FATF Travel Rule

The Travel Rule takes its name from the existing bank wire transfer requirement under the US Bank Secrecy Act, which required correspondent banks to “travel” customer information with fund transfers above $3,000. FATF’s 2019 update — a response to the G20’s call for action on crypto-asset regulation — applied the same principle to virtual asset transfers.

Originator and Beneficiary Data Requirements

For a qualifying transfer, the originating VASP must collect and transmit:

Originator: Full legal name, account number (wallet address), and one of: physical address, national identity number, customer identification number, or date and place of birth.

Beneficiary: Full legal name and account number (wallet address).

The receiving VASP must screen this data against sanctions lists and KYC obligations before crediting the transfer. The IVMS 101 standard (issued by the Joint Working Group on interVASP Messaging Standards) specifies the JSON data schema used for this exchange.

VASP-to-VASP Transmission Protocols

Unlike bank wires, there is no single network through which VASPs transmit Travel Rule data. Multiple competing protocols have emerged:

Notabene provides a protocol-agnostic Travel Rule platform connecting VASPs for counterparty identification and data exchange. TRM Labs includes Travel Rule compliance within its broader crypto compliance suite. Sumsub integrates Travel Rule data exchange within its KYC/KYB onboarding stack. The Travel Rule Protocol (TRP) is an open-source messaging protocol backed by several major exchanges.

The absence of a single mandated protocol creates interoperability friction when sender and receiver use different systems.

The Unhosted Wallet Challenge

The Travel Rule applies cleanly to VASP-to-VASP transfers. Transfers to unhosted (self-custodied) wallets pose a structural problem: there is no counterparty VASP to receive the Travel Rule data. Jurisdictions have taken different approaches — some require VASPs to collect and verify the identity of unhosted wallet owners for transfers above threshold before initiating the transfer; others require enhanced due diligence but stop short of mandatory pre-transfer identity verification. This remains one of the most actively debated compliance boundaries in crypto regulation.