The Crypto Travel Rule: What It Means for Your Transfers

The short version

If you've ever sent a bank wire, the bank didn't just move the money — it also passed along a note with the sender's name and the receiver's name. That note is the "Travel Rule," and banks have lived with it since the mid-1990s. Since 2019, the same idea has applied to cryptocurrency. Businesses that exchange, hold, or move crypto on behalf of customers — exchanges, custodial wallets, payment processors — now have to collect, verify, and share information about the person sending (the "originator") and the person receiving (the "beneficiary") on qualifying transfers.

The name is a little funny, honestly. Nobody is packing a suitcase. The information just has to "travel" alongside the money from one business to the next, the way a note travels with a wire.

Why the rule exists

Blockchain transactions are pseudonymous. The public ledger shows that one wallet address sent funds to another, but not who controls either address. Criminals noticed — and so did the Financial Action Task Force (FATF), an international body that sets anti-money-laundering standards. In 2019, it extended its Recommendation 16 — commonly known as the Travel Rule — to virtual assets. Around the same time, US regulators clarified that their own version of the rule already applied to crypto businesses.

The aim is straightforward: money laundering, terrorist financing, and sanctions evasion all depend on moving value invisibly. The Travel Rule makes sure a transfer's basic details exist and are available to the businesses handling it, and to authorities if needed. The point isn't to track everyday spending — it's to close the gap that lets bad actors move funds with no name attached.

Who shares what

The rules apply to Virtual Asset Service Providers (VASPs) — the businesses that exchange, transfer, or safeguard crypto for customers. Different countries use different names for the same idea: Crypto-Asset Service Providers (CASPs) in the European Union, Money Services Businesses (MSBs) in the United States, Digital Payment Token service providers in Singapore. Same responsibility, different labels. Even stablecoin issuers — companies behind tokens designed to hold a steady value — can be pulled in when their activities resemble a VASP's.

When a customer sends crypto, the sending business collects the originator's name and wallet address (or account number) and, above certain thresholds, the address and date of birth for individuals — or, for companies, an official identifier when one exists. The receiving business collects the beneficiary's name and wallet address, and often the country and town. Both sides verify the details against what they gathered during customer checks, screen the names against sanctions lists, watch for suspicious activity, and keep records for five years or more. Below the threshold, a lighter version applies: just the names and wallet addresses, which don't have to be verified unless something seems off.

One rule, many cutoffs

Here's the catch: the Travel Rule isn't actually one rule. It's a shared standard with many local implementations. FATF recommends collecting the full information set above USD/EUR 1,000. The United States sets its threshold at $3,000. The European Union, under its Transfer of Funds Regulation, has required full details on every crypto transfer since December 2024 — no minimum amount. The UK has done the same since September 2023. Singapore's cutoff is 1,500 Singapore dollars; Canada collects details above 1,000 Canadian dollars; Switzerland applies the rule to essentially every transfer.

This patchwork creates curious situations. A $2,500 transfer between two US exchanges stays under the threshold, so no Travel Rule data is needed. Add an EU or UK counterparty, and the same transfer requires full sender and receiver details. A $500 move might be exempt in the US but subject to full reporting in Europe, Singapore, and Japan. No wonder many international businesses simply collect the information on every transfer — more work, but far easier than keeping a spreadsheet of thresholds.

The hard parts

Implementation is messy, and the industry has names for the messes. The "sunrise issue" describes rules taking effect in different countries at different times — like sunrise moving across time zones. A business in one country may be required to share data with a partner in another that cannot yet accept it. Then there's the "discovery problem": a wallet address carries no clue about which business controls it, so before sending the required data, an exchange must figure out who's on the other end. Industry networks and messaging standards — TRUST, TRISA, OpenVASP, and the common data format IVMS101 — help businesses exchange information securely even when they use different software.

Self-custody, or "unhosted," wallets are a special case. If you hold crypto in your own wallet, there may be no business on the other end to receive or provide information, so national rules vary sharply. Some countries require the exchange to collect information from its customer; others require verifying the wallet owner's identity; a few demand enhanced due diligence or proof of ownership. In the US, proposals for unhosted-wallet rules were floated in late 2020 and have not been finalized. This part of the landscape is still moving.

What happens if a business skips it

Regulators can fine a business, order it to fix its systems, restrict its services, or suspend its license. Directors and senior managers can be held responsible, and a firm can lose its banking partnerships. Criminal prosecutions specifically for Travel Rule violations are still rare — FATF only extended the international standard to virtual assets in 2019, so enforcement records are short. The history of traditional finance hints at the direction ahead: FinCEN, the US enforcement agency, has referred serious recordkeeping failures in banking for criminal prosecution for decades.

What it means for you

For most people, the practical effect is modest. You may be asked for a bit more identifying information when you move crypto, and transfers can pause if details are missing or don't line up. The businesses on both ends are checking each other, not just you.

Rules also keep evolving. FATF revised its standard in June 2025, with countries expected to complete implementation by the end of 2030. During that time, national rules may reflect different versions of the standard. So if your transfer crosses a border, expect a little more friction than in the early crypto days — it's the trade-off for a system designed to keep bad actors from moving money in the dark.