vs Privacy-preserving Digital Currencies

Zano’s Auditable Wallets — Can They Help? So where does Zano fit into this Brave New World? As far as compliance goes, Zano may actually present exchanges with less of a challenge than many other cryptocurrencies, thanks in part to how its address scheme works, and thanks in part to a new feature: Auditable Wallets. Example of auditable wallet in desktop GUIThe Travel Rule mentioned above, at the very least would require Financial Institutions (FI) to maintain records of transactions involving other FIs. So before anything else, they need a way to reliably detect such transactions. Detecting Inter-exchange Transactions (Funds Travel Rule) Obviously exchanges can’t put their licenses on the line by assuming their clients will always faithfully report whenever a withdrawal is going to another exchange, so what can they do? In this case, Zano may actually be much simpler to deal with than most other (including CryptoNote) currencies. Let me explain why. The obvious way in which exchanges could detect inter-exchange transactions is for them to maintain a single, shared database containing all addresses they generate for their customers. In the case of Bitcoin, every customer is normally provided with one or more unique addresses, which would require a shared database with a potentially enormous number of addresses being updated and accessed constantly. With Zano, on the other hand, exchanges tend to use one wallet with a single public address. Each customer, rather than having a unique address (as with Bitcoin et al.), are allocated a payment ID that is bundled and encoded with the public address into an Integrated Address. So the same public address is used for all deposits. Why is this important? Well, in the case of a shared database of exchange-owned addresses, for Zano, exchanges would only have to share the single public address from which each customer’s Integrated Address would later be derived. A far smaller amount of data requiring far, far less frequent updates. An Integrated Address is easily decomposed into its constituent public address and payment ID using the split_integrated_address JSON RPC call. So if the returned public address belongs to another exchange (i.e. is in the shared database), in accordance with the regulations some information must be forwarded. Record Keeping and Reporting Most CryptoNote currencies can be described as “private, optionally transparent”, in that a “View Key” can be shared which makes visible all incoming transactions to the corresponding address. Outgoing transactions, however, cannot be reliably viewed. This is one area in which Zano’s Auditable Wallets might be of help to exchanges. An Auditable Wallet is made visible by sharing a “Tracking Seed”, which allows a third party to see all incoming and outgoing transactions to/from the wallet. So a Tracking Seed could be shared with the relevant regulatory agency to allow them to independently verify the authenticity of any Zano transactions reported. Lower AML Risk Many exchanges list Zcash while only utilizing their (transparent) t-addresses. T-addresses are as transparent as Bitcoin addresses, and so presumably are considered lower risk, meaning enhanced AML measures aren’t required. Something similar can be achieved using Zano Auditable Wallets. All Auditable Wallet addresses have a unique prefix (“aZx”), so exchanges can easily insist that only auditable wallet addresses be used for withdrawals. They could even oblige users to submit the corresponding tracking seed (which makes visible all incoming and outgoing transactions). Then, if required to by law, they could share it with the relevant regulatory agency. This may seem somewhat extreme from an exchange user’s perspective, but it’s actually no more information than Bitcoin traders are sharing on the average KYC-enabled exchange. To protect their data from that point onwards, users could maintain an Auditable Wallet specifically as an exchange interface (the Zano GUI supports multi-wallet management anyway). They’d only have to pay the minimal transaction fee to later move the coins to an ordinary wallet and begin using their Zano with the comprehensive level of privacy we’ve all come to expect. If the legal departments are satisfied that Bitcoin et al., Zcash using t-addresses and wrapped versions of privacy coins are not of sufficient risk to justify removing them from their platforms, then it stands to reason that the above-mentioned scheme using Zano Auditable Wallets, which gives exchanges access to the same amount of information, should be considered equally acceptable. So as you can see, Zano (and in particular Auditable Wallets) present solutions to some of the challenges facing centralized exchanges that want to support privacy coins while maintaining regulatory compliance. But only if the regulations are enforced in a sane manner — in a manner appropriate to the technologies they’re being applied to. If, as assumed by qTrade’s Eric above, exchanges must also somehow prove that withdrawals did NOT go to another financial institution, things become a whole lot trickier. In fact, for the vast majority of cryptocurrencies, meeting such a requirement simply isn’t possible. From my cold, dead hands Many chat participants expressed outright disdain for the new regulations. As a crypto enthusiast and user, I hate these rules. It makes me laugh really, with regards to banking, because there is so much corruption in banking, so much money laundering, terrorist financing, drug money being rinsed by HSBC etc… double standards and completely ridiculous! — ExchangeOwner#1 Another member mentioned seeing the regulations as part of a growing and inescapable trend of comprehensive data-gathering, as exemplified by Digital ID schemes such as id2020: “. . . it will basically take all your users accounts ID resume, job bank, work sites, preference and log pw for all sites hash n send in a [bitcoin transaction].” — Voon So if privacy coins such as Zano can help exchanges comply… a little protocol tweak here, a little compromise there, should they? Should they be complicit in the great data-grab if it helps bag them a few more elusive exchange listings? These new regulations, aside from being unclear and potentially unworkable, go against what might be considered the original spirit of crypto and demand a level of information gathering that is completely antithetical to the purpose of privacy-protecting currencies. But there’s a non-ideological, simpler, and perhaps more compelling argument for opposing them. We’ve seen the trouble that centralized exchanges have had in guarding their funds in the past… what’s to say they’ll do any better with their client data? Let’s be clear, they’ll have your name, address, probably a photo ID and a whole lot of info on how much crypto you potentially hold. And they’ll hold that data for up to 5 years. It’s a treasure trove for would-be scammers (or any thug with a $5 wrench). Case in point — users whose details were in the recent Ledger database leak are already receiving phishing phone calls and one customer was allegedly threatened with home invasion. With the need for exchanges to pass KYC details for every exchange-to-exchange transaction, the number of potential points of vulnerability or failure will only increase. So where can users trade these coins without such unnecessary risks? Several users, including one of our centralized exchange owners, suggested that the answer is Decentralized Exchanges (DEXs) — exchanges that allow trades between users without third party involvement. I wonder if it might be a good idea for developers to look at ways to allow users to interact with decentralsied [sic] markets… avoid all of the regulation! — qTrade Eric With the rate at which the delistings keep coming, DEX’s may soon be the only option that truly private currencies have left.