"Why Has the Traditional Regulatory System Become a Joke on the Blockchain?"
The state of crypto regulation in 2025: an expensive game that everyone involved knows is a joke, but has to continue playing.
Bo Cai recently read a briefing paper published by the Bank for International Settlements (BIS) - "Anti-Money Laundering Compliance Framework for Crypto Assets" [1]. As the central bank of central banks, every report from the BIS becomes a barometer for financial regulation in various countries. So when I saw the title, my first reaction was: Finally, someone has come up with a brilliant way to regulate cryptocurrencies?
However, after reading the full text, I realized that this paper is not a viable solution; in my opinion, it resembles more of a decent surrender document.
The BIS, in a scholarly manner, subtly acknowledges a harsh reality: the KYC/AML system of traditional finance has completely failed in the face of the decentralized crypto world.
What is the "innovative" solution they proposed?
Score wallets, advocate for users to check each other for compliance, and conduct final checks at the deposit and withdrawal points.
It's like a martial arts master who has trained his whole life in the Eighteen Dragon-Subduing Palms, suddenly realizing that his opponent is coming in a tank, so he suggests putting up a sign at the city gate: "Tanks are prohibited from entering."
Not to mention the high implementation and coordination costs of scoring, even if it is implemented, what should we do if others invest a few toxins into high-value wallet accounts?
It advocates that users check for themselves, which is like asking you to check if a dollar bill has ever been used to buy drugs before accepting it. Theoretically feasible, absurd in practice.
Conducting KYC/AML during the deposit and withdrawal process may be the last bit of dignity left for these traditional institutions, at least you can still verify identity and source of funds.
Why is it said that the traditional regulatory system has almost completely failed on-chain? This leads us to take a look at a ridiculous regulatory rule that regulatory agencies around the world are still continuing to implement – the Travel Rule.
Travel Rule: A Farce from Traditional Finance to the Crypto World
To understand the absurdity of the Travel Rule, we must first understand its past and present.
In 1996, when the internet was still in the era of dial-up, the Financial Crimes Enforcement Network (FinCEN) in the United States first introduced the Travel Rule as part of the Bank Secrecy Act.
The requirement at that time was very simple: when banks processed wire transfers over $3,000, they had to pass the remitter's information to the next financial institution.
This works well in the traditional banking system, why?
Because banks are centralized, they have complete customer information and standardized information transmission systems like SWIFT. Industrial and Commercial Bank of China knows everything about Zhang San, and China Construction Bank knows everything about Li Si. When transferring money, information is exchanged, and it happens naturally.
But in 2019, the Financial Action Task Force (FATF) made a game-changing decision: to extend the Travel Rule to cryptocurrencies.
What kind of organization is FATF?
The intergovernmental organization established in 1989 was originally created to combat drug money laundering. Its "40 Recommendations" are regarded as the global gold standard for anti-money laundering. When the FATF speaks, regulators around the world must listen.
On June 21, 2019, the FATF adopted the interpretative note for Recommendation 15 (INR.15) in Orlando, extending the originally applicable Recommendation 16 (Travel Rule) for traditional financial institution wire transfers to the virtual asset space.
Virtual Asset Service Providers (VASPs) are required to collect and transmit the identity information of both the sender and the receiver when processing transactions exceeding $1,000/€.
- Name
- Account number (wallet address)
- Geographic location or ID number
- If needed, there is more detailed information.
Their logic is: since the Travel Rule has been operating in traditional finance for over 20 years, it should also work in the crypto world.
The problem with this logic is that they completely do not understand how Blockchain works.
The Global Chaos of the Travel Rule
Let's take a look at the implementation status of the Travel Rule. According to the FATF report in June 2025, 99 jurisdictions claim to have passed or are in the process of passing legislation for the Travel Rule. Sounds impressive, right?
But the devil is in the details. 75% of jurisdictions are still only partially compliant or non-compliant [2], the same proportion as in April 2023 - 75% of 73 countries, with zero progress.
Why is this happening? Because every country is developing its own system.
The United States has maintained the old rule from 1996: a $3,000 threshold. However, the FATF recommends a $1,000 threshold, leading to the first split.
Singapore was one of the first countries to respond, starting implementation on January 28, 2020, with a threshold of 1500 SGD. South Korea implemented it on March 25, 2022, with a threshold of 1 million KRW (approximately 821 USD). Japan stated that all transactions, regardless of the amount, are required.
The EU is even more extreme, delaying the implementation of the Transfer of Funds Regulation (TFR) until December 30, 2024, and then saying: We do not set a threshold, even 1 cent must comply with the Travel Rule.
What is the result? A transfer of 1500 USD from the United States to the European Union, where the United States says the Travel Rule is not required, but the European Union says it must be followed. Both sides are "compliant", but the transaction is stuck.
This is not the most chaotic. Israel implemented the Travel Rule in 2021 with zero thresholds, but almost no other countries have connected with it. Canada also has zero thresholds, but its rules are not compatible with those of other countries.
What is the result of this fragmentation?
According to Notabene's 2024 industry survey [3], although there has been an improvement compared to the previous year (from 52% to 29%), 29% of VASPs still continue to send Travel Rule information indiscriminately to all counterparties without conducting any due diligence assessments.
This "broad net" approach actually reflects an awkward reality: most VASPs are just going through the motions, as there is no way to verify whether the counterparties are truly using this information or whether they are compliant.
DeFi: The Blind Spot of the Travel Rule
While regulators are still entangled in the Travel Rule for centralized exchanges, DeFi has completely bypassed this issue.
The premise of the Travel Rule is that there are VASPs (intermediaries) to execute it. I use MetaMask to swap tokens directly on Uniswap, may I ask:
- Is MetaMask a VASP? It's just a browser plugin.
- Is Uniswap a VASP? It's just a piece of code.
- Are Ethereum miners VASPs? They only verify transactions.
When both parties are trading directly in a peer-to-peer manner, there is fundamentally no intermediary to enforce the Travel Rule.
This is as absurd as asking the air to enforce the law.
Who is required to enforce the Travel Rule? Does it require the code to provide KYC information?
The FATF's response to this is: Developers of DeFi protocols should be regarded as VASPs.
The absurdity of this logic is akin to saying that the inventors of the TCP/IP protocol should be held responsible for all internet crimes. Vitalik Buterin created Ethereum, so should he be held responsible for all illegal transactions on Ethereum? If Satoshi Nakamoto were still alive, would he be sentenced to life imprisonment?
Criminals' Response: The Art of Smurfing
What do real criminals think about the Travel Rule? Probably they see it as a comedy.
Criminals use traditional Smurfing tactics to circumvent the Travel Rule[4], splitting large transactions into smaller ones. Want to transfer $18,000? Break it down into 20 transactions of $900 each, sent from different wallets and at different times. Each transaction is below the threshold, so the Travel Rule doesn't apply.
North Korean hackers stole $1.46 billion from the ByBit exchange this year — the largest cryptocurrency theft in history. Did they use the Travel Rule? Of course not.
In 2024, the amount of cryptocurrency used for illegal activities reached tens of billions of dollars. None of these criminals were caught by the Travel Rule.
Another consequence of the Travel Rule is that it exacerbates regulatory arbitrage; every time regulations tighten, it's like squeezing toothpaste—when you squeeze it here, it oozes out from there.
Compliance costs: An expensive performance
The Travel Rule does not bring solutions, but astronomical compliance bills.
According to estimates, the cost for a medium-sized exchange to implement the Travel Rule includes:
- Technical solution procurement: annual fee of $100,000 to $500,000
- System integration transformation: one-time $500,000 to $2,000,000 (requires transformation of the entire trading system)
- Compliance team expansion: annual salary cost of 200,000 to 1,000,000 USD (requires a dedicated Travel Rule compliance officer)
- Legal consultation fees: Annual fee of $100,000 to $500,000 (varies by country, requires local legal support)
- Auditing and Reporting: Annual fee of $50,000 to $200,000
This is just the visible cost, what about the invisible ones?
The high compliance costs are accelerating market concentration, and the giants certainly support the Travel Rule—they can afford the compliance costs while their competitors cannot. This is not regulation; it is market cleansing through regulatory costs.
What is the biggest hidden cost? The death of innovation.
A startup team should first consider not technological innovation, but:
- Does this comply with the Travel Rule?
- Can we afford the compliance costs?
- What should I do if I am identified as a VASP?
The result is that innovation either moves to places with relaxed regulations or is simply abandoned. We are stifling 21st-century innovation with 19th-century thinking.
This is the truth about the Travel Rule: a huge amount of money has been spent to build a useless system that has solved nothing except increasing costs, reducing efficiency, and stifling innovation. Meanwhile, ordinary users have to pay the price for this regulatory farce – endless forms to fill out, interminable reviews to wait for, and fees that never seem to end.
Participants in the regulatory theater
The current cryptocurrency regulation is a meticulously orchestrated drama, with everyone having their own script:
Regulators: "Look, we are enforcing the Travel Rule! We are protecting investors!" (Actually knowing it doesn't help, but we need achievements)
Large institutions: "We are fully compliant!" (Actually just going through the motions, asking you, "Is this your wallet?")
Small institutions: "We are working hard to comply!" (Actually thinking about how to move to a place with looser regulations)
User: "I comply with the Travel Rule!" (Actually, I've already learned how to bypass it)
Criminal: "What Rule for Travel?" (Continue doing whatever you want)
Recognize reality, but do not give up thinking.
At this point, you might be asking: What should we do?
First of all, it is important to clarify: this article is not criticizing the regulation itself, but rather pointing out the current situation.
The original intention of regulation is good – to prevent money laundering, protect investors, and maintain financial stability. These goals are beyond reproach and indeed necessary.
What we criticize is using the wrong tools to achieve the right goals, just like trying to screw in a screw with a hammer—if the tool is wrong, no matter how hard you try, it will be in vain.
We need to acknowledge a fact: in a decentralized world, traditional regulatory tools have become ineffective. This is not a technological issue, but a paradigm issue. Just as you cannot manage cars using methods for managing horse-drawn carriages, you also cannot manage DeFi using methods for managing banks.
But this does not mean giving up all regulatory efforts. On the contrary, we need a new way of thinking. Good regulation should be like traffic rules - it does not stop people from driving, but makes the roads safer.
Perhaps what we need is not a globally unified standard, but healthy competition among different jurisdictions. Regulatory innovation and technological innovation should go hand in hand, rather than being in opposition.
This requires strong on-chain data analysis capabilities. Companies like Chainalysis have proven that suspicious transactions can be effectively identified through behavioral analysis without needing to know everyone's ID number. In a future where regulatory frameworks become clearer, compliance infrastructure will become a key infrastructure for the cryptocurrency industry.
What we should call for is not anarchism, but smarter governance. Regulators and practitioners should sit down for sincere dialogue, understand each other's concerns, and jointly explore regulatory paths suitable for the characteristics of new technologies.
After all, the real enemy is not the regulation, nor the cryptocurrency, but those who engage in criminal activities by exploiting technical loopholes. In this regard, the goals of regulators and practitioners are aligned.
Written at the end
Return to the original BIS report.
On the surface, it is proposing solutions. In reality, it is recording the end of an era—the jurisdiction of traditional financial order over crypto assets is irreversibly fading away.
This is the state of crypto regulation in 2025: an expensive game that all participants know is a joke, but have to continue playing.
The Travel Rule, from the bank wire transfer regulations of 1996 to its forceful transplantation into the crypto world in 2019, is itself a manifestation of regulatory inertia – using old bottles to package new wine, managing highways with traffic rules from the carriage era.
As Hayek said: "The road to hell is paved with good intentions." The current cryptocurrency regulation may be such a road. The intention is good – to prevent money laundering, protect investors, and maintain financial stability. But the result of enforcement has been increased friction, hindered innovation, and pushed activities underground.
Pandora's box has been opened, and the decentralized spirit will not return to the bottle.
Instead of continuing this doomed war, it is better to think about how to find balance in the new world. What is needed is not stricter rules, but entirely new wisdom.
And this wisdom clearly will not come from regulatory bodies that still manage 21st-century technology with a 20th-century mindset.
The future is not a place we are going to, but a place we are creating.
Just hope that when history looks back at this era, it will not record it as:
"Humanity once had the opportunity to build a more open, transparent, and efficient financial system, but it was ultimately ruined by a group of bureaucrats who did not understand technology."
That would be a bigger joke than any regulatory failure.
[1]
[2]
[3]
[4]