What Is the Crypto Travel Rule?

If you have ever moved crypto between exchanges, you may have been asked who the recipient is or which platform you are sending to. That request often traces back to the Travel Rule, an anti-money-laundering measure that requires certain firms to pass customer information alongside a transfer. It is one of the most consequential compliance rules in crypto, yet it is widely misunderstood.

This article explains what the Travel Rule is, where it comes from, who it applies to, and why the details differ from one country to the next. This is general information, not legal or financial advice; rules vary by jurisdiction and change over time.

The core idea

The Travel Rule requires that identifying information about the sender and the recipient “travels” with a transfer of value. The logic is simple: if law enforcement later investigates a transaction linked to illicit activity, the information needed to trace who was involved should already be attached to it. The concept is not new to crypto. It has applied to traditional bank wire transfers for years, and it was extended to the crypto sector as digital assets grew.

Where the rule comes from: FATF Recommendation 16

The Travel Rule is set out in Recommendation 16 of the Financial Action Task Force (FATF), an intergovernmental body that sets global standards to combat money laundering and terrorist financing. Recommendation 16 was originally written for wire transfers. In 2019, FATF updated its standards so that they clearly cover virtual assets and virtual asset service providers (VASPs), bringing crypto transfers into scope.

An important nuance is that FATF does not itself pass laws. It issues recommendations that member countries and jurisdictions with significant crypto activity are expected to implement through their own national legislation and regulators. That is why the rule exists globally in principle but looks different in practice depending on where you are.

Who must comply

The Travel Rule places obligations on VASPs — businesses such as crypto exchanges and custodial wallet providers that handle virtual assets on behalf of customers. When one VASP sends crypto to another on a customer’s instruction, the sending (originating) VASP is expected to obtain and transmit the required information to the receiving (beneficiary) VASP.

The rule is not designed to target individuals moving crypto between wallets they control themselves. However, when a customer sends to or receives from a self-hosted wallet, the VASP involved may still have obligations to collect information, depending on the jurisdiction. The definition of exactly which firms count as VASPs is drawn from FATF guidance and then adapted in national law, so coverage can vary.

What information has to travel

FATF’s standard calls for both parties’ details to accompany a transfer. In broad terms this includes:

• Originator (sender) information, such as name and an account or wallet identifier, and often an additional identifier like a physical address, national ID number, or date and place of birth.
• Beneficiary (recipient) information, such as name and the receiving account or wallet reference.

The originating and beneficiary VASPs are expected to exchange this data securely and to hold it in line with record-keeping rules. The precise required fields, formats, and security expectations are determined by each jurisdiction’s implementation.

The threshold, and why it varies

One of the most frequently misstated details is the transaction threshold. FATF recommends applying the Travel Rule to virtual asset transfers at or above a USD/EUR 1,000 value. Below that level, lighter requirements may apply, though basic information may still be needed.

Because this is a recommendation rather than a single global law, real-world thresholds differ. Some jurisdictions apply the suggested figure, others set a lower amount, and some apply no threshold at all, requiring information for every covered transfer. The result is a patchwork: the same transaction can trigger different obligations depending on the countries and firms involved. Anyone assessing a specific case should check the applicable local rules rather than assume a single number applies everywhere.

How it connects to KYC and AML

The Travel Rule does not stand alone. It sits on top of the broader anti-money-laundering framework that VASPs already operate within, including customer identification and ongoing monitoring. To share accurate sender and recipient details, a firm first has to know who its customer is, which is where KYC and AML in crypto come in. In practice, Travel Rule compliance is an extension of the identity and monitoring processes a regulated VASP maintains. The concept of a VASP is itself central here: only a business that meets the definition is expected to comply, which is why understanding what a VASP is and how crypto is licensed is a useful companion to this topic.

Originator and beneficiary: who is who

The rule uses two key terms. The originator is the customer sending the transfer, and the beneficiary is the person receiving it. Correspondingly, the originating VASP is the firm acting for the sender, and the beneficiary VASP is the firm acting for the recipient. In a typical exchange-to-exchange withdrawal, the sending platform must collect the required details and transmit them to the receiving platform, which is expected to receive, store, and where necessary act on that information. The receiving VASP is also generally expected to screen incoming transfers for sanctions and other red flags, so the obligation runs in both directions rather than resting solely on the sender.

The self-hosted wallet question

A recurring point of debate is how the rule applies when one side of a transfer is a self-hosted (also called unhosted or private) wallet rather than another VASP. Because a self-hosted wallet is controlled by an individual, there is no counterparty institution to exchange information with. Jurisdictions have taken different approaches: some require the VASP to collect additional information about the customer’s own self-hosted wallet, and some require extra checks for transfers above certain values. This is one reason a compliant exchange may ask you to confirm that you own a wallet you are withdrawing to, or to provide details about the destination. None of this changes the fact that individuals moving their own funds are not themselves the target of the rule.

Practical friction and open challenges

Implementing the rule across a decentralized, global industry is genuinely difficult. VASPs must be able to identify whether a counterparty is another regulated VASP, securely exchange data with it, and handle transfers involving self-hosted wallets. A well-known difficulty is the so-called sunrise problem: because jurisdictions adopted the standard at different times, a firm in a country that already enforces the rule may need to send information to a firm in a country that has not yet implemented it, or cannot receive it. Data-protection and privacy laws add further complexity, since securely transmitting personal information between firms must respect those rules too. Industry messaging standards and specialized compliance tools have emerged to help, but interoperability remains a work in progress.

How the Travel Rule fits the wider rulebook

The Travel Rule is one piece of a much larger regulatory picture that also includes licensing, consumer protection, and tax. Different countries weave it into their frameworks in different ways, which is why a global overview is helpful; our explainer on how crypto is regulated by jurisdiction puts it alongside other national approaches, and the broader regulation hub collects related topics. Seeing the Travel Rule in context makes clear that it is fundamentally an anti-money-laundering tool, not a tax or investor-protection measure.

Common misconceptions

Several myths cloud discussion of the Travel Rule. The first is that it is a single global law with one fixed threshold; in reality it is a FATF standard implemented differently in each country, with thresholds ranging from the recommended figure down to zero. The second is that it applies to individuals moving their own crypto; the obligation falls on VASPs acting for customers, not on people managing their own wallets. The third is that it bans self-hosted wallets; it does not, though it may add checks around transfers involving them. A fourth is that the rule lets authorities watch every transaction in real time; instead, it requires firms to collect and retain information so it is available if lawfully requested, which is different from live surveillance. Separating the rule’s actual requirements from these misconceptions makes it far easier to understand why compliant platforms behave the way they do.

What this means for users

For everyday users, the Travel Rule mostly shows up as extra questions during withdrawals or transfers on regulated platforms, such as naming the destination, identifying the receiving service, or confirming ownership of a receiving wallet. These steps reflect the platform meeting its obligations, not a judgment about any individual. Understanding this helps explain why compliant exchanges ask for information that older or unregulated services did not, and why the exact questions differ from one platform and country to another.

Because the landscape keeps evolving, treat any specific figure or requirement as jurisdiction-dependent and subject to change. Again, this is general information and not legal or financial advice; the rules vary by country and are still being implemented in many places.

Sources

• Virtual Assets — Financial Action Task Force (FATF)
• The FATF Recommendations — Financial Action Task Force (FATF)
• Updated Guidance for a Risk-Based Approach to Virtual Assets and VASPs — Financial Action Task Force (FATF)