MIME-Version: 1.0
From: Karel Kyovsky <karel.kyovsky@generalbytes.com>
Date: Fri, 16 Jul 2021 16:35:21 +0200
Message-ID: <CALSqm3bG0pYhPvGQd-uxN5fTQXS_rbzQFq3L5+d2xbaLUuCE3Q@mail.gmail.com>
To: bitcoin-dev@lists.linuxfoundation.org
Content-Type: multipart/alternative; boundary="00000000000008055205c73e8048"
Subject: [bitcoin-dev] Travel rule, VASP UID and bitcoin URI - A new BIP
Precedence: list

--00000000000008055205c73e8048
Content-Type: text/plain; charset="UTF-8"

Hi There,
I would like to propose a standardization of the bitcoin URI parameter name
that could be optionally used to contain the unique id of VASP (Virtual
asset service provider as defined by FATF) hosting the user's wallet
address.
My question is: Should I prepare a completely new BIP or should I prepare a
modification of BIP21?
BIP21 status is FINAL so I guess it should be a completely new BIP that
would just extend the BIP21. I'm looking for confirmation of this approach.
Thank you for answering that.

Please let's NOT start a discussion whether the FATF travel rule is a good
thing or not. This could derail my initial question.

Background:
We are going to be soon working on travel rule integration for our Bitcoin
ATM product.
The current user scenario is that the user shows on his phone QR code to
the ATM with bitcoin URI containing an address, inserts cash and walks away
with BTC arriving to his wallet.

In a Travel Rule compliant scenario the ATM operator must perform the "best
effort" to find out who(VASP) is hosting the user's wallet, contact such
VASP and send VASP customer identity data. This can be achieved by:

a) ATM contacting every possible known VASP that is travel rule compliant
via some platform and ask him whether the address read from the QR code
belongs to him. Such search could be done also with bloom filter to protect
the privacy of a user. But of course this is very far from ideal.

or

b) ATM could use blockchain analytics tools to find who might be serving
this wallet (major exchange etc). If the wallet address is empty prior to
the purchase on the ATM this address would have to be monitored for some
time to find out if it doesn't fall into some exchange's(VASP) cluster and
that would have to be later contacted.

or

c) User will choose from the list of VASPs on the ATM screen to match his
wallet provider(imagine phonebook with search field - terrible). Most
people will select irrelevant VASP because they will not be willing to
spend time to search VASP's name on the screen.

or

d) The user could enable in settings of their mobile wallet that VASP UID
would be provided in URI as one of the parameters so that Bitcoin ATM
operator will not have to search for VASP and could communicate with VASP
immediately after scanning URI from QR code. In such a case options a) or
b) or c) would not have to be performed and user experience for ATM users
would stay the same as before travel rule compliance. In order to achieve
this all wallet providers need to use the same parameter name in URI so
that ATM will read this parameter - standardization of this parameter name
is the purpose of proposed new BIP.

VASP UID could be also a public key that could be used to encrypt the
customer's identity information before sending it to wallet provider VASP
from the bitcoin ATM. Directory of VASP UIDs, how VASP could be contacted,
method of transfer when one knows VASP UID should be all outside of scope
of this BIP. I expect this to be covered by 3rd party
tools/platforms/regulators.

Bitcoin ATM operators want to stay in business and for that they need to
stay compliant with US regulation. Therefore they ask us to improve our
products to comply with the FATF-Travel Rule.
The same probably applies to US custodian wallet service providers so I
envision that the majority of custodian wallets offered on Appstore/Google
play in the US would provide their VASP UID in bitcoin URI as a new default
with an option for users to turn it off.

Please note that Travel Rule doesn't apply for unhosted(non-custodian)
wallets.

Thank you,
Karel Kyovsky

--00000000000008055205c73e8048
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"auto"><div dir=3D"auto">Hi There,</div><div dir=3D"auto">I woul=
d like to propose a standardization of the bitcoin URI parameter name that =
could be optionally used to contain the unique id of VASP (Virtual asset se=
rvice provider as defined by FATF) hosting the user&#39;s wallet address.</=
div><div dir=3D"auto">My question is: Should I prepare a completely new BIP=
 or should I prepare a modification of BIP21?</div><div dir=3D"auto">BIP21 =
status is FINAL so I guess it should be a completely new BIP that would jus=
t extend the BIP21. I&#39;m looking for confirmation of this approach. Than=
k you for answering that.</div><div dir=3D"auto"><br></div><div dir=3D"auto=
">Please let&#39;s NOT start a discussion whether the FATF travel rule is a=
 good thing or not. This could derail my initial question.</div><div dir=3D=
"auto"><br></div><div dir=3D"auto">Background:</div><div dir=3D"auto">We ar=
e going to be soon working on travel rule integration for our Bitcoin ATM p=
roduct.</div><div dir=3D"auto">The current user scenario is that the user s=
hows on his phone QR code to the ATM with bitcoin URI containing an address=
, inserts cash and walks away with BTC arriving to his wallet.</div><div di=
r=3D"auto"><br></div><div dir=3D"auto">In a Travel Rule compliant scenario =
the ATM operator must perform the &quot;best effort&quot; to find out who(V=
ASP) is hosting the user&#39;s wallet, contact such VASP and send VASP cust=
omer identity data. This can be achieved by:</div><div dir=3D"auto"><br></d=
iv><div dir=3D"auto">a) ATM contacting every possible known VASP that is tr=
avel rule compliant via some platform and ask him whether the address read =
from the QR code belongs to him. Such search could be done also with bloom =
filter to protect the privacy of a user. But of course this is very far fro=
m ideal.</div><div dir=3D"auto"><br></div><div dir=3D"auto">or</div><div di=
r=3D"auto"><br></div><div dir=3D"auto">b) ATM could use blockchain analytic=
s tools to find who might be serving this wallet (major exchange etc). If t=
he wallet address is empty prior to the purchase on the ATM this address wo=
uld have to be monitored for some time to find out if it doesn&#39;t fall i=
nto some exchange&#39;s(VASP) cluster and that would have to be later conta=
cted.</div><div dir=3D"auto"><br></div><div dir=3D"auto">or</div><div dir=
=3D"auto"><br></div><div dir=3D"auto">c) User will choose from the list of =
VASPs on the ATM screen to match his wallet provider(imagine phonebook with=
 search field - terrible). Most people will select irrelevant VASP because =
they will not be willing to spend time to search VASP&#39;s name on the scr=
een.</div><div dir=3D"auto"><br></div><div dir=3D"auto">or</div><div dir=3D=
"auto"><br></div><div dir=3D"auto">d) The user could enable in settings of =
their mobile wallet that VASP UID would be provided in URI as one of the pa=
rameters so that Bitcoin ATM operator will not have to search for VASP and =
could communicate with VASP immediately after scanning URI from QR code. In=
 such a case options a) or b) or c) would not have to be performed and user=
 experience for ATM users would stay the same as before travel rule complia=
nce. In order to achieve this all wallet providers need to use the same par=
ameter name in URI so that ATM will read this parameter - standardization o=
f this parameter name is the purpose of proposed new BIP.=C2=A0</div><div d=
ir=3D"auto"><br></div><div dir=3D"auto">VASP UID could be also a public key=
 that could be used to encrypt the customer&#39;s identity information befo=
re sending it to wallet provider VASP from the bitcoin ATM. Directory of VA=
SP UIDs, how VASP could be contacted, method of transfer when one knows VAS=
P UID should be all outside of scope of this BIP. I expect this to be cover=
ed by 3rd party tools/platforms/regulators.</div><div dir=3D"auto"><br></di=
v><div dir=3D"auto">Bitcoin ATM operators want to stay in business and for =
that they need to stay compliant with US regulation. Therefore they ask us =
to improve our products to comply with the FATF-Travel Rule.=C2=A0</div><di=
v dir=3D"auto">The same probably applies to US custodian wallet service pro=
viders so I envision that the majority of custodian wallets offered on Apps=
tore/Google play in the US would provide their VASP UID in bitcoin URI as a=
 new default with an option for users to turn it off.</div><div dir=3D"auto=
"><br></div><div dir=3D"auto">Please note that Travel Rule doesn&#39;t appl=
y for unhosted(non-custodian) wallets.</div><div dir=3D"auto"><br></div><di=
v dir=3D"auto">Thank you,</div><div dir=3D"auto">Karel Kyovsky</div></div>

--00000000000008055205c73e8048--