Last Updated: March 2026

The Travel Rule is the regulatory obligation requiring crypto exchanges and Virtual Asset Service Providers (VASPs) to collect, verify, and transmit originator and beneficiary information alongside every cryptocurrency transaction above a defined threshold – £1,000 in the UK, $3,000 in the US, and €1,000 under EU MiCA. Named after the Financial Action Task Force (FATF) Recommendation 16, the Travel Rule is the single most significant AML (Anti-Money Laundering) compliance obligation specific to cryptocurrency transfers, and as of 2026 it is enforceable under UK law via the Money Laundering and Terrorist Financing (Amendment) (No. 2) Regulations 2022. According to ACAMS‘s 2024 VASP compliance survey, 43% of UK-registered crypto exchanges still had incomplete Travel Rule implementation, making it the most common regulatory deficiency identified in FCA supervisory reviews.

Crypto Trace Labs advises crypto exchanges on Travel Rule implementation, VASP counterparty due diligence, and AML compliance architecture. Our team – ACAMS (Association of Certified Anti-Money Laundering Specialists) accredited, MLRO (Money Laundering Reporting Officer) qualified across UK, US, and EU, and Chartered Fellow Grade at the CMI, with founding members from Blockchain.com, Kraken, and Coinbase who have implemented Travel Rule compliance at scale – has direct experience of FCA supervisory review of Travel Rule systems.

Key Takeaways

• The £1,000 threshold applies per transaction, not cumulatively: Each individual transaction at or above £1,000 triggers the Travel Rule data transmission obligation independently – there is no aggregation period.
• VASP-to-VASP transfers and unhosted wallet transfers have different requirements: VASP-to-VASP transfers require bilateral data exchange. Transfers to unhosted (self-custodied) wallets require enhanced due diligence under UK regulations.
• Data must be transmitted before or simultaneously with the transaction: The FCA’s guidance specifies that Travel Rule data must accompany the transaction, not follow it – retroactive data collection is non-compliant.
• VASP counterparty due diligence is mandatory: According to FATF’s 2024 Guidance on Virtual Assets, exchanges must verify that counterparty VASPs are registered or licensed in their jurisdiction and subject to equivalent AML standards before exchanging Travel Rule data.
• Interoperability protocols are not yet universal: TRISA, TRP (Travel Rule Protocol), and OpenVASP are the main protocol standards, but not all VASPs use the same one – exchanges must support multiple protocols or use a Travel Rule aggregator service.

Why This Matters

The Travel Rule is the mechanism that connects cryptocurrency transfers to the identity information required for AML monitoring, law enforcement cooperation, and financial crime investigation. Without Travel Rule data, a Bitcoin transfer is pseudonymous – the exchange can see it happened but cannot identify the parties without additional investigation. With Travel Rule compliance, every significant transfer carries the originator’s name, account number, and address alongside the blockchain transaction, creating the same transparency that SWIFT messaging provides in correspondent banking. Exchanges that fail to implement the Travel Rule face FCA enforcement, fines, and in serious cases, de-registration. More significantly, they cannot cooperate effectively with law enforcement data requests, which damages their banking relationships and their ability to maintain fiat rails.

Travel Rule Data Requirements

Travel Rule data requirements define exactly what information must be collected from the originating customer, verified, and transmitted to the receiving VASP for every qualifying transaction.

For the originator (the sending customer), the exchange must collect and transmit: full legal name; account number or unique identifier (typically the customer’s wallet address at the exchange); physical address, national identity number, date and place of birth, or customer identification number; and the originating institution’s name and account number or address. For the beneficiary (the receiving customer), the exchange must collect and transmit: full legal name; account number or unique identifier at the receiving institution; and the beneficiary institution’s name.

The data must be verified against the KYC (Know Your Customer) records held for the customer, not self-reported by the customer at the time of the transaction. Exchanges that allow customers to input beneficiary information without cross-referencing it against verified records are non-compliant, as unverified data does not satisfy the FATF’s Travel Rule intent.

VASP-to-VASP Data Transmission Protocols

VASP-to-VASP data transmission is the technical process of exchanging Travel Rule data between the sending and receiving exchanges before or simultaneously with the blockchain transaction.

Three main protocol standards have emerged for Travel Rule data exchange. TRISA (Travel Rule Information Sharing Architecture) is a peer-to-peer protocol that enables direct encrypted data exchange between VASPs using X.509 certificates. TRP (Travel Rule Protocol), developed by a consortium of exchanges including Coinbase and Kraken, uses REST API communication with HTTPS encryption. OpenVASP is a decentralised protocol that uses Ethereum smart contracts for VASP discovery and end-to-end encrypted messaging.

All three protocols require that the sending VASP first identify and verify the receiving VASP (the discovery step), then establish a secure channel, then transmit the Travel Rule data, and then receive confirmation of data receipt before broadcasting the blockchain transaction. Exchanges that have not integrated a Travel Rule protocol must use a Travel Rule solution provider (such as Notabene, Sygna, or Shyft) that acts as an intermediary and maintains connections to multiple protocols.

Unhosted Wallet Transfer Requirements

Unhosted wallet transfers – where funds are sent to or from a self-custodied wallet rather than another VASP – present specific compliance challenges because there is no counterparty VASP to exchange Travel Rule data with.

Under UK regulations, transfers to unhosted wallets above £1,000 require the exchange to collect information about the unhosted wallet, assess the risk of the transfer, and apply enhanced due diligence where warranted. The exchange must obtain from its customer: confirmation that the unhosted wallet is owned by the customer (self-hosted) or a declaration of the beneficial owner if it is not; evidence of ownership where the risk assessment warrants it (typically via micro-transaction proof of control); and for higher-risk unhosted wallets, the source of funds.

According to the FCA’s 2024 guidance on unhosted wallets, exchanges should apply a risk-based approach – routine transfers to established self-custody wallets with a consistent historical pattern require less due diligence than large first-time transfers to previously unseen wallet addresses. Transfers to wallets that blockchain analytics identify as high-risk (mixer-associated, darknet-linked, or sanctions-adjacent) should trigger enhanced due diligence regardless of transaction size.

VASP Counterparty Due Diligence

VASP counterparty due diligence is the process of verifying that another exchange or VASP you are exchanging Travel Rule data with is legitimately registered or licensed and subject to equivalent AML standards.

Before establishing a Travel Rule data exchange relationship with a counterparty VASP, the exchange must verify: that the counterparty is registered or licensed in its jurisdiction as a VASP or equivalent; that the jurisdiction’s AML standards are equivalent to UK standards (FATF-compliant jurisdictions are generally acceptable); and that the counterparty has implemented Travel Rule compliance itself. VASPs in FATF grey or black-listed jurisdictions require enhanced due diligence and may not be acceptable counterparties.

The VASP discovery registries maintained by TRISA and the Global Travel Rule (GTR) consortium provide searchable databases of VASPs that have self-certified their compliance status. However, self-certification is not sufficient – exchanges should request regulatory registration evidence from new counterparty VASPs and review it before accepting Travel Rule data exchanges. An exchange that accepts Travel Rule data from an unverified counterparty and passes it to law enforcement risks transmitting unreliable information.

Technical Architecture for Travel Rule Systems

The technical architecture for a compliant Travel Rule system consists of four components: VASP discovery, data collection and verification, secure transmission, and audit logging.

VASP discovery resolves the destination wallet address to a specific VASP. This is done through blockchain address analysis (Chainalysis and Elliptic maintain exchange deposit address attribution databases) and through VASP registry lookups. Where the destination VASP cannot be identified, the transfer must be treated as an unhosted wallet transfer. Data collection and verification pulls verified KYC data for the originating customer from the exchange’s customer database and validates it against the transmission requirements. Secure transmission packages the data in the relevant protocol format (TRISA, TRP, or OpenVASP) and delivers it to the counterparty VASP. Audit logging records every data exchange with timestamps, counterparty identification, data content, and confirmation of receipt.

Frequently Asked Questions

What transactions are subject to the Travel Rule in the UK?

In the UK, the Travel Rule applies to any cryptocurrency transfer of £1,000 or more sent to or received from another VASP. It also applies to transfers to unhosted wallets above £1,000, though the specific data requirements differ. Transfers below £1,000 require basic originator information to be collected but do not require transmission to the receiving VASP. The threshold applies per transaction, not cumulatively across multiple transactions.

What happens if a VASP does not respond to a Travel Rule data request?

If a counterparty VASP does not respond to a Travel Rule data transmission – either because they have not implemented the relevant protocol or because they are in a jurisdiction without Travel Rule requirements – the sending VASP must apply a risk-based decision about whether to proceed with the transaction. The FCA’s guidance suggests that transactions to VASPs that cannot receive Travel Rule data should be escalated for manual review and may warrant refusal where the risk cannot be adequately managed.

Do exchanges need to transmit Travel Rule data for stablecoin transfers?

Yes. The Travel Rule applies to all cryptocurrency transfers above the threshold, including stablecoin transfers (USDT, USDC, DAI). The digital nature of the asset, its peg to fiat currency, or its classification as a payment token rather than a security does not affect the Travel Rule obligation. MiCA in the EU and UK regulations both apply the Travel Rule to stablecoin transfers.

How should exchanges handle Travel Rule data for privacy coin transactions?

Privacy coins such as Monero present a specific challenge because their design makes it technically impossible to associate a transaction on the blockchain with specific wallet addresses. For privacy coin transactions, exchanges should apply enhanced due diligence at the point of withdrawal, collect Travel Rule data in the same way as for standard transactions, and note in their risk documentation that the blockchain transmission cannot be linked to the Travel Rule data. Some exchanges choose to suspend privacy coin services rather than operate in a compliance grey area.

What is the penalty for non-compliance with the Travel Rule?

FCA enforcement for Travel Rule non-compliance can result in fines, public censure, and in serious cases, cancellation of registration. The FCA’s approach to crypto AML enforcement has become increasingly assertive, with Travel Rule compliance now explicitly included in supervisory review frameworks. Criminal liability for MLRO-level officers exists where non-compliance is deliberate or reckless.

How are Travel Rule data records stored and for how long?

Travel Rule data records must be stored for a minimum of five years after the transaction date, consistent with UK AML retention requirements. The records must include the transmitted data, the counterparty VASP identification, the transaction reference, and confirmation of receipt. Records must be securely encrypted at rest and access-controlled, as they contain personally identifiable information subject to UK GDPR.

What Travel Rule solution providers operate in the UK?

Several Travel Rule solution providers operate in the UK market, including Notabene, Sygna, Shyft, and VerifyVASP. These providers act as intermediaries, maintaining connections to multiple Travel Rule protocols and VASP networks, and providing compliance workflow tools for data collection, verification, and transmission. Selecting a provider requires assessment of their protocol coverage, VASP network reach, and regulatory compliance posture.

When will the EU’s MiCA Travel Rule provisions take full effect?

The EU’s Markets in Crypto-Assets (MiCA) regulation brings the Travel Rule into EU law with full effect from December 2024 for most VASP categories, with the Travel Rule applying to all transfers above €1,000 within the EU and to transfers to and from EU-based VASPs globally. UK exchanges transacting with EU-based customers or counterparty VASPs must comply with MiCA’s Travel Rule requirements for those transactions, in addition to UK domestic requirements.

Executive Summary

Travel Rule implementation is a mandatory AML compliance requirement for all UK-registered crypto exchanges, with enforcement active as of 2022 and FCA supervisory reviews actively checking compliance status. The technical implementation requires VASP counterparty due diligence, multi-protocol data transmission capability, unhosted wallet risk assessment procedures, and five-year data retention with audit logging. Incomplete implementation – covering VASP-to-VASP transfers but not unhosted wallets, or using a protocol that reaches only a fraction of counterparty VASPs – fails the FCA’s compliance standard and creates both regulatory and financial crime risk.

What Should You Do Next?

If your exchange’s Travel Rule implementation is incomplete, untested, or due for regulatory review, Crypto Trace Labs provides Travel Rule compliance gap analysis, implementation advisory, and MLRO-level review of your VASP compliance architecture.

The team at Crypto Trace Labs – ACAMS-accredited, MLRO-qualified across UK, US, and EU, Chartered Fellow Grade at the CMI, with founding members from Blockchain.com, Kraken, and Coinbase – has implemented Travel Rule compliance at scale and supported exchanges through FCA supervisory reviews. We offer no upfront charge for non-custodial wallet recoveries. Contact us to discuss your compliance architecture.

People Also Read

• How Does Blockchain Forensics Work? Expert Methods Explained
• What Is Cryptocurrency AML Compliance?
• Crypto Compliance Roadmap 2026: Navigating MiCA, Travel Rule, AMLA and Stablecoin Rules
• 7 On-Chain Red Flags Every Crypto Compliance Team Must Know in 2026

About the Author

Crypto Trace Labs is a specialist crypto asset recovery and blockchain forensics firm founded by VP and Director-level executives formerly of Blockchain.com, Kraken, and Coinbase. Our team holds ACAMS accreditations, MLRO qualifications across the UK, US, and EU, and Chartered Fellow Grade status at the CMI. With over 10 years of experience in financial crime investigation and court-recognized blockchain forensics expertise, we have recovered 101 Bitcoin for clients in the last 12 months and delivered record fraud reduction for a $14bn crypto exchange. We work with law enforcement agencies, regulated financial institutions, and private clients on crypto asset recovery, blockchain forensics, AML compliance, and expert witness testimony – globally. We offer no upfront charge for non-custodial wallet recoveries. Contact us

This content is for informational purposes only and does not constitute legal, financial, or compliance advice. Crypto asset recovery outcomes depend on specific circumstances, regulatory cooperation, and technical factors. Consult qualified professionals regarding your specific situation.