When a bank sends a wire transfer, the names of the sender and the receiver go with it. That simple rule lets the next bank screen the payment and lets investigators follow it. A blockchain carries an address and an amount, and nothing else. The Travel Rule is the FATF's answer to that gap, and putting it into practice is harder than it sounds.

Where the rule comes from

The FATF's Recommendation 16 has long required banks to send originator and beneficiary information with wire transfers. In 2019 the FATF applied the same idea to virtual asset service providers (VASPs): exchanges, custodial wallets, brokers and other businesses that exchange, transfer or hold virtual assets for others. The industry calls it the Travel Rule.

The definition of a VASP is deliberately functional. The FATF's 2021 guidance asks countries to judge by what a business does, not by its technology or name. Calling a service "decentralised" does not by itself take it outside the rules, and the people who control or have sufficient influence over a DeFi arrangement can be VASPs.

What has to travel

Under the FATF's 2021 guidance, the sending VASP must obtain accurate information about its own customer and the required information about the beneficiary, and send it to the receiving VASP immediately and securely:

  • About the sender: name, account number or wallet address, and one more identifier, such as a physical address, national identity number, customer number, or date and place of birth.
  • About the receiver: name, and account number or wallet address.

Three details matter in practice:

  • "Immediately" means before, with or alongside the transfer. Sending it afterwards does not count.
  • It does not have to go on the blockchain. Any technology that does the job is acceptable, and in practice VASPs use separate messaging systems.
  • Thresholds differ. The FATF allows countries a de minimis threshold of up to USD/EUR 1,000, with less information required below it. The EU's Transfer of Funds Regulation, applying since 30 December 2024, sets no threshold for crypto-asset transfers. A team that assumes one global threshold will get it wrong.
Two paths for one crypto transfer: the virtual assets move on the blockchain, while the sender and receiver information travels between the two VASPs on a separate channel, and the receiving VASP screens before releasing the funds. ONE TRANSFER, TWO PATHS Sending VASPknows its customer blockchain: address · amount messaging: names · identifiers Receiving VASPscreens, then releases THE NAMES DO NOT RIDE ON THE CHAIN, SO THE TWO PATHS MUST BE JOINED
The value and the information take different routes. The receiving VASP has to match them, and screen, before the funds are available.

Why it is hard

The two paths have to be joined. The assets move on the blockchain; the information moves on a separate channel. If the information arrives late, the receiving VASP may already hold funds it has not screened. The FATF expects controls so that sanctions screening happens before funds become available, for example by holding them until screening is complete.

You have to know who is on the other side. The FATF notes there is no technically proven way to tell from a wallet address alone which VASP, if any, is behind it. VASPs must do due diligence on their counterparty VASPs, and there is no single directory of them.

Not every transfer has a VASP at the other end. A transfer to or from a self-hosted ("unhosted") wallet has no counterparty VASP to send information to. The VASP must still collect the information from its own customer and look carefully at the transfer. Transfers directly between two self-hosted wallets, with no business involved, fall outside the rule altogether.

Countries are moving at different speeds. The FATF calls this the "sunrise issue": a VASP in a country where the rule applies must still deal with counterparties in countries where it does not yet.

How far countries have got

The FATF publishes an update on virtual assets every year. Its figures are largely self-reported, so they are best read with their year and their base:

  • Laws are spreading. In the 2026 update, 91 of 109 responding jurisdictions (83%) said they had passed Travel Rule legislation, up from 35 in 2023.
  • Enforcement lags. 55 of those 91 had not yet issued supervisory findings or taken enforcement action. A law on paper is not yet a rule that is checked.
  • Wider compliance is still weak. Of 149 jurisdictions assessed by April 2026 against Recommendation 15, one was fully compliant, 34% largely compliant, 43% partially compliant and 22% non-compliant.
  • The gaps the FATF names: peer-to-peer transfers through unhosted wallets, which it calls a structural gap; DeFi; stablecoins, which its 2025 and 2026 updates report have become the asset most used in illicit on-chain activity; and offshore VASPs serving customers where they are not licensed.

The rule is also changing. The FATF revised Recommendation 16 in June 2025, applying the updated requirements to VASPs through Recommendation 15, and expects the changes in effect by the end of 2030.

Questions for a compliance team

Whether you run a VASP or a bank that deals with them, five questions show how ready you are:

  1. Do we know which thresholds apply in each country we serve, including where there is none?
  2. Do we screen before funds become available, or only after the information arrives?
  3. How do we identify and assess counterparty VASPs, and what happens when we cannot?
  4. What do we do with unhosted wallets: what we ask the customer, and when we decline?
  5. What happens when information is missing or wrong: do we hold, return or report the transfer, and is the decision recorded?
The blockchain shows where value went. The Travel Rule is what tells you who sent it, and who received it.

In Kenya, the Virtual Asset Service Providers Act, 2025 came into force on 4 November 2025. It makes the Capital Markets Authority and the Central Bank of Kenya the regulators, each for listed activities, requires licensing, and makes VASPs reporting institutions under the Proceeds of Crime and Anti-Money Laundering Act. As at November 2025, licensing awaited regulations. Check the current regulations and licence register.

Our free course Virtual Assets and the Travel Rule covers the definitions, the FATF Standards, red flags and real cases in depth, with a knowledge check and a certificate.

Sources