We implement Travel Rule compliance—Regulation (EU) 2023/1113—in your crypto operations: capturing, verifying and transmitting originator and beneficiary data on every transfer, handling missing information and keeping inspection-ready evidence. Applicable since December 30, 2024, it requires verification of self-hosted addresses above €1,000.
Free consultation
We reply within 24 hours
The Travel Rule is the traceability requirement under which transfers of crypto-assets must be accompanied by information on the originator and the beneficiary. In the European Union it is implemented through Regulation (EU) 2023/1113—the Transfer of Funds Regulation, or TFR—which overhauled the former regime (which only covered bank transfers) and extended it to crypto-assets.
It has applied since December 30, 2024 and, together with MiCA, forms a dual framework: MiCA regulates services and issuers; the TFR regulates transfers. A point that is often misunderstood: the data requirement applies to all transfers involving a crypto-asset service provider (CASP), with no minimum amount. Enhanced verification is only triggered for self-hosted addresses above €1,000. And it is not "a document": it is an operational process with controls and evidence.
We do not hand over a stand-alone policy but a complete, audit-ready rollout: from the diagnosis and the flows to self-custody verification, counterparty management and evidence.
We analyze your model (custody/self-custody), your flows and your counterparties against Regulation (EU) 2023/1113 and the EBA Guidelines, and define the requirements map and the rollout plan.
We define the required data by transfer type, validations, handling of missing information, rejections, escalations and evidence retention. The process, not just the paperwork.
We design the self-custody playbook: verification of ownership or control above €1,000, risk scoring, escalations and documentation, using a reasonable, repeatable method.
We define the framework for dealing with EU and third-country counterparties: compatibility, format, secure transmission and enhanced measures where appropriate.
We set rules for acceptance, rejection, retries and escalation, and keep a decision log (why a transfer was blocked or allowed), as the EBA Guidelines require.
We define the minimum records per transfer (data sent and received, validation results, timings), retention and an "inspection mode" so you can respond quickly to requests for information.
The Travel Rule requires the provider to handle originator and beneficiary data securely and traceably. The critical point is not just "having" the data, but its quality, its transmission to the counterparty, validation on receipt and incident handling.
This is where most blockages and review findings occur. The data collection requirement always applies; the €1,000 threshold adds verification that the customer owns or controls the self-hosted address.
The Travel Rule is triggered when at least one crypto-asset service provider established in the EU is involved in the transfer. If you move crypto on behalf of customers, you are almost certainly in scope.
"Exchanges, custodians, brokers and transfer providers that execute transactions on behalf of customers must collect, transmit and retain the data for every crypto-asset transfer."
"Anyone who holds or transfers crypto-assets on behalf of third parties handles information, validations and traceability, and must know how to act when a counterparty does not provide complete data."
"Providers involved in a transfer chain as intermediaries must retain the information, handle rejections and maintain traceability along the entire chain."
"Regulation (EU) 2023/1113 brings transfers of funds and crypto-asset transfers under a single framework; payment institutions already subject to traceability rules face stronger transparency and anti-money laundering requirements."
The goal is not to "have a policy", but to operate with data and traceability, with less friction and evidence that holds up in an inspection. These are the risks that create the most exposure.
Regulation (EU) 2023/1113 has fully applied since December 30, 2024. This is not a future goal: the Travel Rule already applies to every transfer.
Incomplete or inconsistent data: capturing fields without quality control (formats, identity, DLT addresses) triggers rejections and back-office workload.
No procedure to verify ownership or control of the self-hosted address above €1,000, or to document the evidence of that verification.
Poor handling of "missing data": without a playbook for transfers with incomplete data, you block too much (and lose business) or too little (money laundering risk).
No audit trail: without minimum logs or per-transaction traceability, responding to a request for information becomes slow, costly and risky.
Penalties and friction: AML/CFT non-compliance exposes you to penalties (in Spain, under Law 10/2010) and to blocks and rejections from banks and counterparties.
If you cannot reconstruct a transfer in two minutes (data, validations and decision), it is not. We carry out the diagnosis, design the flows and put your evidence in "inspection mode".
A good rollout turns the Travel Rule into a repeatable operational sequence: capture, transmit, validate, handle issues and retain the evidence for each transaction.
The Travel Rule can be deployed with different levels of automation. Choosing well avoids friction, rejections and excess operating costs.
Compared with "paper compliance", what makes the difference is a process that is operable, defensible and quick to run, with evidence for each transaction.
A complete, audit-ready rollout focused on real operations, in 2–6 weeks depending on volume, counterparties and automation.
| Feature | Basic (manual) | Automated (API/vendor) |
|---|---|---|
| Rollout time | Fast for an MVP, but more friction as you scale | More upfront design, better scalability |
| Handling missing data | Heavy operational workload (support and back office) | Automated validation and routing |
| Self-custody (self-hosted) | More manual verification and evidence | Built-in, traceable verification methods |
| Audit trail | Risk of inconsistencies without discipline | Consistent logs and evidence by design |
The best strategy is usually "controlled manual" for low volumes and "automated" when there is growth, multiple counterparties or frequent self-custody transfers. Indicative table; this page is for information only and does not constitute advice.
It is the set of traceability obligations that require transfers of crypto-assets to be accompanied by information on the originator and the beneficiary. In the EU it is implemented through Regulation (EU) 2023/1113, which applies to transfers involving at least one CASP established in the Union. In practice, it means capturing the data, transmitting it, validating it and handling any issues.
The main framework is Regulation (EU) 2023/1113 (Transfer of Funds Regulation, TFR), which overhauled the former Regulation (EU) 2015/847, together with the EBA Guidelines (EBA/GL/2024/11) on information accompanying transfers of funds and crypto-assets. The international reference standard is FATF Recommendation 16.
Regulation (EU) 2023/1113 has applied since December 30, 2024, at the same time as MiCA became fully applicable. Since that date, every crypto-asset transfer involving an EU CASP must comply with the Travel Rule.
Data on the originator (name, account number or DLT address and, depending on the case, address, document number, customer identifier or date and place of birth) and on the beneficiary (name and account number or address). For legal persons, the LEI is the preferred identifier. The critical point is not just "having" the data, but its quality, transmission, validation and incident handling.
When a self-hosted address is involved, the CASP must obtain the required information. For transfers exceeding €1,000, the obligation to verify that the customer owns or controls that address is triggered, using a reasonable, documented method (for example, signing a message with the associated key, or blockchain analysis), in line with the EBA Guidelines.
The Travel Rule is triggered when at least one CASP is involved in the transfer. Transfers purely between self-hosted addresses, with no CASP involved, generally fall outside its scope, but money laundering risks may call for internal measures depending on your model. Exact applicability depends on the flow and on your entity’s role.
The EBA Guidelines require you to detect missing or incomplete information, request it from the counterparty (with reminders) and decide, under your internal policies, whether to execute, reject or suspend the transfer. You must also notify the previous provider in the chain and record the decision and the reason for it.
Non-compliance with AML/CFT obligations (including traceability) increases the risk of administrative penalties, requests for information and operational restrictions, as well as reputational damage and blocks and rejections of transfers by banks and counterparties. In Spain, the AML penalty regime (Law 10/2010) provides for significant fines for serious and very serious infringements.
It depends. The Regulation applies to "crypto-assets" as defined in MiCA, which excludes truly unique, non-fungible NFTs. However, NFTs that, despite appearing unique, are issued in series or are functionally fungible may fall within scope and therefore be subject to the Travel Rule. A case-by-case analysis is advisable.
It depends on the volume, the operating model (custody or self-custody), the number of counterparties and the level of automation. As a guide, projects start from €1,995. For an accurate estimate, write to us here.
Not for the general data requirement: it applies to all transfers involving a CASP, regardless of the amount. The €1,000 threshold only determines when you must verify ownership or control of a self-hosted address.
The LEI (Legal Entity Identifier) is a unique 20-character identifier for legal entities involved in financial transactions. Under the TFR it is the preferred identifier for originators that are legal persons.
They form a dual framework: MiCA (Regulation 2023/1114) regulates crypto-asset services and issuers; the TFR (Regulation 2023/1113) regulates transfers. Both began to apply fully on December 30, 2024.
A robust rollout is usually up and running in 2–6 weeks, depending on volume, the model (custody or self-custody), the number of counterparties and the level of automation. What takes longest is generating the evidence and end-to-end testing.
It is a provider involved in the chain of a crypto-asset transfer as an intermediary, without being the originator’s or the beneficiary’s provider. It must retain the information, transmit it and handle rejections while maintaining traceability along the chain.
The transmission of personal data between providers must comply with the GDPR (Regulation (EU) 2016/679): data minimization, a legal basis and safeguards, especially for transfers to third countries. It is a balance between AML traceability and data protection that must be documented.
The Travel Rule is an ongoing operational obligation that accompanies every transfer. A traceability report is a one-off forensic analysis of the path of certain funds (for example, in an investigation or after an incident). They are different and complementary.
Implementing it is not about drafting a policy: it is about designing flows, validating data, resolving missing information, verifying self-custody and keeping evidence for each transaction. The order matters.
A good rollout relies on quality data, validations and per-transfer evidence, not on a generic document that breaks down as volume grows.
This is where most blockages and findings occur. Verification above €1,000 must be documented and repeatable for all comparable cases.
Without a missing-data playbook, you block too much (and lose business) or too little (money laundering risk). The key is balancing risk, friction and evidence.
Want to place the Travel Rule within the wider crypto framework? See the MiCA Regulation, the CASP license and anti-money laundering (AML/CFT).
Implementing the Travel Rule is an ordered sequence (diagnosis, policies, self-custody, testing and evidence) that does not disrupt your day-to-day operations. This is the path.
1) Gap analysis and designWe analyze your model (custody or self-custody), your flows (inbound/outbound), your counterparties and your tools, and define the requirements map and the rollout plan.
2) PoliciesWe draft the operating procedures: required data, validations, handling of missing data, rejections, escalations and evidence retention.
3) Self-custodyPlaybook for self-hosted addresses: verification above €1,000, risk criteria and documentation. We define the framework for dealing with EU and third-country counterparties.
4) Testing + evidenceEnd-to-end transfer testing, generation of minimum logs and delivery of inspection-ready evidence, with training for the operations, compliance and support teams.
Quick decisionThe Travel Rule applies: the data must be collected, transmitted, validated and retained.
In addition, verify ownership or control of the address using a documented method.
Usually out of scope, but money laundering risk may call for internal measures.
Defined roles, acceptance/rejection rules and secure transmission.
Avoids "informal compliance" that breaks down as volume grows.
Fields by transfer type, validations and documented handling of missing data.
In a presentable, exportable format.
Verification of ownership or control, with the chosen method and its evidence.
The same standard for all comparable cases.
Evidence retention and the ability to export by date range, customer and counterparty.
EU: ≥ 5 years; in Spain, Law 10/2010 requires 10 years.
Data minimization and GDPR compliance in processing and transmission.
A balance between AML traceability and data protection.
Anticipate them so you neither lose business by blocking too much nor take on risk by blocking too little.
If you are implementing the Travel Rule, these terms come up in the diagnosis, in flow design and when responding to requests for information.
The requirement for crypto-asset transfers to be accompanied by information on the originator and the beneficiary, with validation and traceability.
The Transfer of Funds Regulation. It extends the traceability rules for transfers of funds to crypto-assets.
EBA/GL/2024/11: they specify how to detect and handle missing or incomplete data and how to verify self-hosted addresses.
The person who orders the crypto-asset transfer. Their data (name, account/address and, where applicable, further identification) must travel with the transaction.
The person who receives the transfer. At least their name and their account number or address must accompany it.
A self-custody wallet controlled by the user, not by a provider. Above €1,000, ownership or control must be verified.
Legal Entity Identifier: a unique 20-character code for legal entities. It is the preferred identifier for originators that are companies.
Crypto-asset service provider. Its involvement in a transfer is what triggers the Travel Rule.
A provider that acts as an intermediary in the chain of a transfer, without being the originator’s or the beneficiary’s provider.
Audit trail: the minimum record per transfer (data sent and received, validations, decisions and timings) that makes it possible to reconstruct the transaction.
Recommendation 16 of the Financial Action Task Force is the global "travel rule" standard for virtual assets and the origin of the European framework.
Required information that is absent or incomplete in a transfer. It must be requested, and a decision taken on whether to execute, reject or suspend the transaction.
A practical resource to prepare for compliance: required fields by transfer type, rules for handling missing data, a self-custody verification procedure, minimum logs and an inspection checklist.
Tell us about your model (custody or self-custody), your volume and your counterparties, and we will tell you what data you must capture, how to handle missing data, how to verify self-custody and how to get your evidence ready for inspection.
The European Travel Rule is Regulation (EU) 2023/1113 of May 31, 2023 on information accompanying transfers of funds and certain crypto-assets, which amended Directive (EU) 2015/849 and repealed Regulation (EU) 2015/847. It has applied since December 30, 2024 and, together with MiCA (Regulation (EU) 2023/1114), forms a dual framework: MiCA regulates services and issuers; the TFR regulates transfers.
The requirement to provide originator and beneficiary data applies to all transfers involving a CASP, with no minimum amount. The €1,000 threshold only triggers verification of ownership or control of self-hosted addresses. The EBA Guidelines (EBA/GL/2024/11 of July 4, 2024) set out how to handle missing or incomplete data and how to verify self-custody. The international reference standard is FATF Recommendation 16.
The Travel Rule does not operate in isolation: it ties in with CASP authorization under MiCA and with the anti-money laundering (AML/CFT) obligations governed in Spain by Law 10/2010, under SEPBLAC supervision. The transmission of personal data must also comply with the GDPR (Regulation (EU) 2016/679). That is why it should be designed together with the rest of your compliance program, not as a stand-alone formality.
You can consult the legislation directly in its official sources: Regulation (EU) 2023/1113 (EUR-Lex), its publication in the BOE and the EBA Guidelines (EBA/GL/2024/11). This page is for information only and does not constitute legal advice; each entity must analyze its own case individually.
Key legislation, linked to the official text:
Legislation and links reviewed in .