Key takeaways
- The Travel Rule requires regulated providers to send originator and beneficiary information with qualifying transfers.
- FATF extended it to virtual asset service providers in 2019, recommending a USD/EUR 1,000 threshold.
- Thresholds and details vary: the EU applies it to crypto transfers between providers with no minimum amount.
- Implementation depends on identifying the counterparty provider and exchanging data securely and interoperably.
In traditional banking, when you send a wire transfer, information about who sent it and who is receiving it travels with the payment. This lets banks screen for sanctions, spot suspicious activity and support law enforcement investigations. The requirement is known as the Travel Rule, and it now applies to digital assets too.
Where the Travel Rule comes from
The Financial Action Task Force (FATF), the global standard-setter for anti-money laundering, sets out wire transfer requirements in Recommendation 16. In 2019, FATF updated its standards to apply these obligations to virtual asset service providers (VASPs), such as exchanges, custodial wallets and brokers.
Under the FATF standard, when a VASP sends a virtual asset transfer, it must obtain, hold and transmit required information about the originator and beneficiary to the receiving VASP, and the receiving VASP must obtain and hold that information too. FATF allows countries to set a de minimis threshold of USD/EUR 1,000, below which less information is required.
What information is required
The exact data set varies by jurisdiction, but typically includes:
| Party | Typical information |
|---|---|
| Originator | Name, account number or wallet address, and one of: physical address, national ID number, customer ID number, or date and place of birth |
| Beneficiary | Name and account number or wallet address |
Providers must also screen this information, for example against sanctions lists, and have policies for transfers that arrive with missing or incomplete information.
How jurisdictions apply it
FATF sets the standard; countries implement it in their own laws. Thresholds and details differ, which matters for any business sending transfers across borders.
| Jurisdiction | Approach |
|---|---|
| European Union | The recast Transfer of Funds Regulation applies from 30 December 2024, with no minimum threshold for transfers between crypto-asset service providers |
| United States | Bank Secrecy Act recordkeeping and travel rules apply to transfers of USD 3,000 or more, and FinCEN has stated they cover convertible virtual currency |
| United Kingdom | Applied since 1 September 2023, with a lighter data set below EUR 1,000 |
| Canada | Applied since 1 June 2021 for transfers of CAD 1,000 or more |
| Singapore | Applied to digital payment token transfers of SGD 1,500 or more |
The sunrise problem
Because countries adopted the Travel Rule at different times and in different ways, a provider in a jurisdiction that enforces it may need to send a transfer to a provider in one that does not yet. This is often called the sunrise problem. Providers must decide how to handle these transfers, typically by assessing the counterparty's risk and collecting the information themselves even if the other side cannot receive it.
Unhosted wallets
Not every transfer goes to another regulated provider. Many go to unhosted (self-hosted) wallets controlled directly by individuals. The FATF standard does not require transmitting data to an unhosted wallet, since there is no provider to receive it, but providers are still expected to collect information about their own customer's counterparty and assess the risk.
Some jurisdictions go further. Under the EU regulation, for transfers above EUR 1,000 involving a self-hosted wallet, a provider must take measures to assess whether the wallet is owned or controlled by its own customer.
How the Travel Rule works in practice
Implementing the Travel Rule involves solving three problems:
- Identifying the counterparty. A blockchain address does not reveal who controls it. Providers use address attribution, blockchain analytics and directories to determine whether the destination belongs to another VASP, and which one.
- Exchanging data securely. Personal data must be transmitted confidentially to the counterparty, not written to the public blockchain. The industry relies on messaging protocols and network providers for this, and interoperability between different solutions remains an ongoing challenge.
- Acting on the result. Providers need clear procedures for when information is missing, incomplete or raises red flags: hold, request more information, return or reject the transfer, and consider whether to report.
Why it matters
The Travel Rule closes a gap that would otherwise make digital assets attractive for moving illicit funds. For legitimate businesses, compliance is also a commercial necessity: banks, payment partners and counterparties increasingly expect it, and non-compliant providers risk losing access to the regulated financial system.
For businesses building on digital assets, the practical lesson is to treat Travel Rule readiness as part of product design. Decisions about which networks to support, whether to allow unhosted wallet transfers and how to collect beneficiary information all depend on it.
For a wider view of the controls that sit alongside the Travel Rule, see What a modern crypto compliance program looks like.
This article is general information, not legal, tax or financial advice. Laws and regulatory guidance change frequently and vary by jurisdiction; it reflects our understanding at the time of writing. Seek qualified advice before acting on it.