The travel rule is an anti-money-laundering requirement under which virtual asset service providers must collect, verify and transmit identifying information about the originator and the beneficiary of a transfer, so that the information travels with the funds from one provider to the next. It applies to crypto exchanges, custodial wallets and similar businesses, and it mirrors the long-standing rule for bank wire transfers.
Among crypto security & rules, the travel rule is the obligation that most directly changes how transfers work in practice. It closes a gap in which a blockchain transaction carries only addresses and amounts, leaving the receiving provider unable to screen the sender against sanctions lists or detect suspicious patterns.
Origin and legal basis of the travel rule
The rule comes from FATF Recommendation 16 on wire transfers, which has applied to banks for decades. In 2019 the FATF extended it to virtual asset service providers through its interpretive note to Recommendation 15, and member jurisdictions then translated the standard into national or regional law.
| Jurisdiction | Legal instrument | Threshold | Notable feature |
|---|---|---|---|
| FATF standard | Recommendations 15 and 16 | USD or EUR 1,000 recommended | Sets the global baseline |
| European Union | Transfer of Funds Regulation (EU) 2023/1113 | No threshold between providers | Applies from 30 December 2024 |
| United States | Bank Secrecy Act recordkeeping and travel rule | USD 3,000 | Treats many crypto businesses as money transmitters |
| United Kingdom | Money laundering regulations, amended | EUR 1,000 equivalent for full data | In force since September 2023 |
| Switzerland | Anti-money laundering ordinance of the supervisor | No threshold | Strict rules for self-hosted wallets |
In the European Union, the travel rule works alongside MiCA, which licenses crypto-asset service providers. A provider that holds a MiCA authorization must also comply with the transfer of funds regulation for every transfer, regardless of amount.
What information must travel
The required data set is standardized but not identical everywhere. In general, the originating provider sends full originator information and the beneficiary name and account identifier, while the receiving provider checks the beneficiary data against its own customer records.
| Party | Required information | Purpose |
|---|---|---|
| Originator | Name, account or wallet address, and address or national identifier or date and place of birth | Identify the sender |
| Beneficiary | Name and account or wallet address | Confirm the intended recipient |
| Originating provider | Identity of the sending service | Locate the counterparty for inquiries |
| Transfer | Amount, asset and transaction reference | Match data to the on-chain transfer |
Providers exchange this data off-chain, because writing personal data to a public blockchain would violate privacy and data protection law. The industry uses a common data model, IVMS 101, and several messaging protocols that let providers discover each other, verify identity and exchange encrypted records before or at the time of the transfer.
How compliance works in practice
A compliant transfer follows a fixed sequence. The sending provider identifies whether the destination address belongs to another regulated provider, a self-hosted wallet or an unknown party. It then sends the required data through a travel rule protocol, waits for confirmation, and only then broadcasts the transaction.
- Counterparty discovery: determine which provider controls the destination address.
- Due diligence on the provider: confirm it is licensed and able to protect personal data.
- Data exchange: send originator and beneficiary information in an encrypted message.
- Screening: both providers check names against sanctions lists and risk indicators.
- Decision: the receiving provider accepts, holds, returns or rejects the incoming funds.
Transfers to and from self-hosted wallets follow different rules. Under the EU regulation, a provider must collect originator and beneficiary information for such transfers and, above 1,000 euros, take steps to verify that the customer actually owns or controls the private wallet, for example through a signed message or a small test transaction.
Related rules and how they differ
The travel rule is one element of a wider compliance framework. It depends on customer identification and feeds into screening, but it is not the same as either.
| Rule | Focus | Relation to the travel rule |
|---|---|---|
| KYC | Identifying the provider’s own customers | Supplies the originator data that travels |
| AML program | Detecting and reporting money laundering | Uses travel rule data in monitoring |
| Sanctions screening | Blocking listed persons and entities | Runs on both originator and beneficiary data |
| MiCA | Licensing and conduct of crypto providers | Separate law applied in parallel in the EU |
| Bank wire travel rule | Information on fiat payment transfers | The original model for the crypto rule |
Challenges and common pitfalls
The biggest practical difficulty is the sunrise problem: jurisdictions adopted the rule at different times and with different thresholds, so a provider in a strict country may need to send data to one in a country without any obligation. Providers must then decide whether to proceed, delay or refuse the transfer under a documented risk policy.
- Protocol fragmentation means two providers may use incompatible messaging systems.
- Address attribution errors can route personal data to the wrong counterparty.
- Data protection obligations apply to every record exchanged, including secure storage and deletion.
- Missing data from a counterparty should trigger follow-up and, if repeated, restriction of the relationship.
- Structuring transfers below a threshold is itself a recognized money laundering indicator.
Supervisors increasingly test travel rule compliance during inspections. A provider should be able to show complete records for each transfer, a written policy for counterparties that cannot receive data, and evidence that missing or inconsistent information led to documented follow-up actions.
Explained without jargon
When you send money abroad from a bank, the bank sends a note with the payment saying who sent it and who should receive it. The travel rule requires crypto exchanges to attach the same kind of note when they move coins for customers.
The note does not go onto the public blockchain. It travels privately between the two companies, so that both can check that nobody on a sanctions list is involved and that the money is not being hidden.
A typical use case
A customer of an exchange licensed in Germany withdraws 2,500 euros worth of USDC to an address. The exchange’s system identifies the address as belonging to a licensed exchange in France and sends an encrypted message containing the customer’s name, account number, address and the beneficiary’s name before releasing the transaction.
The French exchange checks that the beneficiary name matches its own customer record and screens both names against sanctions lists. Both checks pass, so it confirms receipt and the funds are credited within minutes of the blockchain confirmation. A week later, the same customer tries to send funds to a self-hosted wallet; the German exchange asks for a signed message from that wallet to prove ownership and completes the withdrawal only after the signature verifies.