New EU Rules Could Threaten Your Security - What You Need To Know

The Financial Action Task Force’s Travel Rule requires financial institutions, including virtual asset service providers, to collect Know Your Customer information and share it with other institutions involved in a transaction. First introduced for traditional finance in 2012, it has been extended to bitcoin. The EU required compliance from crypto-asset service providers by 30 December 2024 under its Transfer of Funds Regulation, while the UK formalised the rule on 1 September 2023.

Sharing personal data across multiple custodians creates privacy and security risks, with the piece citing breaches at Equifax and India’s Aadhaar system. The EU effectively requires reporting for nearly all transactions, unlike the US, where smaller transactions are exempt, and German freedom of information requests showed that law enforcement lacks data on whether anti-money laundering programmes work. The piece also considers compliance costs for smaller firms and alternatives such as zero-knowledge proofs.