機構想上鏈，身分驗證之外還卡什麼？
Bridging Regulation and Decentralization: Tech Stacks for Compliant Adoption
影片
影片與逐字稿來源：ETHTaipei
場次摘要
Ryan 認為，傳統金融機構要把客戶帶進鏈上服務，除了介面，還得整合身分確認、反洗錢、跨境資訊傳遞、託管與交易政策。他介紹歐盟相關規範及不同的金鑰管理方式，並以台灣託管市場為例討論業者進場。關於 Liminal 的排名與監理身分，逐字稿僅有講者口述，仍須另行查證。
值得記下的 5 件事
- 銀行介面可把鏈上操作藏在既有應用後面，降低一般客戶的使用門檻，但可能犧牲自託管。
- AML 篩檢從交易行為推估身分；Travel Rule 則先確認使用者身分，再追蹤資金移轉。
- 受監管產品必須把身分驗證、金鑰託管與其他合規層接起來，不能只處理交易介面。
- 多簽把權限驗證放在鏈上；MPC 在鏈下聚合成單一帳戶簽章，兩者在跨鏈與控制方式上有取捨。
- KYC 集中收集個資，也會形成外洩風險；加密與密碼學可用來改善資料管理。
逐字稿
機構要上鏈，合規跟去中心化得接上
大家好。今天要談的是，怎麼把監管接到我們熟悉的去中心化世界，以及既有的去中心化產品要變成受監管，需要整合什麼樣的產品或技術棧。到這個時間點，我們大概都同意，下一波主要客戶、資金、使用者也會來自企業世界，也就是我們常講的傳統金融世界。Hi everyone. So today I'm going to talk about, like, how to really bridge regulation into the world that is familiar with us, the decentralization world, and what kind of product or what kind of tech stack we need to integrate into our existing decentralized product to make it regulated. So I think at this point, we all agree that the next major wave of customers and the fund, the money, the user will be coming from the enterprise world, which is a normal world that we discussed about, which is the TradFi world.
但現在我們歡迎所有人上船，進到我們熟悉的鏈上去中心化世界。現在各洲的監理機關都在動，歐盟有 MiCA 和 DORA，近期 Travel Rule 也在適用，還有巴塞爾架構。我想說的是，每個洲、每個國家都在對金融產品套上新規則、新政策，希望讓一切更安全、保護終端使用者。我認為這是大家要對齊的角度，也要確保新進場的去中心化產品方，跟這個領域裡所有傳統金融機構，利益是對齊的。But now we are welcoming everyone on board to this on-chain decentralized world that we are familiar with. And now with all the regulators in each different continent, like in the EU, the MiCA and DORA regulations, and also the recent Travel Rule regulation is also applying, and also the Basel framework. A lot of, basically I'm trying to say is a lot of each continent, each country, they are applying new rules and new policies into the financial product that we hope that we can make everything safer and protect the end user. I think that's the angle that we're all trying to align here, and also make sure that the interest is also aligned between the new player, which is the decentralized product player, and all the TradFi institution players in this space.
兩邊在意的東西不一樣。機構端要知道什麼樣的使用者在用這個產品、怎麼用、要遵守什麼規則。用完之後，交易要怎麼追蹤，包含稽核、會計，確保每件事都被記錄。以太坊這邊在意的是免許可存取、抗審查、可信中立，以及全球、永遠在鏈上結算。我們希望最後還是能回到鏈上。So I think there are two different things in different fields that we care about. From the institution side, they need to know what kind of user is using the product and how can they use it, what kind of rules they need to follow. And after that, after they use the product, how do we keep track of all the trades with all the auditing, with all the accounting, and make sure that everything is being documented. And on the Ethereum side, we care about permissionless access and censorship resistance, credible neutrality, and global and always on-chain settlement. So we hope that everything can still always go back on-chain.
但終端使用者可以被抽象掉，不必直接跟鏈上那些東西互動，同時仍能被政府保護，以他們習慣的方式感到安全，不管是不是真的自託管。這裡也許有取捨。我認為監管整件事，是在找中間地帶，把使用者接到安全的鏈上互動方式。所以這不是加密原生派跟機構派在打架。加密原生的人還是可以跟我們熟悉的鏈上協議互動，這裡沒有對不齊的利益。But the end user can be abstracted from interacting with the stuff on-chain and still can be protected by the government, and everything is safe in their manner, no matter it's really self-custodial or not. Maybe there's some trade-off here. So I think the whole thing about regulation is trying to find the middle ground to integrate the user into a safe on-chain interaction means. So I think it's not a fight between the crypto natives and the institution players. So I think crypto-native people can still interact with all the on-chain protocols that we're familiar with. There's no unaligned interest here.
合規技術棧：介面、Travel Rule、政策、金鑰、身分
對傳統金融機構來說，他們可以用更簡單的使用體驗，把既有使用者帶進來，也許犧牲自託管，但把一切抽象掉，讓我們很難教育的使用者，例如父母或祖父母，直接用既有的銀行應用去跟鏈上應用互動。談這件事時，合規棧有好幾層。使用者跟實際 dApp 互動，是一層。像 Uniswap 和其他業者在做的。And for the TradFi institution, they can onboard their existing users with simpler UX, maybe sacrifice on self-custodial, but with simpler UX, everything can be abstracted and can interact by the users that we are very hard to educate, with our parents or grandparents. They can easily just use the existing banking applications to interact with all the on-chain apps. So there are a couple different layers of the compliance stack when we're talking about this. So when a user is interacting with the actual dApp, I think this is one layer. Like Uniswap and all the other players are doing this.
他們用地圖圍欄和設限資金池，確保跟協議互動的使用者，我們會說不是恐怖分子，或有資格安全使用他們的應用。這是使用者面對的第一層介面。再來是 Travel Rule 軌道。Travel Rule 軌道要管理資金在不同虛擬資產服務商之間怎麼走，確保資金被安全追蹤。Travel Rule 軌道最近才出現，因為先前的方法叫 AML 篩檢，也就是洗錢防制篩檢。They're using geofencing and gated pools to make sure that the users that are interacting with their protocols are, what we'll say, not terrorists, or— they are eligible to use their app safely. So that's the first, like, end interface for the user. And then there's the Travel Rule rails. The Travel Rule rails is trying to manage how the fund goes between different virtual asset providers to make sure that all the fund is being traced safely. And the Travel Rule rails came recently because the previous method is called the AML screening, which is the anti-money-laundering screening.
做法是用一層層監控去追交易，辨識並分類每個帳戶屬於哪類參與者，他們怎麼用鏈上應用、怎麼跟不同協議互動，試著替使用者貼標，在並非真的知道對方是誰的情況下找出他們是誰。Travel Rule 比較像由下而上：先確實知道使用者是誰，再追他們的錢往哪去。這兩種有點像彼此的替代方案。再來是政策引擎。政策引擎比較像在保護使用者，管理使用者被允許用哪些權限去跟不同協議或鏈上互動，或哪類應用會被政策引擎限制。The way that they do this is using a lot of, like, monitoring to track the transactions to make sure that, to identify and categorize which players belong to each account, and how are they using the on-chain apps and interacting with different protocols to try to label the user and find out who they actually are without really knowing who they are. And the Travel Rule is kind of the bottom-up method. It's like— understanding who the user is exactly and track where their money is going to. So these are kind of two, like, alternatives for each other. And then there's the policy engines. Policy engines are more like protecting the user and managing what are the permissions that the user is allowed to use to interact with different protocols or on-chain, or what kind of— No matter what kind of apps will be restricted through policy engines.
再下一層是錢底下的基礎設施，也就是金鑰和託管管理工具。我們講的託管錢包，甚至像 Safe 這種多簽錢包，談的都是錢怎麼被安全管理。再再來是弄清楚實際使用者是誰，也就是身分與證明，用 KYC 工具和我們熟悉的那些事：上傳所有文件，把個人資料幾乎赤裸地跑在中心化伺服器上。要做受監管產品時，合規棧就是這些不同層。And then there's the infrastructure that's underneath the money, which is the keys and the custody management tools. Like all the custodial wallets that we're talking about, or even like Safe, like multisig wallets, are also talking about this, is how the money is being managed safely. And then after that is trying to understand who the actual user is, which is the identity and attestations, using KYC tools and the things that we're familiar with. Like uploading all our documents, running our information pretty much, like, nakedly on all the centralized servers. So these are the different layers of compliance stack when we're trying to build a regulated product.
身分層：中心化 KYC、鏈上證明、ZK 憑證
第一層：身分與證明登記。差不多就是 KYC。我想幾乎大家都用過 KYC，也很熟悉。這個領域有不同玩家。我會說一種是 KYC，另一種是鏈上證明，方法不太一樣。像 Base App 也試過，不過他們差不多把它下架了。Base App 試過用鏈上證明：在鏈上發給使用者身分、做一個鏈上檔案、發證明，讓你追這個使用者在鏈上跟哪些去中心化應用互動。那是另一種方法。So the first layer: the identity and attestation registries. It's pretty much KYC. I would say pretty much everyone would know, have used KYC before, and are familiar with this. I think there's different players in this field. I would say KYC is one, and the other will be on-chain attestation. That's kind of a different method in this field. Like, this is also what, like, Base App, though they kind of, like, sunset it down. But this is what Base App is trying to test through on-chain attestation: issuing on-chain identity to have a profile for a user on-chain, and to issue the attestations, and to issue, like, the identity on-chain to allow to track the user interact with which or what application or decentralized application on-chain. So that's another method.
但那種方法差不多死了，我會這樣說，因為還是很難被監管，也很難透過文件追到實際使用者是誰。不過那更去中心化，也是過去幾年測過的實驗。再來是 ZK 憑證，是這兩、三年冒出來的新方法，也是我前一家公司在試著做的。ZK KYC 這些，講到最後我可以再多談。這些就是人們試著處理 KYC 的三種方法。單純中心化、純儲存型 KYC，是 Sumsub 和 Persona 在做的。But that method is kind of dead, I would say, because it's still really hard to be regulated and to track who the actual user is through documents. So, but that's more decentralization, and that's kind of the experiments that have been tested in the previous couple of years. And then the ZK credential is the recent method that's coming up these two or three years, and it's also what my previous company is trying to build. I can talk about more of this, about ZK KYC stuff, at the end of the talk. But these are the, I'll say, the three different kind of methods that people are trying to tackle KYC. So the simple centralized, purely storage-based KYC, which is what Sumsub and Persona are trying to do.
鏈上證明則透過 EAS，也就是 Ethereum Attestation Service，還有 Coinbase Verifications 和 Human Passport。這個空間大概這三家。Human Passport 會是鏈上檔案。Coinbase Verifications 會是他們 Base App 或 Base 鏈上的驗證者。EAS 會是，抱歉，EAS 會是。喔，好，謝謝。EAS 會是證明基礎設施，用來在鏈上發出可重複使用的身分。And the on-chain attestation is through EAS, the Ethereum Attestation Service, and Coinbase Verifications and Human Passport. They're kind of the three different players in the space. So Human Passport will be the on-chain profile. And Coinbase Verifications will be the verifier on their Base App or Base chain, and EAS is the— sorry, and the EAS will be— Oh. Okay, thank you. The EAS will be the attestation infrastructure to issue all the reusable identity on-chain.
人們為什麼要做 ZK 憑證，跟 PII 怎麼被管理有關，PII 就是可識別個人資訊。稍後會講為什麼我認為隱私在 KYC 裡真的很重要。第二層是金鑰和託管。我會說這個空間相當成熟，產品和解法也很成熟。多簽，Gnosis 做的 Safe，我想大家最熟。他們把一切放在鏈上、在鏈上管理，透過帳戶簽章聚合，再用鏈上智能合約驗證來簽名。And the reason why people are trying to build ZK credential is related to how PII, which is personally identifiable information, is being managed. I'll talk about why I think privacy is really important in KYC later. And then there's the second layer, which is keys and custody. I would say this is a rather mature space, and the product and the solution is quite mature as well in this space. So multisig, the Safe built by Gnosis, I would say, is the most familiar to everyone. They host everything on-chain and manage everything on-chain. Everything is aggregated through account signature and sign everything through on-chain smart contract verification.
金鑰託管、政策引擎與 Travel Rule 軌道
再來是 MPC，鏈上是單一帳戶，但一切在鏈下聚合，所以跨鏈通用，更容易在不同生態間轉移，但更中心化、也更需許可。談金鑰管理時，就是這兩類解法。MPC 管理金鑰又有兩種方式。一種是 TEE，一種是 HSM。這比較偏密碼學用語，不一定要懂。我想指出的是，Fireblocks 和 BitGo 是 MPC 託管錢包領域最大的兩家，Fireblocks 用 TEE，BitGo 用 HSM。And then there's MPC, which is a single account on-chain, but everything is aggregated off-chain. So it's chain-agnostic. So it's— It will be more easily transferred through different ecosystems, but it's more centralized and it's more permissioned. And these are the two different kinds of solutions when we talk about key management. And then about MPC, there are two different kinds of ways to manage the key. One is TEE, and one is HSM. It's more like cryptography-related terms, so you don't necessarily need to understand them. But to talk about this, what I want to point out is that Fireblocks and BitGo are the two biggest players in the MPC custody wallet field, and Fireblocks is using TEE, and BitGo is using HSM.
各有取捨。有興趣的話之後可以再深入。Safe 現在用多簽。這些就是在做金鑰和託管管理的不同玩家。再來是自動化政策引擎，也就是使用者被允許怎麼跟不同應用互動。這些幾乎綁在 WalletConnect、錢包提供方，因為管理資金、把資金轉進轉出錢包，差不多是同一件事。時間很緊，我會講快一點。Which have different trade-offs. If you're interested, we can dive into this later. And Safe is using multisig right now. So these are the different players that are doing keys and custody management. And then there's the automated policy engines, which is how users are allowed to interact with different applications. These are— Pretty much tied to WalletConnect, the wallet provider, because it's pretty much the same thing to manage your funds and to move your funds in and out of your wallet. So it's pretty much the same thing. My time is pretty tight, so I'm going to try to jump faster.
但這些是不同類型、在幫使用者管資金的錢包。再來是 AML。AML 也相當直白，就是監控交易，所以我也跳過。然後 Travel Rule，我會說很有意思，因為 Travel Rule 是相當新的規範，這個領域有幾家大玩家。我會說 21 Analytics 的 TRP 很有意思，因為他們在做 Travel Rule 管理的開放標準，未來可以抽象掉 Travel Rule Alliance。最後是合規 DeFi 前端，這個領域有幾家受監管的玩家。But these are the different kinds of wallets that are doing, to manage funds for the user. And then there's AML. AML also is rather trivial. It's just monitoring transactions, so I'll also jump this. And then Travel Rule, I would say, is pretty interesting because Travel Rule is pretty recent regulation, and these are the couple big players in the team. And I would say the TRP, which is from 21 Analytics, is, I would say, pretty interesting because they are creating an open standard for Travel Rule management, so it can abstract the Travel Rule Alliance in the future. And then finally is the compliant DeFi front end, which these are a couple, like, regulated players in the field.
我想指出 Liminal 相當有意思，因為他們是台灣第九家受監管的虛擬資產服務商。所以他們是台灣最新、最晚進來的託管錢包合法玩家。我會說這值得盯著看。BitGo 和 Fireblocks 也想進台灣，但還沒取得執照。這塊我會講很快，因為我覺得真的很有意思。這些就是人們在做的監管科技領域。所以依你要提供給終端使用者什麼服務，你得把不同拼圖拼起來，做出對你的使用者定義清楚的系統。I want to point out Liminal is quite interesting because they are the ninth regulated virtual asset service provider in Taiwan. So they are the newest and the latest custodial wallet legal player in Taiwan. I would say that's pretty much interesting to keep an eye on. And BitGo and Fireblocks are also trying to come to Taiwan, but they are not licensed yet. And I'll talk about this, like, real quick because I think this is really interesting. So these are the regulation tech fields that people are trying to build. And so depending on what kind of service you want to provide to your end user, you will need to put the different pieces of the puzzle together to build a system that's well defined for your user.
台灣託管還沒發照，Liminal 除外；KYC 也在漏個資
快速總結。這些就是完全合規的交易。一筆完全合規的交易會長這樣，會走過我們前面講的各層。快速總結，我覺得有兩件事值得帶走。一件是：台灣的託管錢包除了 Liminal，都還沒取得執照。BitGo 和 Fireblocks 都還沒被監管。那他們現在怎麼做？我想大家會好奇，他們到底怎麼跟台灣公司合作。目前的做法是，他們在美國、新加坡和阿聯酋有執照。And so just to quickly sum up. These are the fully compliant transactions. What a fully compliant transaction will look like. We'll go through all the previous parts that we talked about. And yeah, so just to quickly summarize, I think there are two things that I think are really interesting for a takeaway. One is that. Taiwan is not licensed yet for the custodial wallets, besides Liminal. So, like, BitGo and Fireblocks are not regulated yet. So what they're trying to do now. I think people will be curious about then how do they actually work with Taiwan companies. So the solution they're going for right now is that they have licenses in the USA and in Singapore and the UAE.
所以如果你的銀行有客戶公司或子公司在這些國家，可以先在那些國家一起做、把系統接起來，等台灣託管錢包監管就緒，再來申請台灣執照。這是一件。最後想講 KYC 為什麼重要：很多資訊和 PII 外洩，是從 KYC 流程漏出去的，像 Discord 和 Coinbase。我認為隱私重要，因為可以用加密、密碼學的方式，更好地管理使用者資料。如果你對隱私、對託管錢包有興趣，歡迎來找我。之後可以再往下談。謝謝。謝謝 Ryan。So if your banks have a client company or a sub-company in these countries, They can work together in these other countries first, and integrate the system together, and then in the future they can apply to Taiwan once the regulation of custodial wallets is being managed. That's one thing. And the last thing I want to talk about is why KYC is important is because a lot of the information and PII leaks are through the KYC process, like Discord and Coinbase. And I think privacy is important because it can be protected through encrypted cryptographic ways to better manage user information. If you guys are interested in privacy and interested in custodial wallets, feel free to reach out to me. I can talk more and deep-dive this into more topics in the future. Thank you. Thank you, Ryan.
