The travel rule for crypto transfers: what providers must collect and why
How FATF's travel rule, EU and US rules decide what data travels with a crypto transfer, including to self-hosted wallets.
When your company sends crypto from an exchange or custodian, that provider now has to send identifying details about you and the recipient alongside the transfer. Expect requests for beneficiary names, proof that you control your own wallets, and occasional held or returned transfers if data is missing.
Where the rule comes from
The travel rule is FATF Recommendation 16, the global anti-money-laundering standard on payment transparency, applied to virtual assets [1]. FATF revised Recommendation 16 in June 2025 to standardise the information that must accompany cross-border payments and to require tools against fraud and error, with the changes due to take effect by the end of 2030 [1].
Adoption is uneven. FATF's July 2026 review found that 83% of surveyed jurisdictions had passed travel rule legislation, up from 73% in 2025, with 11 more working on it [2]. FATF also listed unhosted wallets, stablecoins, offshore providers and DeFi among the risks still to address [2]. In practice this means a transfer can leave a regulated provider in one country and arrive at a provider in a country with no rule yet.
The EU version: no minimum amount
In the EU the rule is set by Regulation (EU) 2023/1113, the Transfer of Funds Regulation, which has applied since 30 December 2024 [3]. Its recitals explain that crypto transfers carry the same requirements whatever their size and whether domestic or cross-border, because transfers can be split easily across many addresses [3].
For each transfer, the sending crypto-asset service provider must make sure the following travels with it [3]:
- For the sender: name, blockchain address and account number where one exists, address with country, official personal document number and customer identification number (or date and place of birth), and LEI where available.
- For the recipient: name, blockchain address and account number where one exists, and LEI where available.
The data does not have to sit on chain. It must be sent before, with, or at the same time as the transfer, securely and in line with GDPR [3]. Before sending, the provider must verify the sender's details from reliable, independent sources [3].
The receiving provider must have procedures to detect missing information. If details are missing or incomplete it must, on a risk basis, either reject or return the transfer, or ask for the data before releasing the funds. Providers that repeatedly fail to send data can face warnings, restrictions or termination of the relationship [3].
Self-hosted wallets
Transfers to or from self-hosted addresses, meaning wallets the customer controls rather than a provider, are covered too. The provider must obtain and hold the sender and recipient information and make sure the transfer can be individually identified. Above EUR 1,000, it must also take adequate measures to assess whether the address is owned or controlled by its own customer [3].
The European Banking Authority's travel rule guidelines, applying from 30 December 2024, say how [4]. Providers should use the crypto-asset's euro value at the time of transfer to test the EUR 1,000 threshold, and use at least one method to check control, for example a video or remote identity check showing the address, sending a small predefined amount to and from the address, or asking the customer to sign a specific message with the address's key [4]. Once satisfied, a provider can record the address and need not repeat the check for later transfers [4]. The guidelines gave providers until 31 July 2025 to adjust their systems [4].
The US version
In the US, the rule sits in FinCEN's funds travel rule, 31 CFR 1010.410(f). FinCEN's 2019 guidance confirmed that crypto transfers count as transmittals of funds, so a transfer of $3,000 or more, or its equivalent in crypto, can trigger the requirement for a money transmitter to obtain or pass on the required information [5]. The same guidance said that a person using their own unhosted wallet to buy goods or services for themselves is not a money transmitter [5].
Why finance teams should care
For a company, the travel rule mostly shows up as friction and evidence. Transfers to a vendor's self-hosted wallet may need extra details, a transfer between your own exchange account and your own wallet may require proof of control, and a transfer can sit in limbo while a provider asks for data. Those delays matter at month-end, because an asset that has left one account and not yet arrived needs to be tracked as in transit, not lost or disposed of.
The data the provider collects is also useful audit evidence. A recorded proof of wallet control helps support the claim that a movement was an internal transfer rather than a payment to a third party.
What to do
- Keep a register of every self-hosted address the company controls, with the date and method used to prove control to each provider.
- Collect legal name, address and LEI from counterparties you pay in crypto before the first payment, not at the point of transfer.
- Agree with treasury how to handle held or returned transfers, and track them as in-transit balances in the reconciliation.
- Check whether your providers' travel rule messaging can reach the counterparty's provider, especially for transfers to jurisdictions without a travel rule.
- Store provider confirmations of internal transfers with your month-end evidence.
Sources
- FATF updates Standards on Recommendation 16 on Payment Transparency (FATF)
- FATF calls for closing of regulatory gaps as virtual asset illicit finance risks become more complex (FATF)
- Regulation (EU) 2023/1113 on information accompanying transfers of funds and certain crypto-assets (EUR-Lex)
- Guidelines on information requirements in relation to transfers of funds and certain crypto-assets transfers under Regulation (EU) 2023/1113 (EBA/GL/2024/11) (European Banking Authority)
- Application of FinCEN's Regulations to Certain Business Models Involving Convertible Virtual Currencies (FIN-2019-G001) (FinCEN)
General information for finance teams, current as of publication. Not legal, tax or accounting advice.