Well, today I had more time to read the long draft, and I see that indeed as I said and was said in the articles I quoted in the OP, the draft poses a threat to privacy. I was going to quote excerpts throughout the text but I think it's going to be more useful to just quote the final proposals, putting in bold what I think is most relevant:
Source:
https://www.europarl.europa.eu/doceo/document/CJ12-PR-704888_EN.pdfThe draft report puts forward the following key proposals.
1. No exemptions based on the value of the transferWith respect to wire transfers, the Transfer of Funds Regulation requires a payment service provider to ensure that transfers of funds are accompanied by complete information on the originator and the beneficiary and to verify the information on their customer only if the transfers of funds exceeds EUR 1000, individually or as part of small linked transfers which together would exceed EUR 1000,
except where the funds to be transferred are received in cash or anonymous electronic money or there are reasonable grounds for suspecting money laundering or terrorist financing.
Due to the specific characteristics and risk profile of crypto-assets, the information obligation should apply to crypto-assets transfers, regardless of the value of the transfer. There are clear indications that crypto-asset activities associated with criminal activities and terrorism financing are often transfers of small value. Furthermore, crypto-assets and related technologies enable criminals to split high value transfers into small amounts across multiple wallet addresses in order to avoid detection of AML/CFT monitoring systems and to carry out illicit activities via structured transactions to a scale and global reach not available to wire transfers.In the view of the co-rapporteurs, the removal of a de minimis threshold for crypto-asset transfers would facilitate, rather than complicate, compliance and risk management by crypto- asset service providers. This is particularly relevant in light of the difficulty to identify linked transfers executed via multiple apparently unrelated wallet addresses as well as the high volatility of the valuation of most crypto-assets.
2. Transfers from/to un-hosted walletsSecondly, it should be clarified that
this Regulation applies also to transfers from or to crypto-asset wallets based on a software or hardware not hosted by a third party, known as ‘unhosted wallets’, provided that a crypto-asset service provider or another obliged entity is involved. In such circumstances, however, there should be no transmission of information to the unhosted wallet. Information should be obtained by the crypto-asset service provider directly from its customer and should be held and made available to competent authorities.
3. Know your transactionIn addition to obtaining accurate information on the originator and the beneficiary,
crypto-asset service providers should also be expected to obtain information on the source and destination of crypto-assets involved in a transfer. In particular crypto-asset service providers should establish effective procedures to detect suspicious crypto-assets, in particular any link with illegal activities, including fraud, extortion, ransomware or darknet marketplaces, or whether the crypto-asset has passed through mixers or tumblers or other anonymizing services. This is especially important when dealing with transfers involving unhosted wallets or non-EU crypto- asset service providers not complying with the same travel rule obligations.
4. Counterparty due diligence and protection of personal informationCrypto-asset service providers are expected to transmit required information also to crypto- asset service providers established outside the Union. However, before transmitting such information, crypto-asset service providers should identify their counterparty and assess whether they can reasonably be expected to comply with the travel rule and protect the confidentiality of personal information. Crypto-asset service providers should avoid interacting with illicit or untrustworthy actors.
5. Public register of noncompliant crypto-asset service providersIn order to facilitate the identification of illicit actors that pose a great risk from a AML/CFT perspective, the European Banking Authority (EBA) should maintain a public register of noncompliant crypto-asset service providers, consisting of entities which cannot be linked to any recognised jurisdictions, do not apply any identification measures on their customer and offer anonymising services, given their role in undermining the effectiveness of AML/CFT systems and controls.
6. Fast trackFinally, in order to speed up its adoption and ensure that crypto-asset service providers and other obliged entities put in place effective mechanisms to comply with the travel rule for combatting money laundering and terrorism financing, the current recast proposal should be decoupled from the rest of the new AML package and should be linked to the existing AMLD framework until the entry into force of the new regime, while preserving the alignment with the upcoming Regulation on Markets in Crypto-assets [MiCA].
The co-rapporteurs are convinced that an effective and strengthened framework to prevent the misuse of crypto-assets for money laundering and terrorist financing purposes is necessary to protect EU citizens from terrorism and organised crime, while contributing to the development
of a safe, lawful and well-functioning space for users of crypto assets and crypto asset service providers across the Union. The co-rapporteurs call on Member States and EU competent authorities to ensure proper implementation and enforcement also in a view of avoiding unfair
and unregulated competition, including from non-EU players.
Finally, the co-rapporteurs emphasize the role the Union should play
in promoting the implementation of the travel rule for crypto-asset transfers at global level as well as effective international cooperation to combat money laundering and terrorist financing.
There are other interesting things in the text, for example it also talks about ATMs:
"Providers of kiosks or automated machines connected to a distributed ledger network, also known as crypto- asset automated teller machines (‘crypto- ATMs’) enable users to perform transfers of crypto-assets to a crypto-asset address, by depositing cash, often without any form of customer identification and verification.
Crypto-ATMs are particularly exposed to money laundering risks because the anonymity provided and the possibility of operating with cash of unknown origin, makes them an ideal vehicle for illicit activities. Given their role in providing or actively facilitating transfers of crypto-assets, transfers of crypto-assets linked to crypto-ATMs should fall under the scope of this regulation."This seems to me to be along the lines of what has happened recently in the UK:
Bitcoin ATMs forced to shutdown in the UKSo I reaffirm what I said in the OP, this draft is a clear threat to privacy.
