Travel Rule for digital asset transfers

What is the Travel Rule?

The Travel Rule requirement is aimed at so-called crypto-asset service providers (CASPs), i.e. companies that transfer digital assets on behalf of their customers. The Travel Rule regulates the information collected and exchanged between these CASPs about the originators and beneficiaries involved in the transaction. The parties involved can take on different roles depending on the type of transfer: originator CASP and beneficiary CASP.

Figure 1: Flow of information during a digital asset transfer

The main stipulations of the Travel Rule are:

• Identification of involved parties: identification of the originators and beneficiaries of digital asset transfers
• Stipulation on the exchange time: coordination of the time of data exchange between the CASPs involved, ensuring that the information is exchanged before the transfer is initiated
• Stipulation on the information to be exchanged:
  • Name of the beneficiary
  • Wallet address of the beneficiary
  • Address of the beneficiary
  • Legal Entity Identifier (LEI)
  • Customer ID of the beneficiary
• Traceability of transactions: the stipulations ensure that all transfers of crypto-assets can always be traced, just like any other financial transactions. Suspicious transactions must be identified and, if necessary, blocked.

What does the Travel Rule regulate?

The Travel Rule, also known as Financial Action Task Force (FATF) Recommendation 16, is a set of guidelines designed to prevent money laundering and terrorist financing in international payment transactions. In 2019, the FATF’s non-binding guidelines were extended to include digital assets. Since then, they have also applied to CASPs.

Figure 2: Timeline for implementing the requirements of the travel rule

The Travel Rule is finding more and more application all over the world. Against this backdrop, the European Union has published the Transfer of Funds Regulation (TFR), which makes the Travel Rule regulations stipulated therein binding. Independently from this EU regulation, Germany has already transposed the recommendations into its national legislation in the form of the Crypto-Asset Transfer Regulation (Kryptowertetransferverordnung, KryptoWTransferV), which came into force on October 1, 2021.

In the future, financial institutions will have to adhere to the EU-wide regulations as per December 30, 2024, i.e. the updated requirements according to the TFR.^[1] These are set out in more detail in the “Final report on Guidelines on information requirements in relation to transfers of funds and certain crypto-assets transfers under Regulation (EU) 2023/1113 (Travel Rule Guidelines)”.

The regulations include stipulations regarding the information to be exchanged, the timing of the data exchange and the handling of errors that may occur during the exchange of information. The requirements also apply to transfers between identical beneficial owners. In order to comply with the TFR, digital asset transfer service providers are also required to clearly identify the originators and beneficiaries involved and to store this data for transparency purposes, e.g. for the prevention of money laundering.

The Travel Rule requires CASPs to obtain accurate information on the originators and beneficiaries of digital asset transfers and pass it on to the other CASPs or financial institutions involved, either before or during the transaction.

Travel Rule protocols – market overview

The requirements defined in the Travel Rule apply to financial institutions that wish to offer transfer-related services (e.g. crypto custody, transfer services on behalf of third parties). To this end, they need to ensure the technological implementation and use of a standardized data exchange protocol, i.e. an existing set of rules that regulates the transfer of Travel Rule-related data between two entities.

There is still no market standard for implementing the Travel Rule, even though there have already been initial efforts to agree on a uniform protocol, such as the interVASP Messaging Standard (IVMS101), which was developed by the FATF. This protocol specifies the information to be transmitted between CASPs as well as their format.

However, there are also other protocols such as the Travel Rule Protocol, TRUST, TRISA or VerifyVASP. These standards are often centralized, complex and costly to deploy. That’s why multiple technology providers offer solutions for their implementation. They are trying to fill the existing market gap and establish themselves on the market with their own technological solutions.

Nevertheless, even the supposed “plug and play” offerings require an interface connection on the part of the financial institutions that takes some effort to develop. Moreover, these service offerings increase the outsourcing risk of digital asset service providers. As a result, they compete with standards based on simplified manual processes that can be implemented quickly and independently and are therefore preferred by companies with a strong go-to-market focus.

Approaches to implementing the Travel Rule

When it comes to implementing the Travel Rule, both newly founded CASPs and existing regulated financial institutions must decide whether they want to develop their own solution or commission a provider. The right choice depends on the individual situation of each financial institution. It is important to carefully weigh up the costs, benefits and strategic objectives.

It is also necessary to set a clear time frame for the implementation of a solution, which must be aligned with the launch of the crypto-asset service offering. However, “faster” is not always better. For example, quick-to-implement solutions are often less tailored to the respective institution’s needs and harder to adapt. By contrast, a longer implementation period allows for thorough planning, integration into existing processes and response to newly emerging market standards.

Thanks to our zeb project experience, we are aware of the challenges that financial institutions face when implementing the Travel Rule.