Travel Rule

What Is the Travel Rule?

The Travel Rule is the requirement that information about the originator and the beneficiary of a transfer must accompany the transfer as it moves between financial institutions. The name comes from the idea that the data "travels" with the payment. In the virtual asset context, it means that a Virtual Asset Service Provider (VASP) sending crypto-assets on behalf of a customer must obtain, hold and transmit specified information about the sender and recipient to the VASP on the receiving side, which must in turn obtain and hold it.

The rule is not new. It originated in the context of traditional wire transfers, where banks have long been required to include originator and beneficiary details with payment messages. In 2019, the Financial Action Task Force (FATF) extended these requirements to virtual assets and VASPs through its standards on new technologies and wire transfers, and that extension is what most people now mean by the Travel Rule.

Why the Travel Rule Matters

Blockchain transactions show addresses and amounts, but not who controls the addresses. Without additional information, a VASP receiving funds cannot tell whether the sender is a sanctioned person, a fraudster or an ordinary customer, and the sending VASP cannot tell who will receive the funds.

The Travel Rule closes part of that gap by putting identity information into the hands of the institutions on both sides of a transfer. This allows them to:

• Screen both parties against sanctions lists before or around the time of the transfer.
• Monitor transactions with knowledge of the counterparty, not just the wallet address.
• Provide law enforcement and Financial Intelligence Units with usable information when investigating suspicious activity.
• Hold or reject transfers where required information is missing.

For VASPs, compliance with the Travel Rule is increasingly a condition of being licensed or registered, and of maintaining relationships with banks and other VASPs.

How the Travel Rule Works

Information Required

Under the FATF standards, the originating VASP should obtain and send, and the beneficiary VASP should obtain and hold, information broadly covering:

• The originator's name.
• The originator's account number or wallet address used to process the transaction.
• The originator's physical address, national identity number, customer identification number, or date and place of birth.
• The beneficiary's name.
• The beneficiary's account number or wallet address.

National rules may specify the data fields differently, and the FATF standards allow countries to apply a reduced set of requirements below a de minimis threshold of USD/EUR 1,000.

The Process in Practice

1. The customer initiates a withdrawal to an external address.
2. The originating VASP determines whether the address belongs to another VASP or to a self-hosted (unhosted) wallet.
3. If the counterparty is a VASP, the originator identifies it and checks it can exchange Travel Rule data securely.
4. The originating VASP transmits the required information, usually before or at the same time as the on-chain transfer.
5. The beneficiary VASP checks the information is complete, screens the parties, and decides whether to credit, hold or return the funds.
6. Both sides keep records of the data and of their decisions.

Self-Hosted Wallets

Transfers to and from wallets not held at a VASP cannot follow the same messaging flow, because there is no counterparty institution to receive the data. Rules generally require VASPs to collect information about the counterparty from their own customer and to apply risk-based measures, and some regimes require VASPs to take steps to verify that the customer owns or controls the self-hosted wallet in certain cases.

Regulatory Expectations

• FATF. Recommendation 15 on new technologies, together with its interpretive note, applies the wire transfer requirements of Recommendation 16 to virtual asset transfers.
• European Union. Regulation (EU) 2023/1113 on information accompanying transfers of funds and certain crypto-assets applies the Travel Rule to crypto-asset service providers. It has applied since 30 December 2024 and does not include a minimum threshold for transfers between providers.
• United States. The Bank Secrecy Act's recordkeeping and travel rules for funds transfers apply to transmittals of $3,000 or more, and FinCEN has stated that they apply to convertible virtual currency transactions conducted by covered institutions.
• United Kingdom. The Money Laundering Regulations 2017 have been amended to apply Travel Rule requirements to cryptoasset businesses.

Implementation varies by country, which creates practical problems when the sending and receiving VASPs are in jurisdictions with different rules or timelines.

Common Challenges

• Counterparty identification. Determining whether a wallet belongs to a VASP, and which one, is not always straightforward.
• Interoperability. VASPs use different messaging protocols and solutions, which may not connect with each other.
• Jurisdictional mismatch. A VASP in a jurisdiction that enforces the rule may send to one where it is not yet in force.
• Counterparty due diligence. VASPs should assess whether a counterparty VASP is licensed and has adequate controls before sending it customer data. See VASP.
• Data protection. Transmitting personal data to another provider, sometimes across borders, raises privacy obligations.
• Incomplete data. Firms need clear policies for what to do when required information is missing or does not match.

How on8.ai Helps

SmartSanction screens people, companies and crypto wallets against sanctions, PEP and other risk sources, so the originator, beneficiary and wallet addresses carried in Travel Rule data can be checked with the reasoning behind each match. See Travel Rule and crypto wallet screening for how this fits into a VASP's compliance flow.

Related Terms

• VASP (Virtual Asset Service Provider)
• Blockchain Analytics
• FATF (Financial Action Task Force)
• Cross-Border Transactions
• Correspondent Banking
• Watchlist