The Short Answer
The travel rule is FATF Recommendation 16: when one VASP sends a virtual asset transfer to another VASP, both sides must collect, exchange, and keep information about the originator and the beneficiary. On paper it is one sentence. In practice it is a cross border problem: finding the other VASP, exchanging data both systems read, and handling the edge cases. The VASP compliance hub collects the related guides.
The rule's nickname comes from banking. Wire transfers have carried originator information alongside the payment for decades; the data "travels" with the money. FATF Recommendation 16 extends that expectation to virtual asset transfers, and it landed on VASPs because VASPs are the institutions in the analogy. The exchange sending the transfer and the exchange receiving it are the two banks.
This page is the education layer: what the rule says, where it came from, what exactly must travel, and why compliance teams find it genuinely hard. It stays on the rule and its edges throughout.
Where the Rule Came From
The travel rule comes from the wire-transfer model, where identifying information accompanies payment messages. FATF revised its virtual-asset standards in October 2018 and June 2019 and issued guidance in June 2019, as the FSB timeline records. National law implements those standards; the 2019 guidance was not the beginning of all virtual-asset regulation.
The FATF recommendations are the international baseline that national law implements. Recommendation 16 is the transfer transparency plank: scrap the secrecy that pure chain transfers offered, and require the identifying information to move with the value. A suspicious transfer can then be reconstructed end to end by the institutions that touched it and, when needed, by investigators.
Since 2019 implementation has moved in waves, jurisdiction by jurisdiction, which is the honest reason no tidy world map of compliance dates fits in this page. What is stable is the direction: the number of jurisdictions expecting travel rule exchange keeps growing, and the FATF's periodic reviews track the progress publicly.
What Actually Has to Travel
Required information commonly includes originator and beneficiary names and account identifiers, with additional identity details under the applicable rules. The exact fields, verification thresholds, retention requirements and exceptions depend on the jurisdiction. The examples below illustrate information categories, not a single global package that applies identically to every transfer.
A VASP must collect and handle the information required by its applicable rules; counterparties cannot simply agree to omit a legal requirement. Missing information requires follow-up and risk-based action under local law. The EBA Travel Rule Guidelines, applicable from 30 December 2024, set out EU procedures for requesting missing information, assessing risk and determining whether to execute, suspend or reject a transfer.
Illustrative information categories; the local rules determine the required fields and verification:
| Data element | Required for | Notes |
|---|---|---|
| Originator name | Where required by applicable rules | Identifies the person, not merely a wallet label |
| Originator account | Where required by applicable rules | Sending account or address identifier under local rules |
| Address, ID number, or birth details | Additional identity fields under applicable rules | Which fields or alternatives are accepted varies by jurisdiction |
| Beneficiary name | Where required by applicable rules | Identifies the recipient |
| Beneficiary account | Where required by applicable rules | Receiving account or address identifier under local rules |
For the related licensing and compliance guides, see the VASP compliance hub.
Information and verification thresholds depend on applicable law. Simplified verification does not necessarily exempt a transfer from collecting required information. In the EU, the crypto-transfer information requirements are not removed simply because the amount is low. In the United States, FinCEN’s funds-transmittal rules may apply to covered money services businesses handling relevant convertible-virtual-currency transfers of 3,000 US dollars or more, as its 2019 guidance explains; this is not a global threshold.
A self-hosted-wallet transfer has no counterparty VASP, but the regulated institution may still have information-collection and risk-assessment duties. A counterparty VASP in a jurisdiction with different implementation creates a sunrise issue. These cases require an applicable-law process, not an assumption that information duties disappear or that refusal is always the only response.
Why Compliance Teams Find It Hard
Three difficulties recur in travel rule work. The sunrise problem: counterparties operate under different implementation schedules, so information may be missing or harder to obtain. Format fragmentation: exchange solutions do not all speak the same dialect. And the non-custodial edge: a wallet with no institution behind it. Each requires a documented process, not an assumption that patience alone fulfils the duty.
For a receiving VASP required to obtain originator information, the relevant counterpart is the sending VASP. If the sending jurisdiction has not implemented the same obligations, information may be missing or harder to obtain, but the absence of a mandate does not make voluntary exchange impossible. Request missing data, assess the counterparty and document local-law decisions about execution, suspension or rejection; waiting for the other jurisdiction to legislate does not replace those duties.
Format fragmentation is the industry's own making. Multiple messaging standards and vendor networks grew up to carry travel rule data, and they do not interoperate perfectly. A sending VASP and a receiving VASP can both be fully compliant locally and still unable to complete a clean exchange without bridging work. In the EU, where the transfer of funds regulation aligned the bloc, supervisors including the European Banking Authority publish the binding expectations; elsewhere the picture is patchwork by design.
Self-hosted wallets are not regulated counterpart institutions, but that does not remove the VASP’s obligations. In the EU, the EBA guidelines require the CASP to collect relevant originator and beneficiary information from its customer. For transfers over EUR 1,000, applicable rules also require measures to assess ownership or control of the self-hosted address. Risk mitigation and decisions on further handling depend on the facts and applicable law, not a universal rule to refuse every self-hosted transfer.
How It Connects to the Rest of Your Duties
Travel rule exchange does not run alone. Knowing who the VASP on the other end is, and whether it is credible, is partner due diligence. What was exchanged, when, and where it is stored is record keeping. And when an examiner asks, the team has to explain all of it on the spot.
That framing matters for sequencing. A team building travel rule operations is really building three. First, a partner VASP due diligence process, so you know who you are exchanging with and can trust what arrives. Second, an exchange channel with retention behind it, so the data exists when asked for. Third, an explanation path, so the file reads coherently under questioning. The first of those overlaps directly with the screening and monitoring discipline this family covers in depth, in the transaction monitoring guide.
The full duty set, where the travel rule sits as the fifth item alongside diligence, monitoring, records, and reporting, is mapped in the VASP AML guide. The family's map page, from definition to license to duties to daily operations, is the VASP compliance hub.