5 Travel Rule Issues and How to Solve Them

The Financial Action Task Force’s (FATF) Travel Rule is an international standard designed to improve transparency in virtual asset transfers. It requires virtual asset service providers (VASPs) and other obliged entities to collect, hold and transmit specified information about the originator and beneficiary of a transaction.

However, implementing the Travel Rule presents several challenges. Although the FATF establishes the international standard, national laws and regulations determine how its requirements apply in practice. VASPs must therefore navigate differences in regulatory requirements, identify counterparties, exchange information securely and manage transactions involving self-hosted wallets.

5 Travel Rule Issues with Solutions for VASPs

Issue 1: Different Interpretations of the Travel Rule

The FATF Travel Rule is an international standard, not legislation that automatically applies to VASPs in every country.

Each jurisdiction implements the FATF requirements through its own laws and regulations. This can result in differences in:

• Implementation dates.
• Transaction thresholds.
• Required originator and beneficiary information.
• Beneficiary data verification.
• Self-hosted wallet requirements.
• Legal person identification.
• Data retention.
• Domestic versus international transfers.
• Requirements for missing or incomplete Travel Rule information.

For example, the United Kingdom has required cryptoasset businesses to collect, verify and share Travel Rule information since 1 September 2023, while its wider cryptoasset regulatory framework is being expanded, with the new regime expected to come into force in October 2027.

These differences create operational challenges for VASPs serving customers across multiple jurisdictions. A compliance process that meets the requirements in one country may not satisfy those applicable to another.

Solution: Assess Jurisdiction-Specific Requirements

VASPs should assess the requirements applicable to each transaction, taking into account the jurisdictions involved, the transaction value, the type of transfer and the parties involved.

A Travel Rule solution should support the collection and exchange of the information required by the applicable regulatory framework. It should also allow compliance teams to apply appropriate controls when information is missing, incomplete or cannot be verified.

VASPs should regularly review regulatory developments to ensure their compliance processes remain aligned with changing requirements.

Explore Travel Rule Requirements by Jurisdiction

Issue 2: Choosing the Right Travel Rule Solution

Travel Rule solutions differ in their functionality, security architecture and ability to support compliance workflows. Selecting a solution that lacks essential capabilities can create compliance gaps, increase manual workloads and disrupt transactions.

Some limitations may be inconvenient, while others can prevent a VASP from meeting its regulatory obligations. Examples include:

• Insufficient data retention controls.
• Limited support for virtual assets.
• Inability to exchange required Travel Rule information before or alongside a transaction.
• Inadequate counterparty identification and due diligence capabilities.
• Limited support for self-hosted wallet verification.
• Insufficient control over sensitive customer information.
• Inadequate handling of missing or incomplete Travel Rule data.

A solution must do more than transmit information. It should support the compliance processes surrounding a transaction, from identifying the counterparty to applying the necessary checks and retaining appropriate records.

Solution: Evaluate Compliance, Security and Operational Requirements

The FATF’s guiding questions for Travel Rule solution providers offer a useful starting point when evaluating available solutions. VASPs should assess whether a solution meets their regulatory obligations, supports their business requirements and provides the necessary security and data management controls.

Key considerations include:

• Regulatory coverage: Can the solution accommodate the Travel Rule requirements applicable in the jurisdictions where the VASP operates?
• Data exchange: Can required information be collected, transmitted and received securely and at the appropriate stage of a transaction?
• Counterparty identification: Can the solution identify the relevant VASP and establish where Travel Rule information should be sent?
• Self-hosted wallets: Does it support appropriate methods for verifying wallet control where required?
• Data retention: Can the VASP retain and manage records in accordance with applicable legal obligations?
• Data protection: Does the solution provide sufficient control over sensitive customer information?
• Operational reliability: Can it support the VASP’s transaction volumes and compliance workflows?

VASPs that already use a Travel Rule solution but identify missing functionality should discuss potential improvements with their provider. If the required capabilities cannot be implemented, they may need to consider an alternative solution.

Issue 3: Counterparty Connectivity and Discovery

Travel Rule compliance requires VASPs to exchange information with the relevant counterparty. However, there is no single global Travel Rule network used by every VASP.

Different counterparties may use different Travel Rule solutions and networks. A VASP therefore needs a reliable way to identify the destination service provider and establish how the required information can be exchanged.

Counterparty discovery presents a separate challenge. A blockchain address generally does not identify the VASP that controls the destination account. A sending VASP may know where the virtual assets are being sent on the blockchain but still lack the information needed to identify the receiving service provider.

Without effective connectivity and discovery mechanisms, VASPs may face delays, additional manual work and difficulties completing compliant transactions.

Solution: Use Reliable Counterparty Discovery and Connectivity

A Travel Rule solution should help VASPs determine where virtual assets are being sent, identify the relevant VASP or other obliged entity and establish where the corresponding Travel Rule information should be transmitted.

When evaluating a solution, VASPs should consider whether it can:

• Identify the relevant counterparty using available transaction and destination information.
• Exchange information securely with supported counterparties.
• Support connectivity to relevant industry networks.
• Facilitate counterparty due diligence and the application of appropriate risk controls.

Access to established networks can help VASPs connect with a wider range of counterparties without developing and maintaining every integration independently.

For example, the TRUST network connects participating VASPs through a dedicated Travel Rule framework with defined onboarding and due diligence requirements. 21 Analytics provides native, plug-and-play support for TRUST, enabling eligible customers to connect to the network without developing an in-house integration.

Issue 4: Self-Hosted Wallet Verification

Self-hosted wallets allow customers to control their own private keys without relying on a custodial service provider. Unlike transactions between two VASPs, transfers involving self-hosted wallets may not have a second regulated intermediary available to exchange Travel Rule information.

Depending on the applicable jurisdiction, VASPs may need to collect additional information or verify that a customer controls the destination wallet.

This creates practical challenges for both customers and compliance teams. Not all wallets support the same verification methods, and some processes can be time-consuming, costly or difficult for less technically experienced users.

For example, a Satoshi Test requires an on-chain transaction to demonstrate control of an address, potentially incurring network fees and delays. Manual signing requires a compatible wallet and the ability to sign a message using the relevant private key. Visual proofs, such as screenshots, may be easier to submit but can be manipulated and typically require manual review.

Solution: Offer Secure and Accessible Verification Methods

VASPs should select a Travel Rule solution that supports appropriate wallet verification methods for their customers, supported assets and regulatory requirements.

Available methods include:

• Cryptographic signatures: Customers sign a message using the private key associated with the relevant address, allowing the VASP to verify control without an on-chain transaction.
• Satoshi Tests: Customers initiate a small blockchain transaction to demonstrate control of an address.
• Visual proofs: Customers submit screenshots or video evidence, which the VASP reviews manually.
• Automated verification: Protocols such as AOPP automate the generation and submission of cryptographic wallet ownership proofs where the required support is available.

The appropriate method depends on factors including security requirements, wallet compatibility, transaction costs and the customer experience. Cryptographic proof methods generally provide stronger evidence of address control than screenshots or video clips.

21 Analytics' AOPP Portal automates wallet ownership verification and supports more than 540 wallets, including BitBox, Jade, Ledger, Trezor, MetaMask, Phantom and TronLink. Where supported, customers can complete verification in a few clicks, with the resulting proof automatically delivered to the VASP's Travel Rule solution.

Issue 5: Data Protection and Information Security

Travel Rule compliance involves collecting, processing, storing and exchanging sensitive customer information. When combined with publicly visible blockchain activity, this information can reveal significant details about a customer's financial activities.

VASPs must therefore consider data protection and information security alongside their AML/CFT obligations.

The General Data Protection Regulation (GDPR), for example, establishes principles governing the processing of personal data, including purpose limitation, data minimisation, storage limitation, integrity and confidentiality. Other jurisdictions impose their own data protection and information security requirements.

Selecting a Travel Rule solution without adequately assessing its data handling practices can expose a VASP to additional risks. Relevant considerations include:

• Where Travel Rule data is stored.
• Who can access customer information.
• Whether the solution provider can access the data.
• How information is transmitted and protected.
• How long records are retained.
• How data is deleted when no longer required.
• Which data protection laws apply to the transaction.
• How third-party service provider risks are managed.

These considerations are particularly important when customer information crosses jurisdictional boundaries or when a VASP relies on an externally hosted service.

Solution: Prioritise Data Control and Security

VASPs should evaluate the security architecture of their Travel Rule solution and determine whether it provides sufficient control over sensitive customer information.

An on-premises solution allows a VASP to deploy the software within its own infrastructure or controlled environment. This can help the organisation retain control over where data is stored, how long it is retained and which parties can access it.

By contrast, a software-as-a-service (SaaS) solution may involve storing or processing customer information within a third-party environment. The associated data access, contractual arrangements and security responsibilities should be assessed carefully before implementation.

The appropriate deployment model depends on the VASP’s risk assessment, regulatory obligations and operational requirements. Regardless of the model selected, the organisation remains responsible for ensuring that its data processing and security arrangements meet applicable requirements.

21 Analytics' 21 Travel Rule is designed for on-premises deployment, allowing VASPs to retain control of their Travel Rule data within their own infrastructure. Customer data is not shared with 21 Analytics, helping organisations maintain control over sensitive information while operationalising their Travel Rule compliance processes.

Read: The General Data Protection Regulation (GDPR) and Travel Rule

For every issue presented by the Travel Rule, 21 Travel Rule has a solution. Contact us and find out how you can tackle the Travel Rule and its challenges with ease.