united-states criminal-law privacy european-union banking
Can Banks legally use Encrypted Ledgers like in Private coins?
<p>Seeing so much news about blockchains and banks I have a question that I may need your help.</p>

<p>Taking in consideration the Bank Secrecy Act, can a Bank use a completely Encrypted Ledger? KYC is still required, deposits and withdraws will still be reported if one deposits/withdraws more than $10k. But the bank has no idea about users' balances or their transactions. So, the bank uses an encrypted ledger that doesn't have a key to be decrypted. Namely, the ledger is encrypted in a way in which transactions are encrypted and unlinkable. Only the users can decrypt their balances and spend their funds with a... hardware token. Using this hardware tokens users can give a proof to the bank that the balance was right. Something like how is done in blockchains solutions focused on privacy. </p>

<p>Can public/private banks in the future use encrypted Ledgers? 
If yes why banks didn't do it until now. 
If no, why banks can't use encrypted Ledgers?</p>

<h2>Banks need to know the balance in each of their accounts</h2>

<p>The business of banking is taking the money of their depositing customers and lending it to their borrowing customers. They are subject to strict prudential laws about how much of the former they can lend to the latter; they need to know the balances to do this. Further, they make money by charging their borrowers interest and paying interest to their depositors and keeping the difference; they need to know the balances to calculate the interest. Further, they are generally public companies and need to be audited by law; the auditors need to be able to see the transactions to do this.</p>

<p>&quot;Encrypted Ledgers&quot;, as used by blockchain cryptocurrencies, are <strong>no good</strong> for banks.</p>
<p>In blockchain cryptocurrencies encryption/cryptography is mainly used to:</p>
<ul>
<li><p>Facilitate the integrity of <em>distributed / decentralised</em> ledger so that anyone could see mathematical proof that the ledger has not been tampered with.</p>
<p>One could assume that has a value for banks too: look, our ledger is encrypted / modern / cool / bla-bla-bla. But not so.  Doing this for ledgers controlled by <em>one party</em> (e.g. bank) does not prove the integrity because the party can always make changes retrospectively and re-calculate all hashes; unlike decentralised ledgers, it can just do it without having to agree on / coordinate those changes with anyone. You would have to keep historic clones of the bank's ledger yourself to verify that the bank does not tamper with it. Who is going to do this? And even if someone does, how to prove that they have not tampered with their clone to frame the bank? Lack of decentralization means lack of point.</p>
</li>
<li><p>Cover the asses of the money owners / senders / recipients. This just goes against of what banks legally must do: keep the asses bare.</p>
</li>
</ul>

<h1>No</h1>

<p>So far as I'm aware there is no law explicitly against an "encrypted ledger" but retail banks have legal obligations that can only be met by awareness of activity in user accounts. They entail being able to see user accounts at transaction level.</p>

<p>E.g. rules relating to</p>

<ul>
<li><p>money laundering</p></li>
<li><p>terrorism financing</p></li>
<li><p>serious crime financing</p></li>
<li><p>other activity considered suspicious in the jurisdiction</p></li>
<li><p>reporting on certain customers (persons or entities) under the Common Reporting Standard</p></li>
<li><p>risk, exposure</p></li>
<li><p>how much money the user had that is 'guaranteed' to be paid in the event of a crash</p></li>
</ul>

<p>In at least the past decade the legal trends are towards <em>greater</em> transparency and traceability, <em>less</em> anonymity and financial privacy, and directly opening financial records to law enforcement authorities. And now we have Open Banking in the UK, EU and I think developing in the USA where the biggest banks are (going to be) obliged to facilitate licensed startups direct access to user accounts.</p>

<p>That's all aside from the bank being able to meet its obligations per the contract with the user and check the user is meeting his contractual obligations too. E.g.</p>

<ul>
<li><p>is the user attempting to withdraw money over a threshold that he may not exceed?</p></li>
<li><p>did the user exceed their authorised overdraft (therefore can be charged higher interest and/or penalty)</p></li>
<li><p>calculating interest due either way (to the user or bank's benefit)</p></li>
<li><p>whether the account qualifies for positive or negative treatment due to frequency of withdrawals (e.g. supersaver account attracting higher interest may allow only five withdrawals a year)</p></li>
<li><p>investigating user complaints (e.g. fraudulent transactions or mistakes)</p></li>
<li><p>fixing mistakes</p></li>
<li><p>processing credits and debits</p></li>
<li><p>processing penalties</p></li>
<li><p>freezing or blocking certain amounts </p></li>
</ul>

<p>(Indeed how could such a business operate as a retail bank?)</p>
