Everything VASPs Need to Know about the FATF Travel Rule

What Is the FATF Travel Rule?

In 2019, the Financial Action Task Force (FATF) extended its anti-money laundering and counter-terrorist financing (AML/CFT) standards to virtual assets and virtual asset service providers (VASPs). The requirements are set out primarily in FATF Recommendation 16 and its Interpretive Note, commonly referred to as the Travel Rule.

The Travel Rule requires relevant financial institutions and VASPs to collect and transmit specified information about the originator and beneficiary of a virtual asset transfer. The objective is to ensure that this information is available to the financial institutions and VASPs involved in a transfer, as well as to competent authorities when required, including for the detection and investigation of financial crime.

Since 2019, the FATF has conducted several reviews of global implementation and continued to develop its standards for the virtual asset sector. In June 2025, the FATF published the final revision of Recommendation 16 following two public consultations. The revised standard clarifies existing requirements and introduces additional requirements that countries will need to incorporate into their domestic legislation.

The FATF standard itself is not directly applicable law. Countries are expected to implement the revised requirements through national legislation and regulation. The FATF has given jurisdictions until the end of 2030 to implement the revised standard.

What Changed in Recommendation 16?

The 2025 revision introduces several changes that affect how Travel Rule information is collected, exchanged and verified.

Beneficiary Address Information

One of the significant changes is the introduction of beneficiary address information. For transfers above the applicable threshold, the beneficiary's address must include the beneficiary's country and town. Unlike the originator address, a full address is not required.

Depending on the applicable jurisdiction and Travel Rule implementation, users may already need to provide information such as the beneficiary's wallet address, name and VASP. The revised Recommendation 16 adds the beneficiary's country and town to the required information.

Verification of Beneficiary Information

The revised standard also introduces requirements relating to the verification of beneficiary information.

The beneficiary's financial institution or VASP should check whether the information received about the intended beneficiary is consistent with information already held about that beneficiary. Depending on the implementation, this verification may take place before the transfer, after the transfer or on an ongoing basis.

For VASPs, this introduces an additional operational consideration when designing Travel Rule workflows, particularly where verification needs to take place before a transaction can proceed.

Legal Person Information

The revised Recommendation 16 introduces additional requirements for transfers involving legal persons.

For transfers above the applicable threshold, information identifying a legal person must include one of the following:

• a connected Business Identifier Code (BIC);
• a Legal Entity Identifier (LEI) per ISO 17442; or
• another unique official identifier issued by the relevant jurisdiction.

This requirement is particularly relevant to institutional and business-to-business virtual asset transfers.

21 Travel Rule already supports the collection of legal entity identification information for transfers involving legal persons. Depending on the jurisdiction and entity involved, this can include an LEI or a domestic official identifier.

The Payment Chain

The 2025 revision also clarifies the concept of the payment chain.

Under the revised framework, payment transparency obligations begin with the financial institution that receives an instruction from the customer and continue through the institutions involved in processing the payment, ending with the institution that services the beneficiary's account or provides cash to the beneficiary.

This clarification is relevant to transactions involving multiple financial institutions or intermediaries and provides a clearer framework for determining where payment transparency obligations apply.

Which Businesses Are Affected by the Travel Rule?

The FATF Travel Rule applies to financial institutions and VASPs that are subject to Recommendation 16 and its national implementation. The precise scope of the requirements depends on the applicable jurisdiction.

Which Transfers Are Covered by the Travel Rule?

At the FATF level, Recommendation 16 establishes requirements for relevant transfers involving obliged entities. National legislation determines how these requirements apply in practice.

For VASPs, this can include:

• virtual asset transfers between a VASP and another VASP or other obliged entity;
• transfers involving financial institutions or other regulated entities where they fall within the applicable Travel Rule framework; and
• transactions involving self-hosted wallets where the relevant jurisdiction imposes requirements for such transfers.

Self-hosted wallet transactions can require additional measures because there may be no second VASP to receive or provide Travel Rule information. Depending on the jurisdiction, VASPs may need to collect additional information or verify that the customer controls the destination wallet.

As a result, VASPs operating across multiple jurisdictions need to determine the requirements applicable to each transaction rather than relying on a single global rule.

Examples of jurisdictions that include self-hosted wallets within their frameworks include Switzerland, the EU, Liechtenstein, Singapore, Hong Kong, among others.

What Do VASPs Have to Do to Comply with the Travel Rule?

The Travel Rule requires relevant information about the parties involved in a virtual asset transfer to accompany the transaction information exchanged.

Depending on the applicable jurisdiction, VASPs may need to:

• collect the required originator and beneficiary information;
• ensure that the required information is accurate and complete;
• transmit the information to the relevant counterparty;
• receive and retain required information from counterparties;
• apply appropriate controls where required information is missing or cannot be verified;
• conduct counterparty due diligence;
• verify beneficiary information where required;
• identify legal persons using the required identifiers;
• apply jurisdiction-specific requirements to transfers involving self-hosted wallets; and
• retain relevant information and make it available to competent authorities when legally required.

The FATF framework is intended to ensure that originator and beneficiary information is available to support law enforcement investigations, financial intelligence analysis and the identification of suspicious, sanctioned or otherwise illicit transactions.

What Information Does the Travel Rule Require?

The exact data requirements depend on the applicable jurisdiction, however the FATF requires, at a minimum, that the below data be collected and exchanged*:

• originator’s name;
• originator’s account number or unique transaction reference;
• originator’s address; and
• originator's date of birth.

• beneficiary’s name;
• beneficiary’s account number or unique transaction reference;
• beneficiary’s address information, including the country and town under the revised framework.

Because national implementation varies, VASPs should assess the requirements applicable to the specific jurisdiction and transaction.

*Applicable from 2030.

What Is the Travel Rule Threshold?

The FATF framework establishes a USD/EUR 1,000 baseline for certain requirements, while national legislation can introduce different thresholds or apply Travel Rule requirements from the first unit of currency.

Several jurisdictions apply a zero threshold, meaning that Travel Rule requirements can apply regardless of the value of the transfer.

The following table provides examples of varying Travel Rule thresholds. Requirements can change as jurisdictions update their legislation and regulatory frameworks.

A Travel Rule threshold does not necessarily mean that no AML/CFT requirements apply below that amount. Different requirements may apply to customer due diligence, transaction monitoring, recordkeeping and Travel Rule data depending on the jurisdiction.

The FATF USD/EUR 1,000 threshold should therefore be treated as an international baseline rather than a universal threshold applicable to every VASP.

Why Do Travel Rule Requirements Differ Between Jurisdictions?

The FATF Travel Rule is an international standard, not legislation that automatically applies to VASPs in every country.

Each jurisdiction implements the FATF requirements through its own laws and regulations. This can result in differences in:

• implementation dates;
• transaction thresholds;
• required originator and beneficiary information;
• beneficiary data verification;
• self-hosted wallet requirements;
• legal person identification;
• data retention;
• domestic versus international transfers; and
• requirements for missing or incomplete Travel Rule information.

For example, the United Kingdom has required cryptoasset businesses to collect, verify and share Travel Rule information since 1 September 2023, while the UK's wider cryptoasset regulatory framework is being expanded, with the new regime expected to come into force in October 2027.

Travel Rule compliance therefore requires VASPs to assess the requirements applicable in each jurisdiction in which they operate.

How to Comply with the Travel Rule as a Crypto Business

In practice, compliance requires more than transmitting customer data. VASPs need to determine which requirements apply to each transaction, identify the relevant counterparty, exchange the required information, manage transactions involving self-hosted wallets and maintain appropriate compliance controls and records.

The exact requirements depend on factors including the jurisdiction, transaction value, counterparty and type of transfer. To operationalise these requirements, a VASP generally needs Travel Rule infrastructure that supports one or more Travel Rule protocols, counterparty discovery and, where applicable, self-hosted wallet verification.

What Is a Travel Rule Solution?

A Travel Rule solution is software that enables a VASP to operationalise Travel Rule compliance. It typically provides functionality for collecting, exchanging and managing Travel Rule information, identifying counterparties, applying compliance controls and maintaining an audit trail.

What Is a Travel Rule Protocol?

A Travel Rule protocol defines how Travel Rule information is formatted, transmitted and received between Travel Rule solutions.

Many protocols use standardised data structures, such as IVMS 101, to ensure that information can be interpreted consistently by different systems.

The protocol operates in the background. Compliance professionals interact with the Travel Rule solution, while the underlying protocol handles the technical exchange of information between counterparties.

What are the Challenges to Implementing the Travel Rule?

The practical implementation of the Travel Rule presents several challenges for VASPs, including interoperability, counterparty discovery, regulatory fragmentation, data protection and transactions involving self-hosted wallets.

Counterparty Connectivity

There is no single global Travel Rule network used by every VASP.

Different counterparties can use different Travel Rule protocols and networks. A VASP therefore needs to be able to communicate with multiple counterparties without requiring a separate integration for every network.

Connectivity allows different Travel Rule solutions and protocols to exchange the required information using compatible technical standards.

For compliance teams, this is important because the choice of Travel Rule provider can affect the number of counterparties a VASP can reach.

Counterparty Discovery

A blockchain address generally does not identify the VASP that controls the destination account.

The sending VASP therefore needs a mechanism for determining:

• where the virtual assets are being sent;
• which VASP or other obliged entity services the destination;
• which Travel Rule network or protocol can be used; and
• where the required Travel Rule information should be sent.

Without an effective discovery mechanism, a VASP may know the destination blockchain address but still not know where to send the corresponding Travel Rule information.

Managing Jurisdiction-Specific Requirements

The FATF provides the international standard, while national implementation determines the specific obligations applicable to VASPs.

A Travel Rule compliance process therefore needs to account for the jurisdictional context of each transaction, including applicable thresholds, information requirements, self-hosted wallet rules, verification requirements, legal person identification and data retention.

Self-Hosted Wallets

Transactions involving self-hosted wallets present a different operational challenge because there may be no second VASP to receive or provide Travel Rule information.

Depending on the applicable jurisdiction, VASPs may need to collect additional information or verify that the customer controls the destination wallet.

Wallet verification can be performed through different methods, including cryptographic signatures, microtransactions and other proof-of-control mechanisms.

Data Protection

Travel Rule compliance involves the collection and exchange of sensitive customer information.

VASPs therefore need to consider data protection requirements when selecting and implementing a Travel Rule solution, including:

• where Travel Rule data is stored;
• who can access it;
• whether the provider can access customer data;
• how data is transmitted;
• how long information is retained;
• how data is deleted; and
• which data protection laws apply to the transaction.

These considerations become particularly important when transactions cross jurisdictions with different data protection requirements.

How Does 21 Analytics Help VASPs Comply with the Travel Rule?

21 Analytics provides integrated Travel Rule infrastructure designed to address the key operational requirements involved in Travel Rule compliance.

TRUST: Connect to Major Counterparties

21 Travel Rule provides built-in access to the TRUST network, enabling VASPs to exchange Travel Rule information peer-to-peer with participating counterparties securely, without requiring a separate TRUST integration.

TRUST connects a global network of VASPs, including major exchanges such as Coinbase, Kraken, Gemini, Crypto.com, PayPal, and Robinhood.

TRUST participants undergo a defined due diligence process when joining the network, providing an additional layer of counterparty assurance while allowing VASPs to connect with a broad network of established counterparties.

Combined with 21 Travel Rule’s counterparty discovery and compliance capabilities, the TRUST integration helps VASPs extend their Travel Rule connectivity across custodial and non-custodial transactions while managing the exchange of required information through a single compliance infrastructure.

TRP: Exchange Travel Rule Data

The Travel Rule Protocol (TRP) is an open, royalty-free standard for exchanging Travel Rule information between VASPs.

TRP also supports VASP auto-discovery through its Travel Address, which contains information identifying the VASP responsible for the receiving address and where Travel Rule data should be sent.

It provides additional transaction controls through its Accept or Reject functionality, allowing VASPs to review incoming Travel Rule information and accept, reject or hold transactions before on-chain activity takes place where the applicable workflow supports this. This enables compliance teams to address missing information and apply additional controls as part of the transaction process.

By combining TRP connectivity, peer-to-peer data exchange and VASP auto-discovery, 21 Travel Rule enables VASPs to manage Travel Rule communication without relying on a single centralised network.

AOPP: Verify Self-Hosted Wallets

21 Travel Rule integrated the AOPP Portal to provide an automated workflow for verifying supported self-hosted wallets.

The AOPP Portal supports over 540 wallets, including Ledger, Trezor, MetaMask, Phantom, TronLink and BitBox. It also supports major blockchain networks including Bitcoin, Ethereum, Binance Chain, Solana, TRON, Polygon, Avalanche, Gnosis, Arbitrum and Optimism, covering more than 2,800 digital assets.

The process is initiated when a customer requests a withdrawal to a self-hosted wallet. The customer is directed to the AOPP Portal, where they complete the wallet ownership or control verification process. Once completed, the proof is automatically sent back to the VASP and appears in the Travel Rule compliance software within seconds.

This allows compliance teams to verify self-hosted wallets as part of the existing Travel Rule workflow while reducing operational overhead and avoiding the need to develop and maintain an in-house verification solution.

AOPP verification can also be completed within seconds, without relying on blockchain transaction speeds or manual visual checks. The integration can be implemented with fewer than 10 lines of code, providing VASPs with a streamlined way to incorporate self-hosted wallet verification into their Travel Rule infrastructure.

Together, these capabilities provide a single infrastructure for peer-to-peer Travel Rule data exchanges, counterparty connectivity, counterparty discovery, self-hosted wallet verification and compliance controls.

What Happens Next?

The revised Recommendation 16 does not require immediate implementation of the new requirements by VASPs worldwide. Countries are expected to update their domestic frameworks, with FATF members expected to implement the revised requirements by the end of 2030.

The FATF has also indicated that further guidance will be developed to address areas where additional clarification is needed. This includes issues raised during the public consultation process and matters relating to implementation of the revised standard alongside Recommendation 15, which provides the FATF framework specifically applicable to virtual assets and VASPs.

For compliance teams, Travel Rule implementation is moving beyond basic data exchange towards more detailed requirements around beneficiary information, data verification, legal entity identification and consistent supervision.

Implementing the FATF Travel Rule

Meeting Travel Rule requirements requires VASPs to determine which requirements apply to each transaction, identify and communicate with the relevant counterparty, exchange the required information, manage self-hosted wallet transactions where applicable, apply compliance controls and maintain an appropriate audit trail.

21 Travel Rule brings these capabilities together through TRP connectivity, TRUST integration, counterparty discovery, AOPP self-hosted wallet verification, automated compliance rules and on-premises deployment.