When someone sends crypto, the blockchain logs the wallet addresses and the transfer. It doesn't say who owns or controls those wallets. That's a problem for regulators and for crypto businesses: a transaction can be fully visible and still tell you nothing about the people behind it. The crypto travel rule is meant to close that gap. It requires regulated crypto businesses to collect and share sender and recipient information when certain transfers happen.
The rule belongs to the wider framework for anti-money laundering (AML) and financial crime prevention, and the details change from country to country. That affects how exchanges, VASPs and ordinary users handle transfers. This guide covers where the rule comes from, what information has to be shared, how it works in practice, and how requirements differ between jurisdictions. It's general information, not legal advice. Rules change, so businesses should check what applies to their own activities.
Where the crypto travel rule comes from
The Travel Rule didn't start with crypto. It comes from the Financial Action Task Force (FATF) framework for stopping money laundering and terrorist financing. FATF Recommendation 16 requires certain information to accompany wire transfers. In 2019, FATF extended similar requirements to virtual assets and virtual asset service providers (VASPs) through Recommendation 15 and its Interpretive Note.
FATF sets international standards. It doesn't license or supervise crypto businesses itself. Each country decides how to put those standards into national law, so there's no single worldwide travel rule. Adoption keeps spreading, though. In its July 2026 update on virtual assets and VASPs, FATF reported that 83% of surveyed jurisdictions had passed travel rule legislation, up from 73% in 2025. It also noted that supervision and enforcement are still uneven.
What information must be transferred?
Under the FATF Travel Rule requirements, the originating VASP generally needs to obtain and hold information about the originator, including:
- Name
- Account or wallet information
- An additional identifier, such as:
- Address
- National identity number
- Customer identification number
- Date and place of birth
The information is then provided to the beneficiary VASP.
FATF has allowed jurisdictions to apply a USD/EUR 1,000 de minimis threshold, below which a shorter set of information may apply. This is not a universal exemption: countries can use different thresholds or apply the requirements to all covered transfers. FATF's 2025 revision of Recommendation 16 also expands the information required for larger transfers, including the date of birth of individual originators and the beneficiary's country and town. Countries have until the end of 2030 to implement the revised requirements.
Who must follow the travel rule and how it works
The rule generally covers businesses that fit local definitions of regulated crypto service providers. FATF says VASP, the European Union says crypto-asset service provider (CASP), and other jurisdictions use their own terms. Exchanges and custodial wallet providers are the clearest cases. Brokers, payment processors and OTC desks may also fall under the definition. What counts is the service a business provides, not the label it uses. FATF has also stressed that some arrangements described as decentralized can still be covered if a person or business has enough control or offers covered services.
The travel rule is one piece of crypto compliance. It doesn't replace know-your-customer (KYC) checks, transaction monitoring, sanctions screening or suspicious transaction reporting. KYC establishes who the customer is. The travel rule makes regulated businesses share relevant information with each other when a covered transfer takes place.
How does a travel rule transaction work?
Take a simple case. Ana withdraws crypto from Exchange A to Ben's account at Exchange B.
- Ana starts the withdrawal from Exchange A to Ben's account at Exchange B.
- Exchange A recognizes that the destination belongs to another regulated platform.
- Exchange A gathers the required information and sends a travel rule message to Exchange B.
- Exchange B checks that information against Ben's account and its own compliance controls.
- If everything checks out, Exchange B releases the assets.
When information is missing or doesn't match, the receiving business may hold, reject or escalate the transfer.
The travel rule message doesn't travel on the blockchain. The two businesses swap the data through separate compliance systems. The common data model is IVMS 101, released in 2020, which defines standard fields so different systems read the information the same way. No single network connects every VASP, so interoperability is still a practical headache.
Self-hosted wallets and different national rules
Self-hosted (or unhosted) wallets raise extra questions. There's no regulated business on the other end to receive a travel rule message. Even so, a transfer between a regulated exchange and a customer's own wallet can trigger information-collection and risk-based requirements. FATF guidance says VASPs should collect originator and beneficiary information for transfers involving unhosted wallets and apply suitable controls. A purely peer-to-peer transfer with no VASP involved generally sits outside the traditional AML perimeter.
Some jurisdictions go further. Under the EU's Regulation (EU) 2023/1113, CASPs must keep information on transfers involving self-hosted addresses. For transfers above EUR 1,000, the CASP must assess whether its customer owns or controls the address. The regulation doesn't generally require the CASP to identify whoever is behind an external address. The focus is on whether its own customer controls it. In practice that can mean a signed message, a small test transaction, or evidence the address was used before. The exact method depends on the business and its risk controls.
Requirements differ a lot between jurisdictions. The EU applies its crypto transfer rules to covered transfers whatever the value, while others use different thresholds. Singapore and Australia have their own frameworks, and some of their obligations depend on whether a firm sends, receives or intermediates a transfer. These gaps matter most in cross-border transactions, where a business may need to meet the rules of more than one jurisdiction for the same transfer.
What the travel rule means for crypto users
For users, compliance often means handing over more information when depositing or withdrawing. A platform might ask for the recipient's full name, details about the receiving exchange, or proof that a self-hosted wallet is yours. Transfers can be delayed when details don't line up. A recipient name typed in by the sender, for instance, may differ from the name the receiving platform has verified.
A sanctions-screening alert can also trigger extra review. A match isn't automatically proof that someone is sanctioned. Unrelated people share names, and systems record them in different ways. Compliance teams look at dates of birth, addresses or ID numbers to work out whether a match is real.
Privacy is the other big concern. Travel rule data is generally exchanged between regulated businesses, not written to the blockchain. In the EU, Regulation 2023/1113 requires processing to comply with GDPR and limits use of the data to preventing money laundering and terrorist financing. It also sets retention requirements and safeguards against unauthorized disclosure. The hard part is balance: businesses need enough information to comply, but they also have to protect it from unnecessary collection, misuse or exposure.
Travel Rule compliance: What crypto businesses need to consider
Compliance starts with knowing exactly where your obligations apply. A useful way in is to map out:
- Jurisdictions where the business operates or serves customers
- Applicable transaction thresholds
- Required data fields
- Self-hosted wallet requirements
- Rules for cross-border transfers
- Procedures for counterparties that can't receive travel rule information
That last item is often called the sunrise problem. One jurisdiction requires the travel rule, but the destination jurisdiction or counterparty hasn't implemented compatible requirements. The firm may still have to collect and retain the information, then make a risk-based call on whether the transfer goes ahead.
Technology helps. Businesses may connect to several travel rule networks, use vendors for messaging and screening, and rely on blockchain analytics to judge whether an address is likely tied to a regulated service. None of it removes the need for human review when information is incomplete or a possible sanctions match appears.
Firms should also document every decision to release, hold, reject or escalate a transaction. Hiring a third-party provider doesn't necessarily move regulatory responsibility off the regulated firm. The travel rule is still evolving, and national implementation will keep shifting. The FATF’s 2026 findings show that legislation is becoming more common, but that effective supervision and enforcement remain uneven. Ultimately compliance depends on who is involved, where they are located, the services provided and the regulatory regime under which the transfer takes place.
Tanya Petrusenko
Disclaimer: All materials on this site are for informational purposes only. None of the material should be interpreted as investment advice. Cryptocurrency investments involve significant risk of loss. Please note that, despite the nature of much of the material created and hosted on this website, HODL FM operates as a media and informational platform, not a provider of financial advisory services. The opinions of authors and other contributors are their own and should not be taken as financial advice. If you require advice, HODL FM strongly recommends contacting a qualified industry professional.
