Notary consensus on Fil+ best practice

[MegTei]

Problem - Notary due diligence best practice
Notaries are required to perform due diligence on new Fil+ applications. Without best practice, process or any training, due diligence outcomes vary in consistency and quality, and this is contributing to issues with datacap in the life of the application.
The directive up until now has been that notaries need to define their own way/ process. At times, the lack of quality and best practivce due diligence up front is one of the contributors to issues later in the application resulting in high effort and friction. It's making an already high touch process even more unsustainable/ not scalable.

Community consensus is required
Some standards, or a code, may reduce some of the issues experienced in the life of datacap tranches guiding notaries to do a better/ more consistent job up front. Including how to adjust for cultural KYC and DD that varies per region.

Call to action: Discussion to lead to consensus

1. What risks are we mitigating?
   Lets first start with why - our (notary) purpose: this is directed to @galen-mcandrew @dkkapur @raghavrmadya
   The following risks (correct me if I am wrong/ missed anything) are what the Fil+ notary social trust layer was designed to manage:
   1.1 Reputational - if observers don’t perceive that the network is useful
   1.2 To uphold a good reputational perception that rewards are not disproportionate by any participant abusing the design of the program that results in profiteering.
   1.3 Abuse exposure is simplified through the program scope limited to public datasets and for every action to be transparent

Note @raghavrmadya the original intent of the layer of social trust did not include KYC on sponsor/ organisation. The logic was, due diligence is performed on a data project level, it is the recent private data applications that have introduced the need to verify KYC.
Does the Fil+ public data process and app need to evolve to include some form or KYC?

2. Seeking some notaries to describe the process/ methods you use to be satisified you have performed adequate KYC:
   (Include the questions you ask, checks performed, what red flags you look for...)

The desire is to discuss views at the next Governance call

[raghavrmadya]

Hi @MegTei , thank you for opening this discussion. I agree that we need better community consensus on best practices for conducting due diligence. I would like to point out that the role of notaries goes beyond reputation and perception management to ensuring the conception of the program as well where each notary must make an active effort to ensure that every DataCap application that is passing through them is accretive to the Filecoin network. Each notary was required to outline their approach and plan for due diligence in their application to become a notary and from the perspective of the governance team, the expectation is that if a notary puts that plan to act as outlined in their application, if elected.

[bmcnabb25]

I know when our team was applying to be a notary, to define our due diligence strategy we looked at the applications of ~20 existing notaries to see their evaluation criteria. We then picked what we thought were reasonable requirements/criteria, and created our own custom evaluation framework. I would assume other notary applicants did the same. Essentially spending a lot of time trying to figure out what a standard or best practice evaluation framework for performing due diligence might look like for when they eventually become notaries.

If we were to go ahead and define this standard due diligence framework, it wouldn't have to be required. Existing notaries can continue to evaluate applications based on the evaluation criteria they outlined in their applications. However, it would be helpful for future notaries onboarding to have some standard, best practices to reference when defining their evaluation criteria. I would also assume that slowly transitioning to a more standardized due diligence framework would help clients better understand what is expected of them before submitting an application, ensure more consistent approvals of high quality datacap applications, more consistent rejections of low quality datacap allocations (that may lead to problems down the line), and speed up time to datacap

[raghavrmadya]

I agree that the original intent of the layer of social trust did not include KYC on sponsor/organization but the amount of instances of abuse + lack of due diligence from notaries has forced the governance team to add KYC as an additional step. I agree that due diligence should be primarily performed on a data project level but even for public datasets, it has always been challenging to do so due to a number of factors - lack of data samples from clients, lack of SP allocation plan, lack of justification for the amount of DC being requested, lack of evidence for a legitimate relationship between the applicant and the data owner, lack of information of retrievals, etc. In such instances, KYC becomes a much needed, if not desired, step in the process.

[dannyob]

Is that true, @raghavrmadya ? As a notary, I've always seen and worked to establish who the provider of content is, because we saw a lot of early attempts at abuse in this area. I don't remember the governance team pushing me into adding that step, though perhaps it was included in the questions about the last notary election.

Also, I think it would be beneficial for us to choose another term in this discussion. KYC has a particular meaning in financial services to defeat money-laundering (see KYC), and is legally mandated.

I believe what we're talking about here is establishing that:

1. The request for datacap is coming from who it claims to be.
2. (Possibly in addition -- we should at least clarify this) that the datacap request is separate institution from any storage provider who might benefit from the deal.

[bmcnabb25]

Been reading through a lot of LDN applications recently, and noticed that this was a pretty common question for clients: filecoin-project/filecoin-plus-large-datasets#490 (comment)

So is this going to be something that notaries are expected to ask moving forward, to help verify that the request for datacap is coming from the individual/entity they claim to be (i.e. an informal "KYC")? A default/standard question while performing due diligence?

[bmcnabb25]

I think it would be beneficial to put together a guide(s) explaining:

• How notaries navigate and use the Filplus registry app
• The various stages / labels of an LDN application, and the actions required by notaries at each stage
• How to leverage some of the tools for performing due diligence (for example, how can a notary verify the datacap allocation for a client before allocating the next round of datacap [DataCap Application]Meizhai Technology filecoin-plus-large-datasets#75 (comment))

Detailing these processes would be helpful for new notaries onboarding, and I assume would be a good reference for existing notaries.

[MegTei]

HI Brandon, yes agree with you there.
@raghavrmadya lets find some time next week perhaps also with @AlexxNica who has been working in the process space to draft something up we can put back to the community

[sxxfuture-official]

Maybe we can all work together in the community to develop a relatively fair plan for everyone to refer to.