Illuvium's Regulatory Exploration

Illuvium is pleased that after months of evaluation, we can announce that Illuvium Labs FZCO has received an Application Acknowledgement Notice from Dubai’s Virtual Asset Regulatory Authority. Details of the notice are below and are required to be disclosed in the form set out below. 

NOTICE: Illuvium Labs FZCO has received an Application Acknowledgement Notice [Notice] from Dubai’s Virtual Asset Regulatory Authority [VARA]. This Notice was dated 07 August 2023 and is valid until 08 September 2023. Please note that this Notice does not constitute a regulatory approval or a licence from VARA – and is merely reflective of the Company’s intent to apply for a fully regulated licence under the VARA regime to continue to operate VA activities in the Emirate of Dubai.

Note that the notice’s validity is until 8 September 2023, which is the date upon which Illuvium Labs filed its full application. We are awaiting VARA’s response in respect of that application and note that at this stage, Illuvium is not compelled to complete the application process and may amend or withdraw its application at its sole discretion.

Introduction

As a pioneering web3 gaming project, Illuvium has reached new heights in the world of blockchain gaming and decentralized finance. As with any nascent industry where regulatory efforts are underway, ensuring Illuvium’s continued success turns on our ability to build into this new paradigm and embrace the opportunities that come with it. 

As regulatory efforts crystalise, Illuvium has joined the ranks of trusted projects such as Binance and Crypto.com, applying for licensure with the world’s first dedicated regulator for crypto activity, VARA in Dubai. VARA has established a regime for the licensing of trusted virtual asset businesses. It is Illuvium’s wish to be the world’s first fully regulated GameFi project and therefore, its safest and most trusted. All gamers should be confident that Illuvium has been built to the highest standard of operational integrity and that our game economy is the world’s safest place in which to game. This article provides an overview of Illuvium’s efforts toward becoming regulated, our rationale for this approach, the potential benefits, and the current status of our engagement with VARA.

Why Regulatory Exploration?

The blockchain space has evolved rapidly and development of appropriate regulatory responses has struggled to keep pace. Responses have been varied and clarity in short supply in key jurisdictions. This has and continues to hamper web3 projects generally, as regulatory certainty increasingly begets operational certainty, investor interest and consumer confidence.

Illuvium's decision to explore regulatory possibilities stems from recognition that regulation is not a matter of if but when, which quickly translates into an assessment of where. Regulatory developments are fragmented and challenging to navigate, especially for decentralized operators with a global customer cohort. Such businesses must have a plan as to how and where they will operate, and even the most decentralised operations must be banked and access other essential services from somewhere. 

Illuvium Labs and Council have thought deeply about where is best to position our project for the best possible chance of commercial success, consistent with our commitment toward decentralised and democratic operations, transparency, sustainability, and the well-being of our community. We have assessed jurisdictions where crypto has lost (or never found) favor with policy makers, legislators and courts. We have assessed regulatory efforts, legal conventions for crypto businesses and appetites for crypto activity in key jurisdictions including Singapore, Cayman Islands, BVI. We have focused our attention on Dubai, which is home of the world’s first dedicated regulator of crypto activity.  By proactively engaging with regulators in Dubai, arguably the most Web3-friendly jurisdiction, with a regulator that wishes to attract high quality projects into the region, Illuvium aims to:

• Increase Trust: Regulatory compliance can enhance the trust of users and investors, who are, in the aftermath of Luna, 3AC, FTX, SVB, XRP watershed moments, justifiably cautious toward crypto projects. In recent times, we see that regulatory certainty and licensure gives greater confidence to potential users leading to better adoption rates in projects. The inverse often holds true.

• Navigate Complexity: The blockchain space is intricate, with rapidly changing dynamics. Engaging with regulators helps navigate this complexity and ensure Illuvium's ecosystem remains resilient. We see value in being an early adopter into jurisdictions that want to create a safe environment for consumers and being among the elite cohort of responsible projects that are building into it with us. 

• Reduce Risk: Even the most decentralised projects need banking, legal and regulatory certainty and access to resources. By proactively seeking compliance with a supportive regulator who respects and accommodates DAOs, Illuvium reduces the unsustainable risk of operating within a jurisdiction that is hostile to web3 and pursuing a ‘regulation-by-enforcement’ agenda. We cannot eliminate this risk all together, but we can locate our operations where we are welcomed. 

• Protect Users: Our customers’ confidence in what we are building is paramount. Illuvium’s interoperable game ecosystem is truly a world first in game experience and design, and we want to make it safe to play for everyone. Building the world’s first and only fully regulated GameFi project means we are building the safest gaming and GameFi experience possible. 

• Innovative Reputation: We strive to be at the head of the curve. As one of the first Web3 gaming projects to proactively seek a regulatory partner, Illuvium reinforces its commitment to building a safe game environment, establishing a high benchmark (where there isn’t one) for responsible operations and leading the industry by example.  

For more details on why pursuing regulation with VARA could be beneficial, see Appendix A at the bottom of this document.

The VARA Application: An Overview

In search of regulatory clarity, llluvium has sought to place itself in a crypto friendly regulatory environment. That environment is Dubai, under the world’s first purpose built crypto asset regulator VARA. Illuvium submitted an onboarding questionnaire to VARA in April 2023. In August, Illuvium received an Application Acknowledgement Notice and completed the full VARA application, which was filed the first week of September. Filing the application does not guarantee regulatory approval or commitment to becoming regulated with VARA. Approval and working toward licensure can take anywhere between and in excess of 6 to 12 months. 

Illuvium is presently awaiting a response from VARA in its application and we anticipate that there is some work to be done to accommodate the Illuvium DAO within VARA’s established framework for two reasons. First, Illuvium is a DAO. DAOs are not commonly understood legal structures and there are few jurisdictions in which they are recognised. VARA holds the potential to understand and accommodate the unique governance structures and decentralized nature of Illuvium, which is very encouraging. The second reason is that Illuvium is a game. The activity based nature of VARA’s regulatory regime means that there is work to be done to identify the nuance of regulating game environments and game virtual assets, as well as trading forums for those assets. 

Adjusting Governance Standards

In considering licensure with VARA, we must consider adjustments to Illuvium’s operations to meet the standards of a regulated entity. The regulatory regime established by VARA specifies operational, technology and risk management requirements, disclosure and reporting obligations and for Illuvium to establish minimum standards to monitor, detect and prevent suspicious transactions and undesirable behavior such as market manipulation and insider dealing. The totality of obligations is too long to set out in this article however the requirements can be reviewed in the rulebooks published here.  However, two key requirements of licensure require changes for our community to consider. They are:

1. Disclosing the identity of IMC members to VARA, who may liken  them to directors of a board due to their responsibility in setting the agenda and direction of the Illuvium DAO. It is important to know that as Illuvium engages with the regulator we will come to understand in greater detail how the regulator views Illuvium DAO’s management, including the roles of IMC and llluvium Labs, noting  that it is Illuvium Labs who has applied for the license. As we prepare for Epoch 9, it is appropriate to prepare IMC candidates for what will be expected of them as we progress our application, and that will include KYC to VARA of each council member and a justification for why they are suitable to fulfill their leadership role. As always, all elected council members are contractually indemnified by the DAO from personal liability for their role as a DAO representative.  

   ---

2. Implementing an enhanced risk monitoring approach that includes an AML CTF program and transaction monitoring tools. This will require that Illuvium monitor Illuvidex (and in-game) trade activity, implement measures to detect, prevent and report market manipulation  and report suspicious transactions to VARA. This will require the creation of new tools and workflows for Illuvium, with close collaboration from our technology partners. Epoch 9 council members will work at the vanguard of industry developments, not merely in terms of regulatory efforts but in relation to the tools required to build safe and robust game environments to onboard the next billion crypto customers.  Building the benchmark for GameFi operations will require deep expertise and fearless engagement with GameFi’s most important challenges. 

In light of the above, assuming a role on Illuvium’s IMC as Illuvium contemplates licensure with VARA is, in some ways, different to epochs before now. In others, it is the same. 

What’s the same? The Illuvium Main Council has been and remains the engine room of the Illuvium DAO and the decision making function of the DAO which drives the Illuvium project forward. It directs Labs in its operations, and together, Labs and IMC work tirelessly toward game launch. Individual IMC members have and shall continue to be Illuvium’s key decision makers and collectively responsible for the direction of the DAO. The Illuvium Labs team, as the service arm of the DAO shall continue to work to produce the games and do so at the pleasure and instruction of the IMC. 

What’s changed? Now, as Illuvium contemplates licensure with VARA, IMC members will be asked to KYC (i.e. disclose and prove their identity) and submit details to ensure that they are trustworthy and sufficiently experienced to serve on the council (a Fit and Proper check). Importantly, this is about ensuring that collectively, the IMC, acting together with Labs’ senior management, have sufficient experience and expertise. What we mean by “collectively” is that together, the composition of the council working with Labs’ leadership team should have the required expertise to lead the DAO. 

Individual risk of serving on the IMC is addressed by indemnities offered by the DAO contractually to members of the council. However, IMC members can expect to be known to regulators, and scrutinized to ensure that they are fit and proper to hold a position of responsibility in a regulated web3 project. Individuals serving on the IMC may wish to bolster this protection and may obtain or may already have  professional indemnity insurance. The DAO will continue to explore financially viable insurance options for the added protection of IMC members. 

We understand that building into a regulated environment is an  adjustment and may necessitate careful consideration and deliberation within our governance framework. This process will be approached with the utmost diligence and consideration for the individuals who serve on the IMC.

Conclusion This article summarises the key elements of Illuvium’s regulatory approach and leaves open for discussion the opportunities that may be found in being early in the game of regulation, an agenda that the IMC encourages and one that we acknowledge is far from certain and clear. New legal regimes are not without growing pains. Despite the challenges of aligning business with new legal paradigms, the most important work to be done by the Council this coming epoch is to prepare the DAO so it may harness those opportunities. At this stage, no specific decisions have been made, and Illuvium retains the autonomy to choose the path that aligns best with our project's goals and values. The decision-making process will be conducted thoughtfully, with a commitment to transparency and community involvement.

Illuvium's exploration of regulatory possibilities is a reflection of our commitment to the long-term success and sustainability of our project and the safety of our gamers. While we navigate this uncharted territory, we appreciate the continued support and trust of our community.

As we embark on this regulatory journey, we look forward to collaborating with VARA, maintaining transparency, and ensuring that Illuvium remains a beacon of possibility, where innovation, trust and decentralization converge in immersive and exciting gameplay. .

Appendix A: A Summary of Recent Regulatory Trends in Web3 

Jurisdictions around the world are advancing progress toward regulating crypto. Some faster than others.  Implementation is the last phase of the policy-to-law development process. Once laws are in place (or if laws exist however their application is uncertain), organizations have a choice to make: comply, exclude themselves from that market entirely, or remain willfully non-compliant. Each option presents a different risk profile, and different costs and benefits.

Within DeFi, arguably the most oppositional sector of crypto with respect to regulation, an increasingly common approach is to block front end access (geoblocks) or contractually prohibit access to protocols. However, whether measures taken to expressly exclude specific customers (e.g. from jurisdictions which ban your operations or in which you are unregistered/unlicensed/unregulated) are sufficient to provide legal protection is largely unknown and untested in jurisprudence and requires monitoring. Increased prevalence of DeFi protocols adopting front end mechanisms to restrict access, scrutinize and block wallets or expressly prohibit customers from specific countries in their T&Cs suggests increased conservatism, or at least awareness of the long arm and ire of the US and its enforcement agencies including the SEC (e.g. Synthetix, GMX, DyDx, Aave, Uni,, Pancake, Paraswap, and 1Inch). 

Impending regulation 

The prevailing thematic is one of impending implementation of crypto market regulation in financial hubs and trading blocks around the world that are early to the activity of implementation (UAE, EU), having already passed laws, and in so doing surpassed other jurisdictions that are late to the party or embroiled in legal actions (US, AU). There are also those countries that have recently narrowly delineated what type of activity they will permit and license (HK) and those countries that while ostensibly permissive of crypto market activity, are increasingly considered so in name only and not in deed (Singapore). Meanwhile efforts to harmonize crypto market regulation mature with recent contributions from ISOCO and FATF. These are important trends to remain across as crypto businesses contract, conserve and source capital and generally look for safe ports to build and weather the winter from within. 

Simultaneously, astute crypto businesses recognise the cooling of popular and political support toward our industry, progression of crypto law standards and frameworks globally and with it, the necessity of seeking regulator approval in one but oftentimes, more than one jurisdiction alone. It is the dawn of a new era in which projects that are regulated may outperform those that are not. Time will distinguish whether this is supposition or fact. However, undeniably, the sun has set on deliberate ignorance as to regulation. The incontrovertible truth is this: a regulatory approach (ignore, embrace, avoid) is a must-have part of overall strategy.

Increased regulator presence and strengthening of global standards: 

Like all crypto market participants, it is incumbent on Illuvium to be aware of key regulator interactions with, and enforcement actions against other projects, which is why in the US the Binance and Coinbase SEC lawsuits and shuttering of Banbridge DAO are of importance, as are the favorable Ripple Order recently handed down (and appeal activities), as well as legislative developments of Lummis Gillibrand and McHenry Thompson draft bills which introduce federal crypto market regulatory frameworks. Equally, recent legislative developments in the EU and international harmonization and standard setting efforts attest to the impending implementation of crypto regulation in key markets and strengthening of global standards. In the EU, ESMA has begun and shall continue to publish technical standards to support the implementation of harmonized crypto market regulation under MiCA, which shall come into force in 2024. Eagerly awaited is guidance on the applicability of MiCA to NFT collections. MiCA does not apply to crypto assets that are unique and not fungible. However, crypto assets published in a large series or collection is suggestive of their fungibility. The mere attribution of a unique identifier to a crypto-asset is not, in and of itself, sufficient to classify it as unique and non-fungible.

 International developments to harmonize and strengthen regulatory efforts in respect of crypto markets (by IOSCO, FSB, BCBS) and AMLCTF laws are advancing. IOSCO’s crypto market regulatory principles  align with FSB and BCBS efforts’, and are expected to be formalized later this year. Through its 130-member states, IOSCO seeks to precipitate legislative reform of virtual asset service providers (VASPs) on an activity basis (the same basis which is adopted by VARA) across the developed world. 

In relation to AMLCTF laws, FATF extended its AMLCTF measures to VASPs and virtual assets (VAs) and has published a report documenting lagging global efforts to implement those measures. The report finds that countries have struggled to implement fundamental requirements such as enacting laws to regulate VASPs and to implement the Travel Rule.  Adoption rates have been poor, which, it is expected will increase FATF scrutiny on countries that have not moved to regulate VASPs/VAs and implement FATF measures, and will be spurred  to do so in the coming 12-18 months. In Australia and elsewhere we can expect to see AMLCTF laws to be strengthened and amended to require all VASPs to KYC customers, including where those VAs are NFTs. Eventually projects that do not currently KYC or sanctions check customers will inevitably be required to do so and with penalties attached if this is not done. 

Early signs that consumer confidence correlates with regulatory certainty and investor interest 

Does consumer confidence in a project follow regulatory certainty? What about investor interest? In the long run, our prediction is that those with regulatory certainty will outperform those that don't. This is true in crypto as it is in other markets where entire industries have succumbed or evolved to meet regulatory shifts (e.g. taxis to Uber, coal manufacture to clean energy policy, tradfi to increased banking regulation post GFC). We are beginning to see early signs of investor interest in compliance and regulated projects and In the immediate term, it is undeniable that markets are incredibly sensitive to regulatory certainty, or the lack thereof. For example, XRP rallied 30% and boosted the entire crypto market immediately upon release of the SEC v Ripple decision. Without the type of certainty born from an appeal to the Second Circuit Court, NYC District Court’s decision cannot yet serve as a go-to-market playbook for US based projects, so the strength of the decision and its market impact should be taken with a grain of salt. However, encouragingly, early SEC appeal efforts have been blocked but have not been exhausted entirely. Inversely, lack of regulatory clarity, or jumbled messaging about licensing can reduce confidence. For example, online casino Rollbit stated publicly that it is licensed in Curacao for gaming but the veracity of its statements were publicly questioned by those familiar with the licensing process there. In light of this, RLB suffered a 20% drop amid public concerns. Rollbit has as a result taken steps to clarify its position and identifies on its site those activities that are and aren't licensed. These are two recent examples of market sensitivity to regulatory matters, short term, at an individual project level and at an industry wide one with more substantial and far reaching implications. Granted, there are many other factors which impact investor confidence. Undeniably, the long term impact of regulatory certainty is unknown as it is too early to tell. Crypto businesses do not have the luxury of operating from within or across developed regulatory frameworks to discern the long term  relative advantages and disadvantages of different regulatory approaches, which may only be known in the fullness of time.