This article is educational and does not constitute legal advice. Travel-rule obligations depend on a business's activities and jurisdiction. Consult qualified counsel before relying on any summary here.
The Core Idea
The travel rule predates digital assets. For decades, banks sending wire transfers above a threshold have been required to include identifying information about the originator and the beneficiary so that information accompanies the money as it moves through the system. The point is to leave a usable trail for investigators and to make it harder to move illicit funds anonymously through regulated channels.
The crypto travel rule applies the same principle to transfers of virtual assets between regulated providers. When one exchange sends bitcoin to another exchange on behalf of a customer, the sending exchange must transmit identifying details about its customer (the originator) and the intended recipient (the beneficiary) to the receiving exchange. The value settles on the Bitcoin network; the identity information moves through a separate channel between the two institutions.
The obligation attaches to the institutions handling the transfer, so at least one side of a travel-rule transfer is an obligated provider. Two individuals moving bitcoin between their own self-custodial wallets are not virtual asset service providers and have no travel-rule duty, a distinction this article returns to below.
FATF Recommendation 16 Extended to Virtual Asset Service Providers
FATF is the intergovernmental body that sets the global anti-money-laundering standard. Recommendation 16, historically the wire-transfer standard, requires that originator and beneficiary information accompany transfers and remain available to authorities. In June 2019, FATF updated its standards and interpretive notes to apply Recommendation 16 to virtual asset transfers and to bring virtual asset service providers (VASPs) into scope under Recommendation 15.
Under the FATF standard, the sending VASP must obtain and hold required originator information and required beneficiary information, submit that information to the receiving VASP, and make it available to authorities on request. The required information generally includes the originator's name, the originator's account or wallet reference used for the transaction, the originator's address or national identity number or date and place of birth, and the beneficiary's name and account or wallet reference.
FATF sets a de minimis threshold of USD or EUR 1,000. Below it, a reduced set of information may suffice; at or above it, the full originator and beneficiary information is expected. FATF itself does not enforce these rules. It assesses how well each member jurisdiction has implemented them through periodic mutual evaluations, and national regulators carry out enforcement in local law. For a broader view of how these standards fit into a compliance program, see What Are AML and KYC Requirements for Bitcoin Businesses?
The Rule in the United States
In the United States, no digital-asset-specific statute creates the travel rule. It comes instead from the funds-transfer recordkeeping rule at 31 CFR 1010.410, issued under the Bank Secrecy Act. That rule applies to transmittals of funds of $3,000 or more and requires the transmittor's financial institution to obtain and retain, and pass to the next institution, a defined set of information.
The data elements the rule names include the transmittor's name and address, the amount of the transmittal order, the execution date, the identity of the recipient's financial institution, and, as received, the recipient's name and address, account number, and any other specific identifier. FinCEN has stated that this recordkeeping and transmittal obligation applies to convertible virtual currency the same way it applies to other value, so a U.S. money services business handling bitcoin operates under it.
The mechanics for traditional wires are described in FinCEN's longstanding advisory on the funds "Travel" rule, available as a primary FinCEN advisory (PDF). The substance is unchanged for digital assets; what changes is the difficulty of carrying out the obligation on a network that was not built to transmit identity, which is the heart of the operational problem.
| Standard | Threshold | Who is obligated |
|---|---|---|
| FATF Recommendation 16 (global standard) | USD / EUR 1,000 de minimis | VASPs, as implemented by each national regulator |
| United States, 31 CFR 1010.410 | $3,000 or more | Money services businesses and other covered financial institutions |
How VASPs Exchange the Information
Because the Bitcoin protocol carries no place to attach sender and recipient identity, providers must move that information through a separate messaging layer that runs in parallel with the on-chain transfer. A category of travel-rule solutions has emerged to do this. They give participating institutions a common message format, a way to discover and authenticate counterparties, and a secure channel to exchange the required personal data without writing any of it to the blockchain.
These solutions share a basic shape regardless of vendor. Before or around the time the value moves on-chain, the sending provider transmits a structured message containing the required originator and beneficiary fields to the receiving provider. The receiving provider acknowledges, validates, and stores the information against its own customer records. Several competing protocols exist, and because the sending and receiving providers may run different ones, each protocol has to work with the others. The category is described here generically; specific products are outside the scope of this article.
The Self-Hosted Wallet Question
The hardest case under the travel rule is the transfer that touches a self-hosted wallet, sometimes called an unhosted or self-custodial wallet. The rule is built around two obligated institutions exchanging information about their respective customers. A self-hosted wallet has no institution behind it. It is controlled directly by an individual who holds their own keys.
Two cases follow. A transfer between two personal self-hosted wallets involves no VASP on either side, so there is no obligated party and the travel rule does not attach to the individuals. A transfer between a VASP and a self-hosted wallet is different: the VASP is obligated, but its counterparty is a person rather than another institution. In that case, depending on the jurisdiction, the VASP may be required to collect and in some cases verify information about the self-hosted wallet's owner, even though there is no counterpart institution to exchange messages with.
How far that obligation reaches is the subject of ongoing policy debate. Some jurisdictions require additional data collection or verification for transfers to and from self-hosted wallets above certain thresholds; others apply lighter requirements. The debate sits at the intersection of legitimate AML aims and the privacy and self-determination that self-custody provides, and reasonable parties disagree on where the balance should fall. The distinction between custodial and self-custodial models is examined in How Does a Custodial Wallet Differ From a Non-Custodial Wallet? and in What Are the Differences Between KYC and Non-KYC Bitcoin?
The Jurisdictional Patchwork
FATF sets one standard, but more than 200 jurisdictions implement it on their own timelines and with their own wording. The result is a patchwork. Thresholds differ: the United States uses $3,000 while the FATF de minimis is the local-currency equivalent of 1,000. Definitions of who counts as a VASP differ, as do the requirements for self-hosted-wallet transfers. Some jurisdictions had the rule in force years ago; others are still drafting implementing regulations.
For a provider operating across borders, this means a single transfer can be governed by more than one regime at once, and a counterparty in another country may be subject to a different set of rules. Compliance teams have to map each corridor they operate in rather than assuming a uniform global rule.
Why It Is Operationally Hard for Bitcoin
Several properties of the Bitcoin network make the travel rule harder to apply than it is to bank wires. The wire system was built by institutions for institutions, with identity fields baked into the message format. Bitcoin was built as a permissionless settlement network, and identity was never part of its design.
- No identity field. A Bitcoin transaction records inputs, outputs, amounts, and scripts. It has no field for a sender's or recipient's name. Any identity exchange has to happen entirely off-chain.
- Addresses are not institutions. A Bitcoin address does not say whether a VASP, a self-hosted wallet, or no one in particular controls it. Before a sending provider can transmit travel-rule data, it must first determine whether the receiving address even belongs to a VASP that can receive the message.
- Counterparty discovery and trust. The two providers must find each other, confirm each is a legitimate regulated entity, and agree on a message format, all outside the transaction itself. With competing protocols, interoperability is not guaranteed.
- Timing. On-chain settlement and the off-chain message are separate events. Providers must reconcile them so that information arrives in a usable relationship to the value transfer.
- Data protection. The information being exchanged is personal data. Moving it between institutions in different countries raises its own privacy-law obligations, which must be satisfied at the same time as the AML obligation.
None of these is unsolvable, and the travel-rule solution category exists to address them. These properties explain why compliance for digital-asset transfers carries an operational burden that the equivalent bank-wire requirement does not: the work that the wire format does automatically has to be reconstructed by separate systems for digital assets.
A Travel-Rule Self-Assessment
A provider evaluating its travel-rule readiness can work through a set of plain questions. These are evaluation criteria, not legal advice.
- Scope: Does the business transmit virtual assets on behalf of customers, making it a VASP or money services business that the travel rule binds?
- Thresholds: Are the correct thresholds applied for each jurisdiction the business operates in, including the $3,000 U.S. threshold and the local equivalent of the FATF de minimis?
- Data capture: Can the business collect and retain the full required originator and beneficiary information for qualifying transfers?
- Transmission: Is there a mechanism to send and receive the information securely with counterparty providers, and does it interoperate with the protocols those counterparties use?
- Counterparty handling: Is there a process to determine whether a receiving address belongs to a VASP, and a defined approach for transfers to and from self-hosted wallets under each applicable jurisdiction's rules?
- Data protection: Are cross-border transfers of personal data handled in line with the privacy laws that apply alongside the AML obligation?
Each "yes" reflects a capability a supervised provider would be expected to demonstrate. Each "no" marks an area to close before a regulator or a counterparty raises it.
Frequently Asked Questions
What is the crypto travel rule in simple terms?
The crypto travel rule requires the exchanges and custodians sending a digital-asset transfer to pass identifying information about the sender and recipient to the receiving institution. The information travels alongside the value. It applies to regulated virtual asset service providers, and not to individuals transacting from their own self-custodial wallets.
What is the travel rule threshold for crypto?
FATF sets a de minimis threshold of USD or EUR 1,000, above which full originator and beneficiary information is required. In the United States, the recordkeeping and transmittal rule at 31 CFR 1010.410 applies to transmittals of funds of $3,000 or more. Thresholds differ by jurisdiction, so a cross-border transfer may face more than one.
Does the travel rule apply to self-custodial wallets?
The travel rule binds virtual asset service providers rather than individuals. A transfer between two personal self-custodial wallets has no obligated institution on either side. When a VASP sends to or receives from a self-custodial wallet, the VASP must follow its jurisdiction's rules, which may require it to collect and verify information about the self-custodial wallet's owner.
Why is the travel rule hard for Bitcoin?
A Bitcoin transaction carries no field for sender or recipient identity, and an address does not reveal which institution, if any, controls it. Providers must exchange identity data through a separate channel, agree on a shared format, confirm a counterparty is a regulated VASP, and reconcile inconsistent national rules. None of this is built into the protocol.
Who enforces the crypto travel rule?
FATF sets the global standard but does not enforce it directly. National regulators implement it in local law and supervise compliance: in the United States, FinCEN administers the recordkeeping and transmittal rules under the Bank Secrecy Act. FATF assesses each country's implementation through periodic mutual evaluations.