Travel Rule Compliance for Stablecoin Transfers: What VASPs Need to Know

Every Virtual Asset Service Provider handling stablecoin transfers faces a regulatory requirement that most traditional payment processors solved decades ago: sharing originator and beneficiary information with counterparties. The FATF Travel Rule, formally Recommendation 16, now applies to every VASP-to-VASP transfer in over 70 jurisdictions. For stablecoin operators, implementation is uniquely difficult because blockchain transactions carry no identity metadata, and there is no universal way to identify which VASP controls a given wallet address.

This guide covers the technical protocols, jurisdiction-specific thresholds, and practical implementation challenges that compliance teams encounter when building Travel Rule infrastructure for stablecoin transfers.

What the Travel Rule Requires

The Travel Rule originated in traditional banking under the US Bank Secrecy Act in 1996. In June 2019, the FATF extended Recommendation 16 to cover virtual assets and VASPs, requiring that originator and beneficiary identifying information travel alongside qualifying fund transfers. The goal: prevent anonymity in crypto transfers from being exploited for money laundering and terrorist financing.

Required Data Fields

For transfers at or above the applicable threshold, VASPs must collect and transmit the following information before or simultaneously with the transfer:

For transfers below the threshold, only the originator's name and account number (or unique transaction reference) are required. Records must be retained for at least five years in most jurisdictions.

June 2025 FATF revision: At the June 2025 Plenary, FATF adopted revisions making date of birth mandatory for originator individuals, requiring beneficiary addresses for larger transfers, and mandating that data be "as structured as possible." The global implementation deadline is set for end of 2030, with FATF publishing implementation guidance in late 2026.

Threshold Amounts by Jurisdiction

There is no single global threshold. Each jurisdiction sets its own, and the differences create significant operational complexity for VASPs processing cross-border stablecoin transfers. Some jurisdictions apply no threshold at all, requiring Travel Rule data for every transfer regardless of size.

The EU's Transfer of Funds Regulation (TFR), which took effect December 30, 2024, is the most aggressive: it requires Travel Rule data for every CASP-to-CASP transfer with zero threshold. This means a $5 USDC transfer between two European exchanges triggers the same compliance obligations as a $5 million wire.

VASP-to-VASP Messaging Protocols

The core technical challenge is straightforward: how do two VASPs exchange sensitive customer data in a standardized, secure, and verifiable way? Unlike SWIFT in traditional finance, there is no single dominant messaging network for crypto. Instead, several competing protocols exist, each with different architectures, trust models, and adoption profiles.

TRISA (Travel Rule Information Sharing Architecture)

Built by CipherTrace (now part of Mastercard) in 2019, TRISA uses Public Key Infrastructure (PKI) and mutual TLS for VASP authentication. VASPs exchange "secure envelopes" over gRPC-based peer-to-peer connections. The TRISA Global VASP Directory acts as a certificate authority, verifying VASP identities before they can participate. Messages are encrypted twice: the payload is signed using a per-envelope secret, and the secret itself is encrypted with the recipient's public key.

TRP (Travel Rule Protocol)

Originally developed by Standard Chartered, ING, and BitGo, TRP takes a minimalist approach: a RESTful API where the beneficiary VASP encodes a URL endpoint into a "Travel Address." The originator VASP calls this endpoint, provides an inquiry resolution webhook, and receives confirmation. Since late 2021, TRP has been the official protocol of the OpenVASP Association. In November 2023, TRISA and TRP achieved interoperability, allowing VASPs using either protocol to exchange Travel Rule data seamlessly.

TRUST (Travel Rule Universal Solution Technology)

Led by Coinbase, TRUST operates as a closed consortium rather than an open protocol. Members (over 125 VASPs including Kraken, Gemini, Circle, PayPal, Revolut, and Fidelity Digital Assets) complete onboarding due diligence to verify security, privacy, and compliance standards. The trade-off: stronger trust guarantees within the network, but no interoperability with VASPs outside it.

Other Solutions

Shyft Network's Veriscope offers auto-detection technology that identifies counterparty VASPs from wallet addresses in real time. Sygna Bridge, built by CoolBitX, provides an API-based messaging tunnel popular in Asia-Pacific markets. Notabene operates as an interoperability layer, supporting TRISA, TRP, and TRUST through a single integration, and partners with Chainalysis for counterparty address attribution.

IVMS101 is the common language: Regardless of which transport protocol VASPs use, the data itself is formatted using IVMS101 (InterVASP Messaging Standard 101), a data model jointly maintained by GBBC Digital Finance, OpenVASP, and VASPnet. Modeled after ISO 20022, IVMS101 defines how originator and beneficiary information is structured regardless of how it is transmitted.

Protocol Comparison

The Counterparty Identification Problem

In traditional finance, identifying the counterparty institution is trivial: SWIFT codes and IBANs map directly to specific banks. In stablecoin transfers, the originating VASP sees only a blockchain address. There is no on-chain metadata indicating which VASP (if any) controls that address.

FATF itself has acknowledged this gap: "To date, the FATF is not aware of any technically proven means of identifying the VASP that manages the beneficiary wallet exhaustively, precisely, and accurately in all circumstances and from the VA address alone."

Current approaches to solving this problem are probabilistic rather than deterministic:

• Blockchain analytics firms (Chainalysis, Elliptic) maintain databases of known VASP-controlled addresses, built from heuristic clustering and voluntary VASP registration
• VASP directories (TRISA Global Directory, Notabene's network) allow VASPs to register their address ranges, but coverage is incomplete
• Shyft/Veriscope attempts real-time auto-detection, but works only when both parties are on the network
• Some VASPs require customers to declare whether the destination is a VASP or self-hosted wallet, shifting identification responsibility to the user

This identification gap is the single biggest technical barrier to universal Travel Rule compliance for stablecoin transfers. Unlike traditional payment rails where the routing infrastructure inherently identifies institutions, blockchain rails are pseudonymous by design.

Self-Hosted Wallet Transfers

The Travel Rule technically applies only to VASP-to-VASP transfers. But when a customer sends stablecoins to or from a self-custodial wallet, VASPs face additional obligations that vary significantly by jurisdiction.

EU Requirements (Transfer of Funds Regulation)

For transfers to or from self-hosted wallets above EUR 1,000, CASPs must verify that the customer controls the external wallet. Acceptable verification methods include cryptographic message signing, small test transfers (micro-deposits), and video-based verification flows. The EBA Guidelines recommend applying verification more broadly than the TFR explicitly mandates.

US Requirements

FinCEN's existing rules do not require the same wallet-ownership verification, but VASPs must still perform KYC/AML due diligence and sanctions screening on self-hosted wallet transactions. The GENIUS Act, signed into law on July 18, 2025, explicitly excludes "immutable and self-custodial software interfaces" from regulation, but treats permitted stablecoin issuers as financial institutions under the Bank Secrecy Act, triggering AML obligations including Travel Rule compliance for custodial transfers.

General VASP Obligations

Regardless of jurisdiction, VASPs handling self-hosted wallet transfers should implement:

• Enhanced due diligence and risk assessment for self-hosted wallet transactions
• Blockchain analytics (KYT checks) to assess fund sources and trace connections to sanctioned entities
• Documentation of approval or rejection decisions with supporting data sources
• Transaction monitoring thresholds calibrated to local requirements

The Sunrise Issue

The "sunrise issue" is the compliance gap created by asynchronous Travel Rule adoption across jurisdictions. When a VASP in a compliant jurisdiction sends stablecoins to a VASP in a non-compliant jurisdiction, the originating VASP is legally obligated to transmit customer information, but the counterparty may have no legal obligation or technical capability to receive it.

As of FATF's July 2026 Targeted Update, 83% of surveyed jurisdictions have passed Travel Rule legislation (up from 73% in 2025). But legislation alone does not mean enforcement: approximately 59% of jurisdictions with Travel Rule laws on the books have not yet issued supervisory findings, directives, or enforcement actions tied to Travel Rule compliance.

This creates what compliance professionals call the "second phase" of the sunrise issue. The original problem was counterparties with no legal obligation. The new problem is counterparties that have a legal obligation but face no consequences for non-compliance. VASPs face three difficult options:

• Refuse transactions to non-compliant counterparties, limiting business reach
• Attempt to collect information from counterparties that have no system to provide it
• Process transactions with incomplete data and accept regulatory risk

Protocol interoperability (the TRISA-TRP bridge, Notabene's multi-protocol support) helps on the technical side, but the fundamental problem is regulatory: the Travel Rule is only as strong as its weakest jurisdiction.

Stablecoin-Specific Implementation Challenges

Stablecoins present unique compliance challenges beyond those faced by other virtual asset transfers:

On-Chain vs. Off-Chain Data

Travel Rule data (personally identifiable information) cannot be stored on-chain due to privacy regulations like GDPR. All current protocols transmit data off-chain through separate secure channels, while the blockchain transaction carries no identity metadata. This creates a reconciliation challenge: VASPs must reliably link off-chain identity records to on-chain transaction hashes, and any mismatch means compliance data becomes orphaned.

Multi-Intermediary Payment Flows

Stablecoin payment flows often involve multiple intermediaries: issuers, exchanges, payment processors, and merchants. Each handoff in the chain requires Travel Rule data to persist. Unlike traditional payment messaging where SWIFT carries data end-to-end, stablecoin intermediaries must each maintain their own Travel Rule infrastructure.

Timing: Data Before Settlement

FATF requires that Travel Rule information be transmitted before or simultaneously with the transfer. But stablecoin transactions on most blockchains settle in seconds. Some VASPs transmit compliance data after settlement, which is technically non-compliant. The solution requires either pre-settlement messaging (introducing latency) or atomic linkage between the off-chain data exchange and the on-chain transfer.

Cross-Chain Complexity

Major stablecoins like USDC operate across multiple blockchains. A transfer might originate on Ethereum and arrive on Solana via a cross-chain bridge. The Travel Rule data must follow the value through intermediary chains, but bridge operators may not be classified as VASPs in all jurisdictions, creating gaps in the compliance chain.

Recent Regulatory Developments

Two major regulatory frameworks have significantly shaped the Travel Rule landscape for stablecoins in 2025-2026:

GENIUS Act (United States)

Signed into law on July 18, 2025, the GENIUS Act is the first comprehensive federal stablecoin regulation in the US. It requires 1:1 reserve backing with liquid assets, monthly public reserve disclosures, and treats permitted stablecoin issuers as financial institutions under the Bank Secrecy Act. Digital asset service providers have a three-year compliance transition period ending July 18, 2028. In April 2026, FinCEN and OFAC proposed AML and sanctions rules specifically for stablecoin issuers under the GENIUS Act framework.

EU MiCA and Transfer of Funds Regulation

The EU's MiCA regulation established the most comprehensive crypto regulatory framework globally. The Transfer of Funds Regulation (TFR), effective December 30, 2024, imposes a zero threshold for Travel Rule compliance on all CASP-to-CASP transfers. MiCA's transitional period expired July 1, 2026: any CASP not fully compliant cannot lawfully process transfers in the EU.

Implementation Decision Tree

When a VASP receives an outbound stablecoin transfer request, the compliance workflow follows a series of decision points:

1. Is the transfer amount above the local jurisdiction's threshold? If no threshold exists (EU, Japan, India, UK), proceed to step 2 for all transfers.
2. Can the counterparty VASP be identified? Use blockchain analytics, VASP directories, and customer declarations. If the destination is a self-hosted wallet, apply self-hosted wallet procedures instead.
3. Does the counterparty VASP support a compatible Travel Rule protocol? Check TRISA directory, TRP Travel Address availability, TRUST membership, or Notabene network participation.
4. Exchange IVMS101-formatted data through the available protocol. Confirm receipt and validate the response before or simultaneously with settlement.
5. If no compatible protocol is available, apply risk-based measures: enhanced due diligence, transaction monitoring, and documentation of the compliance gap.

Compliance Checklist for VASPs

Organizations building or auditing Travel Rule infrastructure for stablecoin transfers should verify the following:

Data Collection and Storage

• Originator and beneficiary data fields mapped to IVMS101 schema
• Data retention policies meeting the five-year minimum
• Encryption at rest and in transit for all PII
• GDPR and local privacy law compliance for stored Travel Rule data

Protocol Integration

• At least one Travel Rule messaging protocol integrated (TRISA, TRP, or TRUST)
• VASP directory registration completed (TRISA Global Directory, Notabene, or equivalent)
• Counterparty VASP identification tooling deployed (blockchain analytics integration)
• Pre-settlement data exchange workflow tested and operational

Jurisdiction-Specific Configuration

• Threshold amounts configured per jurisdiction, with automatic updates for regulatory changes
• Self-hosted wallet verification procedures implemented where required (EU: above EUR 1,000)
• Sanctions screening integrated into the pre-transfer workflow
• SAR filing procedures connected to Travel Rule data gaps

Operational Readiness

• Fallback procedures defined for when counterparty VASPs cannot receive Travel Rule data
• Audit trail capturing every Travel Rule exchange attempt (successful or failed)
• Staff training on threshold calculations, data field requirements, and escalation procedures
• Incident response plan for Travel Rule data breaches (PII exposure)

Global Adoption Status

According to FATF's Seventh Targeted Update published in July 2026, 83% of surveyed jurisdictions have now passed Travel Rule legislation. The share rated "largely compliant" increased from 29% to 34%, while the share rated "partially compliant" fell from 50% to 43%. Despite this progress, nearly two-thirds of assessed jurisdictions remain only partially compliant or non-compliant in practice.

Regional variation is stark. Europe leads with the TFR providing a uniform framework. Asia-Pacific is mixed: Japan and Singapore are advanced, while Australia's implementation takes effect July 1, 2026. Latin America lags with an acceptance rate of approximately 22%. New enforcement dates continue to be set: Brazil targets February 2, 2027, and Peru targets August 1, 2026.

For a broader view of how stablecoin regulations are evolving alongside Travel Rule requirements, see our stablecoin regulation global tracker.

What This Means for the Spark Ecosystem

As stablecoin payments move from crypto-native use cases into mainstream commerce, Travel Rule compliance becomes a prerequisite for any business handling regulated transfers. Platforms building on Spark that process stablecoin transfers (including USDB and other assets on the network) will need to consider how Travel Rule obligations apply to their specific use case: whether they qualify as a VASP under local law, which thresholds apply, and which messaging protocols their counterparties support.

Developers integrating stablecoin functionality can explore the Spark SDK documentation for technical details on building compliant payment flows. For a practical example of a Spark-powered wallet handling stablecoin transfers, see General Bread.

This article is for educational purposes only. It does not constitute financial, legal, or investment advice. Stablecoin regulation and compliance requirements vary by jurisdiction and change frequently. Always consult qualified legal counsel and do your own research before implementing compliance infrastructure.