Travel Rule

What Is the Travel Rule?

The travel rule is a regulatory requirement that certain identifying information about the sender and recipient of a financial transfer must "travel" alongside the transaction from one institution to another. Originally introduced by the U.S. Financial Crimes Enforcement Network (FinCEN) in 1996 under the Bank Secrecy Act for wire transfers, the concept was adopted internationally by the Financial Action Task Force (FATF) as Recommendation 16 following the September 11, 2001 attacks.

In 2019, the FATF extended the travel rule to cover virtual asset transfers, requiring Virtual Asset Service Providers (VASPs): crypto exchanges, custodial wallet providers, and similar businesses: to collect, verify, and transmit originator and beneficiary information for transactions above specified thresholds. This extension brought crypto businesses into the same compliance framework that has governed traditional banking for decades.

The rule is central to global anti-money laundering (AML) and counter-terrorism financing (CTF) efforts. By ensuring that identity data follows funds across institutional boundaries, regulators can trace suspicious transaction chains and hold intermediaries accountable for facilitating illicit flows.

How It Works

When a customer initiates a crypto transfer from one VASP to another, the originating VASP must collect and transmit specific data to the beneficiary VASP before or at the time of the transfer. The beneficiary VASP must verify this data and apply risk-based controls if information is incomplete or the counterparty's compliance status cannot be confirmed.

1. The originating VASP collects the sender's identity information as part of its KYC process
2. The VASP identifies whether the receiving address belongs to another VASP or to a self-custodial wallet
3. If the recipient is another VASP, the originator transmits the required data fields to the beneficiary VASP via a travel rule messaging protocol
4. The beneficiary VASP validates the received information and either accepts or rejects the transfer
5. Both VASPs retain records of the transmitted data for regulatory reporting and audit purposes

Required Data Fields

The specific data that must accompany a transfer depends on jurisdiction, but the FATF baseline requires the following for the originator:

• Full name of the sender
• Account number or wallet address used to process the transaction
• Physical address, national identity number, customer identification number, or date and place of birth

For the beneficiary, the minimum fields include:

• Full name of the recipient
• Account number or wallet address used to receive the transaction

The IVMS101 Standard

One of the core challenges in implementing the travel rule for crypto has been the lack of a standardized data format across VASPs. In traditional banking, ISO 20022 provides a universal messaging standard for wire transfers. Crypto had no equivalent until the interVASP Messaging Standard (IVMS101) was published in 2020.

IVMS101 defines a common data model for formatting personally identifiable information (PII) in travel rule messages. It specifies field types, data constraints, and message structures that distinguish between natural persons and legal entities. The standard ensures that when VASP A sends originator data to VASP B, both sides interpret the fields identically regardless of which messaging protocol carries the data.

// Simplified IVMS101 message structure
{
  "originator": {
    "originatorPersons": [{
      "naturalPerson": {
        "name": {
          "nameIdentifier": [{
            "primaryIdentifier": "Nakamoto",
            "secondaryIdentifier": "Satoshi"
          }]
        },
        "nationalIdentification": {
          "nationalIdentifier": "AB1234567",
          "nationalIdentifierType": "PASSPORT"
        },
        "dateAndPlaceOfBirth": {
          "dateOfBirth": "1975-04-05"
        }
      }
    }],
    "accountNumber": ["1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa"]
  },
  "beneficiary": {
    "beneficiaryPersons": [{
      "naturalPerson": {
        "name": {
          "nameIdentifier": [{
            "primaryIdentifier": "Doe",
            "secondaryIdentifier": "Jane"
          }]
        }
      }
    }],
    "accountNumber": ["bc1qw508d6qejxtdg4y5r3zarvary0c5xw7kv8f3t4"]
  }
}

Thresholds by Jurisdiction

While the FATF sets baseline recommendations, individual jurisdictions define their own thresholds and enforcement mechanisms. The table below shows how major markets have implemented the travel rule as of 2026:

The EU's zero-threshold approach is the strictest globally: every crypto transfer processed by an EU-based VASP must include full originator and beneficiary data, regardless of transaction size. This contrasts sharply with the U.S. approach, where transfers under $3,000 are exempt.

Compliance Solutions

Unlike traditional banking, where the SWIFT network provides a unified messaging infrastructure, the crypto industry lacks a single channel for transmitting travel rule data between VASPs. This has led to a fragmented landscape of competing protocols and solutions:

• TRISA (Travel Rule Information Sharing Alliance): an open-source, peer-to-peer protocol that uses a centralized Certificate Authority model to verify VASP identities and facilitate encrypted data exchange
• Notabene: a commercial platform that integrates multiple messaging protocols (TRP, OpenVASP, TRUST, Sygna Bridge, and TRISA), allowing VASPs to interoperate regardless of which protocol each party uses
• Sygna: a compliance protocol widely adopted in Asian markets, particularly among exchanges in Taiwan, Japan, and South Korea
• TRUST (Travel Rule Universal Solution Technology): developed by a consortium of U.S.-based exchanges including Coinbase and other major platforms for peer-to-peer compliance messaging
• OpenVASP: a decentralized, open-source protocol maintained by the OpenVASP Association that aims to provide a vendor-neutral standard

The interoperability challenge is significant. If VASP A uses TRISA and VASP B uses Sygna, the two cannot exchange data directly unless they share a common bridge or aggregator platform. Solutions like Notabene address this by acting as multi-protocol routers, translating between standards so that compliance data reaches its destination.

Self-Custodial Wallets and the Travel Rule

The travel rule assumes an institutional counterparty on both sides of a transfer: an originating VASP and a beneficiary VASP. When a user withdraws funds from an exchange to their own self-custodial wallet, there is no receiving VASP to send compliance data to. This creates a fundamental enforcement gap.

Jurisdictions have taken different approaches to this problem:

• The EU and UK require VASPs to collect the self-hosted wallet owner's information from their own customer (the sender or receiver) and record it internally
• Singapore and Germany require VASPs to verify the identity of the self-hosted wallet owner, not just collect a self-declaration
• Switzerland requires both identity verification and proof of wallet ownership (for example, signing a message with the private key)
• Some jurisdictions remain undecided: as of the FATF's most recent implementation review, roughly 70% of jurisdictions have not finalized their approach to self-hosted wallet transfers

This regulatory uncertainty has real market consequences. EU-based VASPs are significantly more likely to block transactions involving self-hosted wallets compared to the global average, with some exchanges banning such transfers entirely rather than building complex compliance infrastructure for uncertain regulatory outcomes.

Why It Matters

For money services businesses and crypto platforms, travel rule compliance is not optional: non-compliance can result in enforcement actions, fines, and loss of banking relationships. The rule affects every VASP that processes transfers above the applicable threshold, making it one of the most operationally demanding regulatory requirements in the crypto industry.

The travel rule is particularly relevant for stablecoin transfers, which the FATF explicitly treats as virtual asset transfers. As stablecoins become a primary rail for cross-border payments and remittance corridors, the volume of transfers subject to travel rule requirements continues to grow. Understanding how identity data flows alongside value is essential for any business building on crypto payment rails.

Solutions that minimize compliance friction while preserving user privacy represent a significant opportunity. Layer 2 networks and self-custodial protocols like Spark navigate this landscape by enabling users to maintain control of their own funds without requiring intermediaries to collect and transmit personal data on every transaction.

Risks and Considerations

Privacy Concerns

The travel rule requires transmitting sensitive personal data (full names, addresses, dates of birth, national ID numbers) across multiple institutions for every qualifying transfer. Each VASP that handles this data becomes a potential target for data breaches. Unlike traditional banking, where SWIFT communications flow through established secure channels, crypto travel rule data may traverse newer, less battle-tested infrastructure.

Fragmented Infrastructure

With multiple competing messaging protocols and no single industry standard, VASPs face significant integration costs. A mid-sized exchange may need to support three or four protocols to reach the majority of counterparties, each with its own API, data format, and onboarding process. This fragmentation increases compliance costs and creates operational complexity, particularly for smaller VASPs.

Sunrise Problem

The "sunrise problem" refers to the period when some jurisdictions enforce the travel rule while others do not. A VASP in a compliant jurisdiction sending funds to a VASP in a non-compliant jurisdiction has no counterparty to transmit data to, even though the originating VASP is required to make the attempt. As of 2026, over 50 jurisdictions have enacted travel rule legislation, but significant gaps remain, particularly in emerging markets where crypto adoption is highest.

Regulatory Divergence

Different thresholds, different data requirements, and different approaches to self-custodial wallets mean that a globally operating VASP must maintain multiple compliance configurations. A transfer that requires no data sharing in the U.S. (under $3,000) may require full identity transmission in the EU (any amount). This jurisdictional patchwork increases the cost and complexity of regulatory compliance for platforms operating across borders.

This glossary entry is for informational purposes only and does not constitute financial or investment advice. Always do your own research before using any protocol or technology.