Travel Rule Crypto

The Financial Action Task Force, the global standard-setter for anti-money-laundering rules, adopted the travel rule for wire transfers decades before crypto existed. Recommendation 16 requires a bank sending a wire transfer to attach the originator's name, account number and address, and to pass that data to the receiving bank along with the payment. The rule exists so that investigators can follow money through the banking system the same way a courier's paper trail lets them follow a physical package. SWIFT messages have carried this data between banks since the rule took effect, and more than 200 jurisdictions apply some version of the FATF recommendations today, crypto included.

FATF updated Recommendation 16 in June 2019 to cover virtual asset service providers, requiring the same sender and recipient data on a crypto transfer above a threshold FATF set at 1,000 euros or dollars. A crypto transfer moves directly between wallets on a blockchain, with no shared messaging network like SWIFT built in to carry the compliance data alongside it. Exchanges and custodians had to build new systems to exchange this data with each other, and dozens of competing technical standards emerged before the market settled on a handful of interoperable protocols.

The EU implemented the travel rule through the recast Transfer of Funds Regulation, Regulation (EU) 2023/1113, in force since 30 December 2024. Unlike FATF's own recommended threshold, the EU version applies to every crypto-asset transfer between CASPs, with no minimum amount at all. A CASP acting as the originator has to collect the sender's name, account or wallet identifier, and address or other identifying number, and send it to the beneficiary's CASP before or alongside the transfer; a CASP receiving a transfer has to check that the required data arrived and hold the transfer back if it did not. The same regulation extended the older wire-transfer travel rule to intermediary CASPs as well, so a transaction that passes through more than one provider on its way to the recipient still carries its full data trail at every hop.

A transfer to or from a self-hosted wallet, one a person controls without a CASP's involvement, raises a harder case: there is no receiving provider to send data to. Under the EU rules, a CASP handling a transfer above 1,000 euros to or from a self-hosted wallet has to assess whether the address is owned or controlled by its own customer, using means such as an address ownership check. This assessment does not prohibit transfers involving a third party’s wallet. Below that threshold, the CASP still applies its own risk-based checks even though the strict verification duty does not apply.

Compliance under MiCAR, which includes the travel rule obligations that came into force alongside it, was the topic of a senior policy director's talk at the Bybit EU Crypto Evening at TechQuartier, an event Finance Loop supported. MiCAR and custody were also on the program of the Forum für Digitale Vermögenswerte, a Finance Loop partner event. The travel rule sits in Finance Loop's Risk & Compliance track. Related pages: CASP license, MiCA in Germany and KYC in Germany.

The travel rule requires a crypto-asset service provider sending a transfer to collect the sender's name and account or wallet details and pass them to the receiving provider, so a transaction can be traced back to a real identity the same way a bank wire transfer can.

No. FATF recommends a threshold of 1,000 euros or dollars, but the EU's Transfer of Funds Regulation applies the travel rule to every crypto-asset transfer between CASPs, with no minimum amount.

A CASP handling a transfer above 1,000 euros to or from a self-hosted wallet has to assess whether the address is owned or controlled by its own customer. This assessment does not prohibit transfers involving a third party’s wallet. Below that amount, the CASP applies its own risk-based checks instead of the strict verification duty.