The Travel Rule Explained: Your Guide to Crypto Compliance

The FATF defines a VASP as “any natural or legal person who is not covered elsewhere under the Recommendations, and as a business conducts one or more of the following activities (stated below) or operations for or on behalf of another natural or legal person.”

As defined by the FATF, VASP activities include:

• Exchange between virtual assets (crypto assets) and fiat currencies,
• Exchange between one or more forms of virtual assets,
• Transfer of virtual assets,
• Safekeeping and/or administration of virtual assets or instruments enabling control over virtual assets,
• Participation in and provision of financial services related to an issuer's offer and/or sale of a virtual asset.

Source: FATF (2021), Updated Guidance for a Risk-Based Approach to Virtual Assets and Virtual Asset Service Providers.

Is a VASP a CASP?

A VASP and a are very similar in function except for two differences: the FATF’s definition of a VASP is not as explicit as MiCA’s CASP, nor does it extend to cover crypto advisory services.

MiCA defines a CASP as “any person whose occupation or business is the provision of one or more crypto-asset services - as mentioned above - to third parties on a professional basis.”

See Article 3 Definitions for further information on the topic.

As per the MiCA, CASP activities include: 

• The custody and administration of crypto assets (virtual assets) on behalf of third parties, 
• The operation of a trading platform for crypto assets, 
• The exchange of crypto assets for fiat currency that is legal tender,
• The exchange of crypto assets for other crypto assets, 
• The execution of orders for crypto assets on behalf of third parties, 
• The placing of crypto assets, 
• The reception and transmission of orders for crypto assets on behalf of third parties, 
• Providing advice on crypto assets.

In summary, if a business provides any of the below services to citizens in Europe, it is deemed a CASP: 

• Offering custody and administration of crypto assets on behalf of a third party,
• Offering a crypto exchange service or running an exchange,
• Offering crypto advisory services, or information defined as advice on investing in crypto assets. This does not include portfolio management services.

See Article 3 Definitions for further information on the topic.

Is a VASP a CASP?

A VASP and a CASP are very similar in function except for two differences: the FATF’s definition of a VASP is not as explicit as MiCA’s CASP, nor does it extend to cover crypto advisory services.

MiCA defines a CASP as “any person whose occupation or business is the provision of one or more crypto-asset services - as mentioned above - to third parties on a professional basis” whereas the FATF defines a VASP as “any natural or legal person who is not covered elsewhere under the Recommendations, and as a business conducts one or more of the following activities (stated below) or operations for or on behalf of another natural or legal person.”

The FATF defines a virtual asset as a “digital representation of value that can be digitally traded or transferred and can be used for payment or investment purposes”. The FATF generally does not consider non-fungible tokens (NFT) as virtual assets, but this depends on their characteristics. They may fall under the definition if they are used for “payment or investment purposes”.

Examples of virtual assets include specific currencies like bitcoin and Ether, as well as stablecoins, and the MiCA equivalents asset referenced tokens and electronic money tokens.

Although the FATF has advised member jurisdictions to implement the Travel Rule into their domestic laws as soon as possible, the Travel Rule remains a recommendation and has been implemented at varying intervals.

Some notable jurisdictions that have implemented the Travel Rule include the EU, Switzerland, Singapore, and the UK.

See a global breakdown of the implementation status of the Travel Rule. 

The following jurisdictions have implemented the Travel Rule or a variation thereof. 

• Argentina
• Australia
• Austria
• Bahamas
• Bahrain
• Belgium
• Bermuda
• Botswana
• British Virgin Islands
• Bulgaria
• Canada
• Cayman Islands
• Channel Islands
• Chile
• Croatia
• Cyprus
• Czech Republic
• Denmark
• El Salvador
• Estonia
• Finland
• France
• Germany
• Gibraltar
• Greece
• Guernsey
• Hong Kong SAR
• Hungary
• Iceland
• India
• Indonesia
• Ireland
• Isle of Man
• Israel
• Italy
• Japan
• Kazakhstan
• Latvia
• Liechtenstein
• Lithuania
• Luxembourg
• Malaysia
• Malta
• Mauritius
• Mexico
• The Netherlands
• New Zealand
• Nigeria
• Norway
• The Philippines
• Poland
• Portugal
• Qatar
• Romania
• Serbia
• Seychelles
• Singapore
• Slovakia
• Slovenia
• South Africa
• South Korea
• Spain
• Sweden
• Switzerland
• Taiwan (October 2026)
• Türkiye
• Ukraine
• United Arab Emirates
• United Kingdom
• United States
• Venezuela
• Zimbabwe

Please note this is not a non-exhaustive list and is meant as guidance only.

The Transfer of Funds Regulation (TFR) is the EU's counterpart to the FATF's Travel Rule, and is part of the Anti-Money Laundering Package as well as the MiCA Regulation. 

The TFR covers the transfer of funds, including banknotes, coins, scriptural money, electronic money, and crypto assets, when at least one of the involved payment service providers or CASPs, is established or registered within the EU. This regulation also applies to intermediary CASPs, which are businesses that handle the transfer of crypto assets on behalf of another CASP or intermediary.

The TFR's scope extends to transfers executed via crypto ATMs and self-hosted wallets when a CASP is involved.

However, the TFR does not apply to:

• Cash transactions, paper checks, or electronic money tokens used for payments with cards, electronic money, or mobile phones;
• Tax payments, fines, and similar payments to a public authority within an EU Member State;
• Payment service providers acting on their own behalf (when both the originator and the beneficiary are CASPs);
• Peer-to-peer (P2P) transactions without the involvement of a CASP.

Under the TFR, CASPs are required to collect and share customer information during transactions, including:

• The name of the originator
• The originator’s distributed ledger address,
• The originator’s crypto-asset account number (e.g., account at a CASP),
• The originator’s address (including the country, official personal document number, customer ID number, or alternatively, date and place of birth),
• The current Legal Entity Identifier (LEI) of the sender, where applicable,
• The name of the beneficiary,
• The beneficiary’s distributed ledger address,
• The beneficiary’s crypto-asset account number, and
• The current LEI of the beneficiary, where applicable.

Further reading on the TFR 

• What CASPs Need to Remember about the TFR's Final Version
• The Transfer of Funds Regulation (TFR) Summarised

Looking for a Travel Rule solution that is 100% compliant with the TFR - Try 21 Travel Rule.

As part of its digital finance strategy, the EU Commission introduced a proposal to regulate the markets in crypto assets; enter MiCA. MiCA's objective is to establish a balanced environment for financial institutions and CASPs throughout the EU. MiCA intends to:  

• Protect consumers, investors, and market integrity, 
• Ensure financial stability,
• Provide legal certainty for crypto assets,
• Support fair competition and innovation.

MiCA differs from the Transfer of Funds Regulation (TFR), which is the European Union's implementation of the Travel Rule as

• It does not set a minimum threshold for transfers between accounts,
• It excludes transfers involving self-hosted wallets from its scope,
• Neither does it address activities related to DeFi and DAOs,
• It doesn’t include the lending and borrowing of crypto assets,
• Or cover NFTs. 

MiCA applies to natural and legal persons who issue, offer, and trade crypto assets or provide services related to crypto assets within the EU. 

To read more about MiCA, see the blog posts below: 

• The Markets in Crypto Assets Regulation (MiCA) Tackled
• What Is The Markets in Crypto Assets (MiCA) Regulation?
• Does MiCA Impact Crypto Asset Service Providers (CASPs)?
• Stablecoins in the EU: What Has Changed?
• Stablecoins Are No More: MiCA’s EMTs and ARTs Explained

The difference between the Transfer of Funds Regulation (TFR) and MiCA is that MiCA builds the legal framework for crypto, including CASPs, licensing regimes and definitions, while the TFR only brings the Travel Rule into the European Union.  

The TFR covers the transfer of funds, including banknotes, coins, scriptural money, electronic money, and crypto assets, when at least one of the involved payment service providers or CASPs, is established or registered within the EU. This regulation also applies to intermediary CASPs and transfers executed via crypto ATMs and self-hosted wallets when a CASP is involved.

MiCA differs from the TFR as

• It does not set a minimum threshold for transfers between accounts;
• It excludes transfers involving self-hosted wallets from its scope;
• Neither does it address activities related to DeFi and DAOs;
• It doesn’t include the lending and borrowing of crypto assets;
• Or cover NFTs.

MiCA applies to natural and legal persons who issue, offer, and trade crypto assets or provide services related to crypto assets within the EU.

Read more about the TFR and MiCA below

• What CASPs Need to Remember about the TFR's Final Version
• The Transfer of Funds Regulation (TFR) Summarised
• The Markets in Crypto Assets Regulation (MiCA) Tackled
• What Is The Markets in Crypto Assets (MiCA) Regulation?

Looking for a Travel Rule solution that is 100% compliant with the TFR - Try 21 Travel Rule.

Non-European (foreign) VASPs must comply with MiCA's regulations to offer their services within the EU.

This includes obtaining authorisation from relevant EU authorities and adhering to MiCA’s standards, including consumer protection, transparency, operational resilience, and anti-market abuse measures. Moreover, foreign VASPs must establish a legal presence in the EU, such as a registered office.

If foreign VASPs issue “stablecoins”, they must meet MiCA’s requirements for stablecoin issuers, such as maintaining adequate reserves and adhering to caps on non-EU currency-pegged stablecoins.

Read more about stablecoins in the EU

• Stablecoins in the EU: What Has Changed?
• Stablecoins Are No More: MiCA’s EMTs and ARTs Explained
• The Ultimate Guide to MiCA's Asset-referenced Tokens (ARTs)
• The Ultimate Guide to MiCA's Electronic Money Tokens (EMTs)

Travel Rule thresholds vary from jurisdiction to jurisdiction. The FATF recommends a threshold of EUR 1000. However, some jurisdictions like have a zero threshold.

• Switzerland CHF 0
• The EU EUR 0
• The UK EUR 0
• Australia AUD 0
• Bermuda USD 0
• Brazil BRL 0
• BVI USD 0
• Canada CAD 1000
• Cayman Islands USD 0
• Estonia EUR 0
• Gibraltar EUR 1000
• Hong Kong HKD 8000
• Isle of Man EUR 1000
• Jersey EUR 1000
• Liechtenstein CHF 1
• New Zealand NZD 0
• Pakistan USD 1000
• Serbia RSD 0
• Singapore SGD 1500
• South Africa ZAR 0
• South Korea KRW 0
• Türkiye TL 0
• The UAE AED 0
• The USA USD 3000

Access Travel Rule breakdowns, including thresholds, per country.

As per the FATF Travel Rule, he following information is to be collected and verified by the originator VASP before transacting,

• Originator's name,
• Originator's account number,
• Originator's physical address OR
• Originator's national identity number, or customer identification, or date and place of birth.

With the below information collected and verified by the beneficiary VASP before transacting,

• Beneficiary's name,
• Beneficiary's account number.

The above data is then to be exchanged and held by the reciprocating VASP for transactions amounting to or exceeding EUR 1000. However, these requirements can vary from jurisdiction to jurisdiction. 

What Changes by 2030?

The FATF revised Recommendation 16 in June 2025, introducing additional requirements that countries are expected to incorporate into their domestic frameworks by the end of 2030.

Under the revised framework, additional information requirements include beneficiary address information. For applicable transfers, the beneficiary's address must include the beneficiary's country and town.

The revised Recommendation 16 also introduces requirements relating to:

• verification of beneficiary information;
• identification of legal persons using a connected Business Identifier Code (BIC), Legal Entity Identifier (LEI) or another unique official identifier; and
• greater clarity around payment-chain responsibilities.

This means that the Travel Rule data requirements will become more detailed as jurisdictions implement the revised Recommendation 16. The exact requirements, thresholds and implementation dates may vary between jurisdictions.

Find out more about different implementations of the Travel Rule. 

This varies according to jurisdiction. Usually, VASPs need to retain Travel Rule data for a minimum of 5 years. 

The FATF

The FATF’s Recommendation 11, page 15,  states that customer data (obtained through customer due diligence measures) be retained for five years for recordkeeping and transaction monitoring. The point is reiterated under Recommendation 16 (the Travel Rule), page 82.  Source: The FATF Recommendations

The European Union

According to the Final Draft AMLR & 6th AMLD Framework, Chapter VI Data Protection and Record-Retention, Article 56,  the EU requires a period of 5 years. This time frame is reiterated in DIRECTIVE (EU) 2015/849 Chapter V, Article 40 and point (44).

Switzerland

According to Article 958f of the Swiss Code of Obligations, data is to be retained for 10 years. 

Nearly every jurisdiction that has implemented the Travel Rule includes self-hosted wallets within its scope.

The FATF Recommendation 16 stipulates that VASPs must still identify the owner of the self-hosted wallet if at least one obliged entity is involved in the transaction. Depending on local regulations, collecting this information may be sufficient, while in other cases, VASPs must verify the ownership of the self-hosted wallet. 

Examples of jurisdictions that include self-hosted wallets in their implementation of the Travel Rule include: 

• Australia
• Austria
• Belgium
• Bulgaria
• British Virgin Islands (BVI)
• Croatia
• Czech Republic
• Denmark 
• Estonia 
• Finland
• France 
• Germany 
• Greece 
• Hong Kong SAR 
• Hungary
• Isle of Man 
• Italy
• Jersey
• Latvia
• Liechtenstein 
• Lithuania
• Luxembourg
• Malta 
• The Netherlands
• Pakistan
• Poland 
• Portugal 
• Romania
• Singapore 
• Slovakia
• Slovenia
• South Africa
• Spain
• Sweden 
• Switzerland 
• Türkiye
• United Arab Emirates
• United Kingdom
• United States

Looking for a Travel Rule solution that supports self-hosted wallets? Try 21 Travel Rule. 21 Analytics' Travel Rule solution supports over 540 different wallets and 2800+ digital assets.

Nearly every jurisdiction that has implemented the Travel Rule includes self-hosted wallets within its scope, minus Bermuda and Canada.

Jurisdictions that Include Self-hosted Wallets in Their Regulatory Frameworks

• Australia
• Austria
• Belgium
• Bulgaria
• British Virgin Islands (BVI)
• Croatia
• Czech Republic
• Denmark 
• Estonia 
• Finland
• France 
• Germany 
• Greece 
• Hong Kong SAR 
• Hungary 
• Italy
• Latvia
• Liechtenstein 
• Lithuania
• Luxembourg
• Malta 
• The Netherlands
• Poland 
• Portugal 
• Romania
• Singapore 
• Slovakia
• Slovenia
• South Africa
• South Korea
• Spain
• Sweden 
• Switzerland 
• Türkiye
• United Arab Emirates
• United Kingdom
• United States

Please note this is not a non-exhaustive list and is meant as guidance only. 

Looking for a Travel Rule solution that supports self-hosted wallets? Try 21 Travel Rule. 21 Analytics' Travel Rule solution supports over 520 different wallets and 2800+ digital assets.

The Travel Rule does not apply to peer-to-peer transactions.

The Travel Rule only applies when a VASP (or regulated entity) transacts with another regulated entity or a self-hosted wallet. In other words, for the Travel Rule to apply, the transaction must involve at least one regulated entity. 

Find out more about self-hosted wallet transactions per the Travel Rule.

The first thing a VASP should do is ascertain if the jurisdiction’s implementation of the Travel Rule covers self-hosted wallets.

If self-hosted wallets are included, check the jurisdiction’s Travel Rule data collection prerequisites; some regions require more extensive data points. 

Thereafter, confirm the threshold. For example, in the EU, wallet proofs are only required for amounts over EUR 1000*, whereas Switzerland requires wallet proofs for all self-hosted wallet transactions. If a wallet proof is required, there are several ways to verify ownership, with AOPP being the most straightforward method.  

For further clarification on self-hosted wallet requirements per region, see Global Travel Rule Regulations: What Are the Requirements?

Looking for a Travel Rule solution that supports self-hosted wallets? Try 21 Travel Rule. 21 Analytics' Travel Rule solution supports over 540 different wallets and 2800+ digital assets.

*Unless the CASP suspects ML/TF activities or any other associated risk. 

Depending on the jurisdiction’s implementation of the Travel Rule, self-hosted wallet verification is required. 

There are 4 ways that this can be done, namely through:

• Address Ownership Proof Protocol (AOPP),
• Satoshi Tests (also known as a micro deposit or a Penny Test)
• Manual Signing, 
• Visual Proofs, which can include a video or image showing the wallet address.  

It's important to keep in mind that one method does not exclude the other. A VASP can offer its users just one, several, or all methods, depending on their needs or preferences. 

Most Travel Rule regulations, like the UK’s implementation of the Travel Rule, require verification through a Satoshi Test or digital signature, avoiding visual proofs due to their lack of trust. Many VASPs opt for a fully automated solution, like AOPP, as it is secure for both VASPs and their customers and prevents address reuse. 

Looking for a Travel Rule solution that supports self-hosted wallets? Try 21 Travel Rule. 21 Analytics' Travel Rule solution supports over 540 different wallets and 2800+ digital assets.