--- updatedAt: 2026-08-31T07:59:31.000Z agentTools: projectIndex: https://docs.sumsub.com/llms.txt --- # Regulatory requirements Explore Travel Rule requirements by jurisdiction. On this page, you can find the information on Travel Rule requirements applied in different jurisdictions. {`

Subject

Details

Status

Not in force. Shall come into force on a date to be determined.

Regulation

Regulatory body

Threshold

The resolution establishes that the obligated subjects must comply with the identification of the originator and the beneficiary of the transactions covered by the Travel Rule, in the terms established by the International Standards of the FATF and in the modality that the FIU establishes for the exchange and validation of said information. Information will be updated when FIU publishes clarifications.

Data to be shared

Subject

Details

Threshold-based data

The resolution establishes that the obligated subjects must comply with the identification of the originator and the beneficiary of the transactions covered by the Travel Rule, in the terms established by the International Standards of the FATF and in the modality that the FIU establishes for the exchange and validation of said information. Information will be updated when FIU publishes clarifications.

Domestic vs cross-border transfers

Batch file transfer

Unhosted wallet verification

VASP Due Diligence

Time and way to share the Information

Record retention

10 years.

The resolution establishes that the obligated subjects must comply with the identification of the originator and the beneficiary of the transactions covered by the Travel Rule, in the terms established by the International Standards of the FATF and in the modality that the FIU establishes for the exchange and validation of said information. Information will be updated when FIU publishes clarifications.

Subject

Details

Status

In force from July 1, 2026.

Regulation

Regulatory body

Threshold

No threshold. The Travel Rule applies to all virtual asset transfers irrespective of value.

Data to be shared

Individual Person


Originator:

  • Full
  • full name;
  • One one or more of the following: i) (i) residential address (not being a post office box); ii) (ii) unique identifier; iii) (iii) unique customer identification number (given by (given by the ordering institution); originating VASP); (iv) date and place of birth. birth;
  • Wallet virtual asset wallet address (including destination tag or account number (or a unique transaction reference number where no wallet memo details, if applicable) or account number number; or, exists). in any other case, unique transaction reference number.

Beneficiary:

  • Full
  • full name;
  • Wallet virtual asset wallet address (including destination tag or account number (or a unique transaction reference number where no wallet memo details, if applicable) or account number number; or, exists). in any other case, unique transaction reference number.

Legal Entity


Originator:

  • Registered
  • full name;
  • One one or more of the following: i) (i) business address (not being a post office box); ii) (ii) unique identifier; iii) (iii) unique customer identification number (given by (given by the ordering institution). originating VASP);
  • Wallet virtual asset wallet address (including destination tag or account number (or a unique transaction reference number where no wallet memo details, if applicable) or account number number; or, exists). in any other case, unique transaction reference number.

Beneficiary:

  • Registered
  • full name;
  • Wallet virtual asset wallet address (including destination tag or account number (or a unique transaction reference number where no wallet memo details, if applicable) or account number number; or, exists). in any other case, unique transaction reference number.

Subject

Details

Threshold-based data

—

Domestic vs cross-border transfers

Domestic transfers


Individual Person


Originator:

  • Wallet address or account number (or a unique transaction reference number where no wallet or account number exists).

Beneficiary:

  • Wallet address or account number (or a unique transaction reference number where no wallet or account number exists).

Legal Entity


Originator:

  • Wallet address or account number (or a unique transaction reference number where no wallet or account number exists).

Beneficiary:

  • Wallet address or account number (or a unique transaction reference number where no wallet or account number exists).

Cross-border transfers


Originator:

  • Full name;
  • One of the following: i) residential address (not being a post office box); ii) unique identifier; iii) identification number (given by the ordering institution); (iv) date and place of birth.
  • Wallet address or account number (or a unique transaction reference number where no wallet or account number exists).

Beneficiary:

  • Full name;
  • Wallet address or account number (or a unique transaction reference number where no wallet or account number exists).

Legal Entity


Originator:

  • Registered name;.
  • One of the following: i) business address (not being a post office box); ii) unique identifier; iii) identification number (given by the ordering institution).
  • Wallet address or account number (or a unique transaction reference number where no wallet or account number exists).

Beneficiary:

  • Registered name;
  • Wallet address or account number (or a unique transaction reference number where no wallet or account number exists).

No difference.

Batch file transfer

In the event that several individual cross-border transfers from a single originator are bundled in a batch file for transmission to beneficiaries, the batch file shall contain required and accurate originator information, and full beneficiary information.

Unhosted wallet verification

Required.


VASP must establish, in their AML/CTF policy, how they will identify the originator or beneficiary in cases where a self-hosted wallet is used and any steps they will take to verify the person who controls such a wallet. The policy must also describe how the VASP will manage and mitigate the ML/TF risk where the self-hosted wallet controller is unverified.

VASP Due Diligence

Required.

Time and way to share the Information

The regulation does not establish specific provisions. In accordance with the FATF's recommendations, the required information must be transmitted immediately and securely.

Record retention

Seven years.

Obligations of the originating VASP

The originating VASP must:

  • obtain information about the originator and beneficiary from a client who initiated a virtual asset transfer;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
  • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
  • conduct VASP Due Diligence;
  • verify a self-hosted wallet to which the virtual assets should be sent (if applicable);
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
  • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
  • keep records related to the transfer for as long as required by national legislation.

Obligations of the beneficiary VASP

The beneficiary VASP must:

  • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet (if necessary);
  • conduct VASP Due Diligence;
  • verify a self-hosted wallet from which the virtual assets were received (if applicable);
  • receive information about the originator and beneficiary from the originating or intermediary VASP (or obtain it directly from its customer if virtual assets are received from a self-hosted wallet) and ensure that the received information is complete by comparing it with the applicable requirements;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
  • keep records related to the transfer for as long as required by national legislation.

Obligations of the intermediary VASP

The intermediary VASP must:

  • receive information about the originator and beneficiary from the previous VASP in the transfer chain and ensure that the received information is complete by comparing it with the applicable requirements;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
  • conduct VASP Due Diligence;
  • verify a self-hosted wallet from which the virtual assets were received or to which they should be sent (if applicable);
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
  • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
  • keep records related to the transfer for as long as required by national legislation.

Subject

Details

Status

In force from 23 February 2022.

Regulation

Regulatory body

Threshold

None. The Travel Rule applies to all crypto-asset transfers irrespective of value.

Data to be shared

Natural Person


Originator:

  • full name;
  • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
  • address (habitual residence, including country name);
  • one of the following: (i) official personal document number and customer identification number or (ii) date and place of birth.

Beneficiary:

  • full name;
  • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier.

Legal Entity


Originator:

  • registered name;
  • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
  • address (registered office address);
  • registration number and customer identification number;
  • legal entity identifier (LEI), where available and provided, or, in its absence, another equivalent official identifier*.

Beneficiary:

  • registered name;
  • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
  • legal entity identifier (LEI), where available and provided, or, in its absence, another equivalent official identifier*.

* Note: The alternative identifier must: (i) be a unique identification code for the legal entity; (ii) be published in public registries; (iii) be automatically issued upon entity formation by a public authority; (iv) allow identification of name and address elements; (v) be accompanied by a description of the identifier type in the messaging system. Where the registration number satisfies the criteria for the alternative identifier, it may also be used for this purpose.

Subject

Details

Threshold-based data

—

Domestic vs cross-border transfers

No difference.

Batch file transfer

In the case of a batch file transfer of crypto-assets from a single originator, the obligation on the originating CASP to ensure that transfers of crypto-assets are accompanied by the required information shall not apply to the individual transfers bundled together therein, provided that: the batch file contains the required information on the originator and the beneficiary; that such information has been duly verified; and that each individual transfer carries (i) the originator's distributed ledger address and the originator's crypto-asset account number, if such an account exists and is used to process the transaction, where the transfer is registered on a DLT network; (ii) the originator's crypto-asset account number, where the transfer is not registered on a DLT network but is made to or from a crypto-asset account; or (iii) the unique transaction identifier, where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account.

Unhosted wallet verification

Required for transactions exceeding EUR 1,000.

VASP Due Diligence

Required when establishing a correspondent relationship with a CASP registered outside the EU.


With respect to cross-border correspondent relationships involving the execution of crypto-asset services – including transfers of crypto-assets – with a respondent entity not established in the EU and providing similar services, CASPs are required, pursuant to Article 19b of Directive (EU) 2015/849 (as introduced by Article 38(2) of Regulation (EU) 2023/1113), when entering into a business relationship with such an entity, to:

  • determine if the respondent entity is licensed or registered;
  • gather sufficient information about the respondent entity to understand fully the nature of the respondent’s business and to determine from publicly available information the reputation of the entity and the quality of supervision;
  • assess the respondent entity’s AML/CFT controls;
  • obtain approval from senior management before establishing new correspondent relationships;
  • document the respective responsibilities of each party to the correspondent relationship;
  • with respect to payable-through crypto-asset accounts, be satisfied that the respondent entity has verified the identity of, and performed ongoing due diligence on, the customers having direct access to accounts of the correspondent entity, and that it is able to provide relevant customer due diligence data to the correspondent entity, upon request.

When conducting the assessment and determining appropriate risk-mitigating measures, CASPs shall also take into account the criteria and elements set out in Guideline 8 of the ML/TF Risk Factors Guidelines (EBA/GL/2021/02, as amended by EBA/GL/2024/01). These requirements will be further supplemented by Article 37 of Regulation (EU) 2024/1624 (AMLR) as of 10 July 2027.

Time and way to share the Information

The required information shall be transmitted immediately and in a secure manner, and no later than the initiation of the blockchain transaction.

Record retention

10 years.

Obligations of the originating CASP

The originating CASP must:

  • obtain information about the originator and beneficiary from a client who initiated a crypto-asset transfer;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
  • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
  • conduct CASP Due Diligence (if applicable);
  • verify a self-hosted wallet to which the crypto-assets should be sent (if applicable);
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
  • transmit information on the originator and the beneficiary to the next CASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
  • keep records related to the transfer for as long as required by national legislation.

Obligations of the beneficiary CASP

The beneficiary CASP must:

  • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet (if necessary);
  • conduct CASP Due Diligence (if applicable);
  • verify a self-hosted wallet from which the crypto-assets were received (if applicable);
  • receive information about the originator and beneficiary from the originating or intermediary CASP (or obtain it directly from its customer if assets are received from a self-hosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
  • keep records related to the transfer for as long as required by national legislation.

Obligations of the intermediary CASP

The intermediary CASP must:

  • receive information about the originator and beneficiary from the previous CASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
  • conduct CASP Due Diligence (if applicable);
  • verify a self-hosted wallet from which the crypto-assets were received or to which they should be sent (if applicable);
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
  • transmit information on the originator and the beneficiary to the next CASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
  • keep records related to the transfer for as long as required by national legislation.

Subject

Details

Status

In force from December 14, 2020.

Regulation

Regulatory body

Threshold

No threshold. The Travel Rule applies to all virtual asset transfers irrespective of value.

Data to be shared

Originator:

  • a) Full name;
  • b) Account number (or a unique transaction identifier); and
  • c) Address or date and place of birth or the payer's national identity number or customer identification number.

Beneficiary:

  • d) Full name;
  • e) Account number (or a unique transaction identifier).

Subject

Details

Threshold-based data

—

Domestic vs cross-border transfers

There is a difference.


Domestic. The following data needs to be transferred: b), but other data should be provided within three business days after request.


Cross-border. The following data should be transferred:

  • < BSD 1,000: a), b), d), e);
  • > BSD 1,000: a), b), c), d), e).

Batch file transfer

Where a batch file transfer comprises individual wire transfers (VA transfers) of one thousand dollars or more from a single payer (originator) to payees (beneficiary) outside The Bahamas, the originating financial institution shall be exempted from the requirements of paragraph 3 of the Section "The main actions required" in respect of the inclusion of the payer's information with each individual transfer, provided that

  • (a) the batch file contains the information required under paragraph 3 specified in Section "The main actions required" on
    • (i) the payer;
    • (ii) the payees; and
  • (b) the individual wire transfers include the payer's account number or, if no account is used , a unique transaction identifier.

Unhosted wallet verification

No requirement. May be applied based on risk assessment.

VASP Due Diligence

No requirement.

Time and way to share the Information

The regulation does not establish specific provisions. In accordance with the FATF's recommendations, the required information must be transmitted immediately and securely.

Record retention

5 years.

Obligations of the originating VASP

The originating VASP must:

  • obtain information about the originator and beneficiary from a client who initiated a virtual asset transfer;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
  • carry out wallet attribution to establish which type of wallet - custodial or unhosted - is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
  • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
  • keep records related to the transfer for as long as required by national legislation.

Obligations of the beneficiary VASP

The beneficiary VASP must:

  • carry out wallet attribution to establish which type of wallet - custodial or unhosted - is used on the other end and, if it is a custodial one, establish which VASP controls the wallet (if necessary);
  • receive information about the originator and beneficiary from the originating or intermediary VASP (or obtain it directly from its customer if assets are received from an unhosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
  • keep records related to the transfer for as long as required by national legislation.

Obligations of the intermediary VASP

The intermediary VASP must:

  • receive information about the originator and beneficiary from the previous VASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • carry out wallet attribution to establish which type of wallet - custodial or unhosted - is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
  • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
  • keep records related to the transfer for as long as required by national legislation.

Subject

Details

Status

In force.

  • From January 1, 2020 — for crypto-asset licensees.
  • From January 1, 2024 — for investment firm licensees.

Regulation

Regulatory body

Threshold

No threshold. The Travel Rule applies to all virtual asset transfers irrespective of value.

Data to be shared

Natural Person


Originator:

  • full name;
  • account number (e.g. crypto-asset wallet) where such an account is used to process the transaction;
  • one of the following: address, national identity number, customer identification number, or date and place of birth.

Beneficiary:

  • full name;
  • account number (e.g. crypto-asset wallet) where such an account is used to process the transaction.

Legal Entity


Originator:

  • registered name;
  • account number (e.g. crypto-asset wallet) where such an account is used to process the transaction;
  • one of the following: address, national identity number (or equivalent identifier), or customer identification number.

Beneficiary:

  • registered name;
  • account number (e.g. crypto-asset wallet) where such an account is used to process the transaction.

Subject

Details

Threshold-based data

—

Domestic vs cross-border transfers

No difference.

Batch file transfer

There are no special provisions.

Unhosted wallet verification

No requirement. May be applied based on risk assessment.

VASP Due Diligence

No requirement.

Time and way to share the Information

The required information shall be transmitted immediately and in a secure manner.

Record retention

5 years.

Obligations of the originating VASP

The originating VASP must:

  • obtain information about the originator and beneficiary from a client who initiated a virtual asset transfer;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
  • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
  • conduct VASP Due Diligence (if applicable);
  • verify an unhosted wallet to which the virtual assets should be sent (if applicable);
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
  • transmit information on the originator and the beneficiary to the next VASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
  • keep records related to the transfer for as long as required by national legislation.

Obligations of the beneficiary VASP

The beneficiary VASP must:

  • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet (if necessary);
  • conduct VASP Due Diligence (if applicable);
  • verify an unhosted wallet from which the virtual assets were received (if applicable);
  • receive information about the originator and beneficiary from the originating or intermediary VASP (or obtain it directly from its customer if assets are received from an unhosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
  • keep records related to the transfer for as long as required by national legislation.

Obligations of the intermediary VASP

The intermediary VASP must:

  • receive information about the originator and beneficiary from the previous VASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
  • conduct VASP Due Diligence (if applicable);
  • verify an unhosted wallet from which the virtual assets were received or to which they should be sent (if applicable);
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
  • transmit information on the originator and the beneficiary to the next VASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
  • keep records related to the transfer for as long as required by national legislation.

Subject

Details

Status

In force from December 30, 2024.

Regulation

Regulatory body

Threshold

No threshold. The Travel Rule applies to all crypto-asset transfers irrespective of value.

Data to be shared

Natural Person


Originator:

  • full name;
  • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
  • address (habitual residence, including country name);
  • one of the following: (i) official personal document number and customer identification number or (ii) date and place of birth.

Beneficiary:

  • full name;
  • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier.

Legal Entity


Originator:

  • registered name;
  • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
  • address (registered office address);
  • registration number and customer identification number;
  • legal entity identifier (LEI), where available and provided, or, in its absence, another equivalent official identifier*.

Beneficiary:

  • registered name;
  • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
  • legal entity identifier (LEI), where available and provided, or, in its absence, another equivalent official identifier*.

* Note: The alternative identifier must: (i) be a unique identification code for the legal entity; (ii) be published in public registries; (iii) be automatically issued upon entity formation by a public authority; (iv) allow identification of name and address elements; (v) be accompanied by a description of the identifier type in the messaging system. Where the registration number satisfies the criteria for the alternative identifier, it may also be used for this purpose.

Subject

Details

Threshold-based data

—

Domestic vs cross-border transfers

No difference.

Batch file transfer

In the case of a batch file transfer of crypto-assets from a single originator, the obligation on the originating CASP to ensure that transfers of crypto-assets are accompanied by the required information shall not apply to the individual transfers bundled together therein, provided that: the batch file contains the required information on the originator and the beneficiary; that such information has been duly verified; and that each individual transfer carries (i) the originator's distributed ledger address and the originator's crypto-asset account number, if such an account exists and is used to process the transaction, where the transfer is registered on a DLT network; (ii) the originator's crypto-asset account number, where the transfer is not registered on a DLT network but is made to or from a crypto-asset account; or (iii) the unique transaction identifier, where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account.

Unhosted wallet verification

Required for transactions exceeding EUR 1,000.

VASP Due Diligence

Required when establishing a correspondent relationship with a CASP registered outside the EU.


With respect to cross-border correspondent relationships involving the execution of crypto-asset services – including transfers of crypto-assets – with a respondent entity not established in the EU and providing similar services, CASPs are required, pursuant to Article 19b of Directive (EU) 2015/849 (as introduced by Article 38(2) of Regulation (EU) 2023/1113), when entering into a business relationship with such an entity, to:

  • determine if the respondent entity is licensed or registered;
  • gather sufficient information about the respondent entity to understand fully the nature of the respondent’s business and to determine from publicly available information the reputation of the entity and the quality of supervision;
  • assess the respondent entity’s AML/CFT controls;
  • obtain approval from senior management before establishing new correspondent relationships;
  • document the respective responsibilities of each party to the correspondent relationship;
  • with respect to payable-through crypto-asset accounts, be satisfied that the respondent entity has verified the identity of, and performed ongoing due diligence on, the customers having direct access to accounts of the correspondent entity, and that it is able to provide relevant customer due diligence data to the correspondent entity, upon request.

When conducting the assessment and determining appropriate risk-mitigating measures, CASPs shall also take into account the criteria and elements set out in Guideline 8 of the ML/TF Risk Factors Guidelines (EBA/GL/2021/02, as amended by EBA/GL/2024/01). These requirements will be further supplemented by Article 37 of Regulation (EU) 2024/1624 (AMLR) as of 10 July 2027.

Time and way to share the Information

The required information shall be transmitted immediately and in a secure manner, and no later than the initiation of the blockchain transaction.

Record retention

10 years.

Obligations of the originating CASP

The originating CASP must:

  • obtain information about the originator and beneficiary from a client who initiated a crypto-asset transfer;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
  • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
  • conduct CASP Due Diligence (if applicable);
  • verify a self-hosted wallet to which the crypto-assets should be sent (if applicable);
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
  • transmit information on the originator and the beneficiary to the next CASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
  • keep records related to the transfer for as long as required by national legislation.

Obligations of the beneficiary CASP

The beneficiary CASP must:

  • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet (if necessary);
  • conduct CASP Due Diligence (if applicable);
  • verify a self-hosted wallet from which the crypto-assets were received (if applicable);
  • receive information about the originator and beneficiary from the originating or intermediary CASP (or obtain it directly from its customer if assets are received from a self-hosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
  • keep records related to the transfer for as long as required by national legislation.

Obligations of the intermediary CASP

The intermediary CASP must:

  • receive information about the originator and beneficiary from the previous CASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
  • conduct CASP Due Diligence (if applicable);
  • verify a self-hosted wallet from which the crypto-assets were received or to which they should be sent (if applicable);
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
  • transmit information on the originator and the beneficiary to the next CASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
  • keep records related to the transfer for as long as required by national legislation.

Subject

Details

Status

In force from January 1, 2018.

Regulation

Regulatory body

Threshold

No threshold. The Travel Rule applies to all virtual asset transfers irrespective of value.

Data to be shared

Originator:


Natural Person:

  • a) Full name;
  • b) Address (or date and place of birth, customer identification number or national identity number);
  • c) Account number (or unique identifier).

Legal Entity:

  • a) Full name;
  • b) Address;
  • c) Account number (or unique identifier).

Beneficiary:

  • d) Full name;
  • e) Account number (or unique identifier).

Subject

Details

Threshold-based data

—

Domestic vs cross-border transfers

There is a difference.


Domestic.


The following data needs to be transferred irrespective of the threshold: c), but other data should be provided within three business days after request.


Cross-border.


> USD 1,000: a), b), c), d), e).

Batch file transfer

Where there is a batch file transfer from a single payer and the payee PSP is situated outside Bermuda, complete information will be considered to have been transferred, provided that:

  • a) The batch file transfer contains complete information on the payer and on each of the payees for each individual transfer;
  • b) The individual transfers of funds carry the account number of the payer or a unique identifier where an account number is not available; and
  • c) The complete information provided on all payees is fully traceable within the beneficiary country.

Unhosted wallet verification

No requirement. May be applied based on risk assessment.

VASP Due Diligence

When establishing a correspondent relationship with a VASP registered outside Bermuda.

Time and way to share the Information

The essential information of each transfer should be accurate, complete and immediately available.

Record retention

5 years.

Obligations of the originating VASP

The originating VASP must:

  • obtain information about the originator and beneficiary from a client who initiated a virtual asset transfer;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
  • carry out wallet attribution to establish which type of wallet - custodial or unhosted - is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
  • conduct VASP Due Diligence (if applicable);
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
  • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
  • keep records related to the transfer for as long as required by national legislation.

Obligations of the beneficiary VASP

The beneficiary VASP must:

  • carry out wallet attribution to establish which type of wallet - custodial or unhosted - is used on the other end and, if it is a custodial one, establish which VASP controls the wallet (if necessary);
  • conduct VASP Due Diligence (if applicable);
  • receive information about the originator and beneficiary from the originating or intermediary VASP (or obtain it directly from its customer if assets are received from an unhosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
  • keep records related to the transfer for as long as required by national legislation.

Obligations of the intermediary VASP

The intermediary VASP must:

  • receive information about the originator and beneficiary from the previous VASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • carry out wallet attribution to establish which type of wallet - custodial or unhosted - is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
  • conduct VASP Due Diligence (if applicable);
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
  • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
  • keep records related to the transfer for as long as required by national legislation.

Subject

Details

Status

In force since 2 February 2026. VASP-to-VASP transmission of originator and beneficiary data becomes operative in two phases: transfers between Brazilian VASPs – 2 February 2027; transfers involving non-Brazilian VASPs – 2 February 2028. Until each phase is completed, self-declarations may be used.

Regulation

Regulatory body

Threshold

No threshold. The Travel Rule applies to all virtual asset transfers irrespective of value.

Data to be shared

Natural Person


Originator:

  • full name;
  • payment or deposit account, or equivalent international account;
  • residential address;
  • CPF, or the equivalent international identification number (for persons not required to register with the CPF);
  • virtual asset wallet address.

Beneficiary:

  • full name;
  • payment or deposit account, or equivalent international account;
  • virtual asset wallet address.

Legal Entity


Originator:

  • registered name;
  • payment or deposit account, or equivalent international account;
  • address of domicile;
  • CNPJ, or the equivalent international identification number (for legal entities not required to register with the CNPJ);
  • virtual asset wallet address.

Beneficiary:

  • registered name;
  • payment or deposit account, or equivalent international account;
  • virtual asset wallet address.

Subject

Details

Threshold-based data

—

Domestic vs cross-border transfers

No difference.

Batch file transfer

No special provisions.

Unhosted wallet verification

Required. Transfers to or from unhosted wallets are treated as cross-border transfers and are accordingly subject to the foreign exchange regime.

VASP Due Diligence

Required when establishing a relationship with a VASP registered outside Brazil.

Time and way to share the Information

The regulation does not establish specific provisions. In accordance with the FATF's recommendations, the required information must be transmitted immediately and securely.

Record retention

Ten years.

Obligations of the originating VASP

The originating VASP must:

  • obtain information about the originator and beneficiary from a client who initiated a virtual asset transfer;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
  • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
  • conduct VASP Due Diligence (if applicable);
  • verify an unhosted wallet to which the virtual assets should be sent;
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
  • transmit information on the originator and the beneficiary to the next VASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
  • keep records related to the transfer for as long as required by national legislation.

Obligations of the beneficiary VASP

The beneficiary VASP must:

  • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet (if necessary);
  • conduct VASP Due Diligence (if applicable);
  • verify an unhosted wallet from which the virtual assets were received;
  • receive information about the originator and beneficiary from the originating or intermediary VASP (or obtain it directly from its customer if assets are received from an unhosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
  • keep records related to the transfer for as long as required by national legislation.

Obligations of the intermediary VASP

The intermediary VASP must:

  • receive information about the originator and beneficiary from the previous VASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
  • conduct VASP Due Diligence (if applicable);
  • verify an unhosted wallet from which the virtual assets were received or to which they should be sent;
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
  • transmit information on the originator and the beneficiary to the next VASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
  • keep records related to the transfer for as long as required by national legislation.

Subject

Details

Status

In force from December 1, 2022.

Regulation

Regulatory body

Threshold

No threshold. The Travel Rule applies to all virtual asset transfers irrespective of value.

Data to be shared

Natural Person


Originator:

  • full name;
  • account number (or unique transaction identifier);
  • address;
  • one of the following: date and place of birth, customer identification number, or national identity number.

Beneficiary:

  • full name;
  • account number (or unique transaction identifier).

Legal Entity


Originator:

  • registered or trading name;
  • account number (or unique transaction identifier);
  • address;
  • one of the following: customer identification number or legal entity identifier (or equivalent identifier).

Beneficiary:

  • registered or trading name;
  • account number (or unique transaction identifier).

Subject

Details

Threshold-based data

—

Domestic vs cross-border transfers

No difference.

Batch file transfer

In cases of batch file transfers of virtual assets from a single originator, the obligation of the originator’s VASP to ensure that information on the originator accompanies each transfer shall not apply to the individual transfers bundled within the batch file, provided that the batch file contains comprehensive information on both the originator and beneficiary. This information must be fully traceable within the beneficiary’s jurisdiction, and each individual transfer within the batch file must include the originator's account number or a unique identifier.

Unhosted wallet verification

Requirement applicable in cases of heightened risk.

VASP Due Diligence

Required.

Time and way to share the Information

The required information shall be transmitted simultaneously and in a secure manner.

Record retention

5 years.

Obligations of the originating VASP

The originating VASP must:

  • obtain information about the originator and beneficiary from a client who initiated a virtual asset transfer;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
  • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
  • conduct VASP Due Diligence;
  • verify an unhosted wallet to which the virtual assets should be sent (if applicable);
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
  • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
  • keep records related to the transfer for as long as required by national legislation.

Obligations of the beneficiary VASP

The beneficiary VASP must:

  • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet (if necessary);
  • conduct VASP Due Diligence;
  • verify an unhosted wallet from which the virtual assets were received (if applicable);
  • receive information about the originator and beneficiary from the originating or intermediary VASP (or obtain it directly from its customer if assets are received from an unhosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
  • keep records related to the transfer for as long as required by national legislation.

Obligations of the intermediary VASP

The intermediary VASP must:

  • receive information about the originator and beneficiary from the previous VASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
  • conduct VASP Due Diligence;
  • verify an unhosted wallet from which the virtual assets were received or to which they should be sent (if applicable);
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
  • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
  • keep records related to the transfer for as long as required by national legislation.

Subject

Details

Status

In force from December 30, 2024.

Regulation

Regulatory body

Threshold

No threshold. The Travel Rule applies to all crypto-asset transfers irrespective of value.

Data to be shared

Natural Person


Originator:

  • full name;
  • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
  • address (habitual residence, including country name);
  • one of the following: (i) official personal document number and customer identification number or (ii) date and place of birth.

Beneficiary:

  • full name;
  • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier.

Legal Entity


Originator:

  • registered name;
  • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
  • address (registered office address);
  • registration number and customer identification number;
  • legal entity identifier (LEI), where available and provided, or, in its absence, another equivalent official identifier*.

Beneficiary:

  • registered name;
  • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
  • legal entity identifier (LEI), where available and provided, or, in its absence, another equivalent official identifier*.

* Note: The alternative identifier must: (i) be a unique identification code for the legal entity; (ii) be published in public registries; (iii) be automatically issued upon entity formation by a public authority; (iv) allow identification of name and address elements; (v) be accompanied by a description of the identifier type in the messaging system. Where the registration number satisfies the criteria for the alternative identifier, it may also be used for this purpose.

Subject

Details

Threshold-based data

—

Domestic vs cross-border transfers

No difference.

Batch file transfer

In the case of a batch file transfer of crypto-assets from a single originator, the obligation on the originating CASP to ensure that transfers of crypto-assets are accompanied by the required information shall not apply to the individual transfers bundled together therein, provided that: the batch file contains the required information on the originator and the beneficiary; that such information has been duly verified; and that each individual transfer carries (i) the originator's distributed ledger address and the originator's crypto-asset account number, if such an account exists and is used to process the transaction, where the transfer is registered on a DLT network; (ii) the originator's crypto-asset account number, where the transfer is not registered on a DLT network but is made to or from a crypto-asset account; or (iii) the unique transaction identifier, where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account.

Unhosted wallet verification

Required for transactions exceeding EUR 1,000.

VASP Due Diligence

Required when establishing a correspondent relationship with a CASP registered outside the EU.


With respect to cross-border correspondent relationships involving the execution of crypto-asset services – including transfers of crypto-assets – with a respondent entity not established in the EU and providing similar services, CASPs are required, pursuant to Article 19b of Directive (EU) 2015/849 (as introduced by Article 38(2) of Regulation (EU) 2023/1113), when entering into a business relationship with such an entity, to:

  • determine if the respondent entity is licensed or registered;
  • gather sufficient information about the respondent entity to understand fully the nature of the respondent’s business and to determine from publicly available information the reputation of the entity and the quality of supervision;
  • assess the respondent entity’s AML/CFT controls;
  • obtain approval from senior management before establishing new correspondent relationships;
  • document the respective responsibilities of each party to the correspondent relationship;
  • with respect to payable-through crypto-asset accounts, be satisfied that the respondent entity has verified the identity of, and performed ongoing due diligence on, the customers having direct access to accounts of the correspondent entity, and that it is able to provide relevant customer due diligence data to the correspondent entity, upon request.

When conducting the assessment and determining appropriate risk-mitigating measures, CASPs shall also take into account the criteria and elements set out in Guideline 8 of the ML/TF Risk Factors Guidelines (EBA/GL/2021/02, as amended by EBA/GL/2024/01). These requirements will be further supplemented by Article 37 of Regulation (EU) 2024/1624 (AMLR) as of 10 July 2027.

Time and way to share the Information

The required information shall be transmitted immediately and in a secure manner, and no later than the initiation of the blockchain transaction.

Record retention

5 years.

Obligations of the originating CASP

The originating CASP must:

  • obtain information about the originator and beneficiary from a client who initiated a crypto-asset transfer;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
  • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
  • conduct CASP Due Diligence (if applicable);
  • verify a self-hosted wallet to which the crypto-assets should be sent (if applicable);
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
  • transmit information on the originator and the beneficiary to the next CASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
  • keep records related to the transfer for as long as required by national legislation.

Obligations of the beneficiary CASP

The beneficiary CASP must:

  • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet (if necessary);
  • conduct CASP Due Diligence (if applicable);
  • verify a self-hosted wallet from which the crypto-assets were received (if applicable);
  • receive information about the originator and beneficiary from the originating or intermediary CASP (or obtain it directly from its customer if assets are received from a self-hosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
  • keep records related to the transfer for as long as required by national legislation.

Obligations of the intermediary CASP

The intermediary CASP must:

  • receive information about the originator and beneficiary from the previous CASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
  • conduct CASP Due Diligence (if applicable);
  • verify a self-hosted wallet from which the crypto-assets were received or to which they should be sent (if applicable);
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
  • transmit information on the originator and the beneficiary to the next CASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
  • keep records related to the transfer for as long as required by national legislation.

Subject

Details

Status

In force from April 1, 2022.

Regulation

Regulatory body

Threshold

CAD 1,000

Data to be shared

Natural Person


Originator:

  • full name;
  • account number, or unique transaction reference number where no account number exists;
  • address.

Beneficiary:

  • full name;
  • account number, or unique transaction reference number where no account number exists;
  • address.

Legal Entity


Originator:

  • registered name;
  • account number, or unique transaction reference number where no account number exists;
  • address.

Beneficiary:

  • registered name;
  • account number, or unique transaction reference number where no account number exists;
  • address.

Subject

Details

Threshold-based data

—

Domestic vs cross-border transfers

No difference.

Batch file transfer

No special provisions.

Unhosted wallet verification

No requirement. May be applied based on risk assessment.

VASP Due Diligence

No requirement.

Time and way to share the Information

The regulation does not establish specific provisions. In accordance with the FATF's recommendations, the required information must be transmitted immediately and securely.

Record retention

5 years.

Obligations of the originating VASP

The originating VASP must:

  • obtain information about the originator and beneficiary from a client who initiated a virtual asset transfer;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
  • carry out wallet attribution to establish which type of wallet - custodial or unhosted - is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
  • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
  • keep records related to the transfer for as long as required by national legislation.

Obligations of the beneficiary VASP

The beneficiary VASP must:

  • carry out wallet attribution to establish which type of wallet - custodial or unhosted - is used on the other end and, if it is a custodial one, establish which VASP controls the wallet (if necessary);
  • receive information about the originator and beneficiary from the originating or intermediary VASP (or obtain it directly from its customer if assets are received from an unhosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
  • keep records related to the transfer for as long as required by national legislation.

Obligations of the intermediary VASP

The intermediary VASP must:

  • receive information about the originator and beneficiary from the previous VASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • carry out wallet attribution to establish which type of wallet - custodial or unhosted - is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
  • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
  • keep records related to the transfer for as long as required by national legislation.

Subject

Details

Status

In force from July 1, 2022.

Regulation

Regulatory body

Threshold

No threshold. The Travel Rule applies to all virtual asset transfers irrespective of value.

Data to be shared

An originating VASP shall, when conducting a transfer of virtual assets to a beneficiary, collect and record the following information:


Natural Person


Originator:

  • full name;
  • account number (or unique transaction reference number);
  • address;
  • one of the following: a government-issued document evidencing the identity or customer identification number or date and place of birth.

Beneficiary:

  • full name;
  • account number (or unique transaction reference number).

Legal Entity


Originator:

  • registered name;
  • account number (or unique transaction reference number);
  • address;
  • one of the following: legal entity identifier (or equivalent identifier) or customer identification number.

Beneficiary:

  • registered name;
  • account number (or unique transaction reference number).

A beneficiary VASP shall, on receipt of a transfer of virtual assets, collect and record the following information:


Natural Person


Originator:

  • full name;
  • account number (or unique transaction reference number).

Beneficiary:

  • full name;
  • account number (or unique transaction reference number);
  • address;
  • one of the following: a government-issued document evidencing the identity or customer identification number or date and place of birth.

Legal Entity


Originator:

  • registered name;
  • account number (or unique transaction reference number).

Beneficiary:

  • registered name;
  • account number (or unique transaction reference number);
  • address;
  • one of the following: legal entity identifier (or equivalent identifier) or customer identification number.

Subject

Details

Threshold-based data

—

Domestic vs cross-border transfers

No difference.

Batch file transfer

For batch file transfers of virtual assets from a single originator, the originating VASP’s obligation to collect and record the information shall not apply to the individual transfers of virtual assets bundled together if (a) the batch file contains (i) the name of the originator; (ii) where an account is used to process the transfer of virtual assets by the originator, the account number of the originator; (iii) the address of the originator, the number of a government-issued document evidencing the originator’s identity or the originator’s customer identification number or date and place of birth; and (b) the individual transfers of virtual assets carry the account number of the originator or a unique identifier. A batch file shall contain the name, account number or unique identifier of the beneficiary that is traceable in the beneficiary country.

Unhosted wallet verification

No requirement. May be applied based on risk assessment.

VASP Due Diligence

No requirement.

Time and way to share the Information

The required information shall be submitted simultaneously or concurrently with the transfer.

Record retention

5 years.

Obligations of the originating VASP

The originating VASP must:

  • obtain information about the originator and beneficiary from a client who initiated a virtual asset transfer;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
  • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
  • conduct VASP Due Diligence (if applicable);
  • verify an unhosted wallet to which the virtual assets should be sent (if applicable);
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
  • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
  • keep records related to the transfer for as long as required by national legislation.

Obligations of the beneficiary VASP

The beneficiary VASP must:

  • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet (if necessary);
  • conduct VASP Due Diligence (if applicable);
  • verify an unhosted wallet from which the virtual assets were received (if applicable);
  • receive information about the originator and beneficiary from the originating or intermediary VASP (or obtain it directly from its customer if assets are received from an unhosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
  • keep records related to the transfer for as long as required by national legislation.

Obligations of the intermediary VASP

The intermediary VASP must:

  • receive information about the originator and beneficiary from the previous VASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
  • conduct VASP Due Diligence (if applicable);
  • verify an unhosted wallet from which the virtual assets were received or to which they should be sent (if applicable);
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
  • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
  • keep records related to the transfer for as long as required by national legislation.

Subject

Details

Status

In force from July 1, 2025.

Regulation

Regulatory body

Threshold

The Travel Rule applies only to virtual asset transfers with an equivalent value of USD 1,000 or more.

Data to be shared

Natural Person


Originator:

  • full name;
  • account number, where such account is used to process the transaction;
  • national identity card number, for Chileans and residents, or passport number or equivalent identification document for non-resident foreigners.
  • address.

Beneficiary:

  • full name;
  • account number, where such account is used to process the transaction.

Legal Entity


Originator:

  • registered name;
  • account number, where such account is used to process the transaction;
  • tax ID number (RUT) or equivalent identification number if the entity is foreign;
  • address.

Beneficiary:

  • registered name;
  • account number, where such account is used to process the transaction.

Subject

Details

Threshold-based data

—

Domestic vs cross-border transfers

No difference.

Batch file transfer

No special provisions.

Unhosted wallet verification

No requirement. May be applied based on risk assessment.

VASP Due Diligence

No requirement.

Time and way to share the Information

The regulation do not explicitly specify the time frame for information sharing. In turn, according to the interpretive note to FATF Recommendation 15, originating VASPs should submit the information on the originator and beneficiary to the beneficiary VASP immediately and securely.

Record retention

5 years.

Obligations of the originating VASP

The originating VASP must:

  • obtain information about the originator and beneficiary from a client who initiated a virtual asset transfer;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
  • carry out wallet attribution to establish which type of wallet - custodial or unhosted - is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
  • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
  • keep records related to the transfer for as long as required by national legislation.

Obligations of the beneficiary VASP

The beneficiary VASP must:

  • carry out wallet attribution to establish which type of wallet - custodial or unhosted - is used on the other end and, if it is a custodial one, establish which VASP controls the wallet (if necessary);
  • receive information about the originator and beneficiary from the originating or intermediary VASP (or obtain it directly from its customer if assets are received from an unhosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
  • keep records related to the transfer for as long as required by national legislation.

Obligations of the intermediary VASP

The intermediary VASP must:

  • receive information about the originator and beneficiary from the previous VASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • carry out wallet attribution to establish which type of wallet - custodial or unhosted - is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
  • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
  • keep records related to the transfer for as long as required by national legislation.

Subject

Details

Status

In force from December 30, 2024.

Regulation

Regulatory body

Threshold

No threshold. The Travel Rule applies to all crypto-asset transfers irrespective of value.

Data to be shared

Natural Person


Originator:

  • full name;
  • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
  • address (habitual residence, including country name);
  • one of the following: (i) official personal document number and customer identification number or (ii) date and place of birth.

Beneficiary:

  • full name;
  • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier.

Legal Entity


Originator:

  • registered name;
  • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
  • address (registered office address);
  • registration number and customer identification number;
  • legal entity identifier (LEI), where available and provided, or, in its absence, another equivalent official identifier*.

Beneficiary:

  • registered name;
  • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
  • legal entity identifier (LEI), where available and provided, or, in its absence, another equivalent official identifier*.

* Note: The alternative identifier must: (i) be a unique identification code for the legal entity; (ii) be published in public registries; (iii) be automatically issued upon entity formation by a public authority; (iv) allow identification of name and address elements; (v) be accompanied by a description of the identifier type in the messaging system. Where the registration number satisfies the criteria for the alternative identifier, it may also be used for this purpose.

Subject

Details

Threshold-based data

—

Domestic vs cross-border transfers

No difference.

Batch file transfer

In the case of a batch file transfer of crypto-assets from a single originator, the obligation on the originating CASP to ensure that transfers of crypto-assets are accompanied by the required information shall not apply to the individual transfers bundled together therein, provided that: the batch file contains the required information on the originator and the beneficiary; that such information has been duly verified; and that each individual transfer carries (i) the originator's distributed ledger address and the originator's crypto-asset account number, if such an account exists and is used to process the transaction, where the transfer is registered on a DLT network; (ii) the originator's crypto-asset account number, where the transfer is not registered on a DLT network but is made to or from a crypto-asset account; or (iii) the unique transaction identifier, where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account.

Unhosted wallet verification

Required for transactions exceeding EUR 1,000.

VASP Due Diligence

Required when establishing a correspondent relationship with a CASP registered outside the EU.


With respect to cross-border correspondent relationships involving the execution of crypto-asset services – including transfers of crypto-assets – with a respondent entity not established in the EU and providing similar services, CASPs are required, pursuant to Article 19b of Directive (EU) 2015/849 (as introduced by Article 38(2) of Regulation (EU) 2023/1113), when entering into a business relationship with such an entity, to:

  • determine if the respondent entity is licensed or registered;
  • gather sufficient information about the respondent entity to understand fully the nature of the respondent’s business and to determine from publicly available information the reputation of the entity and the quality of supervision;
  • assess the respondent entity’s AML/CFT controls;
  • obtain approval from senior management before establishing new correspondent relationships;
  • document the respective responsibilities of each party to the correspondent relationship;
  • with respect to payable-through crypto-asset accounts, be satisfied that the respondent entity has verified the identity of, and performed ongoing due diligence on, the customers having direct access to accounts of the correspondent entity, and that it is able to provide relevant customer due diligence data to the correspondent entity, upon request.

When conducting the assessment and determining appropriate risk-mitigating measures, CASPs shall also take into account the criteria and elements set out in Guideline 8 of the ML/TF Risk Factors Guidelines (EBA/GL/2021/02, as amended by EBA/GL/2024/01). These requirements will be further supplemented by Article 37 of Regulation (EU) 2024/1624 (AMLR) as of 10 July 2027.

Time and way to share the Information

The required information shall be transmitted immediately and in a secure manner, and no later than the initiation of the blockchain transaction.

Record retention

10 years.

Obligations of the originating CASP

The originating CASP must:

  • obtain information about the originator and beneficiary from a client who initiated a crypto-asset transfer;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
  • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
  • conduct CASP Due Diligence (if applicable);
  • verify a self-hosted wallet to which the crypto-assets should be sent (if applicable);
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
  • transmit information on the originator and the beneficiary to the next CASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
  • keep records related to the transfer for as long as required by national legislation.

Obligations of the beneficiary CASP

The beneficiary CASP must:

  • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet (if necessary);
  • conduct CASP Due Diligence (if applicable);
  • verify a self-hosted wallet from which the crypto-assets were received (if applicable);
  • receive information about the originator and beneficiary from the originating or intermediary CASP (or obtain it directly from its customer if assets are received from a self-hosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
  • keep records related to the transfer for as long as required by national legislation.

Obligations of the intermediary CASP

The intermediary CASP must:

  • receive information about the originator and beneficiary from the previous CASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
  • conduct CASP Due Diligence (if applicable);
  • verify a self-hosted wallet from which the crypto-assets were received or to which they should be sent (if applicable);
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
  • transmit information on the originator and the beneficiary to the next CASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
  • keep records related to the transfer for as long as required by national legislation.

Subject

Details

Status

In force from January 1, 2023.

Regulation

Regulatory body

Threshold

No threshold. The Travel Rule applies to all crypto-asset transfers irrespective of value.

Data to be shared

Originator:

  • a) Full name;
  • b) Account number;
  • c) Physical or geographical address of the originator, or the national identity number, or the customer identification number that uniquely identifies the originator of the ordering institution, or the date and place of birth.

Beneficiary:

  • d) Full name;
  • e) Account number.

Subject

Details

Threshold-based data

USD 1,000

  • < USD 1,000: a), b), d), e).
  • > USD 1,000: a), b), c), d), e).

Domestic vs cross-border transfers

No difference.

Batch file transfer

No special provisions.

Unhosted wallet verification

No requirement. May be applied based on risk assessment.

VASP Due Diligence

No requirement.

Time and way to share the Information

The required information shall be transmitted immediately and in a secure manner.

Record retention

5 years.

Obligations of the originating VASP

The originating VASP must:

  • obtain information about the originator and beneficiary from a client who initiated a virtual asset transfer;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
  • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
  • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
  • keep records related to the transfer for as long as required by national legislation.

Obligations of the beneficiary VASP

The beneficiary VASP must:

  • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet (if necessary);
  • receive information about the originator and beneficiary from the originating or intermediary VASP (or obtain it directly from its customer if assets are received from an unhosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
  • keep records related to the transfer for as long as required by national legislation.

Obligations of the intermediary VASP

The intermediary VASP must:

  • receive information about the originator and beneficiary from the previous VASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
  • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
  • keep records related to the transfer for as long as required by national legislation.

Subject

Details

Status

In force from December 30, 2024.

Regulation

Regulatory body

Threshold

No threshold. The Travel Rule applies to all crypto-asset transfers irrespective of value.

Data to be shared

Natural Person


Originator:

  • full name;
  • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
  • address (habitual residence, including country name);
  • one of the following: (i) official personal document number and customer identification number or (ii) date and place of birth.

Beneficiary:

  • full name;
  • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier.

Legal Entity


Originator:

  • registered name;
  • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
  • address (registered office address);
  • registration number and customer identification number;
  • legal entity identifier (LEI), where available and provided, or, in its absence, another equivalent official identifier*.

Beneficiary:

  • registered name;
  • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
  • legal entity identifier (LEI), where available and provided, or, in its absence, another equivalent official identifier*.

* Note: The alternative identifier must: (i) be a unique identification code for the legal entity; (ii) be published in public registries; (iii) be automatically issued upon entity formation by a public authority; (iv) allow identification of name and address elements; (v) be accompanied by a description of the identifier type in the messaging system. Where the registration number satisfies the criteria for the alternative identifier, it may also be used for this purpose.

Subject

Details

Threshold-based data

—

Domestic vs cross-border transfers

No difference.

Batch file transfer

In the case of a batch file transfer of crypto-assets from a single originator, the obligation on the originating CASP to ensure that transfers of crypto-assets are accompanied by the required information shall not apply to the individual transfers bundled together therein, provided that: the batch file contains the required information on the originator and the beneficiary; that such information has been duly verified; and that each individual transfer carries (i) the originator's distributed ledger address and the originator's crypto-asset account number, if such an account exists and is used to process the transaction, where the transfer is registered on a DLT network; (ii) the originator's crypto-asset account number, where the transfer is not registered on a DLT network but is made to or from a crypto-asset account; or (iii) the unique transaction identifier, where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account.

Unhosted wallet verification

Required for transactions exceeding EUR 1,000.

VASP Due Diligence

Required when establishing a correspondent relationship with a CASP registered outside the EU.


With respect to cross-border correspondent relationships involving the execution of crypto-asset services – including transfers of crypto-assets – with a respondent entity not established in the EU and providing similar services, CASPs are required, pursuant to Article 19b of Directive (EU) 2015/849 (as introduced by Article 38(2) of Regulation (EU) 2023/1113), when entering into a business relationship with such an entity, to:

  • determine if the respondent entity is licensed or registered;
  • gather sufficient information about the respondent entity to understand fully the nature of the respondent’s business and to determine from publicly available information the reputation of the entity and the quality of supervision;
  • assess the respondent entity’s AML/CFT controls;
  • obtain approval from senior management before establishing new correspondent relationships;
  • document the respective responsibilities of each party to the correspondent relationship;
  • with respect to payable-through crypto-asset accounts, be satisfied that the respondent entity has verified the identity of, and performed ongoing due diligence on, the customers having direct access to accounts of the correspondent entity, and that it is able to provide relevant customer due diligence data to the correspondent entity, upon request.

When conducting the assessment and determining appropriate risk-mitigating measures, CASPs shall also take into account the criteria and elements set out in Guideline 8 of the ML/TF Risk Factors Guidelines (EBA/GL/2021/02, as amended by EBA/GL/2024/01). These requirements will be further supplemented by Article 37 of Regulation (EU) 2024/1624 (AMLR) as of 10 July 2027.

Time and way to share the Information

The required information shall be transmitted immediately and in a secure manner, and no later than the initiation of the blockchain transaction.

Record retention

5 years.

Obligations of the originating CASP

The originating CASP must:

  • obtain information about the originator and beneficiary from a client who initiated a crypto-asset transfer;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
  • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
  • conduct CASP Due Diligence (if applicable);
  • verify a self-hosted wallet to which the crypto-assets should be sent (if applicable);
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
  • transmit information on the originator and the beneficiary to the next CASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
  • keep records related to the transfer for as long as required by national legislation.

Obligations of the beneficiary CASP

The beneficiary CASP must:

  • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet (if necessary);
  • conduct CASP Due Diligence (if applicable);
  • verify a self-hosted wallet from which the crypto-assets were received (if applicable);
  • receive information about the originator and beneficiary from the originating or intermediary CASP (or obtain it directly from its customer if assets are received from a self-hosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
  • keep records related to the transfer for as long as required by national legislation.

Obligations of the intermediary CASP

The intermediary CASP must:

  • receive information about the originator and beneficiary from the previous CASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
  • conduct CASP Due Diligence (if applicable);
  • verify a self-hosted wallet from which the crypto-assets were received or to which they should be sent (if applicable);
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
  • transmit information on the originator and the beneficiary to the next CASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
  • keep records related to the transfer for as long as required by national legislation.

Subject

Details

Status

In force from December 30, 2024.

Regulation

Regulatory body

Threshold

No threshold. The Travel Rule applies to all crypto-asset transfers irrespective of value.

Data to be shared

Natural Person


Originator:

  • full name;
  • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
  • address (habitual residence, including country name);
  • one of the following: (i) official personal document number and customer identification number or (ii) date and place of birth.

Beneficiary:

  • full name;
  • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier.

Legal Entity


Originator:

  • registered name;
  • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
  • address (registered office address);
  • registration number and customer identification number;
  • legal entity identifier (LEI), where available and provided, or, in its absence, another equivalent official identifier*.

Beneficiary:

  • registered name;
  • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
  • legal entity identifier (LEI), where available and provided, or, in its absence, another equivalent official identifier*.

* Note: The alternative identifier must: (i) be a unique identification code for the legal entity; (ii) be published in public registries; (iii) be automatically issued upon entity formation by a public authority; (iv) allow identification of name and address elements; (v) be accompanied by a description of the identifier type in the messaging system. Where the registration number satisfies the criteria for the alternative identifier, it may also be used for this purpose.

Subject

Details

Threshold-based data

—

Domestic vs cross-border transfers

No difference.

Batch file transfer

In the case of a batch file transfer of crypto-assets from a single originator, the obligation on the originating CASP to ensure that transfers of crypto-assets are accompanied by the required information shall not apply to the individual transfers bundled together therein, provided that: the batch file contains the required information on the originator and the beneficiary; that such information has been duly verified; and that each individual transfer carries (i) the originator's distributed ledger address and the originator's crypto-asset account number, if such an account exists and is used to process the transaction, where the transfer is registered on a DLT network; (ii) the originator's crypto-asset account number, where the transfer is not registered on a DLT network but is made to or from a crypto-asset account; or (iii) the unique transaction identifier, where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account.

Unhosted wallet verification

Required for transactions exceeding EUR 1,000.

VASP Due Diligence

Required when establishing a correspondent relationship with a CASP registered outside the EU.


With respect to cross-border correspondent relationships involving the execution of crypto-asset services – including transfers of crypto-assets – with a respondent entity not established in the EU and providing similar services, CASPs are required, pursuant to Article 19b of Directive (EU) 2015/849 (as introduced by Article 38(2) of Regulation (EU) 2023/1113), when entering into a business relationship with such an entity, to:

  • determine if the respondent entity is licensed or registered;
  • gather sufficient information about the respondent entity to understand fully the nature of the respondent’s business and to determine from publicly available information the reputation of the entity and the quality of supervision;
  • assess the respondent entity’s AML/CFT controls;
  • obtain approval from senior management before establishing new correspondent relationships;
  • document the respective responsibilities of each party to the correspondent relationship;
  • with respect to payable-through crypto-asset accounts, be satisfied that the respondent entity has verified the identity of, and performed ongoing due diligence on, the customers having direct access to accounts of the correspondent entity, and that it is able to provide relevant customer due diligence data to the correspondent entity, upon request.

When conducting the assessment and determining appropriate risk-mitigating measures, CASPs shall also take into account the criteria and elements set out in Guideline 8 of the ML/TF Risk Factors Guidelines (EBA/GL/2021/02, as amended by EBA/GL/2024/01). These requirements will be further supplemented by Article 37 of Regulation (EU) 2024/1624 (AMLR) as of 10 July 2027.

Time and way to share the Information

The required information shall be transmitted immediately and in a secure manner, and no later than the initiation of the blockchain transaction.

Record retention

10 years.

Obligations of the originating CASP

The originating CASP must:

  • obtain information about the originator and beneficiary from a client who initiated a crypto-asset transfer;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
  • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
  • conduct CASP Due Diligence (if applicable);
  • verify a self-hosted wallet to which the crypto-assets should be sent (if applicable);
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
  • transmit information on the originator and the beneficiary to the next CASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
  • keep records related to the transfer for as long as required by national legislation.

Obligations of the beneficiary CASP

The beneficiary CASP must:

  • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet (if necessary);
  • conduct CASP Due Diligence (if applicable);
  • verify a self-hosted wallet from which the crypto-assets were received (if applicable);
  • receive information about the originator and beneficiary from the originating or intermediary CASP (or obtain it directly from its customer if assets are received from a self-hosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
  • keep records related to the transfer for as long as required by national legislation.

Obligations of the intermediary CASP

The intermediary CASP must:

  • receive information about the originator and beneficiary from the previous CASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
  • conduct CASP Due Diligence (if applicable);
  • verify a self-hosted wallet from which the crypto-assets were received or to which they should be sent (if applicable);
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
  • transmit information on the originator and the beneficiary to the next CASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
  • keep records related to the transfer for as long as required by national legislation.

Subject

Details

Status

In force from December 30, 2024.

Regulation

Regulatory body

Threshold

No threshold. The Travel Rule applies to all crypto-asset transfers irrespective of value.

Data to be shared

Natural Person


Originator:

  • full name;
  • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
  • address (habitual residence, including country name);
  • one of the following: (i) official personal document number and customer identification number or (ii) date and place of birth.

Beneficiary:

  • full name;
  • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier.

Legal Entity


Originator:

  • registered name;
  • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
  • address (registered office address);
  • registration number and customer identification number;
  • legal entity identifier (LEI), where available and provided, or, in its absence, another equivalent official identifier*.

Beneficiary:

  • registered name;
  • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
  • legal entity identifier (LEI), where available and provided, or, in its absence, another equivalent official identifier*.

* Note: The alternative identifier must: (i) be a unique identification code for the legal entity; (ii) be published in public registries; (iii) be automatically issued upon entity formation by a public authority; (iv) allow identification of name and address elements; (v) be accompanied by a description of the identifier type in the messaging system. Where the registration number satisfies the criteria for the alternative identifier, it may also be used for this purpose.

Subject

Details

Threshold-based data

—

Domestic vs cross-border transfers

No difference.

Batch file transfer

In the case of a batch file transfer of crypto-assets from a single originator, the obligation on the originating CASP to ensure that transfers of crypto-assets are accompanied by the required information shall not apply to the individual transfers bundled together therein, provided that: the batch file contains the required information on the originator and the beneficiary; that such information has been duly verified; and that each individual transfer carries (i) the originator's distributed ledger address and the originator's crypto-asset account number, if such an account exists and is used to process the transaction, where the transfer is registered on a DLT network; (ii) the originator's crypto-asset account number, where the transfer is not registered on a DLT network but is made to or from a crypto-asset account; or (iii) the unique transaction identifier, where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account.

Unhosted wallet verification

Required for transactions exceeding EUR 1,000.

VASP Due Diligence

Required when establishing a correspondent relationship with a CASP registered outside the EU.


With respect to cross-border correspondent relationships involving the execution of crypto-asset services – including transfers of crypto-assets – with a respondent entity not established in the EU and providing similar services, CASPs are required, pursuant to Article 19b of Directive (EU) 2015/849 (as introduced by Article 38(2) of Regulation (EU) 2023/1113), when entering into a business relationship with such an entity, to:

  • determine if the respondent entity is licensed or registered;
  • gather sufficient information about the respondent entity to understand fully the nature of the respondent’s business and to determine from publicly available information the reputation of the entity and the quality of supervision;
  • assess the respondent entity’s AML/CFT controls;
  • obtain approval from senior management before establishing new correspondent relationships;
  • document the respective responsibilities of each party to the correspondent relationship;
  • with respect to payable-through crypto-asset accounts, be satisfied that the respondent entity has verified the identity of, and performed ongoing due diligence on, the customers having direct access to accounts of the correspondent entity, and that it is able to provide relevant customer due diligence data to the correspondent entity, upon request.

When conducting the assessment and determining appropriate risk-mitigating measures, CASPs shall also take into account the criteria and elements set out in Guideline 8 of the ML/TF Risk Factors Guidelines (EBA/GL/2021/02, as amended by EBA/GL/2024/01). These requirements will be further supplemented by Article 37 of Regulation (EU) 2024/1624 (AMLR) as of 10 July 2027.

Time and way to share the Information

The required information shall be transmitted immediately and in a secure manner, and no later than the initiation of the blockchain transaction.

Record retention

5 years.

Obligations of the originating CASP

The originating CASP must:

  • obtain information about the originator and beneficiary from a client who initiated a crypto-asset transfer;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
  • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
  • conduct CASP Due Diligence (if applicable);
  • verify a self-hosted wallet to which the crypto-assets should be sent (if applicable);
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
  • transmit information on the originator and the beneficiary to the next CASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
  • keep records related to the transfer for as long as required by national legislation.

Obligations of the beneficiary CASP

The beneficiary CASP must:

  • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet (if necessary);
  • conduct CASP Due Diligence (if applicable);
  • verify a self-hosted wallet from which the crypto-assets were received (if applicable);
  • receive information about the originator and beneficiary from the originating or intermediary CASP (or obtain it directly from its customer if assets are received from a self-hosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
  • keep records related to the transfer for as long as required by national legislation.

Obligations of the intermediary CASP

The intermediary CASP must:

  • receive information about the originator and beneficiary from the previous CASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
  • conduct CASP Due Diligence (if applicable);
  • verify a self-hosted wallet from which the crypto-assets were received or to which they should be sent (if applicable);
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
  • transmit information on the originator and the beneficiary to the next CASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
  • keep records related to the transfer for as long as required by national legislation.

Subject

Details

Status

In force from September 7, 2021.

Regulation

Regulatory body

Threshold

The Travel Rule applies only to virtual asset transfers with an equivalent value of USD 1,000 or more.

Data to be shared

Natural Person

Originator:

  • full name;
  • account number (or unique transaction identifier);
  • address (if available);
  • must also be transmitted: name of the originating financial institution, amount and date of execution of the transfer.

Beneficiary:

  • full name;
  • account number (or unique transaction identifier);
  • address (if available);
  • must also be transmitted: name of the beneficiary financial institution and any other information identifying the beneficiary (if available).

Legal Entity

Originator:

  • registered name;
  • account number (or unique transaction identifier);
  • address (if available);
  • must also be transmitted: name of the originating financial institution, amount and date of execution of the transfer.

Beneficiary:

  • registered name;
  • account number (or unique transaction identifier);
  • address (if available);
  • must also be transmitted: name of the beneficiary financial institution and any other information identifying the beneficiary (if available).

Subject

Details

Threshold-based data

—

Domestic vs cross-border transfers

No difference.

Batch file transfer

No special provisions.

Unhosted wallet verification

No requirement. May be applied based on risk assessment.

VASP Due Diligence

Before establishing a contractual relationship with a Bitcoin Service Provider, an entity shall conduct due diligence on the Bitcoin Service Provider, having regard to the nature of the services to be provided and the risk associated with such relationship, in accordance with each entity's own policies. Any entity shall undertake enhanced due diligence in order to preserve the safety, soundness and integrity of the entity itself and of the financial system as a whole. The matters covered by such due diligence shall include, inter alia, the Bitcoin Service Provider's commercial standing, financial condition, legal and regulatory compliance, risk management and controls, anti-money laundering and counter-terrorist financing systems, information security, and operational resilience. No entity shall be obliged to provide financial services to Bitcoin Service Providers.

Time and way to share the Information

The regulation does not establish specific provisions. In accordance with the FATF's recommendations, the required information must be transmitted immediately and securely.

Record retention

15 years.

Obligations of the originating VASP

The originating VASP must:

  • obtain information about the originator and beneficiary from a client who initiated a virtual asset transfer;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
  • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
  • conduct VASP Due Diligence;
  • verify an unhosted wallet to which the virtual assets should be sent (if applicable);
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
  • transmit information on the originator and the beneficiary to the next VASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
  • keep records related to the transfer for as long as required by national legislation.

Obligations of the beneficiary VASP

The beneficiary VASP must:

  • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet (if necessary);
  • conduct VASP Due Diligence;
  • verify an unhosted wallet from which the virtual assets were received (if applicable);
  • receive information about the originator and beneficiary from the originating or intermediary VASP (or obtain it directly from its customer if assets are received from an unhosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
  • keep records related to the transfer for as long as required by national legislation.

Obligations of the intermediary VASP

The intermediary VASP must:

  • receive information about the originator and beneficiary from the previous VASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
  • conduct VASP Due Diligence;
  • verify an unhosted wallet from which the virtual assets were received or to which they should be sent (if applicable);
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
  • transmit information on the originator and the beneficiary to the next VASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
  • keep records related to the transfer for as long as required by national legislation.

Subject

Details

Status

In force from March 15, 2022.

Regulation

Regulatory body

Threshold

No threshold. The Travel Rule applies to all crypto-asset transfers irrespective of value.

Data to be shared

Natural Person


Originator:

  • full name;
  • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
  • address (habitual residence, including country name);
  • one of the following: (i) official personal document number and customer identification number or (ii) date and place of birth.

Beneficiary:

  • full name;
  • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier.

Legal Entity


Originator:

  • registered name;
  • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
  • address (registered office address);
  • registration number and customer identification number;
  • legal entity identifier (LEI), where available and provided, or, in its absence, another equivalent official identifier*.

Beneficiary:

  • registered name;
  • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
  • legal entity identifier (LEI), where available and provided, or, in its absence, another equivalent official identifier*.

* Note: The alternative identifier must: (i) be a unique identification code for the legal entity; (ii) be published in public registries; (iii) be automatically issued upon entity formation by a public authority; (iv) allow identification of name and address elements; (v) be accompanied by a description of the identifier type in the messaging system. Where the registration number satisfies the criteria for the alternative identifier, it may also be used for this purpose.

Subject

Details

Threshold-based data

—

Domestic vs cross-border transfers

No difference.

Batch file transfer

In the case of a batch file transfer of crypto-assets from a single originator, the obligation on the originating CASP to ensure that transfers of crypto-assets are accompanied by the required information shall not apply to the individual transfers bundled together therein, provided that: the batch file contains the required information on the originator and the beneficiary; that such information has been duly verified; and that each individual transfer carries (i) the originator's distributed ledger address and the originator's crypto-asset account number, if such an account exists and is used to process the transaction, where the transfer is registered on a DLT network; (ii) the originator's crypto-asset account number, where the transfer is not registered on a DLT network but is made to or from a crypto-asset account; or (iii) the unique transaction identifier, where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account.

Unhosted wallet verification

Required for transactions exceeding EUR 1,000.

VASP Due Diligence

Required when establishing a correspondent relationship with a CASP registered outside the EU.


With respect to cross-border correspondent relationships involving the execution of crypto-asset services – including transfers of crypto-assets – with a respondent entity not established in the EU and providing similar services, CASPs are required, pursuant to Article 19b of Directive (EU) 2015/849 (as introduced by Article 38(2) of Regulation (EU) 2023/1113), when entering into a business relationship with such an entity, to:

  • determine if the respondent entity is licensed or registered;
  • gather sufficient information about the respondent entity to understand fully the nature of the respondent’s business and to determine from publicly available information the reputation of the entity and the quality of supervision;
  • assess the respondent entity’s AML/CFT controls;
  • obtain approval from senior management before establishing new correspondent relationships;
  • document the respective responsibilities of each party to the correspondent relationship;
  • with respect to payable-through crypto-asset accounts, be satisfied that the respondent entity has verified the identity of, and performed ongoing due diligence on, the customers having direct access to accounts of the correspondent entity, and that it is able to provide relevant customer due diligence data to the correspondent entity, upon request.

When conducting the assessment and determining appropriate risk-mitigating measures, CASPs shall also take into account the criteria and elements set out in Guideline 8 of the ML/TF Risk Factors Guidelines (EBA/GL/2021/02, as amended by EBA/GL/2024/01). These requirements will be further supplemented by Article 37 of Regulation (EU) 2024/1624 (AMLR) as of 10 July 2027.

Time and way to share the Information

The required information shall be transmitted immediately and in a secure manner, and no later than the initiation of the blockchain transaction.

Record retention

5 years.

Obligations of the originating CASP

The originating CASP must:

  • obtain information about the originator and beneficiary from a client who initiated a crypto-asset transfer;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
  • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
  • conduct CASP Due Diligence (if applicable);
  • verify a self-hosted wallet to which the crypto-assets should be sent (if applicable);
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
  • transmit information on the originator and the beneficiary to the next CASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
  • keep records related to the transfer for as long as required by national legislation.

Obligations of the beneficiary CASP

The beneficiary CASP must:

  • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet (if necessary);
  • conduct CASP Due Diligence (if applicable);
  • verify a self-hosted wallet from which the crypto-assets were received (if applicable);
  • receive information about the originator and beneficiary from the originating or intermediary CASP (or obtain it directly from its customer if assets are received from a self-hosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
  • keep records related to the transfer for as long as required by national legislation.

Obligations of the intermediary CASP

The intermediary CASP must:

  • receive information about the originator and beneficiary from the previous CASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
  • conduct CASP Due Diligence (if applicable);
  • verify a self-hosted wallet from which the crypto-assets were received or to which they should be sent (if applicable);
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
  • transmit information on the originator and the beneficiary to the next CASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
  • keep records related to the transfer for as long as required by national legislation.

Subject

Details

Status

In force from December 30, 2024.

Regulation

Regulatory body

Threshold

No threshold. The Travel Rule applies to all crypto-asset transfers irrespective of value.

Data to be shared

Natural Person


Originator:

  • full name;
  • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
  • address (habitual residence, including country name);
  • one of the following: (i) official personal document number and customer identification number or (ii) date and place of birth.

Beneficiary:

  • full name;
  • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier.

Legal Entity


Originator:

  • registered name;
  • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
  • address (registered office address);
  • registration number and customer identification number;
  • legal entity identifier (LEI), where available and provided, or, in its absence, another equivalent official identifier*.

Beneficiary:

  • registered name;
  • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
  • legal entity identifier (LEI), where available and provided, or, in its absence, another equivalent official identifier*.

* Note: The alternative identifier must: (i) be a unique identification code for the legal entity; (ii) be published in public registries; (iii) be automatically issued upon entity formation by a public authority; (iv) allow identification of name and address elements; (v) be accompanied by a description of the identifier type in the messaging system. Where the registration number satisfies the criteria for the alternative identifier, it may also be used for this purpose.

Subject

Details

Threshold-based data

—

Domestic vs cross-border transfers

No difference.

Batch file transfer

In the case of a batch file transfer of crypto-assets from a single originator, the obligation on the originating CASP to ensure that transfers of crypto-assets are accompanied by the required information shall not apply to the individual transfers bundled together therein, provided that: the batch file contains the required information on the originator and the beneficiary; that such information has been duly verified; and that each individual transfer carries (i) the originator's distributed ledger address and the originator's crypto-asset account number, if such an account exists and is used to process the transaction, where the transfer is registered on a DLT network; (ii) the originator's crypto-asset account number, where the transfer is not registered on a DLT network but is made to or from a crypto-asset account; or (iii) the unique transaction identifier, where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account.

Unhosted wallet verification

Required for transactions exceeding EUR 1,000.

VASP Due Diligence

Required when establishing a correspondent relationship with a CASP registered outside the EU.


With respect to cross-border correspondent relationships involving the execution of crypto-asset services – including transfers of crypto-assets – with a respondent entity not established in the EU and providing similar services, CASPs are required, pursuant to Article 19b of Directive (EU) 2015/849 (as introduced by Article 38(2) of Regulation (EU) 2023/1113), when entering into a business relationship with such an entity, to:

  • determine if the respondent entity is licensed or registered;
  • gather sufficient information about the respondent entity to understand fully the nature of the respondent’s business and to determine from publicly available information the reputation of the entity and the quality of supervision;
  • assess the respondent entity’s AML/CFT controls;
  • obtain approval from senior management before establishing new correspondent relationships;
  • document the respective responsibilities of each party to the correspondent relationship;
  • with respect to payable-through crypto-asset accounts, be satisfied that the respondent entity has verified the identity of, and performed ongoing due diligence on, the customers having direct access to accounts of the correspondent entity, and that it is able to provide relevant customer due diligence data to the correspondent entity, upon request.

When conducting the assessment and determining appropriate risk-mitigating measures, CASPs shall also take into account the criteria and elements set out in Guideline 8 of the ML/TF Risk Factors Guidelines (EBA/GL/2021/02, as amended by EBA/GL/2024/01). These requirements will be further supplemented by Article 37 of Regulation (EU) 2024/1624 (AMLR) as of 10 July 2027.

Time and way to share the Information

The required information shall be transmitted immediately and in a secure manner, and no later than the initiation of the blockchain transaction.

Record retention

5 years.

Obligations of the originating CASP

The originating CASP must:

  • obtain information about the originator and beneficiary from a client who initiated a crypto-asset transfer;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
  • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
  • conduct CASP Due Diligence (if applicable);
  • verify a self-hosted wallet to which the crypto-assets should be sent (if applicable);
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
  • transmit information on the originator and the beneficiary to the next CASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
  • keep records related to the transfer for as long as required by national legislation.

Obligations of the beneficiary CASP

The beneficiary CASP must:

  • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet (if necessary);
  • conduct CASP Due Diligence (if applicable);
  • verify a self-hosted wallet from which the crypto-assets were received (if applicable);
  • receive information about the originator and beneficiary from the originating or intermediary CASP (or obtain it directly from its customer if assets are received from a self-hosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
  • keep records related to the transfer for as long as required by national legislation.

Obligations of the intermediary CASP

The intermediary CASP must:

  • receive information about the originator and beneficiary from the previous CASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
  • conduct CASP Due Diligence (if applicable);
  • verify a self-hosted wallet from which the crypto-assets were received or to which they should be sent (if applicable);
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
  • transmit information on the originator and the beneficiary to the next CASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
  • keep records related to the transfer for as long as required by national legislation.

Subject

Details

Status

In force from December 30, 2024.

Regulation

Regulatory body

Threshold

No threshold. The Travel Rule applies to all crypto-asset transfers irrespective of value.

Data to be shared

Natural Person


Originator:

  • full name;
  • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
  • address (habitual residence, including country name);
  • one of the following: (i) official personal document number and customer identification number or (ii) date and place of birth.

Beneficiary:

  • full name;
  • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier.

Legal Entity


Originator:

  • registered name;
  • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
  • address (registered office address);
  • registration number and customer identification number;
  • legal entity identifier (LEI), where available and provided, or, in its absence, another equivalent official identifier*.

Beneficiary:

  • registered name;
  • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
  • legal entity identifier (LEI), where available and provided, or, in its absence, another equivalent official identifier*.

* Note: The alternative identifier must: (i) be a unique identification code for the legal entity; (ii) be published in public registries; (iii) be automatically issued upon entity formation by a public authority; (iv) allow identification of name and address elements; (v) be accompanied by a description of the identifier type in the messaging system. Where the registration number satisfies the criteria for the alternative identifier, it may also be used for this purpose.

Subject

Details

Threshold-based data

—

Domestic vs cross-border transfers

No difference.

Batch file transfer

In the case of a batch file transfer of crypto-assets from a single originator, the obligation on the originating CASP to ensure that transfers of crypto-assets are accompanied by the required information shall not apply to the individual transfers bundled together therein, provided that: the batch file contains the required information on the originator and the beneficiary; that such information has been duly verified; and that each individual transfer carries (i) the originator's distributed ledger address and the originator's crypto-asset account number, if such an account exists and is used to process the transaction, where the transfer is registered on a DLT network; (ii) the originator's crypto-asset account number, where the transfer is not registered on a DLT network but is made to or from a crypto-asset account; or (iii) the unique transaction identifier, where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account.

Unhosted wallet verification

Required for transactions exceeding EUR 1,000.

VASP Due Diligence

Required when establishing a correspondent relationship with a CASP registered outside the EU.


With respect to cross-border correspondent relationships involving the execution of crypto-asset services – including transfers of crypto-assets – with a respondent entity not established in the EU and providing similar services, CASPs are required, pursuant to Article 19b of Directive (EU) 2015/849 (as introduced by Article 38(2) of Regulation (EU) 2023/1113), when entering into a business relationship with such an entity, to:

  • determine if the respondent entity is licensed or registered;
  • gather sufficient information about the respondent entity to understand fully the nature of the respondent’s business and to determine from publicly available information the reputation of the entity and the quality of supervision;
  • assess the respondent entity’s AML/CFT controls;
  • obtain approval from senior management before establishing new correspondent relationships;
  • document the respective responsibilities of each party to the correspondent relationship;
  • with respect to payable-through crypto-asset accounts, be satisfied that the respondent entity has verified the identity of, and performed ongoing due diligence on, the customers having direct access to accounts of the correspondent entity, and that it is able to provide relevant customer due diligence data to the correspondent entity, upon request.

When conducting the assessment and determining appropriate risk-mitigating measures, CASPs shall also take into account the criteria and elements set out in Guideline 8 of the ML/TF Risk Factors Guidelines (EBA/GL/2021/02, as amended by EBA/GL/2024/01). These requirements will be further supplemented by Article 37 of Regulation (EU) 2024/1624 (AMLR) as of 10 July 2027.

Time and way to share the Information

The required information shall be transmitted immediately and in a secure manner, and no later than the initiation of the blockchain transaction.

Record retention

5 years.

Obligations of the originating CASP

The originating CASP must:

  • obtain information about the originator and beneficiary from a client who initiated a crypto-asset transfer;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
  • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
  • conduct CASP Due Diligence (if applicable);
  • verify a self-hosted wallet to which the crypto-assets should be sent (if applicable);
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
  • transmit information on the originator and the beneficiary to the next CASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
  • keep records related to the transfer for as long as required by national legislation.

Obligations of the beneficiary CASP

The beneficiary CASP must:

  • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet (if necessary);
  • conduct CASP Due Diligence (if applicable);
  • verify a self-hosted wallet from which the crypto-assets were received (if applicable);
  • receive information about the originator and beneficiary from the originating or intermediary CASP (or obtain it directly from its customer if assets are received from a self-hosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
  • keep records related to the transfer for as long as required by national legislation.

Obligations of the intermediary CASP

The intermediary CASP must:

  • receive information about the originator and beneficiary from the previous CASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
  • conduct CASP Due Diligence (if applicable);
  • verify a self-hosted wallet from which the crypto-assets were received or to which they should be sent (if applicable);
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
  • transmit information on the originator and the beneficiary to the next CASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
  • keep records related to the transfer for as long as required by national legislation.

Subject

Details

Status

In force from December 30, 2024.

Regulation

Regulatory body

Threshold

No threshold. The Travel Rule applies to all crypto-asset transfers irrespective of value.

Data to be shared

Natural Person


Originator:

  • full name;
  • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
  • address (habitual residence, including country name);
  • one of the following: (i) official personal document number and customer identification number or (ii) date and place of birth.

Beneficiary:

  • full name;
  • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier.

Legal Entity


Originator:

  • registered name;
  • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
  • address (registered office address);
  • registration number and customer identification number;
  • legal entity identifier (LEI), where available and provided, or, in its absence, another equivalent official identifier*.

Beneficiary:

  • registered name;
  • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
  • legal entity identifier (LEI), where available and provided, or, in its absence, another equivalent official identifier*.

* Note: The alternative identifier must: (i) be a unique identification code for the legal entity; (ii) be published in public registries; (iii) be automatically issued upon entity formation by a public authority; (iv) allow identification of name and address elements; (v) be accompanied by a description of the identifier type in the messaging system. Where the registration number satisfies the criteria for the alternative identifier, it may also be used for this purpose.

Subject

Details

Threshold-based data

—

Domestic vs cross-border transfers

No difference.

Batch file transfer

In the case of a batch file transfer of crypto-assets from a single originator, the obligation on the originating CASP to ensure that transfers of crypto-assets are accompanied by the required information shall not apply to the individual transfers bundled together therein, provided that: the batch file contains the required information on the originator and the beneficiary; that such information has been duly verified; and that each individual transfer carries (i) the originator's distributed ledger address and the originator's crypto-asset account number, if such an account exists and is used to process the transaction, where the transfer is registered on a DLT network; (ii) the originator's crypto-asset account number, where the transfer is not registered on a DLT network but is made to or from a crypto-asset account; or (iii) the unique transaction identifier, where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account.

Unhosted wallet verification

Required for transactions exceeding EUR 1,000.

VASP Due Diligence

Required when establishing a correspondent relationship with a CASP registered outside the EU.


With respect to cross-border correspondent relationships involving the execution of crypto-asset services – including transfers of crypto-assets – with a respondent entity not established in the EU and providing similar services, CASPs are required, pursuant to Article 19b of Directive (EU) 2015/849 (as introduced by Article 38(2) of Regulation (EU) 2023/1113), when entering into a business relationship with such an entity, to:

  • determine if the respondent entity is licensed or registered;
  • gather sufficient information about the respondent entity to understand fully the nature of the respondent’s business and to determine from publicly available information the reputation of the entity and the quality of supervision;
  • assess the respondent entity’s AML/CFT controls;
  • obtain approval from senior management before establishing new correspondent relationships;
  • document the respective responsibilities of each party to the correspondent relationship;
  • with respect to payable-through crypto-asset accounts, be satisfied that the respondent entity has verified the identity of, and performed ongoing due diligence on, the customers having direct access to accounts of the correspondent entity, and that it is able to provide relevant customer due diligence data to the correspondent entity, upon request.

When conducting the assessment and determining appropriate risk-mitigating measures, CASPs shall also take into account the criteria and elements set out in Guideline 8 of the ML/TF Risk Factors Guidelines (EBA/GL/2021/02, as amended by EBA/GL/2024/01). These requirements will be further supplemented by Article 37 of Regulation (EU) 2024/1624 (AMLR) as of 10 July 2027.

Time and way to share the Information

The required information shall be transmitted immediately and in a secure manner, and no later than the initiation of the blockchain transaction.

Record retention

5 years.

Obligations of the originating CASP

The originating CASP must:

  • obtain information about the originator and beneficiary from a client who initiated a crypto-asset transfer;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
  • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
  • conduct CASP Due Diligence (if applicable);
  • verify a self-hosted wallet to which the crypto-assets should be sent (if applicable);
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
  • transmit information on the originator and the beneficiary to the next CASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
  • keep records related to the transfer for as long as required by national legislation.

Obligations of the beneficiary CASP

The beneficiary CASP must:

  • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet (if necessary);
  • conduct CASP Due Diligence (if applicable);
  • verify a self-hosted wallet from which the crypto-assets were received (if applicable);
  • receive information about the originator and beneficiary from the originating or intermediary CASP (or obtain it directly from its customer if assets are received from a self-hosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
  • keep records related to the transfer for as long as required by national legislation.

Obligations of the intermediary CASP

The intermediary CASP must:

  • receive information about the originator and beneficiary from the previous CASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
  • conduct CASP Due Diligence (if applicable);
  • verify a self-hosted wallet from which the crypto-assets were received or to which they should be sent (if applicable);
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
  • transmit information on the originator and the beneficiary to the next CASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
  • keep records related to the transfer for as long as required by national legislation.

Subject

Details

Status

Not in force. Shall come into force on December 31, 2027.

Regulation

Regulatory body

Threshold

The Travel Rule applies only to virtual asset transfers with an equivalent value exceeding EUR 1,000 or USD 1,000 or GEL 3,000.

Data to be shared

Originator:

  • a) Full name (in the case of an individual - first and last name);
  • b) Distributed ledger address, if the transfer of the virtual asset is recorded on a network that uses distributed ledger technology (DLT) or similar technology, and the originator's virtual asset account number, if such an account exists and is used for processing the transfer;
  • c) Virtual asset account number, if the transfer of the virtual asset is not recorded on a network that uses distributed ledger technology (DLT) or similar technology;
  • d) Address, including the name of the country, or the originator's identity document/passport number or personal identification number, or the originator's date and place of birth;
  • e) Official identification data of the legal entity (possibly including the LEI), if the relevant field is presented in the transfer message format and provided by the originator to the VASP.

Beneficiary:

  • a) Full name (in the case of an individual - first and last name);
  • b) Distributed ledger address, if the transfer of the virtual asset is recorded on a network that uses distributed ledger technology (DLT) or similar technology, and the beneficiary's virtual asset account number, if such an account exists and is used for processing the transfer;
  • c) Virtual asset account number, if the transfer of the virtual asset is not recorded on a network that uses distributed ledger technology (DLT) or similar technology;
  • d) Official identification data of the legal entity of the beneficiary (possibly including the LEI), if the relevant field is presented in the transfer message format and provided by the beneficiary to the VASP.

Subject

Details

Threshold-based data

—

Domestic vs cross-border transfers

No difference.

Batch file transfer

In the case of a batch file transfer, the originator's required information need not accompany each individual virtual asset transfer, provided that:

  • a) the batch is accompanied by the remaining required information;
  • b) the information is verified, and the individual transactions comprising the batch file meet one of the following conditions:
    • i) it contains the beneficiary's distributed ledger address, if the virtual asset transfer is registered on a network using DLT or similar technology, as well as the asset beneficiary's virtual asset account number, if such an account exists and is used to process the transfer;
    • ii) the virtual asset account number of the recipient, if the transfer of the virtual asset is not registered on a network that uses DLT or similar technology;
    • iii) if the transfer is not registered on a network using DLT or similar technology, and simultaneously the virtual asset transfer is neither made from nor to a virtual asset account, the VASP is required to ensure that the transfer is accompanied by a unique transaction code.

Unhosted wallet verification

Required if the value of the virtual asset transferred to a self-hosted address exceeds EUR 1,000 or USD 1,000 or GEL 3,000 or the equivalent in other foreign currencies.

VASP Due Diligence

No requirement.

Time and way to share the Information

The required information must be transmitted prior to or during the transfer of the virtual asset, in a secure manner and in compliance with the Law of Georgia on Personal Data Protection. Furthermore, the VASP is not required to accompany the virtual asset transfer transaction with the information by directly attaching it to, or embedding it within, the virtual asset transfer itself.

Record retention

5 years.

Obligations of the originating VASP

The originating VASP must:

  • obtain information about the originator and beneficiary from a client who initiated a virtual asset transfer;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
  • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
  • verify an unhosted wallet to which the assets should be sent (if applicable);
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
  • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
  • keep records related to the transfer for as long as required by national legislation.

Obligations of the beneficiary VASP

The beneficiary VASP must:

  • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet (if necessary);
  • verify an unhosted wallet from which the assets were received (if applicable);
  • receive information about the originator and beneficiary from the originating or intermediary VASP (or obtain it directly from its customer if assets are received from an unhosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
  • keep records related to the transfer for as long as required by national legislation.

Obligations of the intermediary VASP

The intermediary VASP must:

  • receive information about the originator and beneficiary from the previous VASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
  • verify an unhosted wallet from which the assets were received or to which they should be sent (if applicable);
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
  • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
  • keep records related to the transfer for as long as required by national legislation.

Subject

Details

Status

In force from October 1, 2021.

Regulation

Regulatory body

Threshold

No threshold. The Travel Rule applies to all crypto-asset transfers irrespective of value.

Data to be shared

Natural Person


Originator:

  • full name;
  • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
  • address (habitual residence, including country name);
  • one of the following: (i) official personal document number and customer identification number or (ii) date and place of birth.

Beneficiary:

  • full name;
  • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier.

Legal Entity


Originator:

  • registered name;
  • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
  • address (registered office address);
  • registration number and customer identification number;
  • legal entity identifier (LEI), where available and provided, or, in its absence, another equivalent official identifier*.

Beneficiary:

  • registered name;
  • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
  • legal entity identifier (LEI), where available and provided, or, in its absence, another equivalent official identifier*.

* Note: The alternative identifier must: (i) be a unique identification code for the legal entity; (ii) be published in public registries; (iii) be automatically issued upon entity formation by a public authority; (iv) allow identification of name and address elements; (v) be accompanied by a description of the identifier type in the messaging system. Where the registration number satisfies the criteria for the alternative identifier, it may also be used for this purpose.

Subject

Details

Threshold-based data

—

Domestic vs cross-border transfers

No difference.

Batch file transfer

In the case of a batch file transfer of crypto-assets from a single originator, the obligation on the originating CASP to ensure that transfers of crypto-assets are accompanied by the required information shall not apply to the individual transfers bundled together therein, provided that: the batch file contains the required information on the originator and the beneficiary; that such information has been duly verified; and that each individual transfer carries (i) the originator's distributed ledger address and the originator's crypto-asset account number, if such an account exists and is used to process the transaction, where the transfer is registered on a DLT network; (ii) the originator's crypto-asset account number, where the transfer is not registered on a DLT network but is made to or from a crypto-asset account; or (iii) the unique transaction identifier, where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account.

Unhosted wallet verification

Required for transactions exceeding EUR 1,000.

VASP Due Diligence

Required when establishing a correspondent relationship with a CASP registered outside the EU.


With respect to cross-border correspondent relationships involving the execution of crypto-asset services – including transfers of crypto-assets – with a respondent entity not established in the EU and providing similar services, CASPs are required, pursuant to Article 19b of Directive (EU) 2015/849 (as introduced by Article 38(2) of Regulation (EU) 2023/1113), when entering into a business relationship with such an entity, to:

  • determine if the respondent entity is licensed or registered;
  • gather sufficient information about the respondent entity to understand fully the nature of the respondent’s business and to determine from publicly available information the reputation of the entity and the quality of supervision;
  • assess the respondent entity’s AML/CFT controls;
  • obtain approval from senior management before establishing new correspondent relationships;
  • document the respective responsibilities of each party to the correspondent relationship;
  • with respect to payable-through crypto-asset accounts, be satisfied that the respondent entity has verified the identity of, and performed ongoing due diligence on, the customers having direct access to accounts of the correspondent entity, and that it is able to provide relevant customer due diligence data to the correspondent entity, upon request.

When conducting the assessment and determining appropriate risk-mitigating measures, CASPs shall also take into account the criteria and elements set out in Guideline 8 of the ML/TF Risk Factors Guidelines (EBA/GL/2021/02, as amended by EBA/GL/2024/01). These requirements will be further supplemented by Article 37 of Regulation (EU) 2024/1624 (AMLR) as of 10 July 2027.

Time and way to share the Information

The required information shall be transmitted immediately and in a secure manner, and no later than the initiation of the blockchain transaction.

Record retention

5 years.

Obligations of the originating CASP

The originating CASP must:

  • obtain information about the originator and beneficiary from a client who initiated a crypto-asset transfer;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
  • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
  • conduct CASP Due Diligence (if applicable);
  • verify a self-hosted wallet to which the crypto-assets should be sent (if applicable);
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
  • transmit information on the originator and the beneficiary to the next CASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
  • keep records related to the transfer for as long as required by national legislation.

Obligations of the beneficiary CASP

The beneficiary CASP must:

  • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet (if necessary);
  • conduct CASP Due Diligence (if applicable);
  • verify a self-hosted wallet from which the crypto-assets were received (if applicable);
  • receive information about the originator and beneficiary from the originating or intermediary CASP (or obtain it directly from its customer if assets are received from a self-hosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
  • keep records related to the transfer for as long as required by national legislation.

Obligations of the intermediary CASP

The intermediary CASP must:

  • receive information about the originator and beneficiary from the previous CASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
  • conduct CASP Due Diligence (if applicable);
  • verify a self-hosted wallet from which the crypto-assets were received or to which they should be sent (if applicable);
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
  • transmit information on the originator and the beneficiary to the next CASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
  • keep records related to the transfer for as long as required by national legislation.

Subject

Details

Status

Not in force. Shall come into force on a date to be determined.

Regulation

Regulatory body

Threshold

—

Data to be shared

—

Subject

Details

Threshold-based data

—

Domestic vs cross-border transfers

—

Batch file transfer

—

Unhosted wallet verification

—

VASP Due Diligence

—

Time and way to share the Information

—

Record retention

—

—

Subject

Details

Status

In force from September 22, 2022.

Regulation

Regulatory body

Threshold

The Travel Rule applies only to virtual asset transfers with an equivalent value of EUR 1,000 or more.

Data to be shared

Natural Person


Originator:

  • full name;
  • virtual asset account number (or unique transaction identifier);
  • one of the following: address, national identity number, customer identification number, or date and place of birth.

Beneficiary:

  • full name;
  • virtual asset account number (or unique transaction identifier).

Legal Entity


Originator:

  • registered name;
  • virtual asset account number (or unique transaction identifier);
  • one of the following: address, legal entity identifier (or equivalent identifier), or customer identification number.

Beneficiary:

  • registered name;
  • virtual asset account number (or unique transaction identifier).

Subject

Details

Threshold-based data

—

Domestic vs cross-border transfers

No difference.

Batch file transfer

No special provisions.

Unhosted wallet verification

No requirement. May be applied based on risk assessment.

VASP Due Diligence

No requirement. May be applied based on risk assessment.

Time and way to share the Information

The required information shall be transmitted immediately and in a secure manner.

Record retention

5 years.

Obligations of the originating VASP

The originating VASP must:

  • obtain information about the originator and beneficiary from a client who initiated a virtual asset transfer;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
  • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
  • conduct VASP Due Diligence (if applicable);
  • verify an unhosted wallet to which the virtual assets should be sent (if applicable);
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
  • transmit information on the originator and the beneficiary to the next VASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
  • keep records related to the transfer for as long as required by national legislation.

Obligations of the beneficiary VASP

The beneficiary VASP must:

  • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet (if necessary);
  • conduct VASP Due Diligence (if applicable);
  • verify an unhosted wallet from which the virtual assets were received (if applicable);
  • receive information about the originator and beneficiary from the originating or intermediary VASP (or obtain it directly from its customer if assets are received from an unhosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
  • keep records related to the transfer for as long as required by national legislation.

Obligations of the intermediary VASP

The intermediary VASP must:

  • receive information about the originator and beneficiary from the previous VASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
  • conduct VASP Due Diligence (if applicable);
  • verify an unhosted wallet from which the virtual assets were received or to which they should be sent (if applicable);
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
  • transmit information on the originator and the beneficiary to the next VASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
  • keep records related to the transfer for as long as required by national legislation.

Subject

Details

Status

In force from December 30, 2024.

Regulation

Regulatory body

Threshold

No threshold. The Travel Rule applies to all crypto-asset transfers irrespective of value.

Data to be shared

Natural Person


Originator:

  • full name;
  • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
  • address (habitual residence, including country name);
  • one of the following: (i) official personal document number and customer identification number or (ii) date and place of birth.

Beneficiary:

  • full name;
  • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier.

Legal Entity


Originator:

  • registered name;
  • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
  • address (registered office address);
  • registration number and customer identification number;
  • legal entity identifier (LEI), where available and provided, or, in its absence, another equivalent official identifier*.

Beneficiary:

  • registered name;
  • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
  • legal entity identifier (LEI), where available and provided, or, in its absence, another equivalent official identifier*.

* Note: The alternative identifier must: (i) be a unique identification code for the legal entity; (ii) be published in public registries; (iii) be automatically issued upon entity formation by a public authority; (iv) allow identification of name and address elements; (v) be accompanied by a description of the identifier type in the messaging system. Where the registration number satisfies the criteria for the alternative identifier, it may also be used for this purpose.

Subject

Details

Threshold-based data

—

Domestic vs cross-border transfers

No difference.

Batch file transfer

In the case of a batch file transfer of crypto-assets from a single originator, the obligation on the originating CASP to ensure that transfers of crypto-assets are accompanied by the required information shall not apply to the individual transfers bundled together therein, provided that: the batch file contains the required information on the originator and the beneficiary; that such information has been duly verified; and that each individual transfer carries (i) the originator's distributed ledger address and the originator's crypto-asset account number, if such an account exists and is used to process the transaction, where the transfer is registered on a DLT network; (ii) the originator's crypto-asset account number, where the transfer is not registered on a DLT network but is made to or from a crypto-asset account; or (iii) the unique transaction identifier, where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account.

Unhosted wallet verification

Required for transactions exceeding EUR 1,000.

VASP Due Diligence

Required when establishing a correspondent relationship with a CASP registered outside the EU.


With respect to cross-border correspondent relationships involving the execution of crypto-asset services – including transfers of crypto-assets – with a respondent entity not established in the EU and providing similar services, CASPs are required, pursuant to Article 19b of Directive (EU) 2015/849 (as introduced by Article 38(2) of Regulation (EU) 2023/1113), when entering into a business relationship with such an entity, to:

  • determine if the respondent entity is licensed or registered;
  • gather sufficient information about the respondent entity to understand fully the nature of the respondent’s business and to determine from publicly available information the reputation of the entity and the quality of supervision;
  • assess the respondent entity’s AML/CFT controls;
  • obtain approval from senior management before establishing new correspondent relationships;
  • document the respective responsibilities of each party to the correspondent relationship;
  • with respect to payable-through crypto-asset accounts, be satisfied that the respondent entity has verified the identity of, and performed ongoing due diligence on, the customers having direct access to accounts of the correspondent entity, and that it is able to provide relevant customer due diligence data to the correspondent entity, upon request.

When conducting the assessment and determining appropriate risk-mitigating measures, CASPs shall also take into account the criteria and elements set out in Guideline 8 of the ML/TF Risk Factors Guidelines (EBA/GL/2021/02, as amended by EBA/GL/2024/01). These requirements will be further supplemented by Article 37 of Regulation (EU) 2024/1624 (AMLR) as of 10 July 2027.

Time and way to share the Information

The required information shall be transmitted immediately and in a secure manner, and no later than the initiation of the blockchain transaction.

Record retention

5 years.

Obligations of the originating CASP

The originating CASP must:

  • obtain information about the originator and beneficiary from a client who initiated a crypto-asset transfer;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
  • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
  • conduct CASP Due Diligence (if applicable);
  • verify a self-hosted wallet to which the crypto-assets should be sent (if applicable);
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
  • transmit information on the originator and the beneficiary to the next CASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
  • keep records related to the transfer for as long as required by national legislation.

Obligations of the beneficiary CASP

The beneficiary CASP must:

  • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet (if necessary);
  • conduct CASP Due Diligence (if applicable);
  • verify a self-hosted wallet from which the crypto-assets were received (if applicable);
  • receive information about the originator and beneficiary from the originating or intermediary CASP (or obtain it directly from its customer if assets are received from a self-hosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
  • keep records related to the transfer for as long as required by national legislation.

Obligations of the intermediary CASP

The intermediary CASP must:

  • receive information about the originator and beneficiary from the previous CASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
  • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
  • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
  • conduct CASP Due Diligence (if applicable);
  • verify a self-hosted wallet from which the crypto-assets were received or to which they should be sent (if applicable);
  • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
  • transmit information on the originator and the beneficiary to the next CASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
  • keep records related to the transfer for as long as required by national legislation.

Subject

Details

Status

In force from July 10, 2023.

Regulation

Regulatory body

Threshold

No threshold. The Travel Rule applies to all crypto-asset transfers irrespective of value.

Data to be shared

Originator:

  • a) Full official name;
  • b) Where a transfer of virtual assets is registered on a network using DLT or similar technology, the originator’s distributed ledger address and the originator’s virtual asset account number, where such an account exists and is used to process the transaction;
  • c) Where a transfer of virtual assets is not registered on a network using DLT or similar technology, the originator’s account numbers;
  • d) Where a transfer of virtual assets is neither registered on a network using DLT or similar technology nor is made from or to a virtual asset account, the originating VASP shall ensure that the transfer of virtual assets is accompanied by a unique transaction identifier which permits traceability of the transaction;
  • e) One of either: (i) the originator’s address, including the name of the country, (ii) national identity number, (iii) customer identification number or (iv) date and place of birth;
  • f) Subject to the existence of the necessary field in the relevant message format, and where provided by the originator to the originator’s VASP, the current LEI of the originator or any other available equivalent official identifier.

Beneficiary:

  • g) Full official name;
  • h) Where a transfer of virtual assets is registered on a network using DLT or similar technology, the beneficiary’s distributed ledger address and the beneficiary’s virtual asset account number, where such an account exists and is used to process the transaction;
  • i) Where a transfer of virtual assets is not registered on a network using DLT or similar technology, the beneficiary’s account numbers;
  • j) Where an account is not used to process the transfer, the unique transaction identifier which permits the traceability of the transaction;
  • k) Subject to the existence of the necessary field in the relevant message format, and where provided by the originator to the originator’s VASP, the current LEI of the originator or any other available equivalent official identifier.

    • Subject

    Details

    Threshold-based data

    Sumsub has submitted a request to the Guernsey Financial Services Commission for clarification on the application of the rules concerning the minimum threshold amount. This information will be updated upon receipt of the regulator's response.


    GGP 1,000


    Where a transfer is carried out which is under the GGP 1,000 threshold, VASPs must obtain and hold:

    • a) the names of the originator and the beneficiary; and
    • b) the virtual asset wallet address for each party or a unique transaction reference number.

    It is not necessary to verify the originator's information unless the virtual assets to be transferred have been received anonymously, or the VASP has reasonable grounds to suspect ML, TF and/or PF.

    Domestic vs cross-border transfers

    No difference.

    Batch file transfer

    In the case of a batch transfer, an originating VASP shall:

    • a) ensure that the batch file contains required and accurate originator information and required beneficiary information;
    • b) ensure that the information is such as to permit the traceability within the beneficiary jurisdiction of each transaction comprised in the batch from the originator to the beneficiary (and “beneficiary jurisdiction” means the jurisdiction in which the beneficiary VASP received the transfer of the virtual assets); and
    • c) include the originator’s account number or unique transaction identifier and/or such other information, or information of such a class or description, as may be specified in the Handbook on Countering Financial Crime (AML/CFT/CPF).

    The batch file information requirements which apply where several individual virtual asset transfers with a single originator are bundled together for transmission in a batch transfer include:

    • a) The name of the originator;
    • b) Where an account is used to process the transfer of virtual assets by the originator, the account number of the originator;
    • c) One of either (i) the originator’s address, including the name of the country, (ii) national identity number, (iii) customer identification number or (iv) date and place of birth;
    • d) The individual transfers of virtual assets carry the account number of the originator or a unique identifier; and
    • e) The name, account number or unique identifier of the beneficiary that is traceable in the beneficiary country.

    Where a transfer is carried out which is under the GGP 1,000 threshold, VASPs must obtain and hold:

    • a) the names of the originator and the beneficiary; and
    • b) the virtual asset wallet address for each party or a unique transaction reference number.

    It is not necessary to verify the originator's information unless the virtual assets to be transferred have been received anonymously, or the VASP has reasonable grounds to suspect ML, TF and/or PF.

    Unhosted wallet verification

    Required for transactions exceeding GGP 1,000.

    VASP Due Diligence

    No requirement.

    Time and way to share the Information

    The required information should be submitted in advance of, or simultaneously or concurrently with, the transfer of virtual assets and in a secure manner.

    Record retention

    5 years.

    Obligations of the originating VASP

    The originating VASP must:

    • obtain information about the originator and beneficiary from a client who initiated a virtual asset transfer;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
    • verify an unhosted wallet to which the assets should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the beneficiary VASP

    The beneficiary VASP must:

    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet (if necessary);
    • verify an unhosted wallet from which the assets were received (if applicable);
    • receive information about the originator and beneficiary from the originating or intermediary VASP (or obtain it directly from its customer if assets are received from an unhosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the intermediary VASP

    The intermediary VASP must:

    • receive information about the originator and beneficiary from the previous VASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
    • verify an unhosted wallet from which the assets were received or to which they should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
    • keep records related to the transfer for as long as required by national legislation.

    Subject

    Details

    Status

    In force from June 1, 2023.

    Regulation

    Regulatory body

    Threshold

    No threshold. The Travel Rule applies to all virtual asset transfers irrespective of value.

    Data to be shared

    Natural Person


    Originator:

    • full name;
    • account number, or unique transaction reference number where no account number exists;
    • address, customer identification number or identification document number or date and place of birth.

    Beneficiary:

    • full name;
    • account number, or unique transaction reference number where no account number exists.

    Legal Entity


    Originator:

    • registered name;
    • account number, or unique transaction reference number where no account number exists;
    • address, customer identification number or legal entity identifier.

    Benefiaicry:

    • registered name;
    • account number, or unique transaction reference number where no account number exists.

    Subject

    Details

    Threshold-based data

    If a crypto-asset transfer has an equivalent value of less than HKD 8,000, the following information shall be shared:


    Natural Person


    Originator:

    • full name;
    • account number, or unique transaction reference number where no account number exists.

    Beneficiary:

    • full name;
    • account number, or unique transaction reference number where no account number exists.

    Legal Entity


    Originator:

    • registered name;
    • account number, or unique transaction reference number where no account number exists.

    Benefiaicry:

    • registered name;
    • account number, or unique transaction reference number where no account number exists.

    If a crypto-asset transfer has an equivalent value of HKD 8,000 or more, the following information shall be shared:


    Natural Person


    Originator:

    • full name;
    • account number, or unique transaction reference number where no account number exists;
    • address, customer identification number or identification document number or date and place of birth.

    Beneficiary:

    • full name;
    • account number, or unique transaction reference number where no account number exists.

    Legal Entity


    Originator:

    • registered name;
    • account number, or unique transaction reference number where no account number exists;
    • address, customer identification number or legal entity identifier.

    Benefiaicry:

    • registered name;
    • account number, or unique transaction reference number where no account number exists.

    Domestic vs cross-border transfers

    No difference.

    Batch file transfer

    No special provisions.

    Unhosted wallet verification

    Required.

    VASP Due Diligence

    Required.

    Time and way to share the Information

    The required information shall be transmitted immediately and in a secure manner.

    Record retention

    5 years.

    Obligations of the originating VASP

    The originating VASP must:

    • obtain information about the originator and beneficiary from a client who initiated a virtual asset transfer;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
    • carry out wallet attribution to establish which type of wallet - custodial or unhosted - is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
    • conduct VASP Due Diligence (if applicable);
    • verify an unhosted wallet to which the assets should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the beneficiary VASP

    The beneficiary VASP must:

    • carry out wallet attribution to establish which type of wallet - custodial or unhosted - is used on the other end and, if it is a custodial one, establish which VASP controls the wallet (if necessary);
    • conduct VASP Due Diligence (if applicable);
    • verify an unhosted wallet from which the assets were received (if applicable);
    • receive information about the originator and beneficiary from the originating or intermediary VASP (or obtain it directly from its customer if assets are received from an unhosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the intermediary VASP

    The intermediary VASP must:

    • receive information about the originator and beneficiary from the previous VASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • carry out wallet attribution to establish which type of wallet - custodial or unhosted - is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
    • conduct VASP Due Diligence (if applicable);
    • verify an unhosted wallet from which the assets were received or to which they should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
    • keep records related to the transfer for as long as required by national legislation.

    Subject

    Details

    Status

    In force from December 30, 2024.

    Regulation

    Regulatory body

    Threshold

    No threshold. The Travel Rule applies to all crypto-asset transfers irrespective of value.

    Data to be shared

    Natural Person


    Originator:

    • full name;
    • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
    • address (habitual residence, including country name);
    • one of the following: (i) official personal document number and customer identification number or (ii) date and place of birth.

    Beneficiary:

    • full name;
    • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier.

    Legal Entity


    Originator:

    • registered name;
    • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
    • address (registered office address);
    • registration number and customer identification number;
    • legal entity identifier (LEI), where available and provided, or, in its absence, another equivalent official identifier*.

    Beneficiary:

    • registered name;
    • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
    • legal entity identifier (LEI), where available and provided, or, in its absence, another equivalent official identifier*.

    * Note: The alternative identifier must: (i) be a unique identification code for the legal entity; (ii) be published in public registries; (iii) be automatically issued upon entity formation by a public authority; (iv) allow identification of name and address elements; (v) be accompanied by a description of the identifier type in the messaging system. Where the registration number satisfies the criteria for the alternative identifier, it may also be used for this purpose.

    Subject

    Details

    Threshold-based data

    —

    Domestic vs cross-border transfers

    No difference.

    Batch file transfer

    In the case of a batch file transfer of crypto-assets from a single originator, the obligation on the originating CASP to ensure that transfers of crypto-assets are accompanied by the required information shall not apply to the individual transfers bundled together therein, provided that: the batch file contains the required information on the originator and the beneficiary; that such information has been duly verified; and that each individual transfer carries (i) the originator's distributed ledger address and the originator's crypto-asset account number, if such an account exists and is used to process the transaction, where the transfer is registered on a DLT network; (ii) the originator's crypto-asset account number, where the transfer is not registered on a DLT network but is made to or from a crypto-asset account; or (iii) the unique transaction identifier, where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account.

    Unhosted wallet verification

    Required for transactions exceeding EUR 1,000.

    VASP Due Diligence

    Required when establishing a correspondent relationship with a CASP registered outside the EU.


    With respect to cross-border correspondent relationships involving the execution of crypto-asset services – including transfers of crypto-assets – with a respondent entity not established in the EU and providing similar services, CASPs are required, pursuant to Article 19b of Directive (EU) 2015/849 (as introduced by Article 38(2) of Regulation (EU) 2023/1113), when entering into a business relationship with such an entity, to:

    • determine if the respondent entity is licensed or registered;
    • gather sufficient information about the respondent entity to understand fully the nature of the respondent’s business and to determine from publicly available information the reputation of the entity and the quality of supervision;
    • assess the respondent entity’s AML/CFT controls;
    • obtain approval from senior management before establishing new correspondent relationships;
    • document the respective responsibilities of each party to the correspondent relationship;
    • with respect to payable-through crypto-asset accounts, be satisfied that the respondent entity has verified the identity of, and performed ongoing due diligence on, the customers having direct access to accounts of the correspondent entity, and that it is able to provide relevant customer due diligence data to the correspondent entity, upon request.

    When conducting the assessment and determining appropriate risk-mitigating measures, CASPs shall also take into account the criteria and elements set out in Guideline 8 of the ML/TF Risk Factors Guidelines (EBA/GL/2021/02, as amended by EBA/GL/2024/01). These requirements will be further supplemented by Article 37 of Regulation (EU) 2024/1624 (AMLR) as of 10 July 2027.

    Time and way to share the Information

    The required information shall be transmitted immediately and in a secure manner, and no later than the initiation of the blockchain transaction.

    Record retention

    8 years.

    Obligations of the originating CASP

    The originating CASP must:

    • obtain information about the originator and beneficiary from a client who initiated a crypto-asset transfer;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
    • conduct CASP Due Diligence (if applicable);
    • verify a self-hosted wallet to which the crypto-assets should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information on the originator and the beneficiary to the next CASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the beneficiary CASP

    The beneficiary CASP must:

    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet (if necessary);
    • conduct CASP Due Diligence (if applicable);
    • verify a self-hosted wallet from which the crypto-assets were received (if applicable);
    • receive information about the originator and beneficiary from the originating or intermediary CASP (or obtain it directly from its customer if assets are received from a self-hosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the intermediary CASP

    The intermediary CASP must:

    • receive information about the originator and beneficiary from the previous CASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
    • conduct CASP Due Diligence (if applicable);
    • verify a self-hosted wallet from which the crypto-assets were received or to which they should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information on the originator and the beneficiary to the next CASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
    • keep records related to the transfer for as long as required by national legislation.

    Subject

    Details

    Status

    In force from January 1, 2026.

    Regulation

    Regulatory body

    Threshold

    No threshold. The Travel Rule applies to all crypto-asset transfers irrespective of value.

    Data to be shared

    Natural Person


    Originator:

    • full official name;
    • distributed ledger address and crypto-asset account number: If the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number if it exists and is used. If not registered on a DLT network, provide the crypto-asset account number;
    • address (habitual residence, including country name);
    • one of the following: (i) official personal document number and customer identification number or (ii) date and place of birth.

    Beneficiary:

    • full official name;
    • distributed ledger address and crypto-asset account number: If the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number if it exists and is used. If not registered on a DLT network, provide the crypto-asset account number.

    Legal Entity


    Originator:

    • registered name;
    • distributed ledger address and crypto-asset account number: If the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number if it exists and is used. If not registered on a DLT network, provide the crypto-asset account number;
    • address (registered office address);
    • registration number (or equivalent identifier)* and customer identification number;
    • legal entity identifier (LEI) or equivalent identifier*.

    Beneficiary:

    • registered name;
    • distributed ledger address and crypto-asset account number: If the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number if it exists and is used. If not registered on a DLT network, provide the crypto-asset account number;
    • legal entity identifier (LEI) or equivalent identifier*.

    * The alternative identifier must: (i) be a unique identification code for the legal entity; (ii) be published in public registries; (iii) be automatically issued upon entity formation by a public authority; (iv) allow identification of name and address elements; (v) be accompanied by a description of the identifier type in the messaging system. Where the registration number satisfies the criteria for the alternative identifier, it may also be used for this purpose.

    Subject

    Details

    Threshold-based data

    —

    Domestic vs cross-border transfers

    No difference.

    Batch file transfer

    In the case of a batch file transfer of crypto-assets from a single originator, the obligation on the originating CASP to ensure that transfers of crypto-assets are accompanied by the required information shall not apply to the individual transfers bundled together therein, provided that the batch file contains the required information on the originator and the beneficiary, or a unique transaction identifier where applicable; that such information has been duly verified; and that the individual transfers carry the originator's distributed ledger address, the originator's crypto-asset account number, or the unique transaction identifier, as applicable.

    Unhosted wallet verification

    Required for transactions exceeding EUR 1,000.

    VASP Due Diligence

    Required when establishing a correspondent relationship with a CASP registered outside the EU.


    With respect to cross-border correspondent relationships involving the execution of crypto-asset services – including transfers of crypto-assets – with a respondent entity not established in the EU and providing similar services, CASPs are required, pursuant to Article 19b of Directive (EU) 2015/849 (as introduced by Article 38(2) of Regulation (EU) 2023/1113), when entering into a business relationship with such an entity, to:

    • determine if the respondent entity is licensed or registered;
    • gather sufficient information about the respondent entity to understand fully the nature of the respondent’s business and to determine from publicly available information the reputation of the entity and the quality of supervision;
    • assess the respondent entity’s AML/CFT controls;
    • obtain approval from senior management before establishing new correspondent relationships;
    • document the respective responsibilities of each party to the correspondent relationship;
    • with respect to payable-through crypto-asset accounts, be satisfied that the respondent entity has verified the identity of, and performed ongoing due diligence on, the customers having direct access to accounts of the correspondent entity, and that it is able to provide relevant customer due diligence data to the correspondent entity, upon request.

    When conducting the assessment and determining appropriate risk-mitigating measures, CASPs shall also take into account the criteria and elements set out in Guideline 8 of the ML/TF Risk Factors Guidelines (EBA/GL/2021/02, as amended by EBA/GL/2024/01). These requirements will be further supplemented by Article 37 of Regulation (EU) 2024/1624 (AMLR) as of 10 July 2027.

    Time and way to share the Information

    The required information shall be transmitted immediately and in a secure manner, and no later than the initiation of the blockchain transaction.

    Record retention

    5 years.

    Obligations of the originating CASP

    The originating CASP must:

    • obtain information about the originator and beneficiary from a client who initiated a crypto-asset transfer;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
    • conduct CASP Due Diligence (if applicable);
    • verify a self-hosted wallet to which the crypto-assets should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information on the originator and the beneficiary to the next CASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the beneficiary CASP

    The beneficiary CASP must:

    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet (if necessary);
    • conduct CASP Due Diligence (if applicable);
    • verify a self-hosted wallet from which the crypto-assets were received (if applicable);
    • receive information about the originator and beneficiary from the originating or intermediary CASP (or obtain it directly from its customer if assets are received from a self-hosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the intermediary CASP

    The intermediary CASP must:

    • receive information about the originator and beneficiary from the previous CASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
    • conduct CASP Due Diligence (if applicable);
    • verify a self-hosted wallet from which the crypto-assets were received or to which they should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information on the originator and the beneficiary to the next CASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
    • keep records related to the transfer for as long as required by national legislation.

    Subject

    Details

    Status

    In force from March 10, 2023.

    Regulation

    Regulatory body

    Threshold

    No threshold. The Travel Rule applies to all virtual asset transfers irrespective of value.

    Data to be shared

    Originator:

    • a) Permanent Account Number (PAN) or National Identity Number;
    • b) Full name;
    • c) Account number;
    • d) Physical (geographical) address, or date and place of birth.

    Beneficiary:

    • e) Full name;
    • f) Account number.

    Subject

    Details

    Threshold-based data

    —

    Domestic vs cross-border transfers

    No difference.

    Batch file transfer

    No special provisions.

    Unhosted wallet verification

    No requirement. May be applied based on risk assessment.

    VASP Due Diligence

    Required.

    Time and way to share the Information

    The required information shall be transmitted immediately and in a secure manner.

    Record retention

    5 years.

    Obligations of the originating VASP

    The originating VASP must:

    • obtain information about the originator and beneficiary from a client who initiated a virtual asset transfer;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
    • conduct VASP Due Diligence;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the beneficiary VASP

    The beneficiary VASP must:

    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet (if necessary);
    • conduct VASP Due Diligence;
    • receive information about the originator and beneficiary from the originating or intermediary VASP (or obtain it directly from its customer if assets are received from an unhosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the intermediary VASP

    The intermediary VASP must:

    • receive information about the originator and beneficiary from the previous VASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
    • conduct VASP Due Diligence;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
    • keep records related to the transfer for as long as required by national legislation.

    Subject

    Details

    Status

    In force from October 1, 2021.

    Regulation

    Regulatory body

    Threshold

    No threshold. The Travel Rule applies to all virtual asset transfers irrespective of value.

    Data to be shared

    Originator:

    • a) Full name;
    • b) Wallet address;
    • c) Residential address;
    • d) For Indonesians: Identity card number; for non-Indonesians: passport number, identity card number issued by the individual's country of origin, permanent residence permit card number or limited residence permit card number (if available).

    Beneficiary:

    • e) Full name;
    • f) Wallet address;
    • g) Residential address.

    Subject

    Details

    Threshold-based data

    USD 1,000

    • < USD 1,000: a), b), e), f);
    • ≥ USD 1,000: a), b), c), d), e), f), g).

    Domestic vs cross-border transfers

    No difference.

    Batch file transfer

    No special requirement.

    Unhosted wallet verification

    No requirement. May be applied based on risk assessment.

    VASP Due Diligence

    No requirement.

    Time and way to share the Information

    The required information shall be transmitted immediately and in a secure manner.

    Record retention

    10 years.

    Obligations of the originating VASP

    The originating VASP must:

    • obtain information about the originator and beneficiary from a client who initiated a virtual asset transfer;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the beneficiary VASP

    The beneficiary VASP must:

    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet (if necessary);
    • receive information about the originator and beneficiary from the originating or intermediary VASP (or obtain it directly from its customer if assets are received from an unhosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the intermediary VASP

    The intermediary VASP must:

    • receive information about the originator and beneficiary from the previous VASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
    • keep records related to the transfer for as long as required by national legislation.

    Subject

    Details

    Status

    In force from December 30, 2024.

    Regulation

    Regulatory body

    Threshold

    No threshold. The Travel Rule applies to all crypto-asset transfers irrespective of value.

    Data to be shared

    Natural Person


    Originator:

    • full name;
    • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
    • address (habitual residence, including country name);
    • one of the following: (i) official personal document number and customer identification number or (ii) date and place of birth.

    Beneficiary:

    • full name;
    • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier.

    Legal Entity


    Originator:

    • registered name;
    • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
    • address (registered office address);
    • registration number and customer identification number;
    • legal entity identifier (LEI), where available and provided, or, in its absence, another equivalent official identifier*.

    Beneficiary:

    • registered name;
    • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
    • legal entity identifier (LEI), where available and provided, or, in its absence, another equivalent official identifier*.

    * Note: The alternative identifier must: (i) be a unique identification code for the legal entity; (ii) be published in public registries; (iii) be automatically issued upon entity formation by a public authority; (iv) allow identification of name and address elements; (v) be accompanied by a description of the identifier type in the messaging system. Where the registration number satisfies the criteria for the alternative identifier, it may also be used for this purpose.

    Subject

    Details

    Threshold-based data

    —

    Domestic vs cross-border transfers

    No difference.

    Batch file transfer

    In the case of a batch file transfer of crypto-assets from a single originator, the obligation on the originating CASP to ensure that transfers of crypto-assets are accompanied by the required information shall not apply to the individual transfers bundled together therein, provided that: the batch file contains the required information on the originator and the beneficiary; that such information has been duly verified; and that each individual transfer carries (i) the originator's distributed ledger address and the originator's crypto-asset account number, if such an account exists and is used to process the transaction, where the transfer is registered on a DLT network; (ii) the originator's crypto-asset account number, where the transfer is not registered on a DLT network but is made to or from a crypto-asset account; or (iii) the unique transaction identifier, where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account.

    Unhosted wallet verification

    Required for transactions exceeding EUR 1,000.

    VASP Due Diligence

    Required when establishing a correspondent relationship with a CASP registered outside the EU.


    With respect to cross-border correspondent relationships involving the execution of crypto-asset services – including transfers of crypto-assets – with a respondent entity not established in the EU and providing similar services, CASPs are required, pursuant to Article 19b of Directive (EU) 2015/849 (as introduced by Article 38(2) of Regulation (EU) 2023/1113), when entering into a business relationship with such an entity, to:

    • determine if the respondent entity is licensed or registered;
    • gather sufficient information about the respondent entity to understand fully the nature of the respondent’s business and to determine from publicly available information the reputation of the entity and the quality of supervision;
    • assess the respondent entity’s AML/CFT controls;
    • obtain approval from senior management before establishing new correspondent relationships;
    • document the respective responsibilities of each party to the correspondent relationship;
    • with respect to payable-through crypto-asset accounts, be satisfied that the respondent entity has verified the identity of, and performed ongoing due diligence on, the customers having direct access to accounts of the correspondent entity, and that it is able to provide relevant customer due diligence data to the correspondent entity, upon request.

    When conducting the assessment and determining appropriate risk-mitigating measures, CASPs shall also take into account the criteria and elements set out in Guideline 8 of the ML/TF Risk Factors Guidelines (EBA/GL/2021/02, as amended by EBA/GL/2024/01). These requirements will be further supplemented by Article 37 of Regulation (EU) 2024/1624 (AMLR) as of 10 July 2027.

    Time and way to share the Information

    The required information shall be transmitted immediately and in a secure manner, and no later than the initiation of the blockchain transaction.

    Record retention

    5 years.

    Obligations of the originating CASP

    The originating CASP must:

    • obtain information about the originator and beneficiary from a client who initiated a crypto-asset transfer;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
    • conduct CASP Due Diligence (if applicable);
    • verify a self-hosted wallet to which the crypto-assets should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information on the originator and the beneficiary to the next CASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the beneficiary CASP

    The beneficiary CASP must:

    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet (if necessary);
    • conduct CASP Due Diligence (if applicable);
    • verify a self-hosted wallet from which the crypto-assets were received (if applicable);
    • receive information about the originator and beneficiary from the originating or intermediary CASP (or obtain it directly from its customer if assets are received from a self-hosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the intermediary CASP

    The intermediary CASP must:

    • receive information about the originator and beneficiary from the previous CASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
    • conduct CASP Due Diligence (if applicable);
    • verify a self-hosted wallet from which the crypto-assets were received or to which they should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information on the originator and the beneficiary to the next CASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
    • keep records related to the transfer for as long as required by national legislation.

    Subject

    Details

    Status

    In force from October 28, 2024.

    Regulation

    Regulatory body

    Threshold

    No threshold. The Travel Rule applies to all virtual asset transfers irrespective of value.

    Data to be shared

    Natural Person:


    Originator:

    • a) Full official name;
    • b) Unique account Identifier (or a unique transaction identifier);
    • c) One of the following: address, a national identity number, or date and place of birth.

    Beneficiary:

    • d) Full official name;
    • e) Unique account Identifier (or a unique transaction identifier).

    Legal Entity:


    Originator:

    • f) Registered name (or a trading name);
    • g) Unique account Identifier (or a unique transaction identifier);
    • h) Registered office address, or if different, or if there is none, a principal place of business.

    Beneficiary:

    • i) Registered name (or a trading name);
    • j) Unique account Identifier (or a unique transaction identifier).

    Subject

    Details

    Threshold-based data

    EUR 1,000


    Natural Person:

    • < EUR 1,000: a), b), d), e);
    • > EUR 1,000: a), b), c), d), e).

    Legal Entity: No difference.

    Domestic vs cross-border transfers

    No difference.

    Batch file transfer

    In the case of a batch file transfer, the information required specified does not have to accompany each individual virtual asset transfer provided that:

    • a) each individual virtual asset transfer within the batch is accompanied by the unique account identifier or, if there is no unique account identifier, the unique transaction identifier; and
    • b) the batch is accompanied by the remaining required information.

    Unhosted wallet verification

    No requirement. May be applied based on risk assessment.

    VASP Due Diligence

    No requirement.

    Time and way to share the Information

    The required information shall be transmitted immediately and in a secure manner.

    Record retention

    5 years.

    Obligations of the originating VASP

    The originating VASP must:

    • obtain information about the originator and beneficiary from a client who initiated a virtual asset transfer;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
    • carry out wallet attribution to establish which type of wallet - custodial or unhosted - is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the beneficiary VASP

    The beneficiary VASP must:

    • carry out wallet attribution to establish which type of wallet - custodial or unhosted - is used on the other end and, if it is a custodial one, establish which VASP controls the wallet (if necessary);
    • receive information about the originator and beneficiary from the originating or intermediary VASP (or obtain it directly from its customer if assets are received from an unhosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the intermediary VASP

    The intermediary VASP must:

    • receive information about the originator and beneficiary from the previous VASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • carry out wallet attribution to establish which type of wallet - custodial or unhosted - is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
    • keep records related to the transfer for as long as required by national legislation.

    Subject

    Details

    Status

    In force from November 14, 2021.

    Regulation

    Regulatory body

    Threshold

    No threshold. The Travel Rule applies to all virtual asset transfers irrespective of value.

    Data to be shared

    Originator:

    • a) Full name;
    • b) Identity number (or a unique identity number), or the date of birth or the date of incorporation;
    • c) Address;
    • d) Account number (or another unique identification number).

    Beneficiary:

    • a) Full name;
    • b) Account number (or another unique identification number).

    Subject

    Details

    Threshold-based data

    —

    Domestic vs cross-border transfers

    No difference.

    Batch file transfer

    In the event a Service Provider performed a number of cross border electronic wire transfers from Israel, or transfers of virtual currency, for the same originator in one batch file, the said batch file will include the information contained in Section "Data to be shared" with respect to each of the transfers in the batch file.

    Unhosted wallet verification

    No requirement. May be applied based on risk assessment.

    VASP Due Diligence

    No requirement.

    Time and way to share the Information

    The required information shall be transmitted immediately and in a secure manner.

    Record retention

    5 years.

    Obligations of the originating VASP

    The originating VASP must:

    • obtain information about the originator and beneficiary from a client who initiated a virtual asset transfer;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
    • carry out wallet attribution to establish which type of wallet - custodial or unhosted - is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the beneficiary VASP

    The beneficiary VASP must:

    • carry out wallet attribution to establish which type of wallet - custodial or unhosted - is used on the other end and, if it is a custodial one, establish which VASP controls the wallet (if necessary);
    • receive information about the originator and beneficiary from the originating or intermediary VASP (or obtain it directly from its customer if assets are received from an unhosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the intermediary VASP

    The intermediary VASP must:

    • receive information about the originator and beneficiary from the previous VASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • carry out wallet attribution to establish which type of wallet - custodial or unhosted - is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
    • keep records related to the transfer for as long as required by national legislation.

    Subject

    Details

    Status

    In force from December 30, 2024.

    Regulation

    Regulatory body

    Threshold

    No threshold. The Travel Rule applies to all crypto-asset transfers irrespective of value.

    Data to be shared

    Natural Person


    Originator:

    • full name;
    • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
    • address (habitual residence, including country name);
    • one of the following: (i) official personal document number and customer identification number or (ii) date and place of birth.

    Beneficiary:

    • full name;
    • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier.

    Legal Entity


    Originator:

    • registered name;
    • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
    • address (registered office address);
    • registration number and customer identification number;
    • legal entity identifier (LEI), where available and provided, or, in its absence, another equivalent official identifier*.

    Beneficiary:

    • registered name;
    • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
    • legal entity identifier (LEI), where available and provided, or, in its absence, another equivalent official identifier*.

    * Note: The alternative identifier must: (i) be a unique identification code for the legal entity; (ii) be published in public registries; (iii) be automatically issued upon entity formation by a public authority; (iv) allow identification of name and address elements; (v) be accompanied by a description of the identifier type in the messaging system. Where the registration number satisfies the criteria for the alternative identifier, it may also be used for this purpose.

    Subject

    Details

    Threshold-based data

    —

    Domestic vs cross-border transfers

    No difference.

    Batch file transfer

    In the case of a batch file transfer of crypto-assets from a single originator, the obligation on the originating CASP to ensure that transfers of crypto-assets are accompanied by the required information shall not apply to the individual transfers bundled together therein, provided that: the batch file contains the required information on the originator and the beneficiary; that such information has been duly verified; and that each individual transfer carries (i) the originator's distributed ledger address and the originator's crypto-asset account number, if such an account exists and is used to process the transaction, where the transfer is registered on a DLT network; (ii) the originator's crypto-asset account number, where the transfer is not registered on a DLT network but is made to or from a crypto-asset account; or (iii) the unique transaction identifier, where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account.

    Unhosted wallet verification

    Required for transactions exceeding EUR 1,000.

    VASP Due Diligence

    Required when establishing a correspondent relationship with a CASP registered outside the EU.


    With respect to cross-border correspondent relationships involving the execution of crypto-asset services – including transfers of crypto-assets – with a respondent entity not established in the EU and providing similar services, CASPs are required, pursuant to Article 19b of Directive (EU) 2015/849 (as introduced by Article 38(2) of Regulation (EU) 2023/1113), when entering into a business relationship with such an entity, to:

    • determine if the respondent entity is licensed or registered;
    • gather sufficient information about the respondent entity to understand fully the nature of the respondent’s business and to determine from publicly available information the reputation of the entity and the quality of supervision;
    • assess the respondent entity’s AML/CFT controls;
    • obtain approval from senior management before establishing new correspondent relationships;
    • document the respective responsibilities of each party to the correspondent relationship;
    • with respect to payable-through crypto-asset accounts, be satisfied that the respondent entity has verified the identity of, and performed ongoing due diligence on, the customers having direct access to accounts of the correspondent entity, and that it is able to provide relevant customer due diligence data to the correspondent entity, upon request.

    When conducting the assessment and determining appropriate risk-mitigating measures, CASPs shall also take into account the criteria and elements set out in Guideline 8 of the ML/TF Risk Factors Guidelines (EBA/GL/2021/02, as amended by EBA/GL/2024/01). These requirements will be further supplemented by Article 37 of Regulation (EU) 2024/1624 (AMLR) as of 10 July 2027.

    Time and way to share the Information

    The required information shall be transmitted immediately and in a secure manner, and no later than the initiation of the blockchain transaction.

    Record retention

    10 years.

    Obligations of the originating CASP

    The originating CASP must:

    • obtain information about the originator and beneficiary from a client who initiated a crypto-asset transfer;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
    • conduct CASP Due Diligence (if applicable);
    • verify a self-hosted wallet to which the crypto-assets should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information on the originator and the beneficiary to the next CASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the beneficiary CASP

    The beneficiary CASP must:

    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet (if necessary);
    • conduct CASP Due Diligence (if applicable);
    • verify a self-hosted wallet from which the crypto-assets were received (if applicable);
    • receive information about the originator and beneficiary from the originating or intermediary CASP (or obtain it directly from its customer if assets are received from a self-hosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the intermediary CASP

    The intermediary CASP must:

    • receive information about the originator and beneficiary from the previous CASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
    • conduct CASP Due Diligence (if applicable);
    • verify a self-hosted wallet from which the crypto-assets were received or to which they should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information on the originator and the beneficiary to the next CASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
    • keep records related to the transfer for as long as required by national legislation.

    Subject

    Details

    Status

    In force from June 1, 2023.

    Regulation

    Regulatory body

    Threshold

    No threshold. The Travel Rule applies to all virtual asset transfers irrespective of value.

    Data to be shared

    Natural Person


    Originator:

    • full name;
    • identifier related to the transfer, or an alphanumeric code sufficient to identify such identifier;
    • residential address, or identity verification document, or a customer identification number.

    Beneficiary:

    • full name;
    • identifier related to the transfer, or an alphanumeric code sufficient to identify such identifier.

    Legal Entity


    Originator:

    • registered name;
    • identifier related to the transfer, or an alphanumeric code sufficient to identify such identifier;
    • location of the head office or principal business office, or customer identification number.

    Beneficiary:

    • registered name;
    • identifier related to the transfer, or an alphanumeric code sufficient to identify such identifier.

    Subject

    Details

    Threshold-based data

    —

    Domestic vs cross-border transfers

    No difference.

    If a virtual asset transfer is carried out to a VASP incorporated in a jurisdiction other than those specified in the list approved by the FSA, the Travel Rule does not apply; however, such transfers are not prohibited.

    Batch file transfer

    No special provisions.

    Unhosted wallet verification

    No requirement. May be applied based on risk assessment.

    VASP Due Diligence

    No requirement.

    Time and way to share the Information

    The required information shall be transmitted at the time of the transfer.

    Record retention

    7 years.

    Obligations of the originating CASP

    The originating CASP must:

    • obtain information about the originator and beneficiary from a client who initiated a crypto-asset transfer;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information about the originator and beneficiary to the beneficiary or intermediary CASP; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the beneficiary CASP

    The beneficiary CASP must:

    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet (if necessary);
    • receive information about the originator and beneficiary from the originating or intermediary VASP (or obtain it directly from its customer if assets are received from a self-hosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the intermediary CASP

    The intermediary CASP must:

    • receive information about the originator and beneficiary from the previous CASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information about the originator and beneficiary to the beneficiary or intermediary CASP; and
    • keep records related to the transfer for as long as required by national legislation.

    Subject

    Details

    Status

    In force from September 1, 2023.

    Regulation

    Regulatory body

    Threshold

    No threshold. The Travel Rule applies to all virtual asset transfers irrespective of value.

    Data to be shared

    Natural Person:


    Originator:

    • a) Full name;
    • b) Account number (or other unique transaction identifiers);
    • c) One of the following: customer identification number; or address; or birth certificate, passport number, or national ID card number (or individual's date and place of birth).

    Beneficiary:

    • d) Full name;
    • e) Account number (or other unique transaction identifiers).

    Legal Entity:


    Originator:

    • f) Registered or trading names;
    • g) Account number (or other unique transaction identifiers);
    • h) One of the following: customer identification number; or address of registered office (or principal place of business).

    Beneficiary:

    • i) Registered or trading names;
    • j) Account number (or other unique transaction identifiers).

    Subject

    Details

    Threshold-based data

    EUR 1,000

    Natural Person/Legal Entity

    Domestic:

    • b) and e).

    If additional information is requested, then:

    • < EUR 1,000: a), b), d), e);
    • > EUR 1,000: a), b), c), d), e).

    Cross-border:

    The following data should be transferred:

    • < EUR 1,000: a), b), d), e);
    • > EUR 1,000: a), b), c), d), e).

    Domestic vs cross-border transfers

    There is a difference.

    Natural Person:

    Domestic. The following data should be transferred: b) and e). However, within three working days of receiving a request for information from the beneficiary's CASP or ICASP, the following data should be made available:

    • < EUR 1,000: a), b), d), e);
    • > EUR 1,000: a), b), c), d), e).

    Cross-border. The following data should be transferred:

    • < EUR 1,000: a), b), d), e);
    • > EUR 1,000: a), b), c), d), e).

    Legal Entity:

    Domestic. The following data should be transferred: g) and j). However, within three working days of receiving a request for information from the beneficiary's CASP or ICASP, the following data should be made available:

    • < EUR 1,000: f), g), i), j);
    • > EUR 1,000: f), g), h); i), j).

    Cross-border. The following data should be transferred:

    • < EUR 1,000: f), g), i), j);
    • > EUR 1,000: f), g), h); i), j).

    Sumsub has submitted a request to the Jersey Financial Services Commission for clarification on the application of the rules concerning the minimum threshold amount. This information will be updated upon receipt of the regulator's response.

    Batch file transfer

    In the case of a batch file transfer from a single originator where the CASPs of the beneficiaries are established outside the EU, the obligation on the CASP of the originator to ensure that information on the originator accompanies transfers of funds shall not apply to the individual transfers bundled together therein, provided that the batch file contains the information on the originator and the beneficiary, that the information has been properly verified, and that the individual transfers carry the account number of the originator or, where the exception is applied, the unique transaction identifier.

    Unhosted wallet verification

    Required in cases of higher risk.

    VASP Due Diligence

    No requirement.

    Time and way to share the Information

    The regulation do not explicitly specify the time frame for information sharing. In turn, according to the interpretive note to FATF Recommendation 15, originating CASPs should submit the information on the originator and beneficiary to the beneficiary CASP immediately and securely.

    Record retention

    6 years.

    Obligations of the originating CASP

    The originating CASP must:

    • obtain information about the originator and beneficiary from a client who initiated a crypto-asset transfer;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
    • verify a self-hosted wallet to which the crypto-assets should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information about the originator and beneficiary to the beneficiary or intermediary CASP; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the beneficiary CASP

    The beneficiary CASP must:

    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet (if necessary);
    • verify a self-hosted wallet from which the crypto-assets were received (if applicable);
    • receive information about the originator and beneficiary from the originating or intermediary VASP (or obtain it directly from its customer if assets are received from a self-hosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the intermediary CASP

    The intermediary CASP must:

    • receive information about the originator and beneficiary from the previous CASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
    • verify a self-hosted wallet from which the crypto-assets were received or to which they should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information about the originator and beneficiary to the beneficiary or intermediary CASP; and
    • keep records related to the transfer for as long as required by national legislation.

    Subject

    Details

    Status

    In force from January 1, 2025.

    Regulation
    • Anti-Money Laundering and Counter-Terroris Financing and Sanctions Rules
    • «Қылмыстық жолмен алынған кірістерді заңдастыруға (жылыстатуға) және терроризмді қаржыландыруға қарсы іс-қимыл туралы» Қазақстан Республикасының 2009 жылғы 28 тамыздағы № 191-ІV Заңы

    Regulatory body

    Threshold

    No threshold. The Travel Rule applies to all virtual asset transfers irrespective of value.

    Data to be shared

    Natural Person


    Originator:

    • a) Full official name;
    • b) Digital asset wallet address or account number or (in the absence of an account) unique transaction reference number;
    • c) Physical address, or national identity number, or customer identification, or date and place of birth.

    Beneficiary:

    • d) Full official name;
    • e) Digital asset wallet address or account number or (in the absence of an account) unique transaction reference number.

    Legal Entity


    Originator:

    • f) Registered corporate name or trading name;
    • g) Digital asset wallet address or account number or (in the absence of an account) unique transaction reference number;
    • h) Either of the following: (i) the customer identification number; or (ii) the registered office address or primary place of business.

    Beneficiary:

    • i) Registered corporate name or trading name;
    • j) Digital asset wallet address or account number or (in the absence of an account) unique transaction reference number.

    Subject

    Details

    Threshold-based data

    USD 1,000

    Natural Person

    • < USD 1,000: a), b), d), e);
    • ≥ USD 1,000: a), b), c), d), e).

    Legal Entity

    • < USD 1,000: f), g), i), j);
    • ≥ USD 1,000: f), g), h), i), j).

    Domestic vs cross-border transfers

    No difference.

    Batch file transfer

    If several transfers from a single originator are bundled in a batch file for transmission to beneficiaries, they may be exempted from the requirements in respect of originator information, provided that they include the originator’s account number or unique transaction reference number, and the batch file contains required and accurate originator information, and full beneficiary information, that is fully traceable within the beneficiary country.

    Unhosted wallet verification

    Required for transactions exceeding USD 1,000, as well as when there is a suspicion of money laundering or terrorist financing involving a transfer to a self-hosted digital wallet.

    VASP Due Diligence

    Required.

    Time and way to share the Information

    The required information shall be transmitted immediately and in a secure manner.

    Record retention

    As a general rule, the period is 5 years; for intermediary VASPs, it is 6 years.

    Obligations of the originating VASP

    The originating VASP must:

    • obtain information about the originator and beneficiary from a client who initiated a virtual asset transfer;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
    • conduct VASP Due Diligence (if applicable);
    • verify an unhosted wallet to which the assets should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the beneficiary VASP

    The beneficiary VASP must:

    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet (if necessary);
    • conduct VASP Due Diligence (if applicable);
    • verify an unhosted wallet from which the assets were received (if applicable);
    • receive information about the originator and beneficiary from the originating or intermediary VASP (or obtain it directly from its customer if assets are received from an unhosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the intermediary VASP

    The intermediary VASP must:

    • receive information about the originator and beneficiary from the previous VASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
    • conduct VASP Due Diligence (if applicable);
    • verify an unhosted wallet from which the assets were received or to which they should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
    • keep records related to the transfer for as long as required by national legislation.

    Subject

    Details

    Status

    In force from December 30, 2024.

    Regulation

    Regulatory body

    Threshold

    No threshold. The Travel Rule applies to all crypto-asset transfers irrespective of value.

    Data to be shared

    Natural Person


    Originator:

    • full name;
    • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
    • address (habitual residence, including country name);
    • one of the following: (i) official personal document number and customer identification number or (ii) date and place of birth.

    Beneficiary:

    • full name;
    • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier.

    Legal Entity


    Originator:

    • registered name;
    • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
    • address (registered office address);
    • registration number and customer identification number;
    • legal entity identifier (LEI), where available and provided, or, in its absence, another equivalent official identifier*.

    Beneficiary:

    • registered name;
    • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
    • legal entity identifier (LEI), where available and provided, or, in its absence, another equivalent official identifier*.

    * Note: The alternative identifier must: (i) be a unique identification code for the legal entity; (ii) be published in public registries; (iii) be automatically issued upon entity formation by a public authority; (iv) allow identification of name and address elements; (v) be accompanied by a description of the identifier type in the messaging system. Where the registration number satisfies the criteria for the alternative identifier, it may also be used for this purpose.

    Subject

    Details

    Threshold-based data

    —

    Domestic vs cross-border transfers

    No difference.

    Batch file transfer

    In the case of a batch file transfer of crypto-assets from a single originator, the obligation on the originating CASP to ensure that transfers of crypto-assets are accompanied by the required information shall not apply to the individual transfers bundled together therein, provided that: the batch file contains the required information on the originator and the beneficiary; that such information has been duly verified; and that each individual transfer carries (i) the originator's distributed ledger address and the originator's crypto-asset account number, if such an account exists and is used to process the transaction, where the transfer is registered on a DLT network; (ii) the originator's crypto-asset account number, where the transfer is not registered on a DLT network but is made to or from a crypto-asset account; or (iii) the unique transaction identifier, where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account.

    Unhosted wallet verification

    Required for transactions exceeding EUR 1,000.

    VASP Due Diligence

    Required when establishing a correspondent relationship with a CASP registered outside the EU.


    With respect to cross-border correspondent relationships involving the execution of crypto-asset services – including transfers of crypto-assets – with a respondent entity not established in the EU and providing similar services, CASPs are required, pursuant to Article 19b of Directive (EU) 2015/849 (as introduced by Article 38(2) of Regulation (EU) 2023/1113), when entering into a business relationship with such an entity, to:

    • determine if the respondent entity is licensed or registered;
    • gather sufficient information about the respondent entity to understand fully the nature of the respondent’s business and to determine from publicly available information the reputation of the entity and the quality of supervision;
    • assess the respondent entity’s AML/CFT controls;
    • obtain approval from senior management before establishing new correspondent relationships;
    • document the respective responsibilities of each party to the correspondent relationship;
    • with respect to payable-through crypto-asset accounts, be satisfied that the respondent entity has verified the identity of, and performed ongoing due diligence on, the customers having direct access to accounts of the correspondent entity, and that it is able to provide relevant customer due diligence data to the correspondent entity, upon request.

    When conducting the assessment and determining appropriate risk-mitigating measures, CASPs shall also take into account the criteria and elements set out in Guideline 8 of the ML/TF Risk Factors Guidelines (EBA/GL/2021/02, as amended by EBA/GL/2024/01). These requirements will be further supplemented by Article 37 of Regulation (EU) 2024/1624 (AMLR) as of 10 July 2027.

    Time and way to share the Information

    The required information shall be transmitted immediately and in a secure manner, and no later than the initiation of the blockchain transaction.

    Record retention

    5 years.

    Obligations of the originating CASP

    The originating CASP must:

    • obtain information about the originator and beneficiary from a client who initiated a crypto-asset transfer;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
    • conduct CASP Due Diligence (if applicable);
    • verify a self-hosted wallet to which the crypto-assets should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information on the originator and the beneficiary to the next CASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the beneficiary CASP

    The beneficiary CASP must:

    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet (if necessary);
    • conduct CASP Due Diligence (if applicable);
    • verify a self-hosted wallet from which the crypto-assets were received (if applicable);
    • receive information about the originator and beneficiary from the originating or intermediary CASP (or obtain it directly from its customer if assets are received from a self-hosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the intermediary CASP

    The intermediary CASP must:

    • receive information about the originator and beneficiary from the previous CASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
    • conduct CASP Due Diligence (if applicable);
    • verify a self-hosted wallet from which the crypto-assets were received or to which they should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information on the originator and the beneficiary to the next CASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
    • keep records related to the transfer for as long as required by national legislation.

    Subject

    Details

    Status

    In force from June 1, 2021.

    Regulation

    Regulatory body

    Threshold

    No threshold. The Travel Rule applies to all crypto-asset transfers irrespective of value.

    Data to be shared

    Natural Person


    Originator:

    • full official name;
    • distributed ledger address and crypto-asset account number: If the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number if it exists and is used. If not registered on a DLT network, provide the crypto-asset account number;
    • address (habitual residence, including country name);
    • one of the following: (i) official personal document number and customer identification number or (ii) date and place of birth.

    Beneficiary:

    • full official name;
    • distributed ledger address and crypto-asset account number: If the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number if it exists and is used. If not registered on a DLT network, provide the crypto-asset account number.

    Legal Entity


    Originator:

    • registered name;
    • distributed ledger address and crypto-asset account number: If the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number if it exists and is used. If not registered on a DLT network, provide the crypto-asset account number;
    • address (registered office address);
    • registration number (or equivalent identifier)* and customer identification number;
    • legal entity identifier (LEI) or equivalent identifier*.

    Beneficiary:

    • registered name;
    • distributed ledger address and crypto-asset account number: If the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number if it exists and is used. If not registered on a DLT network, provide the crypto-asset account number;
    • legal entity identifier (LEI) or equivalent identifier*.

    * The alternative identifier must: (i) be a unique identification code for the legal entity; (ii) be published in public registries; (iii) be automatically issued upon entity formation by a public authority; (iv) allow identification of name and address elements; (v) be accompanied by a description of the identifier type in the messaging system. Where the registration number satisfies the criteria for the alternative identifier, it may also be used for this purpose.

    Subject

    Details

    Threshold-based data

    —

    Domestic vs cross-border transfers

    No difference.

    Batch file transfer

    In the case of a batch file transfer of crypto-assets from a single originator, the obligation on the originating CASP to ensure that transfers of crypto-assets are accompanied by the required information shall not apply to the individual transfers bundled together therein, provided that the batch file contains the required information on the originator and the beneficiary, or a unique transaction identifier where applicable; that such information has been duly verified; and that the individual transfers carry the originator's distributed ledger address, the originator's crypto-asset account number, or the unique transaction identifier, as applicable.

    Unhosted wallet verification

    Required for transactions exceeding EUR 1,000.

    VASP Due Diligence

    Required when establishing a correspondent relationship with a CASP registered outside the EU.


    With respect to cross-border correspondent relationships involving the execution of crypto-asset services – including transfers of crypto-assets – with a respondent entity not established in the EU and providing similar services, CASPs are required, pursuant to Article 19b of Directive (EU) 2015/849 (as introduced by Article 38(2) of Regulation (EU) 2023/1113), when entering into a business relationship with such an entity, to:

    • determine if the respondent entity is licensed or registered;
    • gather sufficient information about the respondent entity to understand fully the nature of the respondent’s business and to determine from publicly available information the reputation of the entity and the quality of supervision;
    • assess the respondent entity’s AML/CFT controls;
    • obtain approval from senior management before establishing new correspondent relationships;
    • document the respective responsibilities of each party to the correspondent relationship;
    • with respect to payable-through crypto-asset accounts, be satisfied that the respondent entity has verified the identity of, and performed ongoing due diligence on, the customers having direct access to accounts of the correspondent entity, and that it is able to provide relevant customer due diligence data to the correspondent entity, upon request.

    When conducting the assessment and determining appropriate risk-mitigating measures, CASPs shall also take into account the criteria and elements set out in Guideline 8 of the ML/TF Risk Factors Guidelines (EBA/GL/2021/02, as amended by EBA/GL/2024/01). These requirements will be further supplemented by Article 37 of Regulation (EU) 2024/1624 (AMLR) as of 10 July 2027.

    Time and way to share the Information

    The required information shall be transmitted immediately and in a secure manner, and no later than the initiation of the blockchain transaction.

    Record retention

    10 years.

    Obligations of the originating CASP

    The originating CASP must:

    • obtain information about the originator and beneficiary from a client who initiated a crypto-asset transfer;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
    • conduct CASP Due Diligence (if applicable);
    • verify a self-hosted wallet to which the crypto-assets should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information on the originator and the beneficiary to the next CASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the beneficiary CASP

    The beneficiary CASP must:

    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet (if necessary);
    • conduct CASP Due Diligence (if applicable);
    • verify a self-hosted wallet from which the crypto-assets were received (if applicable);
    • receive information about the originator and beneficiary from the originating or intermediary CASP (or obtain it directly from its customer if assets are received from a self-hosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the intermediary CASP

    The intermediary CASP must:

    • receive information about the originator and beneficiary from the previous CASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
    • conduct CASP Due Diligence (if applicable);
    • verify a self-hosted wallet from which the crypto-assets were received or to which they should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information on the originator and the beneficiary to the next CASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
    • keep records related to the transfer for as long as required by national legislation.

    Subject

    Details

    Status

    In force from December 30, 2024.

    Regulation

    Regulatory body

    Threshold

    No threshold. The Travel Rule applies to all crypto-asset transfers irrespective of value.

    Data to be shared

    Natural Person


    Originator:

    • full name;
    • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
    • address (habitual residence, including country name);
    • one of the following: (i) official personal document number and customer identification number or (ii) date and place of birth.

    Beneficiary:

    • full name;
    • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier.

    Legal Entity


    Originator:

    • registered name;
    • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
    • address (registered office address);
    • registration number and customer identification number;
    • legal entity identifier (LEI), where available and provided, or, in its absence, another equivalent official identifier*.

    Beneficiary:

    • registered name;
    • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
    • legal entity identifier (LEI), where available and provided, or, in its absence, another equivalent official identifier*.

    * Note: The alternative identifier must: (i) be a unique identification code for the legal entity; (ii) be published in public registries; (iii) be automatically issued upon entity formation by a public authority; (iv) allow identification of name and address elements; (v) be accompanied by a description of the identifier type in the messaging system. Where the registration number satisfies the criteria for the alternative identifier, it may also be used for this purpose.

    Subject

    Details

    Threshold-based data

    —

    Domestic vs cross-border transfers

    No difference.

    Batch file transfer

    In the case of a batch file transfer of crypto-assets from a single originator, the obligation on the originating CASP to ensure that transfers of crypto-assets are accompanied by the required information shall not apply to the individual transfers bundled together therein, provided that: the batch file contains the required information on the originator and the beneficiary; that such information has been duly verified; and that each individual transfer carries (i) the originator's distributed ledger address and the originator's crypto-asset account number, if such an account exists and is used to process the transaction, where the transfer is registered on a DLT network; (ii) the originator's crypto-asset account number, where the transfer is not registered on a DLT network but is made to or from a crypto-asset account; or (iii) the unique transaction identifier, where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account.

    Unhosted wallet verification

    Required for transactions exceeding EUR 1,000.

    VASP Due Diligence

    Required when establishing a correspondent relationship with a CASP registered outside the EU.


    With respect to cross-border correspondent relationships involving the execution of crypto-asset services – including transfers of crypto-assets – with a respondent entity not established in the EU and providing similar services, CASPs are required, pursuant to Article 19b of Directive (EU) 2015/849 (as introduced by Article 38(2) of Regulation (EU) 2023/1113), when entering into a business relationship with such an entity, to:

    • determine if the respondent entity is licensed or registered;
    • gather sufficient information about the respondent entity to understand fully the nature of the respondent’s business and to determine from publicly available information the reputation of the entity and the quality of supervision;
    • assess the respondent entity’s AML/CFT controls;
    • obtain approval from senior management before establishing new correspondent relationships;
    • document the respective responsibilities of each party to the correspondent relationship;
    • with respect to payable-through crypto-asset accounts, be satisfied that the respondent entity has verified the identity of, and performed ongoing due diligence on, the customers having direct access to accounts of the correspondent entity, and that it is able to provide relevant customer due diligence data to the correspondent entity, upon request.

    When conducting the assessment and determining appropriate risk-mitigating measures, CASPs shall also take into account the criteria and elements set out in Guideline 8 of the ML/TF Risk Factors Guidelines (EBA/GL/2021/02, as amended by EBA/GL/2024/01). These requirements will be further supplemented by Article 37 of Regulation (EU) 2024/1624 (AMLR) as of 10 July 2027.

    Time and way to share the Information

    The required information shall be transmitted immediately and in a secure manner, and no later than the initiation of the blockchain transaction.

    Record retention

    8 years.

    Obligations of the originating CASP

    The originating CASP must:

    • obtain information about the originator and beneficiary from a client who initiated a crypto-asset transfer;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
    • conduct CASP Due Diligence (if applicable);
    • verify a self-hosted wallet to which the crypto-assets should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information on the originator and the beneficiary to the next CASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the beneficiary CASP

    The beneficiary CASP must:

    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet (if necessary);
    • conduct CASP Due Diligence (if applicable);
    • verify a self-hosted wallet from which the crypto-assets were received (if applicable);
    • receive information about the originator and beneficiary from the originating or intermediary CASP (or obtain it directly from its customer if assets are received from a self-hosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the intermediary CASP

    The intermediary CASP must:

    • receive information about the originator and beneficiary from the previous CASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
    • conduct CASP Due Diligence (if applicable);
    • verify a self-hosted wallet from which the crypto-assets were received or to which they should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information on the originator and the beneficiary to the next CASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
    • keep records related to the transfer for as long as required by national legislation.

    Subject

    Details

    Status

    In force from March 30, 2020.

    Regulation

    Regulatory body

    Threshold

    No threshold. The Travel Rule applies to all crypto-asset transfers irrespective of value.

    Data to be shared

    Natural Person


    Originator:

    • full name;
    • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
    • address (habitual residence, including country name);
    • one of the following: (i) official personal document number and customer identification number or (ii) date and place of birth.

    Beneficiary:

    • full name;
    • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier.

    Legal Entity


    Originator:

    • registered name;
    • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
    • address (registered office address);
    • registration number and customer identification number;
    • legal entity identifier (LEI), where available and provided, or, in its absence, another equivalent official identifier*.

    Beneficiary:

    • registered name;
    • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
    • legal entity identifier (LEI), where available and provided, or, in its absence, another equivalent official identifier*.

    * Note: The alternative identifier must: (i) be a unique identification code for the legal entity; (ii) be published in public registries; (iii) be automatically issued upon entity formation by a public authority; (iv) allow identification of name and address elements; (v) be accompanied by a description of the identifier type in the messaging system. Where the registration number satisfies the criteria for the alternative identifier, it may also be used for this purpose.

    Subject

    Details

    Threshold-based data

    —

    Domestic vs cross-border transfers

    No difference.

    Batch file transfer

    In the case of a batch file transfer of crypto-assets from a single originator, the obligation on the originating CASP to ensure that transfers of crypto-assets are accompanied by the required information shall not apply to the individual transfers bundled together therein, provided that: the batch file contains the required information on the originator and the beneficiary; that such information has been duly verified; and that each individual transfer carries (i) the originator's distributed ledger address and the originator's crypto-asset account number, if such an account exists and is used to process the transaction, where the transfer is registered on a DLT network; (ii) the originator's crypto-asset account number, where the transfer is not registered on a DLT network but is made to or from a crypto-asset account; or (iii) the unique transaction identifier, where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account.

    Unhosted wallet verification

    Required for transactions exceeding EUR 1,000.

    VASP Due Diligence

    Required when establishing a correspondent relationship with a CASP registered outside the EU.


    With respect to cross-border correspondent relationships involving the execution of crypto-asset services – including transfers of crypto-assets – with a respondent entity not established in the EU and providing similar services, CASPs are required, pursuant to Article 19b of Directive (EU) 2015/849 (as introduced by Article 38(2) of Regulation (EU) 2023/1113), when entering into a business relationship with such an entity, to:

    • determine if the respondent entity is licensed or registered;
    • gather sufficient information about the respondent entity to understand fully the nature of the respondent’s business and to determine from publicly available information the reputation of the entity and the quality of supervision;
    • assess the respondent entity’s AML/CFT controls;
    • obtain approval from senior management before establishing new correspondent relationships;
    • document the respective responsibilities of each party to the correspondent relationship;
    • with respect to payable-through crypto-asset accounts, be satisfied that the respondent entity has verified the identity of, and performed ongoing due diligence on, the customers having direct access to accounts of the correspondent entity, and that it is able to provide relevant customer due diligence data to the correspondent entity, upon request.

    When conducting the assessment and determining appropriate risk-mitigating measures, CASPs shall also take into account the criteria and elements set out in Guideline 8 of the ML/TF Risk Factors Guidelines (EBA/GL/2021/02, as amended by EBA/GL/2024/01). These requirements will be further supplemented by Article 37 of Regulation (EU) 2024/1624 (AMLR) as of 10 July 2027.

    Time and way to share the Information

    The required information shall be transmitted immediately and in a secure manner, and no later than the initiation of the blockchain transaction.

    Record retention

    5 years.

    Obligations of the originating CASP

    The originating CASP must:

    • obtain information about the originator and beneficiary from a client who initiated a crypto-asset transfer;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
    • conduct CASP Due Diligence (if applicable);
    • verify a self-hosted wallet to which the crypto-assets should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information on the originator and the beneficiary to the next CASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the beneficiary CASP

    The beneficiary CASP must:

    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet (if necessary);
    • conduct CASP Due Diligence (if applicable);
    • verify a self-hosted wallet from which the crypto-assets were received (if applicable);
    • receive information about the originator and beneficiary from the originating or intermediary CASP (or obtain it directly from its customer if assets are received from a self-hosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the intermediary CASP

    The intermediary CASP must:

    • receive information about the originator and beneficiary from the previous CASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
    • conduct CASP Due Diligence (if applicable);
    • verify a self-hosted wallet from which the crypto-assets were received or to which they should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information on the originator and the beneficiary to the next CASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
    • keep records related to the transfer for as long as required by national legislation.

    Subject

    Details

    Status

    In force from April 26, 2021.

    Regulation

    Regulatory body

    Threshold

    No threshold. The Travel Rule applies to all virtual asset transfers irrespective of value.

    Data to be shared

    Originator:

    • a) Full name;
    • b) National registration identity card number or passport number;
    • c) Account number or digital wallet address or a unique transaction reference number;
    • d) Address or date and place of birth.

    Beneficiary:

    • e) Full name;
    • f) Account number or digital wallet address or a unique transaction reference number.

    Subject

    Details

    Threshold-based data

    —

    Domestic vs cross-border transfers

    No difference.

    Batch file transfer

    No special provisions.

    Unhosted wallet verification

    No requirement. May be applied based on risk assessment.

    VASP Due Diligence

    No requirement.

    Time and way to share the Information

    The regulation does not establish specific provisions. In accordance with the FATF's recommendations, the required information must be transmitted immediately and securely.

    Record retention

    7 years.

    Obligations of the originating VASP

    The originating VASP must:

    • obtain information about the originator and beneficiary from a client who initiated a virtual asset transfer;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the beneficiary VASP

    The beneficiary VASP must:

    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet (if necessary);
    • receive information about the originator and beneficiary from the originating or intermediary VASP (or obtain it directly from its customer if assets are received from an unhosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the intermediary VASP

    The intermediary VASP must:

    • receive information about the originator and beneficiary from the previous VASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
    • keep records related to the transfer for as long as required by national legislation.

    Subject

    Details

    Status

    In force from January 1, 2025.

    Regulation

    Regulatory body

    Threshold

    No threshold. The Travel Rule applies to all virtual asset transfers irrespective of value.

    Data to be shared

    Natural Person


    Originator:

    • Full name;
    • Account number or wallet address or any unique transaction number;
    • National Registration Identity Card (NRIC) number or passport number, and either residential address or date and place of birth.

    Beneficiary:

    • Full name;
    • Account number or wallet address or any unique transaction number.

    Legal Entity


    Originator:

    • Registered name;
    • Account number or wallet address or any unique transaction number;
    • Incorporation number or business registration number, and registered or business address, or date of incorporation or registration.

    Beneficiary:

    • Registered name;
    • Account number or wallet address or any unique transaction number.

    Subject

    Details

    Threshold-based data

    If a digital asset transfer has an equivalent value of USD 1,000 or less, the following information shall be shared:


    Natural Person


    Originator:

    • Full name;
    • Account number or wallet address or any unique transaction number.

    Beneficiary:

    • Full name;
    • Account number or wallet address or any unique transaction number.

    Legal Entity


    Originator:

    • Registered name;
    • Account number or wallet address or any unique transaction number.

    Beneficiary:

    • Registered name;
    • Account number or wallet address or any unique transaction number.

    If a digital asset transfer has an equivalent value exceeding USD 1,000, the following information shall be shared:


    Natural Person


    Originator:

    • Full name;
    • Account number or wallet address or any unique transaction number;
    • National Registration Identity Card (NRIC) number or passport number, and either residential address or date and place of birth.

    Beneficiary:

    • Full name;
    • Account number or wallet address or any unique transaction number.

    Legal Entity


    Originator:

    • Registered name;
    • Account number or wallet address or any unique transaction number;
    • Incorporation number or business registration number, and registered or business address, or date of incorporation or registration.

    Beneficiary:

    • Registered name;
    • Account number or wallet address or any unique transaction number.

    Domestic vs cross-border transfers

    No difference.

    Batch file transfer

    No special provisions.

    Unhosted wallet verification

    No requirement. May be applied based on risk assessment.

    VASP Due Diligence

    No requirement.

    Time and way to share the Information

    The required information shall be transmitted immediately and in a secure manner, and no later than the initiation of the blockchain transaction.

    Record retention

    Six years.

    Obligations of the originating VASP

    The originating VASP must:

    • obtain information about the originator and beneficiary from a client who initiated a crypto-asset transfer;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the beneficiary VASP

    The beneficiary VASP must:

    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet (if necessary);
    • receive information about the originator and beneficiary from the originating or intermediary VASP (or obtain it directly from its customer if assets are received from a self-hosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the intermediary VASP

    The intermediary VASP must:

    • receive information about the originator and beneficiary from the previous VASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
    • keep records related to the transfer for as long as required by national legislation.

    Subject

    Details

    Status

    In force from December 30, 2024.

    Regulation

    Regulatory body

    Threshold

    No threshold. The Travel Rule applies to all crypto-asset transfers irrespective of value.

    Data to be shared

    Natural Person


    Originator:

    • full name;
    • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
    • address (habitual residence, including country name);
    • one of the following: (i) official personal document number and customer identification number or (ii) date and place of birth.

    Beneficiary:

    • full name;
    • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier.

    Legal Entity


    Originator:

    • registered name;
    • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
    • address (registered office address);
    • registration number and customer identification number;
    • legal entity identifier (LEI), where available and provided, or, in its absence, another equivalent official identifier*.

    Beneficiary:

    • registered name;
    • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
    • legal entity identifier (LEI), where available and provided, or, in its absence, another equivalent official identifier*.

    * Note: The alternative identifier must: (i) be a unique identification code for the legal entity; (ii) be published in public registries; (iii) be automatically issued upon entity formation by a public authority; (iv) allow identification of name and address elements; (v) be accompanied by a description of the identifier type in the messaging system. Where the registration number satisfies the criteria for the alternative identifier, it may also be used for this purpose.

    Subject

    Details

    Threshold-based data

    —

    Domestic vs cross-border transfers

    No difference.

    Batch file transfer

    In the case of a batch file transfer of crypto-assets from a single originator, the obligation on the originating CASP to ensure that transfers of crypto-assets are accompanied by the required information shall not apply to the individual transfers bundled together therein, provided that: the batch file contains the required information on the originator and the beneficiary; that such information has been duly verified; and that each individual transfer carries (i) the originator's distributed ledger address and the originator's crypto-asset account number, if such an account exists and is used to process the transaction, where the transfer is registered on a DLT network; (ii) the originator's crypto-asset account number, where the transfer is not registered on a DLT network but is made to or from a crypto-asset account; or (iii) the unique transaction identifier, where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account.

    Unhosted wallet verification

    Required for transactions exceeding EUR 1,000.

    VASP Due Diligence

    Required when establishing a correspondent relationship with a CASP registered outside the EU.


    With respect to cross-border correspondent relationships involving the execution of crypto-asset services – including transfers of crypto-assets – with a respondent entity not established in the EU and providing similar services, CASPs are required, pursuant to Article 19b of Directive (EU) 2015/849 (as introduced by Article 38(2) of Regulation (EU) 2023/1113), when entering into a business relationship with such an entity, to:

    • determine if the respondent entity is licensed or registered;
    • gather sufficient information about the respondent entity to understand fully the nature of the respondent’s business and to determine from publicly available information the reputation of the entity and the quality of supervision;
    • assess the respondent entity’s AML/CFT controls;
    • obtain approval from senior management before establishing new correspondent relationships;
    • document the respective responsibilities of each party to the correspondent relationship;
    • with respect to payable-through crypto-asset accounts, be satisfied that the respondent entity has verified the identity of, and performed ongoing due diligence on, the customers having direct access to accounts of the correspondent entity, and that it is able to provide relevant customer due diligence data to the correspondent entity, upon request.

    When conducting the assessment and determining appropriate risk-mitigating measures, CASPs shall also take into account the criteria and elements set out in Guideline 8 of the ML/TF Risk Factors Guidelines (EBA/GL/2021/02, as amended by EBA/GL/2024/01). These requirements will be further supplemented by Article 37 of Regulation (EU) 2024/1624 (AMLR) as of 10 July 2027.

    Time and way to share the Information

    The required information shall be transmitted immediately and in a secure manner, and no later than the initiation of the blockchain transaction.

    Record retention

    5 years.

    Obligations of the originating CASP

    The originating CASP must:

    • obtain information about the originator and beneficiary from a client who initiated a crypto-asset transfer;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
    • conduct CASP Due Diligence (if applicable);
    • verify a self-hosted wallet to which the crypto-assets should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information on the originator and the beneficiary to the next CASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the beneficiary CASP

    The beneficiary CASP must:

    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet (if necessary);
    • conduct CASP Due Diligence (if applicable);
    • verify a self-hosted wallet from which the crypto-assets were received (if applicable);
    • receive information about the originator and beneficiary from the originating or intermediary CASP (or obtain it directly from its customer if assets are received from a self-hosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the intermediary CASP

    The intermediary CASP must:

    • receive information about the originator and beneficiary from the previous CASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
    • conduct CASP Due Diligence (if applicable);
    • verify a self-hosted wallet from which the crypto-assets were received or to which they should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information on the originator and the beneficiary to the next CASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
    • keep records related to the transfer for as long as required by national legislation.

    Subject

    Details

    Status

    In force from August 31, 2023.

    Regulation

    Regulatory body

    Threshold

    No threshold. The Travel Rule applies to all virtual asset transfers irrespective of value.

    Data to be shared

    Originator:

    • a) Full name;
    • b) Account number (or a unique reference number that permits the transaction to be traced if there is no account);
    • c) Address, national identity number, customer identification number, or date and place of birth.

    Beneficiary:

    • d) Full name;
    • e) Account number (or a unique reference number that permits the transaction to be traced if there is no account).

    Subject

    Details

    Threshold-based data

    —

    Domestic vs cross-border transfers

    No difference.

    Batch file transfer

    Where several individual transfers from a single originator are bundled in a batch file for transmission to beneficiaries, they are exempt from the originator information requirements provided that:

    • a) they include the originator's account number (or unique reference number); and
    • b) the batch file contains full and accurate originator information, and full beneficiary information, that is fully traceable within the beneficiary country.

    Unhosted wallet verification

    No requirement. May be applied based on risk assessment.

    VASP Due Diligence

    No requirement.

    Time and way to share the Information

    The required information shall be transmitted immediately and securely.

    Record retention

    6 years.

    Obligations of the originating VASP

    The originating VASP must:

    • obtain information about the originator and beneficiary from a client who initiated a virtual asset transfer;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the beneficiary VASP

    The beneficiary VASP must:

    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet (if necessary);
    • receive information about the originator and beneficiary from the originating or intermediary VASP (or obtain it directly from its customer if assets are received from an unhosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the intermediary VASP

    The intermediary VASP must:

    • receive information about the originator and beneficiary from the previous VASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
    • keep records related to the transfer for as long as required by national legislation.

    Subject

    Details

    Status

    In force from February 7, 2022.

    Regulation

    Regulatory body

    Threshold

    No threshold. The Travel Rule applies to all virtual asset transfers irrespective of value.

    Data to be shared

    Originator:

    • a) Full name;
    • b) Account number (or a unique transaction reference number);
    • c) One of the following information: physical address; or national identity card number or passport number; or customer identification number; or place of birth.

    Beneficiary:

    • d) Full name;
    • e) Account number (or a unique transaction reference number).

    Subject

    Details

    Threshold-based data

    —

    Domestic vs cross-border transfers

    No difference.

    Batch file transfer

    No special provisions.

    Unhosted wallet verification

    No requirement. May be applied based on risk assessment.

    VASP Due Diligence

    Required.

    Time and way to share the Information

    The required information shall be transmitted immediately and in a secure manner.

    Record retention

    7 years.

    Obligations of the originating VASP

    The originating VASP must:

    • obtain information about the originator and beneficiary from a client who initiated a virtual asset transfer;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
    • conduct VASP Due Diligence (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the beneficiary VASP

    The beneficiary VASP must:

    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet (if necessary);
    • conduct VASP Due Diligence (if applicable);
    • receive information about the originator and beneficiary from the originating or intermediary VASP (or obtain it directly from its customer if assets are received from an unhosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the intermediary VASP

    The intermediary VASP must:

    • receive information about the originator and beneficiary from the previous VASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
    • conduct VASP Due Diligence (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
    • keep records related to the transfer for as long as required by national legislation.

    Subject

    Details

    Status

    In force from March 20, 2025.

    Regulation

    Regulatory body

    Threshold

    No threshold. The Travel Rule applies to all virtual asset transfers irrespective of value.

    Data to be shared

    Natural Person


    Originator:

    • full name;
    • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
    • address (including country name);
    • one of the following: (i) official personal document number (broj lične isprave); (ii) unique master citizen number (jedinstveni matični broj); or (iii) date and place of birth.

    Beneficiary:

    • full name;
    • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier.

    Legal Entity


    Originator:

    • registered name;
    • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
    • address (registered office address, including country name);
    • registration number (matični broj);
    • legal entity identifier (LEI), where available and provided, or, in its absence, another equivalent official identifier.

    Beneficiary:

    • registered name;
    • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
    • legal entity identifier (LEI), where available and provided, or, in its absence, another equivalent official identifier.

    Subject

    Details

    Threshold-based data

    —

    Domestic vs cross-border transfers

    No difference.

    Batch file transfer

    In the case of a batch file transfer of crypto-assets from a single originator, the obligation on the originating CASP to ensure that transfers of crypto-assets are accompanied by the required information shall not apply to the individual transfers bundled together therein, provided that: the batch file contains the required information on the originator and the beneficiary; that such information has been duly verified; and that each individual transfer carries (i) the originator's distributed ledger address and the originator's crypto-asset account number, if such an account exists and is used to process the transaction, where the transfer is registered on a DLT network; (ii) the originator's crypto-asset account number, where the transfer is not registered on a DLT network but is made to or from a crypto-asset account; or (iii) the unique transaction identifier, where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account.

    Unhosted wallet verification

    Required for transactions exceeding EUR 1,000.

    VASP Due Diligence

    Required when establishing a correspondent relationship with a CASP registered outside Montenegro.


    With respect to cross-border correspondent relationships involving the execution of crypto-asset services – including transfers of crypto-assets – with a respondent entity not established in Montenegro and providing similar services, CASPs are required, when entering into a business relationship with such an entity, to:

    • determine if the respondent entity is licensed or registered;
    • gather sufficient information about the respondent entity to understand fully the nature of the respondent’s business and to determine from publicly available information the reputation of the entity and the quality of supervision;
    • assess the respondent entity’s AML/CFT controls;
    • obtain approval from senior management before establishing new correspondent relationships;
    • document the respective responsibilities of each party to the correspondent relationship;
    • with respect to payable-through crypto-asset accounts, be satisfied that the respondent entity has verified the identity of, and performed ongoing due diligence on, the customers having direct access to accounts of the correspondent entity, and that it is able to provide relevant customer due diligence data to the correspondent entity, upon request.

    Time and way to share the Information

    The required information shall be transmitted immediately and in a secure manner, and no later than the initiation of the blockchain transaction.

    Record retention

    Five years.

    Obligations of the originating CASP

    The originating CASP must:

    • obtain information about the originator and beneficiary from a client who initiated a crypto-asset transfer;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
    • conduct CASP Due Diligence (if applicable);
    • verify a self-hosted wallet to which the crypto-assets should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information on the originator and the beneficiary to the next CASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the beneficiary CASP

    The beneficiary CASP must:

    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet (if necessary);
    • conduct CASP Due Diligence (if applicable);
    • verify a self-hosted wallet from which the crypto-assets were received (if applicable);
    • receive information about the originator and beneficiary from the originating or intermediary CASP (or obtain it directly from its customer if assets are received from a self-hosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the intermediary CASP

    The intermediary CASP must:

    • receive information about the originator and beneficiary from the previous CASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
    • conduct CASP Due Diligence (if applicable);
    • verify a self-hosted wallet from which the crypto-assets were received or to which they should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information on the originator and the beneficiary to the next CASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
    • keep records related to the transfer for as long as required by national legislation.

    Subject

    Details

    Status

    In force from September 1, 2023.

    Sumsub offers a ready-made Travel Rule: Namibia rule bundle that can be installed from is the Rules Library. It allows you to place transactions onHold and tag them Missing Originator Information or Missing Beneficiary Information when required sender or recipient details are absent for transfers involving VASPs incorporated in Namibia.i>

    Regulation

    Regulatory body

    Threshold

    No threshold. The Travel Rule applies to all virtual asset transfers irrespective of value.

    Data to be shared

    Natural Person


    Originator:

    • full name;
    • virtual asset account number, where such a number is used to process the transaction, or, in its absence, a unique transaction reference number;
    • one of the following: (i) address; (ii) national identity card number or passport number; (iii) customer identification number; or (iv) place of birth.

    Beneficiary:

    • full name;
    • virtual asset account number, where such a number is used to process the transaction, or, in its absence, a unique transaction reference number.

    Legal Entity


    Originator:

    • registered name;
    • virtual asset account number, where such a number is used to process the transaction, or, in its absence, a unique transaction reference number;
    • one of the following: (i) address; (ii) legal entity identifier (or equivalent); or (iii) customer identification number.

    Beneficiary:

    • registered name;
    • virtual asset account number, where such a number is used to process the transaction, or, in its absence, a unique transaction reference number.

    Subject

    Details

    Threshold-based data

    —

    Domestic vs cross-border transfers

    No difference.

    Batch file transfer

    Where several individual cross-border wire transfers from a single originator are bundled in a batch file for transmission to beneficiaries, the batch file must contain the required and accurate originator and beneficiary information that is fully traceable within the beneficiary's country.


    For batch file transfers of virtual assets from a single originator, the individual transfers of virtual assets bundled must contain the following information:


    Natural Person


    Originator:

    • full name;
    • virtual asset account number, where such an account is used to process the transaction, or, in its absence, a unique transaction reference number that permits traceability of the transaction;
    • one of the following: (i) address; (ii) national identity card number or passport number; (iii) customer identification number; or (iv) date and place of birth.

    Beneficiary:

    • full name;
    • virtual asset account number, where such an account is used to process the transaction, or, in its absence, a unique transaction reference number that permits traceability of the transaction.

    Legal Entity


    Originator:

    • registered name;
    • virtual asset account number, where such an account is used to process the transaction, or, in its absence, a unique transaction reference number that permits traceability of the transaction;
    • one of the following: (i) address; (ii) legal entity identifier (or equivalent); or (iii) customer identification number.

    Beneficiary:

    • registered name;
    • virtual asset account number, where such an account is used to process the transaction, or, in its absence, a unique transaction reference number that permits traceability of the transaction.

    Any other information and documents as the regulatory authority may require.

    Unhosted wallet verification

    No requirement. May be applied based on risk assessment.

    VASP Due Diligence

    No requirement.

    Time and way to share the Information

    The required information shall be transmitted immediately and in a secure manner.

    Record retention

    5 years.

    Obligations of the originating VASP

    The originating VASP must:

    • obtain information about the originator and beneficiary from a client who initiated a virtual asset transfer;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
    • conduct VASP Due Diligence (if applicable);
    • verify an unhosted wallet to which the virtual assets should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information on the originator and the beneficiary to the next VASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the beneficiary VASP

    The beneficiary VASP must:

    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet (if necessary);
    • conduct VASP Due Diligence (if applicable);
    • verify an unhosted wallet from which the virtual assets were received (if applicable);
    • receive information about the originator and beneficiary from the originating or intermediary VASP (or obtain it directly from its customer if assets are received from an unhosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the intermediary VASP

    The intermediary VASP must:

    • receive information about the originator and beneficiary from the previous VASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
    • conduct VASP Due Diligence (if applicable);
    • verify an unhosted wallet from which the virtual assets were received or to which they should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information on the originator and the beneficiary to the next VASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
    • keep records related to the transfer for as long as required by national legislation.

    Subject

    Details

    Status

    In force from December 30, 2024.

    Regulation

    Regulatory body

    Threshold

    No threshold. The Travel Rule applies to all crypto-asset transfers irrespective of value.

    Data to be shared

    Natural Person


    Originator:

    • full name;
    • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
    • address (habitual residence, including country name);
    • one of the following: (i) official personal document number and customer identification number or (ii) date and place of birth.

    Beneficiary:

    • full name;
    • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier.

    Legal Entity


    Originator:

    • registered name;
    • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
    • address (registered office address);
    • registration number and customer identification number;
    • legal entity identifier (LEI), where available and provided, or, in its absence, another equivalent official identifier*.

    Beneficiary:

    • registered name;
    • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
    • legal entity identifier (LEI), where available and provided, or, in its absence, another equivalent official identifier*.

    * Note: The alternative identifier must: (i) be a unique identification code for the legal entity; (ii) be published in public registries; (iii) be automatically issued upon entity formation by a public authority; (iv) allow identification of name and address elements; (v) be accompanied by a description of the identifier type in the messaging system. Where the registration number satisfies the criteria for the alternative identifier, it may also be used for this purpose.

    Subject

    Details

    Threshold-based data

    —

    Domestic vs cross-border transfers

    No difference.

    Batch file transfer

    In the case of a batch file transfer of crypto-assets from a single originator, the obligation on the originating CASP to ensure that transfers of crypto-assets are accompanied by the required information shall not apply to the individual transfers bundled together therein, provided that: the batch file contains the required information on the originator and the beneficiary; that such information has been duly verified; and that each individual transfer carries (i) the originator's distributed ledger address and the originator's crypto-asset account number, if such an account exists and is used to process the transaction, where the transfer is registered on a DLT network; (ii) the originator's crypto-asset account number, where the transfer is not registered on a DLT network but is made to or from a crypto-asset account; or (iii) the unique transaction identifier, where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account.

    Unhosted wallet verification

    Required for transactions exceeding EUR 1,000.

    VASP Due Diligence

    Required when establishing a correspondent relationship with a CASP registered outside the EU.


    With respect to cross-border correspondent relationships involving the execution of crypto-asset services – including transfers of crypto-assets – with a respondent entity not established in the EU and providing similar services, CASPs are required, pursuant to Article 19b of Directive (EU) 2015/849 (as introduced by Article 38(2) of Regulation (EU) 2023/1113), when entering into a business relationship with such an entity, to:

    • determine if the respondent entity is licensed or registered;
    • gather sufficient information about the respondent entity to understand fully the nature of the respondent’s business and to determine from publicly available information the reputation of the entity and the quality of supervision;
    • assess the respondent entity’s AML/CFT controls;
    • obtain approval from senior management before establishing new correspondent relationships;
    • document the respective responsibilities of each party to the correspondent relationship;
    • with respect to payable-through crypto-asset accounts, be satisfied that the respondent entity has verified the identity of, and performed ongoing due diligence on, the customers having direct access to accounts of the correspondent entity, and that it is able to provide relevant customer due diligence data to the correspondent entity, upon request.

    When conducting the assessment and determining appropriate risk-mitigating measures, CASPs shall also take into account the criteria and elements set out in Guideline 8 of the ML/TF Risk Factors Guidelines (EBA/GL/2021/02, as amended by EBA/GL/2024/01). These requirements will be further supplemented by Article 37 of Regulation (EU) 2024/1624 (AMLR) as of 10 July 2027.

    Time and way to share the Information

    The required information shall be transmitted immediately and in a secure manner, and no later than the initiation of the blockchain transaction.

    Record retention

    5 years.

    Obligations of the originating CASP

    The originating CASP must:

    • obtain information about the originator and beneficiary from a client who initiated a crypto-asset transfer;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
    • conduct CASP Due Diligence (if applicable);
    • verify a self-hosted wallet to which the crypto-assets should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information on the originator and the beneficiary to the next CASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the beneficiary CASP

    The beneficiary CASP must:

    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet (if necessary);
    • conduct CASP Due Diligence (if applicable);
    • verify a self-hosted wallet from which the crypto-assets were received (if applicable);
    • receive information about the originator and beneficiary from the originating or intermediary CASP (or obtain it directly from its customer if assets are received from a self-hosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the intermediary CASP

    The intermediary CASP must:

    • receive information about the originator and beneficiary from the previous CASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
    • conduct CASP Due Diligence (if applicable);
    • verify a self-hosted wallet from which the crypto-assets were received or to which they should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information on the originator and the beneficiary to the next CASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
    • keep records related to the transfer for as long as required by national legislation.

    Subject

    Details

    Status

    In force from June 1, 2024.

    Regulation

    Regulatory body

    Threshold

    No threshold. The Travel Rule applies to all virtual asset transfers irrespective of value.

    Data to be shared

    Originator:

    • a) Full name;
    • b) Account number or other identifying information;

    One of the following:

    • c) Address;
    • d) National identity number;
    • e) Customer identification number;
    • f) Place and date of birth.

    Beneficiary:

    • g) Full name;
    • h) Account number (or a unique transaction reference number).

    Subject

    Details

    Threshold-based data

    —

    Domestic vs cross-border transfers

    There is a difference.


    Domestic. The following data needs to be transfered: b), but a), c), d), e), f), g) or other information should be provided within three working days after the request.


    Cross-border: a), b), c), d), e), f), g), h).

    Batch file transfer

    No special provisions.

    Unhosted wallet verification

    No requirement. May be applied based on risk assessment.

    VASP Due Diligence

    No requirement.

    Time and way to share the Information

    Any information about the originator obtained by a reporting entity that is an intermediary institution must be provided by that reporting entity to the beneficiary institution as soon as practicable.


    The information obtained by the reporting entity must accompany the wire transfer.

    Record retention

    5 years.

    Obligations of the originating VASP

    The originating VASP must:

    • obtain information about the originator and beneficiary from a client who initiated a virtual asset transfer;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the beneficiary VASP

    The beneficiary VASP must:

    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet (if necessary);
    • receive information about the originator and beneficiary from the originating or intermediary VASP (or obtain it directly from its customer if assets are received from an unhosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the intermediary VASP

    The intermediary VASP must:

    • receive information about the originator and beneficiary from the previous VASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
    • keep records related to the transfer for as long as required by national legislation.

    Subject

    Details

    Status

    In force from January 9, 2025.

    Regulation

    Regulatory body

    Threshold

    No threshold. The Travel Rule applies to all virtual asset transfers irrespective of value.

    Data to be shared

    Natural Person


    Originator:

    • a) Name;
    • b) Distributed ledger address, in cases where the virtual asset transfer is recorded on a network using distributed ledger technology (DLT) or similar technology, and the originator's virtual asset account number, where such account exists and is used to process the transaction. In cases where the transfer is not recorded on a DLT network or similar technology, the virtual asset account number should be provided;
    • c) Address, official identity document number or customer identification number, or date and place of birth.

    Beneficiary:

    • d) Name;
    • e) Distributed ledger address, in cases where the virtual asset transfer is recorded on a network using distributed ledger technology (DLT) or similar technology, and the originator's virtual asset account number, where such account exists and is used to process the transaction. In cases where the transfer is not recorded on a DLT network or similar technology, the virtual asset account number should be provided.

    Legal Entity


    Originator:

    • f) Registered name;
    • g) Distributed ledger address, in cases where the virtual asset transfer is recorded on a network using distributed ledger technology (DLT) or similar technology, and the originator's virtual asset account number, where such account exists and is used to process the transaction. In cases where the transfer is not recorded on a DLT network or similar technology, the virtual asset account number should be provided;
    • h) Address, official identification document number or customer identification number.

    Beneficiary:

    • i) Registered name;
    • j) Distributed ledger address, in cases where the virtual asset transfer is recorded on a network using distributed ledger technology (DLT) or similar technology, and the originator's virtual asset account number, where such account exists and is used to process the transaction. In cases where the transfer is not recorded on a DLT network or similar technology, the virtual asset account number should be provided.

    Subject

    Details

    Threshold-based data

    —

    Domestic vs cross-border transfers

    There is a difference.


    Domestic transfer

    • Natural Person: a), b), c), d), e).
    • Legal Entity: f), g), h), i), j).

    In the case of domestic virtual asset transfers, where the beneficiary VASP already holds the originator's and beneficiary's information, the originating VASP may include only the transaction identifier, provided it allows tracing of the virtual asset transfer to either the originator or the beneficiary. If the beneficiary VASP or competent authorities request the full information, the originating VASP shall provide it within three working days of the request.


    Cross-border

    • Natural Person: a), b), c), d), e).
    • Legal Entity: f), g), h), i), j).

    Batch file transfer

    Where multiple individual virtual asset transfers from a single originator are bundled into a single batch file for transmission to beneficiaries, the file must contain the required information, which must be fully traceable in the beneficiary’s jurisdiction and include the originator’s distributed ledger address, the virtual asset account number, or a unique identifier or transaction reference number.

    Unhosted wallet verification

    Required for transactions exceeding USD 1,000.

    VASP Due Diligence

    No requirement.

    Time and way to share the Information

    The required information shall be provided securely and either prior to or at the same time as the virtual asset transfer.

    Record retention

    5 years.

    Obligations of the originating VASP

    The originating VASP must:

    • obtain information about the originator and beneficiary from a client who initiated a virtual asset transfer;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
    • verify an unhosted wallet to which the assets should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the beneficiary VASP

    The beneficiary VASP must:

    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet (if necessary);
    • verify an unhosted wallet from which the assets were received (if applicable);
    • receive information about the originator and beneficiary from the originating or intermediary VASP (or obtain it directly from its customer if assets are received from an unhosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the intermediary VASP

    The intermediary VASP must:

    • receive information about the originator and beneficiary from the previous VASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
    • verify an unhosted wallet from which the assets were received or to which they should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
    • keep records related to the transfer for as long as required by national legislation.

    Subject

    Details

    Status

    In force from May 12, 2022.

    Regulation

    Regulatory body

    Threshold

    No threshold. The Travel Rule applies to all virtual asset transfers irrespective of value.

    Data to be shared

    Natural Person


    Originator:

    • full official name;
    • wallet address;
    • physical address or national identity number.

    Beneficiary:

    • full official name;
    • wallet address.

    Legal Entity


    Originator:

    • registered name;
    • wallet address;
    • incorporation number or business registration number.

    Beneficiary:

    • registered name;
    • wallet address.

    Subject

    Details

    Threshold-based data

    Different requirements apply depending on the equivalent value of the virtual asset transfer.


    If a virtual asset transfer has an equivalent value of less than USD 1,000, the following information shall be shared:


    Natural Person


    Originator:

    • full official name;
    • wallet address.

    Beneficiary:

    • full official name;
    • wallet address.

    Legal Entity


    Originator:

    • registered name;
    • wallet address.

    Beneficiary:

    • registered name;
    • wallet address.

    With respect to a virtual asset transfer that has an equivalent value of less than USD 1,000, the information pertaining to an originator must be verified if there is a suspicion of money laundering or terrorist financing.


    If a virtual asset transfer has an equivalent value of USD 1,000 or more, the following information shall be shared:


    Natural Person


    Originator:

    • full official name;
    • wallet address;
    • physical address or national identity number.

    Beneficiary:

    • full official name;
    • wallet address.

    Legal Entity


    Originator:

    • registered name;
    • wallet address;
    • incorporation number or business registration number.

    Beneficiary:

    • registered name;
    • wallet address.

    Domestic vs cross-border transfers

    No difference. All virtual asset transfers must be treated as cross-border transfers.

    Batch file transfer

    No special provisions.

    Unhosted wallet verification

    No requirement. May be applied based on risk assessment.

    VASP Due Diligence

    Required.

    Time and way to share the Information

    The required information shall be transmitted immediately and in a secure manner.

    Record retention

    5 years.

    Obligations of the originating VASP

    The originating VASP must:

    • obtain information about the originator and beneficiary from a client who initiated a virtual asset transfer;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
    • conduct VASP Due Diligence;
    • verify an uhosted wallet to which the virtual assets should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the beneficiary VASP

    The beneficiary VASP must:

    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet (if necessary);
    • conduct VASP Due Diligence;
    • verify an uhosted wallet from which the virtual assets were received (if applicable);
    • receive information about the originator and beneficiary from the originating or intermediary VASP (or obtain it directly from its customer if assets are received from an unhosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the intermediary VASP

    The intermediary VASP must:

    • receive information about the originator and beneficiary from the previous VASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
    • conduct VASP Due Diligence;
    • verify an uhosted wallet from which the virtual assets were received or to which they should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
    • keep records related to the transfer for as long as required by national legislation.

    Subject

    Details

    Status

    In force from July 1, 2025.

    Regulation

    Regulatory body

    Threshold

    No threshold. The Travel Rule applies to all crypto-asset transfers irrespective of value.

    Data to be shared

    Natural Person


    Originator:

    • full official name;
    • distributed ledger address and crypto-asset account number: If the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number if it exists and is used. If not registered on a DLT network, provide the crypto-asset account number;
    • address (habitual residence, including country name);
    • one of the following: (i) official personal document number and customer identification number or (ii) date and place of birth.

    Beneficiary:

    • full official name;
    • distributed ledger address and crypto-asset account number: If the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number if it exists and is used. If not registered on a DLT network, provide the crypto-asset account number.

    Legal Entity


    Originator:

    • registered name;
    • distributed ledger address and crypto-asset account number: If the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number if it exists and is used. If not registered on a DLT network, provide the crypto-asset account number;
    • address (registered office address);
    • registration number (or equivalent identifier)* and customer identification number;
    • legal entity identifier (LEI) or equivalent identifier*.

    Beneficiary:

    • registered name;
    • distributed ledger address and crypto-asset account number: If the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number if it exists and is used. If not registered on a DLT network, provide the crypto-asset account number;
    • legal entity identifier (LEI) or equivalent identifier*.

    * The alternative identifier must: (i) be a unique identification code for the legal entity; (ii) be published in public registries; (iii) be automatically issued upon entity formation by a public authority; (iv) allow identification of name and address elements; (v) be accompanied by a description of the identifier type in the messaging system. Where the registration number satisfies the criteria for the alternative identifier, it may also be used for this purpose.

    Subject

    Details

    Threshold-based data

    —

    Domestic vs cross-border transfers

    No difference.

    Batch file transfer

    In the case of a batch file transfer of crypto-assets from a single originator, the obligation on the originating CASP to ensure that transfers of crypto-assets are accompanied by the required information shall not apply to the individual transfers bundled together therein, provided that the batch file contains the required information on the originator and the beneficiary, or a unique transaction identifier where applicable; that such information has been duly verified; and that the individual transfers carry the originator's distributed ledger address, the originator's crypto-asset account number, or the unique transaction identifier, as applicable.

    Unhosted wallet verification

    Required for transactions exceeding EUR 1,000.

    VASP Due Diligence

    Required when establishing a correspondent relationship with a CASP registered outside the EU.


    With respect to cross-border correspondent relationships involving the execution of crypto-asset services – including transfers of crypto-assets – with a respondent entity not established in the EU and providing similar services, CASPs are required, pursuant to Article 19b of Directive (EU) 2015/849 (as introduced by Article 38(2) of Regulation (EU) 2023/1113), when entering into a business relationship with such an entity, to:

    • determine if the respondent entity is licensed or registered;
    • gather sufficient information about the respondent entity to understand fully the nature of the respondent’s business and to determine from publicly available information the reputation of the entity and the quality of supervision;
    • assess the respondent entity’s AML/CFT controls;
    • obtain approval from senior management before establishing new correspondent relationships;
    • document the respective responsibilities of each party to the correspondent relationship;
    • with respect to payable-through crypto-asset accounts, be satisfied that the respondent entity has verified the identity of, and performed ongoing due diligence on, the customers having direct access to accounts of the correspondent entity, and that it is able to provide relevant customer due diligence data to the correspondent entity, upon request.

    When conducting the assessment and determining appropriate risk-mitigating measures, CASPs shall also take into account the criteria and elements set out in Guideline 8 of the ML/TF Risk Factors Guidelines (EBA/GL/2021/02, as amended by EBA/GL/2024/01). These requirements will be further supplemented by Article 37 of Regulation (EU) 2024/1624 (AMLR) as of 10 July 2027.

    Time and way to share the Information

    The required information shall be transmitted immediately and in a secure manner, and no later than the initiation of the blockchain transaction.

    Record retention

    5 years.

    Obligations of the originating CASP

    The originating CASP must:

    • obtain information about the originator and beneficiary from a client who initiated a crypto-asset transfer;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
    • conduct CASP Due Diligence (if applicable);
    • verify a self-hosted wallet to which the crypto-assets should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information on the originator and the beneficiary to the next CASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the beneficiary CASP

    The beneficiary CASP must:

    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet (if necessary);
    • conduct CASP Due Diligence (if applicable);
    • verify a self-hosted wallet from which the crypto-assets were received (if applicable);
    • receive information about the originator and beneficiary from the originating or intermediary CASP (or obtain it directly from its customer if assets are received from a self-hosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the intermediary CASP

    The intermediary CASP must:

    • receive information about the originator and beneficiary from the previous CASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
    • conduct CASP Due Diligence (if applicable);
    • verify a self-hosted wallet from which the crypto-assets were received or to which they should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information on the originator and the beneficiary to the next CASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
    • keep records related to the transfer for as long as required by national legislation.

    Subject

    Details

    Status

    In force from June 6, 2023.

    Regulation

    Regulatory body

    Threshold

    No threshold. The Travel Rule applies to all virtual asset transfers irrespective of value.

    Data to be shared

    Natural Person


    Originator:

    • full name;
    • wallet address, where used to process the transfer, or unique transaction reference number;
    • one of the following: (i) physical address; (ii) national identification number or customer identification number; or (iii) date and place of birth.

    Beneficiary:

    • full name;
    • wallet address, where used to process the transfer, or unique transaction reference number.

    Legal Entity


    Originator:

    • registered name;
    • wallet address, where used to process the transfer, or unique transaction reference number;
    • one of the following: (i) address; or (ii) legal entity identifier (or equivalent identifier) or customer identification number.

    Beneficiary:

    • registered name;
    • wallet address, where used to process the transfer, or unique transaction reference number.

    Subject

    Details

    Threshold-based data

    —

    Domestic vs cross-border transfers

    No difference. All virtual asset transfers must be treated as cross-border transfers.

    Batch file transfer

    No special provisions.

    Unhosted wallet verification

    No requirement. May be applied based on risk assessment.

    VASP Due Diligence

    Financial institutions must take the following additional CDD measures and procedures when establishing correspondent relationships, as follows from Article 38 of the Law on Combating Money Laundering and Terrorism Financing enacted by Royal Decree No. 30/2016. However, there is no explicitly expressed position on whether these requirements apply by analogy to relationships between VASPs.

    Time and way to share the Information

    The required information shall be transmitted immediately and in a secure manner.

    Record retention

    10 years.

    Obligations of the originating VASP

    The originating VASP must:

    • obtain information about the originator and beneficiary from a client who initiated a virtual asset transfer;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
    • conduct VASP Due Diligence;
    • verify an unhosted wallet to which the virtual assets should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information on the originator and the beneficiary to the next VASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the beneficiary VASP

    The beneficiary VASP must:

    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet (if necessary);
    • conduct VASP Due Diligence;
    • verify an unhosted wallet from which the virtual assets were received (if applicable);
    • receive information about the originator and beneficiary from the originating or intermediary VASP (or obtain it directly from its customer if assets are received from an unhosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the intermediary VASP

    The intermediary VASP must:

    • receive information about the originator and beneficiary from the previous VASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
    • conduct VASP Due Diligence;
    • verify an unhosted wallet from which the virtual assets were received or to which they should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information on the originator and the beneficiary to the next VASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
    • keep records related to the transfer for as long as required by national legislation.

    Subject

    Details

    Status

    Not in force. Shall come into force on January 1, 2029.

    Regulation

    Regulatory body

    Threshold

    No threshold. The Travel Rule applies to all virtual asset transfers irrespective of value.

    Data to be shared

    Natural Person


    Originator:

    • full name;
    • account number, when it is used to process the transaction, or the virtual asset wallet address, as applicable, or if there is no account, the operation reference code that allows it to be traced;
    • identity document number;
    • address, date and place of birth, and/or transaction identification number.*

    Beneficiary:

    • full name;
    • account number, when it is used to process the transaction, or the virtual asset wallet address, as applicable, or if there is no account, the operation reference code that allows it to be traced.

    Legal Entity


    Originator:

    • registered name;
    • account number, when it is used to process the transaction, or the virtual asset wallet address, as applicable, or if there is no account, the operation reference code that allows it to be traced;
    • unique taxpayer registry number (RUC) or equivalent registration number;
    • address, and/or transaction identification number.*

    Beneficiary:

    • registered name;
    • account number, when it is used to process the transaction, or the virtual asset wallet address, as applicable, or if there is no account, the operation reference code that allows it to be traced.

    * Notes: ¹ Article 24.1(a)(iv) contains no explicit natural-person/legal-entity fork; the single 'y/o' leaves open whether 'dirección' is severable from 'fecha y lugar de nacimiento' (and thus available to legal entities) or the two form one indivisible natural-person-only block.

    Subject

    Details

    Threshold-based data

    There is a difference.


    If a virtual asset transfer has an equivalent value of less than USD 1,000, the following information shall be shared:


    Natural Person


    Originator:

    • full name;
    • the virtual asset wallet address or the self-custodied virtual asset wallet address, or if there is no account, the operation reference code that allows it to be traced;
    • identity document number.

    Beneficiary:

    • full name;
    • the virtual asset wallet address or the self-custodied virtual asset wallet address, or if there is no account, the operation reference code that allows it to be traced.

    Legal Entity


    Originator:

    • registered name;
    • the virtual asset wallet address or the self-custodied virtual asset wallet address, or if there is no account, the operation reference code that allows it to be traced;
    • unique taxpayer registry number (RUC) or equivalent registration number.

    Beneficiary:

    • registered name;
    • the virtual asset wallet address or the self-custodied virtual asset wallet address, or if there is no account, the operation reference code that allows it to be traced.

    If a virtual asset transfer has an equivalent value of USD 1,000 or more, the following information shall be shared:

    Natural Person


    Originator:

    • full name;
    • account number, when it is used to process the transaction, or the virtual asset wallet address, as applicable, or if there is no account, the operation reference code that allows it to be traced;
    • identity document number;
    • address, date and place of birth, and/or transaction identification number.*

    Beneficiary:

    • full name;
    • account number, when it is used to process the transaction, or the virtual asset wallet address, as applicable, or if there is no account, the operation reference code that allows it to be traced.

    Legal Entity


    Originator:

    • registered name;
    • account number, when it is used to process the transaction, or the virtual asset wallet address, as applicable, or if there is no account, the operation reference code that allows it to be traced;
    • unique taxpayer registry number (RUC) or equivalent registration number;
    • address, and/or transaction identification number.*

    Beneficiary:

    • registered name;
    • account number, when it is used to process the transaction, or the virtual asset wallet address, as applicable, or if there is no account, the operation reference code that allows it to be traced.

    * Note: Article 24.1(a)(iv) contains no explicit natural-person/legal-entity fork; the single 'y/o' leaves open whether 'dirección' is severable from 'fecha y lugar de nacimiento' (and thus available to legal entities) or the two form one indivisible natural-person-only block.

    Domestic vs cross-border transfers

    No difference.

    Batch file transfer

    No special provisions.

    Unhosted wallet verification

    No requirement. May be applied based on risk assessment.

    VASP Due Diligence

    Required.

    Time and way to share the Information

    The required information shall be transmitted immediately and in a secure manner.

    Record retention

    5 years.

    Obligations of the originating VASP

    The originating VASP must:

    • obtain information about the originator and beneficiary from a client who initiated a crypto-asset transfer;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
    • conduct VASP Due Diligence;
    • verify an unhosted wallet to which the virtual assets should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information on the originator and the beneficiary to the next VASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the beneficiary VASP

    The beneficiary VASP must:

    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet (if necessary);
    • conduct VASP Due Diligence;
    • verify an unhosted wallet from which the virtual assets were received (if applicable);
    • receive information about the originator and beneficiary from the originating or intermediary VASP (or obtain it directly from its customer if assets are received from an unhosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the intermediary VASP

    The intermediary VASP must:

    • receive information about the originator and beneficiary from the previous VASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
    • conduct VASP Due Diligence;
    • verify an unhosted wallet from which the virtual assets were received or to which they should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information on the originator and the beneficiary to the next VASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
    • keep records related to the transfer for as long as required by national legislation.

    Subject

    Details

    Status

    In force from February 10, 2021.

    Regulation

    Regulatory body

    Threshold

    No threshold. The Travel Rule applies to all virtual asset transfers irrespective of value.

    Data to be shared

    Natural Person


    Originator:

    • full name;
    • account number (virtual asset address);
    • one of the following: address, national identity number, customer identification number, or date and place of birth.

    Beneficiary:

    • full name;
    • account number (virtual asset address).

    Legal Entity


    Originator:

    • registered name;
    • account number (virtual asset address);
    • one of the following: address, legal entity identifier (or equivalent identifier), or customer identification number.

    Beneficiary:

    • registered name;
    • account number (virtual asset address).

    Subject

    Details

    Threshold-based data

    There is a difference.


    If a virtual asset transfer has an equivalent value not exceeding PHP 50,000, the following information shall be shared:


    Natural Person


    Originator:

    • full name;
    • account number (virtual asset address).

    Beneficiary:

    • full name;
    • account number (virtual asset address).

    Legal Entity


    Originator:

    • registered name;
    • account number (virtual asset address).

    Beneficiary:

    • registered name;
    • account number (virtual asset address).

    If a virtual asset transfer has an equivalent value exceeding PHP 50,000, the following information shall be shared:


    Natural Person


    Originator:

    • full name;
    • account number (virtual asset address);
    • one of the following: address, national identity number, customer identification number, or date and place of birth.

    Beneficiary:

    • full name;
    • account number (virtual asset address).

    Legal Entity


    Originator:

    • registered name;
    • account number (virtual asset address);
    • one of the following: address, legal entity identifier (or equivalent identifier), or customer identification number.

    Beneficiary:

    • registered name;
    • account number (virtual asset address).

    Domestic vs cross-border transfers

    No difference. All virtual asset transfers must be treated as cross-border transfers.

    Batch file transfer

    No special provisions.

    Unhosted wallet verification

    Required.

    VASP Due Diligence

    Required.

    Time and way to share the Information

    The required information shall be transmitted immediately and in a secure manner.

    Record retention

    5 years.

    Obligations of the originating VASP

    The originating VASP must:

    • obtain information about the originator and beneficiary from a client who initiated a virtual asset transfer;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
    • conduct VASP Due Diligence;
    • verify an unhosted wallet to which the virtual assets should be sent;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the beneficiary VASP

    The beneficiary VASP must:

    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet (if necessary);
    • conduct VASP Due Diligence;
    • verify an unhosted wallet from which the virtual assets were received;
    • receive information about the originator and beneficiary from the originating or intermediary VASP (or obtain it directly from its customer if assets are received from an unhosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the intermediary VASP

    The intermediary VASP must:

    • receive information about the originator and beneficiary from the previous VASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
    • conduct VASP Due Diligence;
    • verify an unhosted wallet from which the virtual assets were received or to which they should be sent;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
    • keep records related to the transfer for as long as required by national legislation.

    Subject

    Details

    Status

    In force from December 30, 2024.

    Regulation

    Regulatory body

    Threshold

    No threshold. The Travel Rule applies to all crypto-asset transfers irrespective of value.

    Data to be shared

    Natural Person


    Originator:

    • full name;
    • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
    • address (habitual residence, including country name);
    • one of the following: (i) official personal document number and customer identification number or (ii) date and place of birth.

    Beneficiary:

    • full name;
    • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier.

    Legal Entity


    Originator:

    • registered name;
    • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
    • address (registered office address);
    • registration number and customer identification number;
    • legal entity identifier (LEI), where available and provided, or, in its absence, another equivalent official identifier*.

    Beneficiary:

    • registered name;
    • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
    • legal entity identifier (LEI), where available and provided, or, in its absence, another equivalent official identifier*.

    * Note: The alternative identifier must: (i) be a unique identification code for the legal entity; (ii) be published in public registries; (iii) be automatically issued upon entity formation by a public authority; (iv) allow identification of name and address elements; (v) be accompanied by a description of the identifier type in the messaging system. Where the registration number satisfies the criteria for the alternative identifier, it may also be used for this purpose.

    Subject

    Details

    Threshold-based data

    —

    Domestic vs cross-border transfers

    No difference.

    Batch file transfer

    In the case of a batch file transfer of crypto-assets from a single originator, the obligation on the originating CASP to ensure that transfers of crypto-assets are accompanied by the required information shall not apply to the individual transfers bundled together therein, provided that: the batch file contains the required information on the originator and the beneficiary; that such information has been duly verified; and that each individual transfer carries (i) the originator's distributed ledger address and the originator's crypto-asset account number, if such an account exists and is used to process the transaction, where the transfer is registered on a DLT network; (ii) the originator's crypto-asset account number, where the transfer is not registered on a DLT network but is made to or from a crypto-asset account; or (iii) the unique transaction identifier, where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account.

    Unhosted wallet verification

    Required for transactions exceeding EUR 1,000.

    VASP Due Diligence

    Required when establishing a correspondent relationship with a CASP registered outside the EU.


    With respect to cross-border correspondent relationships involving the execution of crypto-asset services – including transfers of crypto-assets – with a respondent entity not established in the EU and providing similar services, CASPs are required, pursuant to Article 19b of Directive (EU) 2015/849 (as introduced by Article 38(2) of Regulation (EU) 2023/1113), when entering into a business relationship with such an entity, to:

    • determine if the respondent entity is licensed or registered;
    • gather sufficient information about the respondent entity to understand fully the nature of the respondent’s business and to determine from publicly available information the reputation of the entity and the quality of supervision;
    • assess the respondent entity’s AML/CFT controls;
    • obtain approval from senior management before establishing new correspondent relationships;
    • document the respective responsibilities of each party to the correspondent relationship;
    • with respect to payable-through crypto-asset accounts, be satisfied that the respondent entity has verified the identity of, and performed ongoing due diligence on, the customers having direct access to accounts of the correspondent entity, and that it is able to provide relevant customer due diligence data to the correspondent entity, upon request.

    When conducting the assessment and determining appropriate risk-mitigating measures, CASPs shall also take into account the criteria and elements set out in Guideline 8 of the ML/TF Risk Factors Guidelines (EBA/GL/2021/02, as amended by EBA/GL/2024/01). These requirements will be further supplemented by Article 37 of Regulation (EU) 2024/1624 (AMLR) as of 10 July 2027.

    Time and way to share the Information

    The required information shall be transmitted immediately and in a secure manner, and no later than the initiation of the blockchain transaction.

    Record retention

    5 years.

    Obligations of the originating CASP

    The originating CASP must:

    • obtain information about the originator and beneficiary from a client who initiated a crypto-asset transfer;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
    • conduct CASP Due Diligence (if applicable);
    • verify a self-hosted wallet to which the crypto-assets should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information on the originator and the beneficiary to the next CASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the beneficiary CASP

    The beneficiary CASP must:

    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet (if necessary);
    • conduct CASP Due Diligence (if applicable);
    • verify a self-hosted wallet from which the crypto-assets were received (if applicable);
    • receive information about the originator and beneficiary from the originating or intermediary CASP (or obtain it directly from its customer if assets are received from a self-hosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the intermediary CASP

    The intermediary CASP must:

    • receive information about the originator and beneficiary from the previous CASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
    • conduct CASP Due Diligence (if applicable);
    • verify a self-hosted wallet from which the crypto-assets were received or to which they should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information on the originator and the beneficiary to the next CASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
    • keep records related to the transfer for as long as required by national legislation.

    Subject

    Details

    Status

    In force from July 15, 2023.

    Regulation

    Regulatory body

    Threshold

    No threshold. The Travel Rule applies to all crypto-asset transfers irrespective of value.

    Data to be shared

    Natural Person


    Originator:

    • full name;
    • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
    • address (habitual residence, including country name);
    • one of the following: (i) official personal document number and customer identification number or (ii) date and place of birth.

    Beneficiary:

    • full name;
    • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier.

    Legal Entity


    Originator:

    • registered name;
    • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
    • address (registered office address);
    • registration number and customer identification number;
    • legal entity identifier (LEI), where available and provided, or, in its absence, another equivalent official identifier*.

    Beneficiary:

    • registered name;
    • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
    • legal entity identifier (LEI), where available and provided, or, in its absence, another equivalent official identifier*.

    * Note: The alternative identifier must: (i) be a unique identification code for the legal entity; (ii) be published in public registries; (iii) be automatically issued upon entity formation by a public authority; (iv) allow identification of name and address elements; (v) be accompanied by a description of the identifier type in the messaging system. Where the registration number satisfies the criteria for the alternative identifier, it may also be used for this purpose.

    Subject

    Details

    Threshold-based data

    —

    Domestic vs cross-border transfers

    No difference.

    Batch file transfer

    In the case of a batch file transfer of crypto-assets from a single originator, the obligation on the originating CASP to ensure that transfers of crypto-assets are accompanied by the required information shall not apply to the individual transfers bundled together therein, provided that: the batch file contains the required information on the originator and the beneficiary; that such information has been duly verified; and that each individual transfer carries (i) the originator's distributed ledger address and the originator's crypto-asset account number, if such an account exists and is used to process the transaction, where the transfer is registered on a DLT network; (ii) the originator's crypto-asset account number, where the transfer is not registered on a DLT network but is made to or from a crypto-asset account; or (iii) the unique transaction identifier, where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account.

    Unhosted wallet verification

    Required for transactions exceeding EUR 1,000.

    VASP Due Diligence

    Required when establishing a correspondent relationship with a CASP registered outside the EU.


    With respect to cross-border correspondent relationships involving the execution of crypto-asset services – including transfers of crypto-assets – with a respondent entity not established in the EU and providing similar services, CASPs are required, pursuant to Article 19b of Directive (EU) 2015/849 (as introduced by Article 38(2) of Regulation (EU) 2023/1113), when entering into a business relationship with such an entity, to:

    • determine if the respondent entity is licensed or registered;
    • gather sufficient information about the respondent entity to understand fully the nature of the respondent’s business and to determine from publicly available information the reputation of the entity and the quality of supervision;
    • assess the respondent entity’s AML/CFT controls;
    • obtain approval from senior management before establishing new correspondent relationships;
    • document the respective responsibilities of each party to the correspondent relationship;
    • with respect to payable-through crypto-asset accounts, be satisfied that the respondent entity has verified the identity of, and performed ongoing due diligence on, the customers having direct access to accounts of the correspondent entity, and that it is able to provide relevant customer due diligence data to the correspondent entity, upon request.

    When conducting the assessment and determining appropriate risk-mitigating measures, CASPs shall also take into account the criteria and elements set out in Guideline 8 of the ML/TF Risk Factors Guidelines (EBA/GL/2021/02, as amended by EBA/GL/2024/01). These requirements will be further supplemented by Article 37 of Regulation (EU) 2024/1624 (AMLR) as of 10 July 2027.

    Time and way to share the Information

    The required information shall be transmitted immediately and in a secure manner, and no later than the initiation of the blockchain transaction.

    Record retention

    7 years.

    Obligations of the originating CASP

    The originating CASP must:

    • obtain information about the originator and beneficiary from a client who initiated a crypto-asset transfer;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
    • conduct CASP Due Diligence (if applicable);
    • verify a self-hosted wallet to which the crypto-assets should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information on the originator and the beneficiary to the next CASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the beneficiary CASP

    The beneficiary CASP must:

    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet (if necessary);
    • conduct CASP Due Diligence (if applicable);
    • verify a self-hosted wallet from which the crypto-assets were received (if applicable);
    • receive information about the originator and beneficiary from the originating or intermediary CASP (or obtain it directly from its customer if assets are received from a self-hosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the intermediary CASP

    The intermediary CASP must:

    • receive information about the originator and beneficiary from the previous CASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
    • conduct CASP Due Diligence (if applicable);
    • verify a self-hosted wallet from which the crypto-assets were received or to which they should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information on the originator and the beneficiary to the next CASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
    • keep records related to the transfer for as long as required by national legislation.

    Subject

    Details

    Status

    In force from December 30, 2024.

    Regulation

    Regulatory body

    Threshold

    No threshold. The Travel Rule applies to all crypto-asset transfers irrespective of value.

    Data to be shared

    Natural Person


    Originator:

    • full name;
    • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
    • address (habitual residence, including country name);
    • one of the following: (i) official personal document number and customer identification number or (ii) date and place of birth.

    Beneficiary:

    • full name;
    • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier.

    Legal Entity


    Originator:

    • registered name;
    • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
    • address (registered office address);
    • registration number and customer identification number;
    • legal entity identifier (LEI), where available and provided, or, in its absence, another equivalent official identifier*.

    Beneficiary:

    • registered name;
    • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
    • legal entity identifier (LEI), where available and provided, or, in its absence, another equivalent official identifier*.

    * Note: The alternative identifier must: (i) be a unique identification code for the legal entity; (ii) be published in public registries; (iii) be automatically issued upon entity formation by a public authority; (iv) allow identification of name and address elements; (v) be accompanied by a description of the identifier type in the messaging system. Where the registration number satisfies the criteria for the alternative identifier, it may also be used for this purpose.

    Subject

    Details

    Threshold-based data

    —

    Domestic vs cross-border transfers

    No difference.

    Batch file transfer

    In the case of a batch file transfer of crypto-assets from a single originator, the obligation on the originating CASP to ensure that transfers of crypto-assets are accompanied by the required information shall not apply to the individual transfers bundled together therein, provided that: the batch file contains the required information on the originator and the beneficiary; that such information has been duly verified; and that each individual transfer carries (i) the originator's distributed ledger address and the originator's crypto-asset account number, if such an account exists and is used to process the transaction, where the transfer is registered on a DLT network; (ii) the originator's crypto-asset account number, where the transfer is not registered on a DLT network but is made to or from a crypto-asset account; or (iii) the unique transaction identifier, where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account.

    Unhosted wallet verification

    Required for transactions exceeding EUR 1,000.

    VASP Due Diligence

    Required when establishing a correspondent relationship with a CASP registered outside the EU.


    With respect to cross-border correspondent relationships involving the execution of crypto-asset services – including transfers of crypto-assets – with a respondent entity not established in the EU and providing similar services, CASPs are required, pursuant to Article 19b of Directive (EU) 2015/849 (as introduced by Article 38(2) of Regulation (EU) 2023/1113), when entering into a business relationship with such an entity, to:

    • determine if the respondent entity is licensed or registered;
    • gather sufficient information about the respondent entity to understand fully the nature of the respondent’s business and to determine from publicly available information the reputation of the entity and the quality of supervision;
    • assess the respondent entity’s AML/CFT controls;
    • obtain approval from senior management before establishing new correspondent relationships;
    • document the respective responsibilities of each party to the correspondent relationship;
    • with respect to payable-through crypto-asset accounts, be satisfied that the respondent entity has verified the identity of, and performed ongoing due diligence on, the customers having direct access to accounts of the correspondent entity, and that it is able to provide relevant customer due diligence data to the correspondent entity, upon request.

    When conducting the assessment and determining appropriate risk-mitigating measures, CASPs shall also take into account the criteria and elements set out in Guideline 8 of the ML/TF Risk Factors Guidelines (EBA/GL/2021/02, as amended by EBA/GL/2024/01). These requirements will be further supplemented by Article 37 of Regulation (EU) 2024/1624 (AMLR) as of 10 July 2027.

    Time and way to share the Information

    The required information shall be transmitted immediately and in a secure manner, and no later than the initiation of the blockchain transaction.

    Record retention

    5 years.

    Obligations of the originating CASP

    The originating CASP must:

    • obtain information about the originator and beneficiary from a client who initiated a crypto-asset transfer;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
    • conduct CASP Due Diligence (if applicable);
    • verify a self-hosted wallet to which the crypto-assets should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information on the originator and the beneficiary to the next CASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the beneficiary CASP

    The beneficiary CASP must:

    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet (if necessary);
    • conduct CASP Due Diligence (if applicable);
    • verify a self-hosted wallet from which the crypto-assets were received (if applicable);
    • receive information about the originator and beneficiary from the originating or intermediary CASP (or obtain it directly from its customer if assets are received from a self-hosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the intermediary CASP

    The intermediary CASP must:

    • receive information about the originator and beneficiary from the previous CASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
    • conduct CASP Due Diligence (if applicable);
    • verify a self-hosted wallet from which the crypto-assets were received or to which they should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information on the originator and the beneficiary to the next CASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
    • keep records related to the transfer for as long as required by national legislation.

    Subject

    Details

    Status

    In force from June 29, 2021.

    Regulation

    Regulatory body

    Threshold

    No threshold. The Travel Rule applies to all virtual asset transfers irrespective of value.

    Data to be shared

    Natural Person


    Originator:

    • full name;
    • digital asset address, or the unique identifier of the digital asset transaction;
    • residential or domicile address. If the data concerning the address was not obtained, one of the following identifiers shall be collected: i) national identification number (e.g., a unique master citizen number (JMBG)); or ii) personal identification document number, date and place of birth.

    Beneficiary:

    • full name;
    • digital asset address, or the unique identifier of the digital asset transaction;
    • residential or domicile address. If the data concerning the address was not obtained, one of the following identifiers shall be collected: i) national identification number (e.g., a unique master citizen number (JMBG)); or ii) personal identification document number, date and place of birth.

    Legal Entity


    Originator:

    • registered name;
    • digital asset address, or the unique identifier of the digital asset transaction;
    • identification number or, if such a number does not exist, another appropriate unique identification mark;
    • registered office address. If the data concerning the address was not obtained, one of the following data shall be collected: i) national identification number (e.g., a legal entity registration number); or ii) unique identification number.

    Beneficiary:

    • registered name;
    • digital asset address, or the unique identifier of the digital asset transaction;
    • registered office address. If the data concerning the address was not obtained, one of the following data shall be collected: i) national identification number (e.g., a legal entity registration number); or ii) unique identification number.

    Subject

    Details

    Threshold-based data

    —

    Domestic vs cross-border transfers

    No difference.

    Batch file transfer

    In the case of a batch file transfer of digital assets from a single originator, the obligation on the DASP of the originator to ensure that transfers of digital assets are accompanied by the required information shall not apply to the individual transfers bundled together therein, provided that the batch file contains the information on the originator and beneficiary, that that information has been verified, and that the individual transfers carry the distributed ledger address of the originator where this is applicable, the digital asset account number of the originator where this is applicable, or the unique transaction identifier where this is applicable.

    Unhosted wallet verification

    No requirement. May be applied based on risk assessment.

    VASP Due Diligence

    No requirement.

    Time and way to share the Information

    The data shall be provided to the other DASP simultaneously with the execution of the digital asset transaction and in a manner that ensures the integrity of such data and protection from unauthorised access to such data.

    Record retention

    10 years.

    Obligations of the originating DASP

    The originating DASP must:

    • obtain information about the originator and beneficiary from a client who initiated a virtual asset transfer;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which DASP controls the wallet;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information about the originator and beneficiary to the beneficiary or intermediary DASP; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the beneficiary DASP

    The beneficiary DASP must:

    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which DASP controls the wallet (if necessary);
    • receive information about the originator and beneficiary from the originating or intermediary DASP (or obtain it directly from its customer if assets are received from an unhosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating DASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the intermediary DASP

    The intermediary DASP must:

    • receive information about the originator and beneficiary from the previous DASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating DASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which DASP controls the wallet;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information about the originator and beneficiary to the beneficiary or intermediary DASP; and
    • keep records related to the transfer for as long as required by national legislation.

    Subject

    Details

    Status

    In force from September 1, 2024.

    Regulation

    Regulatory body

    Threshold

    No threshold. The Travel Rule applies to all virtual asset transfers irrespective of value.

    Data to be shared

    An originating VASP shall, when conducting a transfer of virtual assets to a next VASP in the transfer chain, collect and record the following information:


    Natural Person


    Originator:

    • full name;
    • wallet address (where a wallet is used to process the transfer) or unique transaction reference number (commonly known as a transaction hash) utilised for the tracing of the transfer (where a wallet is not used);
    • address (including the name of the country);
    • one of the following: (i) government issued identification information inclusive of the national identification number (if applicable), (ii) customer identification number or (iii) date and place of birth.

    Beneficiary:

    • full name;
    • wallet address (where a wallet is used to process the transfer) or unique transaction reference number (commonly known as a transaction hash) utilised for the tracing of the transfer (where a wallet is not used).

    Legal Entity


    Originator:

    • registered name;
    • wallet address (where a wallet is used to process the transfer) or unique transaction reference number (commonly known as a transaction hash) utilised for the tracing of the transfer (where a wallet is not used);
    • address (including the name of the country);
    • registration number or customer identification number.

    Beneficiary:

    • registered name;
    • wallet address (where a wallet is used to process the transfer) or unique transaction reference number (commonly known as a transaction hash) utilised for the tracing of the transfer (where a wallet is not used).

    A beneficiary VASP shall, on receipt of a transfer of virtual assets, collect and record the following information:


    Natural Person


    Originator:

    • full name;
    • wallet address (where a wallet is used to process the transfer) or unique transaction reference number (commonly known as a transaction hash) utilised for the tracing of the transfer (where a wallet is not used);
    • one of the following: (i) address (including the name of the country); (ii) government issued identification information inclusive of the national identification number (if applicable), (iii) customer identification number or (iv) date and place of birth.

    Beneficiary:

    • full name;
    • wallet address (where a wallet is used to process the transfer) or unique transaction reference number (commonly known as a transaction hash) utilised for the tracing of the transfer (where a wallet is not used).

    Legal Entity


    Originator:

    • registered name;
    • wallet address (where a wallet is used to process the transfer) or unique transaction reference number (commonly known as a transaction hash) utilised for the tracing of the transfer (where a wallet is not used);
    • one of the following: (i) address (including the name of the country); (ii) registration number; or (iii) customer identification number.

    Beneficiary:

    • registered name;
    • wallet address (where a wallet is used to process the transfer) or unique transaction reference number (commonly known as a transaction hash) utilised for the tracing of the transfer (where a wallet is not used).

    Subject

    Details

    Threshold-based data

    —

    Domestic vs cross-border transfers

    No difference.

    Batch file transfer

    In the case of a batch file transfer of virtual assets from a single originator, the obligation on the originating VASP to ensure that transfers of virtual assets are accompanied by the required information shall not apply to the individual transfers so bundled, provided that: the batch file contains the required information about the originator; such information has been duly verified; and each individual transfer carries (i) wallet address(es) (where a wallet is used) or (ii) the unique transaction reference number (commonly known as a transaction hash) utilised for the tracing of the transfer (where a wallet is not used to process virtual asset transfers).

    Unhosted wallet verification

    No requirement. May be applied based on risk assessment.

    VASP Due Diligence

    No requirement. May be applied based on risk assessment.

    Time and way to share the Information

    An originating virtual asset provider shall provide the information under Section "Data to be shared", without delay to the beneficiary virtual asset service provider, together with transmission of the set of payment instructions to the beneficiary virtual asset service provider or to the beneficiary's financial institution.


    An originating virtual asset service provider may provide the information under Section "Data to be shared" to the beneficiary virtual asset service provider or reporting entity directly by attaching the information to the virtual asset transfer or providing the information directly.

    Record retention

    7 years.

    Obligations of the originating VASP

    The originating VASP must:

    • obtain information about the originator and beneficiary from a client who initiated a virtual asset transfer;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
    • conduct VASP Due Diligence (if applicable);
    • verify an unhosted wallet to which the virtual assets should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information on the originator and the beneficiary to the next VASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the beneficiary VASP

    The beneficiary VASP must:

    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet (if necessary);
    • conduct VASP Due Diligence (if applicable);
    • verify an unhosted wallet from which the virtual assets were received (if applicable);
    • receive information about the originator and beneficiary from the originating or intermediary VASP (or obtain it directly from its customer if assets are received from an unhosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the intermediary VASP

    The intermediary VASP must:

    • receive information about the originator and beneficiary from the previous VASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
    • conduct VASP Due Diligence (if applicable);
    • verify an unhosted wallet from which the virtual assets were received or to which they should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information on the originator and the beneficiary to the next VASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
    • keep records related to the transfer for as long as required by national legislation.

    Subject

    Details

    Status

    Shall come into force on a date to be determined.

    Regulation

    Regulatory body

    —

    Threshold

    —

    Data to be shared

    —

    Subject

    Details

    Threshold-based data

    —

    Domestic vs cross-border transfers

    —

    Batch file transfer

    —

    Unhosted wallet verification

    —

    VASP Due Diligence

    —

    Time and way to share the Information

    —

    Record retention

    —

    —

    Subject

    Details

    Status

    In force from January 28, 2020.

    Regulation

    Regulatory body

    Threshold

    No threshold. The Travel Rule applies to all virtual asset transfers irrespective of value.

    Data to be shared

    Natural Person


    Originator:

    • a) Full name;
    • b) Account number (or unique transaction reference number where no account number exists);
    • c) One of the following: (i) residential address; (ii) unique identification number (such as an identity card number, birth certificate number or passport number); or (iii) the date and place of birth.

    Beneficiary:

    • d) Full name;
    • e) Account number (or unique transaction reference number where no account number exists).

    Legal Entity


    Originator:

    • f) Registered name;
    • g) Account number (or unique transaction reference number where no account number exists);
    • h) One of the following: (i) registered or business address, and if different, principal place of business, as may be appropriate; (ii) unique identification number (such as an incorporation number or business registration number); or (iii) the date and place of incorporation or registration (as may be appropriate).

    Beneficiary:

    • i) Registered name;
    • j) Account number (or unique transaction reference number where no account number exists).

    Subject

    Details

    Threshold-based data

    SGD 1,500


    Natural Person

    • ≤ SGD 1,500: a), b), d), e);
    • > SGD 1,500: a), b) c), d), e).

    Legal Entity

    • ≤ SGD 1,500: f), g), i), j);
    • > SGD 1,500: f), g) h), i), j).

    Please also see the Domestic vs cross-border transfers section.

    Domestic vs cross-border transfers

    There is a difference.


    Ordering VASP may, in the message or payment instruction that accompanies or relates to the value transfer to an intermediary VASP in Singapore, include only the unique transaction reference number and the beneficiary's name and account number (or unique transaction reference number where no account number exists), provided that:

    • a) the unique transaction reference number will permit the transaction to be traced back to the originator and beneficiary;
    • b) the ordering VASP shall provide the required originator information and beneficiary information within three business days of a request for such information by the intermediary VASP in Singapore, the Monetary Authority of Singapore or other relevant authorities in Singapore;
    • c) the ordering VASP shall provide the required originator information and beneficiary information immediately upon request for such information by law enforcement authorities in Singapore; and
    • d) the ordering VASP shall provide the required originator information and beneficiary information to the beneficiary VASP.

    Batch file transfer

    Where multiple individual transfers from a single originator are combined in a batch file for transmission to beneficiaries, a VASP shall ensure that the batch transfer file contains:

    • a) the required originator information, which has been verified; and
    • b) the required beneficiary information, which is fully traceable within the beneficiary country or jurisdiction.

    Unhosted wallet verification

    Required.


    Where the transfer of digital payment token has been received from or sent to the VASP’s own customer’s personal wallet address, the customer should demonstrate control over the said wallet address, by effecting a transfer of digital payment token of an amount specified by the VASP.

    VASP Due Diligence

    No requirement.

    Time and way to share the Information

    The required information shall be transmitted immediately and in a secure manner.

    Record retention

    5 years.

    Obligations of the originating VASP

    The originating VASP must:

    • obtain information about the originator and beneficiary from a client who initiated a virtual asset transfer;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
    • verify an unhosted wallet to which the assets should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the beneficiary VASP

    The beneficiary VASP must:

    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet (if necessary);
    • verify an unhosted wallet from which the assets were received (if applicable);
    • receive information about the originator and beneficiary from the originating or intermediary VASP (or obtain it directly from its customer if assets are received from an unhosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the intermediary VASP

    The intermediary VASP must:

    • receive information about the originator and beneficiary from the previous VASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
    • verify an unhosted wallet from which the assets were received or to which they should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
    • keep records related to the transfer for as long as required by national legislation.

    Subject

    Details

    Status

    In force from December 30, 2024.

    Regulation

    Regulatory body

    Threshold

    No threshold. The Travel Rule applies to all crypto-asset transfers irrespective of value.

    Data to be shared

    Natural Person


    Originator:

    • full name;
    • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
    • address (habitual residence, including country name);
    • one of the following: (i) official personal document number and customer identification number or (ii) date and place of birth.

    Beneficiary:

    • full name;
    • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier.

    Legal Entity


    Originator:

    • registered name;
    • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
    • address (registered office address);
    • registration number and customer identification number;
    • legal entity identifier (LEI), where available and provided, or, in its absence, another equivalent official identifier*.

    Beneficiary:

    • registered name;
    • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
    • legal entity identifier (LEI), where available and provided, or, in its absence, another equivalent official identifier*.

    * Note: The alternative identifier must: (i) be a unique identification code for the legal entity; (ii) be published in public registries; (iii) be automatically issued upon entity formation by a public authority; (iv) allow identification of name and address elements; (v) be accompanied by a description of the identifier type in the messaging system. Where the registration number satisfies the criteria for the alternative identifier, it may also be used for this purpose.

    Subject

    Details

    Threshold-based data

    —

    Domestic vs cross-border transfers

    No difference.

    Batch file transfer

    In the case of a batch file transfer of crypto-assets from a single originator, the obligation on the originating CASP to ensure that transfers of crypto-assets are accompanied by the required information shall not apply to the individual transfers bundled together therein, provided that: the batch file contains the required information on the originator and the beneficiary; that such information has been duly verified; and that each individual transfer carries (i) the originator's distributed ledger address and the originator's crypto-asset account number, if such an account exists and is used to process the transaction, where the transfer is registered on a DLT network; (ii) the originator's crypto-asset account number, where the transfer is not registered on a DLT network but is made to or from a crypto-asset account; or (iii) the unique transaction identifier, where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account.

    Unhosted wallet verification

    Required for transactions exceeding EUR 1,000.

    VASP Due Diligence

    Required when establishing a correspondent relationship with a CASP registered outside the EU.


    With respect to cross-border correspondent relationships involving the execution of crypto-asset services – including transfers of crypto-assets – with a respondent entity not established in the EU and providing similar services, CASPs are required, pursuant to Article 19b of Directive (EU) 2015/849 (as introduced by Article 38(2) of Regulation (EU) 2023/1113), when entering into a business relationship with such an entity, to:

    • determine if the respondent entity is licensed or registered;
    • gather sufficient information about the respondent entity to understand fully the nature of the respondent’s business and to determine from publicly available information the reputation of the entity and the quality of supervision;
    • assess the respondent entity’s AML/CFT controls;
    • obtain approval from senior management before establishing new correspondent relationships;
    • document the respective responsibilities of each party to the correspondent relationship;
    • with respect to payable-through crypto-asset accounts, be satisfied that the respondent entity has verified the identity of, and performed ongoing due diligence on, the customers having direct access to accounts of the correspondent entity, and that it is able to provide relevant customer due diligence data to the correspondent entity, upon request.

    When conducting the assessment and determining appropriate risk-mitigating measures, CASPs shall also take into account the criteria and elements set out in Guideline 8 of the ML/TF Risk Factors Guidelines (EBA/GL/2021/02, as amended by EBA/GL/2024/01). These requirements will be further supplemented by Article 37 of Regulation (EU) 2024/1624 (AMLR) as of 10 July 2027.

    Time and way to share the Information

    The required information shall be transmitted immediately and in a secure manner, and no later than the initiation of the blockchain transaction.

    Record retention

    5 years.

    Obligations of the originating CASP

    The originating CASP must:

    • obtain information about the originator and beneficiary from a client who initiated a crypto-asset transfer;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
    • conduct CASP Due Diligence (if applicable);
    • verify a self-hosted wallet to which the crypto-assets should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information on the originator and the beneficiary to the next CASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the beneficiary CASP

    The beneficiary CASP must:

    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet (if necessary);
    • conduct CASP Due Diligence (if applicable);
    • verify a self-hosted wallet from which the crypto-assets were received (if applicable);
    • receive information about the originator and beneficiary from the originating or intermediary CASP (or obtain it directly from its customer if assets are received from a self-hosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the intermediary CASP

    The intermediary CASP must:

    • receive information about the originator and beneficiary from the previous CASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
    • conduct CASP Due Diligence (if applicable);
    • verify a self-hosted wallet from which the crypto-assets were received or to which they should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information on the originator and the beneficiary to the next CASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
    • keep records related to the transfer for as long as required by national legislation.

    Subject

    Details

    Status

    In force from December 30, 2024.

    Regulation

    Regulatory body

    Threshold

    No threshold. The Travel Rule applies to all crypto-asset transfers irrespective of value.

    Data to be shared

    Natural Person


    Originator:

    • full name;
    • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
    • address (habitual residence, including country name);
    • one of the following: (i) official personal document number and customer identification number or (ii) date and place of birth.

    Beneficiary:

    • full name;
    • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier.

    Legal Entity


    Originator:

    • registered name;
    • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
    • address (registered office address);
    • registration number and customer identification number;
    • legal entity identifier (LEI), where available and provided, or, in its absence, another equivalent official identifier*.

    Beneficiary:

    • registered name;
    • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
    • legal entity identifier (LEI), where available and provided, or, in its absence, another equivalent official identifier*.

    * Note: The alternative identifier must: (i) be a unique identification code for the legal entity; (ii) be published in public registries; (iii) be automatically issued upon entity formation by a public authority; (iv) allow identification of name and address elements; (v) be accompanied by a description of the identifier type in the messaging system. Where the registration number satisfies the criteria for the alternative identifier, it may also be used for this purpose.

    Subject

    Details

    Threshold-based data

    —

    Domestic vs cross-border transfers

    No difference.

    Batch file transfer

    In the case of a batch file transfer of crypto-assets from a single originator, the obligation on the originating CASP to ensure that transfers of crypto-assets are accompanied by the required information shall not apply to the individual transfers bundled together therein, provided that: the batch file contains the required information on the originator and the beneficiary; that such information has been duly verified; and that each individual transfer carries (i) the originator's distributed ledger address and the originator's crypto-asset account number, if such an account exists and is used to process the transaction, where the transfer is registered on a DLT network; (ii) the originator's crypto-asset account number, where the transfer is not registered on a DLT network but is made to or from a crypto-asset account; or (iii) the unique transaction identifier, where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account.

    Unhosted wallet verification

    Required for transactions exceeding EUR 1,000.

    VASP Due Diligence

    Required when establishing a correspondent relationship with a CASP registered outside the EU.


    With respect to cross-border correspondent relationships involving the execution of crypto-asset services – including transfers of crypto-assets – with a respondent entity not established in the EU and providing similar services, CASPs are required, pursuant to Article 19b of Directive (EU) 2015/849 (as introduced by Article 38(2) of Regulation (EU) 2023/1113), when entering into a business relationship with such an entity, to:

    • determine if the respondent entity is licensed or registered;
    • gather sufficient information about the respondent entity to understand fully the nature of the respondent’s business and to determine from publicly available information the reputation of the entity and the quality of supervision;
    • assess the respondent entity’s AML/CFT controls;
    • obtain approval from senior management before establishing new correspondent relationships;
    • document the respective responsibilities of each party to the correspondent relationship;
    • with respect to payable-through crypto-asset accounts, be satisfied that the respondent entity has verified the identity of, and performed ongoing due diligence on, the customers having direct access to accounts of the correspondent entity, and that it is able to provide relevant customer due diligence data to the correspondent entity, upon request.

    When conducting the assessment and determining appropriate risk-mitigating measures, CASPs shall also take into account the criteria and elements set out in Guideline 8 of the ML/TF Risk Factors Guidelines (EBA/GL/2021/02, as amended by EBA/GL/2024/01). These requirements will be further supplemented by Article 37 of Regulation (EU) 2024/1624 (AMLR) as of 10 July 2027.

    Time and way to share the Information

    The required information shall be transmitted immediately and in a secure manner, and no later than the initiation of the blockchain transaction.

    Record retention

    5 years.

    Obligations of the originating CASP

    The originating CASP must:

    • obtain information about the originator and beneficiary from a client who initiated a crypto-asset transfer;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
    • conduct CASP Due Diligence (if applicable);
    • verify a self-hosted wallet to which the crypto-assets should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information on the originator and the beneficiary to the next CASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the beneficiary CASP

    The beneficiary CASP must:

    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet (if necessary);
    • conduct CASP Due Diligence (if applicable);
    • verify a self-hosted wallet from which the crypto-assets were received (if applicable);
    • receive information about the originator and beneficiary from the originating or intermediary CASP (or obtain it directly from its customer if assets are received from a self-hosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the intermediary CASP

    The intermediary CASP must:

    • receive information about the originator and beneficiary from the previous CASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
    • conduct CASP Due Diligence (if applicable);
    • verify a self-hosted wallet from which the crypto-assets were received or to which they should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information on the originator and the beneficiary to the next CASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
    • keep records related to the transfer for as long as required by national legislation.

    Subject

    Details

    Status

    In force from April 30, 2025.

    Regulation

    Regulatory body

    Threshold

    No threshold. The Travel Rule applies to all virtual asset transfers irrespective of value.

    Data to be shared

    Natural Persons


    Originator:

    • a) Full name;
    • b) Identity number, if the originator is a South African citizen or resident; or passport number or foreign national identity number, and date of birth, if the originator is not a South African citizen or resident;
    • c) Residential address, if such an address is readily available; or country of birth, if the residential address is not readily available;
    • d) Distributed ledger address associated with the transfer, if the transfer is registered on a network using distributed ledger or similar technology;
    • e) Crypto asset account number with the ordering CASP, if such an account is used to process the transaction, or a unique transaction reference number, if such an account number is not available.

    Beneficiary:

    • f) Full name;
    • g) Distributed ledger address associated with the transfer, in cases, if the transfer is registered on a network using distributed ledger or similar technology;
    • h) Crypto asset account number with the recipient CASP, if such an account is used to process the transaction and this information is readily available to the ordering crypto asset service provider.

    Legal Entities


    Originator:

    • i) Registered name;
    • j) Registration number under which it is incorporated; and
    • k) Registered address;
    • l) Distributed ledger address associated with the transfer, if the transfer is registered on a network using distributed ledger or similar technology;
    • m) Crypto asset account number with the ordering CASP, if such an account is used to process the transaction, or a unique transaction reference number, if such an account number is not available.

    Beneficiary:

    • n) Registered name;
    • o) Distributed ledger address associated with the transfer, in cases, if the transfer is registered on a network using distributed ledger or similar technology;
    • p) Crypto asset account number with the recipient CASP, if such an account is used to process the transaction and this information is readily available to the ordering crypto asset service provider.

    Subject

    Details

    Threshold-based data

    If < ZAR 5,000


    Natural Persons:

    • Originator: a), d), e);
    • Beneficiary: f), g), h).

    Legal Entities:

    • Originator: i), l), m);
    • Beneficiary: n), o), p).

    An ordering crypto asset service provider need not verify the above-mentioned information in respect of a transfer that is a single transaction valued at less than ZAR 5,000 for accuracy, unless there is a suspicion of money laundering or terrorist financing, in which case, the ordering crypto asset service provider must verify the information pertaining to the originator.

    In respect of an inward transfer that is a single transaction valued at less than ZAR 5,000 from an originator in a high-risk or other monitored jurisdiction, a recipient CASP must verify the accuracy of the beneficiary information.


    If ≥ ZAR 5,000


    Natural Persons:

    • Originator: a), b), c), d), e);
    • Beneficiary: f), g), h).

    Legal Entities:

    • Originator: i), j), k), l), m);
    • Beneficiary: n), o), p).

    Domestic vs cross-border transfers

    Sumsub has submitted a request to the Financial Intelligence Centre for clarification regarding the differences between rules applicable to domestic and cross-border crypto-asset transfers. This guidance will be updated upon receipt of the regulator's response.


    There is a difference.


    CASPs and ICASPs must take reasonable measures to identify cross-border crypto-asset transfers that lack the required information. Additionally, they must develop, document, maintain and implement effective risk-based policies and procedures for determining:

    • (i) when to execute, suspend execution of, or return a cross-border crypto-asset transfer that lacks any of the required information; and
    • (ii) the appropriate follow-up action that they will take in each instance where they execute, suspend execution of, or return a cross-border crypto-asset transfer.

    Batch file transfer

    Sumsub has submitted a request to the Financial Intelligence Centre seeking clarification as to which information shall be contained within the batch file and which shall be contained within each individual transfer. This guidance shall be updated upon receipt of the regulator's response.


    Ordering and intermediary CASPs may transmit the required information in batches; however, the Directive does not specify any particular requirements.

    Unhosted wallet verification

    No requirement. May be applied based on risk assessment.

    VASP Due Diligence

    Required.

    Time and way to share the Information

    The required information shall be transmitted simultaneously with the transfer itself and in a secure manner. Post facto transmission of the required information is not permitted.

    Record retention

    5 years.

    Obligations of the originating VASP

    The originating VASP must:

    • obtain information about the originator and beneficiary from a client who initiated a virtual asset transfer;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
    • conduct VASP Due Diligence;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the beneficiary VASP

    The beneficiary VASP must:

    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet (if necessary);
    • conduct VASP Due Diligence;
    • receive information about the originator and beneficiary from the originating or intermediary VASP (or obtain it directly from its customer if assets are received from an unhosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the intermediary VASP

    The intermediary VASP must:

    • receive information about the originator and beneficiary from the previous VASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
    • conduct VASP Due Diligence;
    • verify an unhosted wallet from which the assets were received or to which they should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
    • keep records related to the transfer for as long as required by national legislation.

    Subject

    Details

    Status

    In force from March 25, 2022.

    Regulation

    Regulatory body

    Threshold

    The Travel Rule applies only to virtual asset transfers with an equivalent value of KRW 1,000,000 or more.

    Data to be shared

    Natural Person


    Originator:

    • full name;
    • virtual asset address;
    • for Korean nationals: resident registration number;
    • for foreign nationals: passport number or alien registration number.

    Beneficiary:

    • full name;
    • virtual asset address.

    Legal Entity


    Originator:

    • registered name;
    • name of representative;
    • virtual asset address;
    • corporate registration number.

    Beneficiary:

    • registered name;
    • name of representative;
    • virtual asset address.

    Note: Resident registration number (Korean nationals), passport number or alien registration number (foreign nationals), or corporate registration number (legal entities) shall be provided within three business days of receipt of a request from the Commissioner of the Korea Financial Intelligence Unit or the beneficiary VASP.

    Subject

    Details

    Threshold-based data

    —

    Domestic vs cross-border transfers

    No difference.

    Batch file transfer

    No special provisions.

    Unhosted wallet verification

    No requirement. May be applied based on risk assessment.

    VASP Due Diligence

    No requirement.

    Time and way to share the Information

    Information from the Section "Data to be shared" shall be provided together when transferring virtual assets.


    In case of a request by the head of the Financial Intelligence Unit or the virtual asset business operator receiving the virtual asset, the resident registration number (in the case of a corporation, the corporate registration number) or passport number/alien registration number (only for foreigners) of the customer sending the virtual asset shall be provided within three business days from the date of request for information provision.

    Record retention

    5 years.

    Obligations of the originating VASP

    The originating VASP must:

    • obtain information about the originator and beneficiary from a client who initiated a virtual asset transfer;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
    • conduct VASP Due Diligence (if applicable);
    • verify an unhosted wallet to which the virtual assets should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the beneficiary VASP

    The beneficiary VASP must:

    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet (if necessary);
    • conduct VASP Due Diligence (if applicable);
    • verify an unhosted wallet from which the virtual assets were received (if applicable);
    • receive information about the originator and beneficiary from the originating or intermediary VASP (or obtain it directly from its customer if assets are received from an unhosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the intermediary VASP

    The intermediary VASP must:

    • receive information about the originator and beneficiary from the previous VASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
    • conduct VASP Due Diligence (if applicable);
    • verify an unhosted wallet from which the virtual assets were received or to which they should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
    • keep records related to the transfer for as long as required by national legislation.

    Subject

    Details

    Status

    In force from December 30, 2024.

    Regulation

    Regulatory body

    Threshold

    No threshold. The Travel Rule applies to all crypto-asset transfers irrespective of value.

    Data to be shared

    Natural Person


    Originator:

    • full name;
    • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
    • address (habitual residence, including country name);
    • one of the following: (i) official personal document number and customer identification number or (ii) date and place of birth.

    Beneficiary:

    • full name;
    • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier.

    Legal Entity


    Originator:

    • registered name;
    • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
    • address (registered office address);
    • registration number and customer identification number;
    • legal entity identifier (LEI), where available and provided, or, in its absence, another equivalent official identifier*.

    Beneficiary:

    • registered name;
    • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
    • legal entity identifier (LEI), where available and provided, or, in its absence, another equivalent official identifier*.

    * Note: The alternative identifier must: (i) be a unique identification code for the legal entity; (ii) be published in public registries; (iii) be automatically issued upon entity formation by a public authority; (iv) allow identification of name and address elements; (v) be accompanied by a description of the identifier type in the messaging system. Where the registration number satisfies the criteria for the alternative identifier, it may also be used for this purpose.

    Subject

    Details

    Threshold-based data

    —

    Domestic vs cross-border transfers

    No difference.

    Batch file transfer

    In the case of a batch file transfer of crypto-assets from a single originator, the obligation on the originating CASP to ensure that transfers of crypto-assets are accompanied by the required information shall not apply to the individual transfers bundled together therein, provided that: the batch file contains the required information on the originator and the beneficiary; that such information has been duly verified; and that each individual transfer carries (i) the originator's distributed ledger address and the originator's crypto-asset account number, if such an account exists and is used to process the transaction, where the transfer is registered on a DLT network; (ii) the originator's crypto-asset account number, where the transfer is not registered on a DLT network but is made to or from a crypto-asset account; or (iii) the unique transaction identifier, where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account.

    Unhosted wallet verification

    Required for transactions exceeding EUR 1,000.

    VASP Due Diligence

    Required when establishing a correspondent relationship with a CASP registered outside the EU.


    With respect to cross-border correspondent relationships involving the execution of crypto-asset services – including transfers of crypto-assets – with a respondent entity not established in the EU and providing similar services, CASPs are required, pursuant to Article 19b of Directive (EU) 2015/849 (as introduced by Article 38(2) of Regulation (EU) 2023/1113), when entering into a business relationship with such an entity, to:

    • determine if the respondent entity is licensed or registered;
    • gather sufficient information about the respondent entity to understand fully the nature of the respondent’s business and to determine from publicly available information the reputation of the entity and the quality of supervision;
    • assess the respondent entity’s AML/CFT controls;
    • obtain approval from senior management before establishing new correspondent relationships;
    • document the respective responsibilities of each party to the correspondent relationship;
    • with respect to payable-through crypto-asset accounts, be satisfied that the respondent entity has verified the identity of, and performed ongoing due diligence on, the customers having direct access to accounts of the correspondent entity, and that it is able to provide relevant customer due diligence data to the correspondent entity, upon request.

    When conducting the assessment and determining appropriate risk-mitigating measures, CASPs shall also take into account the criteria and elements set out in Guideline 8 of the ML/TF Risk Factors Guidelines (EBA/GL/2021/02, as amended by EBA/GL/2024/01). These requirements will be further supplemented by Article 37 of Regulation (EU) 2024/1624 (AMLR) as of 10 July 2027.

    Time and way to share the Information

    The required information shall be transmitted immediately and in a secure manner, and no later than the initiation of the blockchain transaction.

    Record retention

    5 years.

    Obligations of the originating CASP

    The originating CASP must:

    • obtain information about the originator and beneficiary from a client who initiated a crypto-asset transfer;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
    • conduct CASP Due Diligence (if applicable);
    • verify a self-hosted wallet to which the crypto-assets should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information on the originator and the beneficiary to the next CASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the beneficiary CASP

    The beneficiary CASP must:

    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet (if necessary);
    • conduct CASP Due Diligence (if applicable);
    • verify a self-hosted wallet from which the crypto-assets were received (if applicable);
    • receive information about the originator and beneficiary from the originating or intermediary CASP (or obtain it directly from its customer if assets are received from a self-hosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the intermediary CASP

    The intermediary CASP must:

    • receive information about the originator and beneficiary from the previous CASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
    • conduct CASP Due Diligence (if applicable);
    • verify a self-hosted wallet from which the crypto-assets were received or to which they should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information on the originator and the beneficiary to the next CASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
    • keep records related to the transfer for as long as required by national legislation.

    Subject

    Details

    Status

    In force from December 30, 2024.

    Regulation

    Regulatory body

    Threshold

    No threshold. The Travel Rule applies to all crypto-asset transfers irrespective of value.

    Data to be shared

    Natural Person


    Originator:

    • full name;
    • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
    • address (habitual residence, including country name);
    • one of the following: (i) official personal document number and customer identification number or (ii) date and place of birth.

    Beneficiary:

    • full name;
    • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier.

    Legal Entity


    Originator:

    • registered name;
    • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
    • address (registered office address);
    • registration number and customer identification number;
    • legal entity identifier (LEI), where available and provided, or, in its absence, another equivalent official identifier*.

    Beneficiary:

    • registered name;
    • distributed ledger address and/or crypto-asset account number: (i) where the transfer is registered on a DLT network, include the distributed ledger address and the crypto-asset account number, if one exists and is used; (ii) where the transfer is not registered on a DLT network, provide the crypto-asset account number; (iii) where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account, provide a unique transaction identifier;
    • legal entity identifier (LEI), where available and provided, or, in its absence, another equivalent official identifier*.

    * Note: The alternative identifier must: (i) be a unique identification code for the legal entity; (ii) be published in public registries; (iii) be automatically issued upon entity formation by a public authority; (iv) allow identification of name and address elements; (v) be accompanied by a description of the identifier type in the messaging system. Where the registration number satisfies the criteria for the alternative identifier, it may also be used for this purpose.

    Subject

    Details

    Threshold-based data

    —

    Domestic vs cross-border transfers

    No difference.

    Batch file transfer

    In the case of a batch file transfer of crypto-assets from a single originator, the obligation on the originating CASP to ensure that transfers of crypto-assets are accompanied by the required information shall not apply to the individual transfers bundled together therein, provided that: the batch file contains the required information on the originator and the beneficiary; that such information has been duly verified; and that each individual transfer carries (i) the originator's distributed ledger address and the originator's crypto-asset account number, if such an account exists and is used to process the transaction, where the transfer is registered on a DLT network; (ii) the originator's crypto-asset account number, where the transfer is not registered on a DLT network but is made to or from a crypto-asset account; or (iii) the unique transaction identifier, where the transfer is neither registered on a DLT network nor made to or from a crypto-asset account.

    Unhosted wallet verification

    Required for transactions exceeding EUR 1,000.

    VASP Due Diligence

    Required when establishing a correspondent relationship with a CASP registered outside the EU.


    With respect to cross-border correspondent relationships involving the execution of crypto-asset services – including transfers of crypto-assets – with a respondent entity not established in the EU and providing similar services, CASPs are required, pursuant to Article 19b of Directive (EU) 2015/849 (as introduced by Article 38(2) of Regulation (EU) 2023/1113), when entering into a business relationship with such an entity, to:

    • determine if the respondent entity is licensed or registered;
    • gather sufficient information about the respondent entity to understand fully the nature of the respondent’s business and to determine from publicly available information the reputation of the entity and the quality of supervision;
    • assess the respondent entity’s AML/CFT controls;
    • obtain approval from senior management before establishing new correspondent relationships;
    • document the respective responsibilities of each party to the correspondent relationship;
    • with respect to payable-through crypto-asset accounts, be satisfied that the respondent entity has verified the identity of, and performed ongoing due diligence on, the customers having direct access to accounts of the correspondent entity, and that it is able to provide relevant customer due diligence data to the correspondent entity, upon request.

    When conducting the assessment and determining appropriate risk-mitigating measures, CASPs shall also take into account the criteria and elements set out in Guideline 8 of the ML/TF Risk Factors Guidelines (EBA/GL/2021/02, as amended by EBA/GL/2024/01). These requirements will be further supplemented by Article 37 of Regulation (EU) 2024/1624 (AMLR) as of 10 July 2027.

    Time and way to share the Information

    The required information shall be transmitted immediately and in a secure manner, and no later than the initiation of the blockchain transaction.

    Record retention

    5 years.

    Obligations of the originating CASP

    The originating CASP must:

    • obtain information about the originator and beneficiary from a client who initiated a crypto-asset transfer;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
    • conduct CASP Due Diligence (if applicable);
    • verify a self-hosted wallet to which the crypto-assets should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information on the originator and the beneficiary to the next CASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the beneficiary CASP

    The beneficiary CASP must:

    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet (if necessary);
    • conduct CASP Due Diligence (if applicable);
    • verify a self-hosted wallet from which the crypto-assets were received (if applicable);
    • receive information about the originator and beneficiary from the originating or intermediary CASP (or obtain it directly from its customer if assets are received from a self-hosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the intermediary CASP

    The intermediary CASP must:

    • receive information about the originator and beneficiary from the previous CASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
    • conduct CASP Due Diligence (if applicable);
    • verify a self-hosted wallet from which the crypto-assets were received or to which they should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information on the originator and the beneficiary to the next CASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
    • keep records related to the transfer for as long as required by national legislation.

    Subject

    Details

    Status

    In force from January 1, 2020.

    Regulation

    Regulatory body

    Threshold

    No threshold. The Travel Rule applies to all crypto-asset transfers irrespective of value.

    Data to be shared

    Natural Person


    Originator:

    • full name;
    • account number (or, if unavailable, a transaction-linked reference number);
    • address (or, alternatively, date and place of birth, customer identification number or national identity number).

    Beneficiary:

    • full name;
    • account number (or, if unavailable, a transaction-linked reference number).

    Legal Entity


    Originator:

    • registered name;
    • account number (or, if unavailable, a transaction-linked reference number);
    • address (or, alternatively, customer identification number or legal entity identifier (or equivalent identifier)).

    Beneficiary:

    • registered name;
    • account number (or, if unavailable, a transaction-linked reference number).

    Subject

    Details

    Threshold-based data

    —

    Domestic vs cross-border transfers

    There is a difference.


    For domestic virtual asset transfers, an originating VASP may provide only an account number (or, if unavailable, a transaction-linked reference number), provided that the remaining originator details can be made available to the beneficiary VASP and the relevant Swiss authorities within three working days of a request.


    For domestic virtual asset transfers made in payment for goods and services, an originating VASP may likewise provide only an account number (or, if unavailable, a transaction-linked reference number), where it is not technically feasible to provide the remaining details, provided that such details can be made available to the beneficiary VASP and the relevant Swiss authorities within three working days of a request.


    The first option:


    Natural Person


    Originator:

    • full name*;
    • account number (or, if unavailable, a transaction-linked reference number);
    • address (or, alternatively, date and place of birth, customer identification number or national identity number)*.

    Beneficiary:

    • full name;
    • account number (or, if unavailable, a transaction-linked reference number).

    Legal Entity


    Originator:

    • registered name*;
    • account number (or, if unavailable, a transaction-linked reference number);
    • address (or, alternatively, customer identification number or legal entity identifier (or equivalent identifier))*.

    Beneficiary:

    • registered name;
    • account number (or, if unavailable, a transaction-linked reference number).

    * This information may not be transmitted by default; however, it must be made available to the beneficiary VASP and the relevant Swiss authorities within three working days of a request.

    The second option:


    Natural Person


    Originator:

    • full name;
    • account number (or, if unavailable, a transaction-linked reference number);
    • address (or, alternatively, date and place of birth, customer identification number or national identity number).

    Beneficiary:

    • full name;
    • account number (or, if unavailable, a transaction-linked reference number).

    Legal Entity


    Originator:

    • registered name;
    • account number (or, if unavailable, a transaction-linked reference number);
    • address (or, alternatively, customer identification number or legal entity identifier (or equivalent identifier)).

    Beneficiary:

    • registered name;
    • account number (or, if unavailable, a transaction-linked reference number).

    Batch file transfer

    No special provisions.

    Unhosted wallet verification

    Until a VASP is able to send and receive the required information, such transactions are permitted to and from external wallets only where those wallets belong to one of the VASP's own customers. The customer's ownership of the wallet must be proven by suitable technical means. A transfer to or from an external wallet belonging to a third party is permissible only if, as when establishing a client relationship, the VASP has first verified the identity of the third party, identified the beneficial owner, and proven the third party's ownership of the wallet by suitable technical means.

    VASP Due Diligence

    No requirement. May be applied based on risk assessment.

    Time and way to share the Information

    The required information must be transmitted with payment orders.

    Record retention

    10 years.

    Obligations of the originating VASP

    The originating VASP must:

    • obtain information about the originator and beneficiary from a client who initiated a virtual asset transfer;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
    • conduct VASP Due Diligence (if applicable);
    • verify an unhosted wallet to which the virtual assets should be sent;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information on the originator and the beneficiary to the next VASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the beneficiary VASP

    The beneficiary VASP must:

    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet (if necessary);
    • conduct VASP Due Diligence (if applicable);
    • verify an unhosted wallet from which the virtual assets were received;
    • receive information about the originator and beneficiary from the originating or intermediary VASP (or obtain it directly from its customer if assets are received from an unhosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the intermediary VASP

    The intermediary VASP must:

    • receive information about the originator and beneficiary from the previous VASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
    • conduct VASP Due Diligence (if applicable);
    • verify an unhosted wallet from which the virtual assets were received or to which they should be sent;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information on the originator and the beneficiary to the next VASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
    • keep records related to the transfer for as long as required by national legislation.

    Subject

    Details

    Status

    Not in force. Shall come into force on a date to be determined.

    Regulation

    Regulatory body

    Threshold

    No threshold. The Travel Rule applies to all virtual asset transfers irrespective of value.

    Data to be shared

    Originator:

    • a) Full name;
    • b) Information on the wallet used;
    • c) One of the following information: number of official identity document; or address; or date and place of birth.

    Beneficiary:

    • d) Full name;
    • e) Information on the wallet used.

    Subject

    Details

    Threshold-based data

    —

    Domestic vs cross-border transfers

    No difference.

    Batch file transfer

    No special provisions.

    Unhosted wallet verification

    No requirement. May be applied based on risk assessment.

    VASP Due Diligence

    Required.

    Time and way to share the Information

    The required information shall be transmitted immediately and in a secure manner.

    Record retention

    5 years.

    Obligations of the originating VASP

    The originating VASP must:

    • obtain information about the originator and beneficiary from a client who initiated a virtual asset transfer;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
    • conduct VASP Due Diligence (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the beneficiary VASP

    The beneficiary VASP must:

    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet (if necessary);
    • conduct VASP Due Diligence (if applicable);
    • receive information about the originator and beneficiary from the originating or intermediary VASP (or obtain it directly from its customer if assets are received from an unhosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the intermediary VASP

    The intermediary VASP must:

    • receive information about the originator and beneficiary from the previous VASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
    • conduct VASP Due Diligence (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
    • keep records related to the transfer for as long as required by national legislation.

    Subject

    Details

    Status

    Not in force. Shall come into force on July 1, 2026.

    Regulation

    Regulatory body

    Threshold

    None. The Travel Rule applies to all virtual asset transfers irrespective of value.

    Data to be shared

    Natural Person


    Originator:

    • full name;
    • account number (where such an account is used to process the transaction), or the digital asset wallet address (where the digital asset transfer takes place on a digital asset network), or a transaction reference number enabling subsequent verification of the transaction;
    • address, which must include, at a minimum, the country and the province or city;
    • date of birth (where the originator is a natural person);
    • personal identification number issued by a government authority.

    Beneficiary:

    • full name;
    • account number (where such an account is used to process the transaction), or the digital asset wallet address (where the digital asset transfer takes place on a digital asset network), or a transaction reference number enabling subsequent verification of the transaction;
    • address, which must include, at a minimum, the country and the province or city.

    Legal Entity


    Originator:

    • registered name;
    • account number (where such an account is used to process the transaction), or the digital asset wallet address (where the digital asset transfer takes place on a digital asset network), or a transaction reference number enabling subsequent verification of the transaction;
    • address, which must include, at a minimum, the country and the province or city;
    • legal entity identification number, or Legal Entity Identifier (LEI) (where such information is available).

    Beneficiary:

    • registered name;
    • account number (where such an account is used to process the transaction), or the digital asset wallet address (where the digital asset transfer takes place on a digital asset network), or a transaction reference number enabling subsequent verification of the transaction;
    • address, which must include, at a minimum, the country and the province or city.

    In addition, the following transaction-specific information shall be included in the message:

    • name of the digital asset;
    • quantity of the digital asset;
    • value of the digital asset (THB);
    • digital asset network (where the transfer takes place on a digital asset network, e.g. Bitcoin, Ethereum, BNB Chain).

    Subject

    Details

    Threshold-based data

    If a digital asset transfer has an equivalent value of less than THB 30,000, the following information shall be shared:


    Natural Person


    Originator:

    • full name;
    • account number (where such an account is used to process the transaction), or the digital asset wallet address (where the digital asset transfer takes place on a digital asset network), or a transaction reference number enabling subsequent verification of the transaction.

    Beneficiary:

    • full name;
    • account number (where such an account is used to process the transaction), or the digital asset wallet address (where the digital asset transfer takes place on a digital asset network), or a transaction reference number enabling subsequent verification of the transaction.

    Legal Entity


    Originator:

    • registered name;
    • account number (where such an account is used to process the transaction), or the digital asset wallet address (where the digital asset transfer takes place on a digital asset network), or a transaction reference number enabling subsequent verification of the transaction.

    Beneficiary:

    • registered name;
    • account number (where such an account is used to process the transaction), or the digital asset wallet address (where the digital asset transfer takes place on a digital asset network), or a transaction reference number enabling subsequent verification of the transaction.

    For transfers not exceeding THB 30,000, verification of originator data is required only where there are reasonable grounds for suspicion regarding the reliability or completeness of such data.


    If a digital asset transfer has an equivalent value of THB 30,000 or more, the following information shall be shared:


    Natural Person


    Originator:

    • full name;
    • account number (where such an account is used to process the transaction), or the digital asset wallet address (where the digital asset transfer takes place on a digital asset network), or a transaction reference number enabling subsequent verification of the transaction;
    • address, which must include, at a minimum, the country and the province or city;
    • date of birth;
    • personal identification number issued by a government authority.

    Beneficiary:

    • full name;
    • account number (where such an account is used to process the transaction), or the digital asset wallet address (where the digital asset transfer takes place on a digital asset network), or a transaction reference number enabling subsequent verification of the transaction;
    • address, which must include, at a minimum, the country and the province or city.

    Legal Entity


    Originator:

    • registered name;
    • account number (where such an account is used to process the transaction), or the digital asset wallet address (where the digital asset transfer takes place on a digital asset network), or a transaction reference number enabling subsequent verification of the transaction;
    • address, which must include, at a minimum, the country and the province or city;
    • legal entity identification number, or Legal Entity Identifier (LEI) (where such information is available).

    Beneficiary:

    • registered name;
    • account number (where such an account is used to process the transaction), or the digital asset wallet address (where the digital asset transfer takes place on a digital asset network), or a transaction reference number enabling subsequent verification of the transaction;
    • address, which must include, at a minimum, the country and the province or city.

    Domestic vs cross-border transfers

    No difference.

    Batch file transfer

    In cases where digital assets are transferred from a single originator to multiple beneficiaries, the originating digital asset operator must ensure that the following information is made available: the account number and/or digital asset wallet address of each beneficiary, together with other information pertaining to the originator and beneficiaries that may be used to verify the transaction data relating to each such digital asset transfer.

    Unhosted wallet verification

    Required.

    VASP Due Diligence

    Required.

    Record retention

    5 years.

    Obligations of the originating digital asset operator

    The originating digital asset operator must:

    • obtain information about the originator and beneficiary from a client who initiated a digital asset transfer;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which digital asset operator controls the wallet;
    • conduct digital asset operator due diligence;
    • verify a self-hosted wallet to which the digital assets should be sent;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information on the originator and the beneficiary to the next digital asset operator in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the beneficiary digital asset operator

    The beneficiary digital asset operator must:

    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which digital asset operator controls the wallet (if necessary);
    • conduct digital asset operator due diligence;
    • verify a self-hosted wallet from which the digital assets were received;
    • receive information about the originator and beneficiary from the originating or intermediary digital asset operator (or obtain it directly from its customer if assets are received from a self-hosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating digital asset operator's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the intermediary digital asset operator

    The intermediary digital asset operator must:

    • receive information about the originator and beneficiary from the previous digital asset operator in the chain and ensure that the received information is complete by comparing it with the requirements in the originating digital asset operator's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • carry out wallet attribution to establish which type of wallet – custodial or self-hosted – is used on the other end and, if it is a custodial one, establish which digital asset operator controls the wallet;
    • conduct digital asset operator due diligence;
    • verify a self-hosted wallet from which the digital assets were received or to which they should be sent;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information on the originator and the beneficiary to the next digital asset operator in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
    • keep records related to the transfer for as long as required by national legislation.

    Subject

    Details

    Status

    In force from February 25, 2025.

    Regulation

    Regulatory body

    Threshold

    No threshold. The Travel Rule applies to all virtual asset transfers irrespective of value.

    Data to be shared

    Originator:

    • a) Full legal name;
    • b) Wallet address, or in the absence of a wallet address, the reference number related to the transaction;
    • c) At least one of the following identifying details: address; place and date of birth; customer number; national identification number; citizenship number; or tax identification number.

    Beneficiary:

    • d) Full legal name;
    • e) Wallet address, or in the absence of a wallet address, the reference number related to the transaction.

    Subject

    Details

    Threshold-based data

    15,000 TL

    • < 15,000 TL: a), b), d), e). It is not necessary to verify the information on the originator and beneficiary.
    • ≥ 15,000 TL: a), b), c), d), e).

    Domestic vs cross-border transfers

    No difference.

    Batch file transfer

    No special provisions.

    Unhosted wallet verification

    No requirement.


    However, for crypto asset transfers to or from a wallet address that is not registered with any CASP, the CASP must obtain from the customer, who is a party to the respective transaction, a declaration containing at least one of the following identifying details about the owner of the self-hosted wallet: full legal name; address; place and date of birth; customer number; national identification number; citizenship number; or tax identification number.

    VASP Due Diligence

    No requirement.

    Time and way to share the Information

    The required information shall be transmitted immediately and in a secure manner.

    Record retention

    8 years.

    Obligations of the originating VASP

    The originating VASP must:

    • obtain information about the originator and beneficiary from a client who initiated a virtual asset transfer;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the beneficiary VASP

    The beneficiary VASP must:

    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet (if necessary);
    • receive information about the originator and beneficiary from the originating or intermediary VASP (or obtain it directly from its customer if assets are received from an unhosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the intermediary VASP

    The intermediary VASP must:

    • receive information about the originator and beneficiary from the previous VASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
    • keep records related to the transfer for as long as required by national legislation.

    Subject

    Details

    Status

    In force from March 31, 2022.

    Regulation

    Regulatory body

    Threshold

    No threshold. The Travel Rule applies to all virtual asset transfers irrespective of value.

    Data to be shared

    Natural Person


    Originator:

    • full name;
    • wallet or account number (or, in its absence, a unique reference number enabling the transaction to be traced);
    • address, national identity number or travel document number, customer identification number, date and place of birth.

    Beneficiary:

    • full name;
    • wallet or account number (or, in its absence, a unique reference number enabling the transaction to be traced).

    Legal Entity


    Originator:

    • registered name;
    • wallet or account number (or, in its absence, a unique reference number enabling the transaction to be traced);
    • address, legal entity identifier or equivalent identifier, customer identification number.

    Beneficiary:

    • registered name;
    • wallet or account number (or, in its absence, a unique reference number enabling the transaction to be traced).

    Note: Article 1(6) of the UAE Virtual Assets Travel Rule provides for a reduced data set (wallet/account number or unique reference number only) in respect of domestic Virtual Asset Transfers where the full data set is otherwise available to the beneficiary VASP by other means. In practice, this reduction is not available to VASPs: the CBUAE's AML/CFT Guidelines for Financial Institutions (para. 6.3.2) direct that, for the purposes of applying the wire transfer requirements to VASPs, all virtual asset transfers are to be treated as cross-border – a position mirrored in Cabinet Resolution No. (134) of 2025, Article 36(2), which omits any domestic carve-out from the VASP-specific minimum data set. The full data set set out above should accordingly be applied to every transfer, regardless of whether the originating and beneficiary VASPs are both licensed in the UAE.

    Subject

    Details

    Threshold-based data

    There is no difference.


    At the same time, where a virtual asset transfer is for a value below the daily aggregated amount of AED 3,500, VASPs are not required to verify the data – both for occasional transactions and for customers with whom the VASP has an ongoing business relationship – unless they have suspicions concerning the commission of a crime.

    Domestic vs cross-border transfers

    There is a difference.


    In the case of domestic transfers where the verified data is available to the beneficiary VASP by other means:

    • the originating VASP is only required to include the wallet or account number, or the unique reference number of the virtual asset transfer, provided that this number enables the transaction to be traced back to the originator and the beneficiary; and
    • for such a virtual asset transfer, the beneficiary VASP or the supervisory authority may request the full set of data (name, wallet and additional identifiers), in which case the originating VASP must provide such data within three working days of receiving the request from the beneficiary VASP or the supervisory authority concerned.

    Batch file transfer

    Where several virtual asset transfers are executed on behalf of a single originator for receipt by one or more beneficiaries, and are batched into a single transfer before being sent to the beneficiary VASP, the transfer must include the information required for each individual virtual asset transfer.

    Unhosted wallet verification

    A VASP must perform enhanced due diligence on a customer before sending or receiving a virtual asset transfer to or from an unhosted wallet on behalf of that customer, including by requesting additional identification documentation and source of funds verification from that customer.

    VASP Due Diligence

    The originating VASP must, before executing a virtual asset transfer to another VASP, ensure that the VASP is appropriately regulated in accordance with applicable law in the jurisdiction in which it is incorporated and located, and must not execute a virtual asset transfer to a VASP which is not appropriately regulated either in the UAE or outside the UAE.

    Time and way to share the Information

    The required information shall be transmitted immediately and in a secure manner.

    Record retention

    5 years.

    Obligations of the originating VASP

    The originating VASP must:

    • obtain information about the originator and beneficiary from a client who initiated a virtual asset transfer;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
    • conduct VASP Due Diligence;
    • verify an unhosted wallet to which the virtual assets should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the beneficiary VASP

    The beneficiary VASP must:

    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet (if necessary);
    • conduct VASP Due Diligence;
    • verify an unhosted wallet from which the virtual assets were received (if applicable);
    • receive information about the originator and beneficiary from the originating or intermediary VASP (or obtain it directly from its customer if assets are received from an unhosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the intermediary VASP

    The intermediary VASP must:

    • receive information about the originator and beneficiary from the previous VASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
    • conduct VASP Due Diligence;
    • verify an unhosted wallet from which the virtual assets were received or to which they should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
    • keep records related to the transfer for as long as required by national legislation.

    Subject

    Details

    Status

    In force from December 21, 2023.

    Regulation

    Regulatory body

    Threshold

    No threshold. The Travel Rule applies to all virtual asset transfers irrespective of value.

    Data to be shared

    Natural Person


    Originator:

    • full name;
    • account number (or unique transaction reference number);
    • one of the following: address, national identity number, travel document number, customer identification number, or date and place of birth.

    Beneficiary:

    • full name;
    • account number (or unique transaction reference number).

    Legal Entity


    Originator:

    • registered name;
    • account number (or unique transaction reference number);
    • one of the following: address, legal entity identifier or equivalent identifier, or customer identification number.

    Beneficiary:

    • registered name;
    • account number (or unique transaction reference number).

    Note: (i) Unlike the United Arab Emirates' Virtual Assets Travel Rule, which contains no express stipulation that only one of the identifiers (such as address, national identity number, travel document number, customer identification number, or date and place of birth) need be transmitted, the Anti-Money Laundering and Sanctions Rulebook (AML) does so provide.


    (ii) Article 1(6) of the UAE Virtual Assets Travel Rule provides for a reduced data set (wallet/account number or unique reference number only) in respect of domestic Virtual Asset Transfers where the full data set is otherwise available to the beneficiary VASP by other means. In practice, this reduction is not available to VASPs: the CBUAE's AML/CFT Guidelines for Financial Institutions (para. 6.3.2) direct that, for the purposes of applying the wire transfer requirements to VASPs, all virtual asset transfers are to be treated as cross-border – a position mirrored in Cabinet Resolution No. (134) of 2025, Article 36(2), which omits any domestic carve-out from the VASP-specific minimum data set. The full data set set out above should accordingly be applied to every transfer, regardless of whether the originating and beneficiary VASPs are both licensed in the UAE.

    Subject

    Details

    Threshold-based data

    Based on the UAE’s Virtual Assets Travel Rule, where a virtual asset transfer is for a value below the daily aggregated amount of AED 3,500, VASPs are not required to verify the data – both for occasional transactions and for customers with whom the VASP has an ongoing business relationship – unless they have suspicions concerning the commission of a crime.

    Domestic vs cross-border transfers

    Based on the UAE’s Virtual Assets Travel Rule, in the case of domestic transfers where the verified data is available to the beneficiary VASP by other means:

    • the originating VASP is only required to include the wallet or account number, or the unique reference number of the virtual asset transfer, provided that this number enables the transaction to be traced back to the originator and the beneficiary; and
    • for such a virtual asset transfer, the beneficiary VASP or the supervisory authority may request the full set of data (name, wallet and additional identifiers), in which case the originating VASP must provide such data within three working days of receiving the request from the beneficiary VASP or the supervisory authority concerned.

    Batch file transfer

    A VASP must ensure that it has verified the originator information, that the batch file contains the beneficiary information for each beneficiary, and that this information is fully traceable in the beneficiary's jurisdiction.

    Unhosted wallet verification

    Based on the UAE’s Virtual Assets Travel Rule, a VASP must perform enhanced due diligence on a customer before sending or receiving a virtual asset transfer to or from an unhosted wallet on behalf of that customer, including by requesting additional identification documentation and source of funds verification from that customer.

    VASP Due Diligence

    Based on the UAE’s Virtual Assets Travel Rule, the originating VASP must, before executing a virtual asset transfer to another VASP, ensure that the VASP is appropriately regulated in accordance with applicable law in the jurisdiction in which it is incorporated and located, and must not execute a virtual asset transfer to a VASP which is not appropriately regulated either in the UAE or outside the UAE.

    Time and way to share the Information

    The required information shall be transmitted immediately and in a secure manner.

    Record retention

    6 years.

    Obligations of the originating VASP

    The originating VASP must:

    • obtain information about the originator and beneficiary from a client who initiated a virtual asset transfer;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
    • conduct VASP Due Diligence;
    • verify an unhosted wallet to which the virtual assets should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the beneficiary VASP

    The beneficiary VASP must:

    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet (if necessary);
    • conduct VASP Due Diligence;
    • verify an unhosted wallet from which the virtual assets were received (if applicable);
    • receive information about the originator and beneficiary from the originating or intermediary VASP (or obtain it directly from its customer if assets are received from an unhosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the intermediary VASP

    The intermediary VASP must:

    • receive information about the originator and beneficiary from the previous VASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
    • conduct VASP Due Diligence;
    • verify an unhosted wallet from which the virtual assets were received or to which they should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
    • keep records related to the transfer for as long as required by national legislation.

    Subject

    Details

    Status

    In force from June 3, 2024.

    Regulation

    Regulatory body

    Threshold

    No threshold. The Travel Rule applies to all virtual asset transfers irrespective of value.

    Data to be shared

    Natural Person


    Originator:

    • full name;
    • account number (or unique transaction reference number);
    • one of the following: address, national identity number (such as an identity card number or passport number), customer identification number, or date and place of birth.

    Beneficiary:

    • full name;
    • account number (or unique transaction reference number).

    Legal Entity


    Originator:

    • registered name;
    • account number (or unique transaction reference number);
    • one of the following: address, legal entity identifier or equivalent identifier, or customer identification number.

    Beneficiary:

    • registered name;
    • account number (or unique transaction reference number).

    Note: (i) Unlike the United Arab Emirates' Virtual Assets Travel Rule, which contains no express stipulation that only one of the identifiers (such as address, national identity number, travel document number, customer identification number, or date and place of birth) need be transmitted, the Anti-Money Laundering, Counter-Terrorist Financing and Sanctions Module (AML) does so provide.


    (ii) Article 1(6) of the UAE Virtual Assets Travel Rule provides for a reduced data set (wallet/account number or unique reference number only) in respect of domestic Virtual Asset Transfers where the full data set is otherwise available to the beneficiary VASP by other means. In practice, this reduction is not available to VASPs: the CBUAE's AML/CFT Guidelines for Financial Institutions (para. 6.3.2) direct that, for the purposes of applying the wire transfer requirements to VASPs, all virtual asset transfers are to be treated as cross-border – a position mirrored in Cabinet Resolution No. (134) of 2025, Article 36(2), which omits any domestic carve-out from the VASP-specific minimum data set. The full data set set out above should accordingly be applied to every transfer, regardless of whether the originating and beneficiary VASPs are both licensed in the UAE.

    Subject

    Details

    Threshold-based data

    Please see the Domestic vs. cross-border transfers section.

    Domestic vs cross-border transfers

    There is a difference.


    Domestic:


    For a domestic virtual asset transfer, the originating VASP must either:


    (i) include in the message or payment instruction that accompanies or relates to the transfer the following information:


    Natural Person


    Originator:

    • full name;
    • account number (or unique transaction reference number);
    • one of the following: address, national identity number (such as an identity card number or passport number), customer identification number, or date and place of birth.

    Legal Entity


    Originator:

    • registered name;
    • account number (or unique transaction reference number);
    • one of the following: address, legal entity identifier or equivalent identifier, or customer identification number.

    or


    (ii) include only the beneficiary's account number (or unique transaction reference number), provided that those details enable the transaction to be traced back to the originator and the beneficiary; and the originating VASP must provide the originator information within three business days of a request from the beneficiary institution or the DFSA, or immediately upon request from a law enforcement agency.


    Cross-border:


    Where a cross-border virtual asset transfer has an equivalent value of USD 1,000 or less , the following information shall be shared:


    Natural Person


    Originator:

    • full name;
    • account number (or unique transaction reference number).

    Beneficiary:

    • full name;
    • account number (or unique transaction reference number).

    Legal Entity


    Originator:

    • registered name;
    • account number (or unique transaction reference number).

    Beneficiary:

    • registered name;
    • account number (or unique transaction reference number).

    Where a cross-border virtual asset transfer has an equivalent value exceeding USD 1,000 , the following information shall be shared:


    Natural Person


    Originator:

    • full name;
    • account number (or unique transaction reference number);
    • one of the following: address, national identity number (such as an identity card number or passport number), customer identification number, or date and place of birth.

    Beneficiary:

    • full name;
    • account number (or unique transaction reference number).

    Legal Entity


    Originator:

    • registered name;
    • account number (or unique transaction reference number);
    • one of the following: address, legal entity identifier or equivalent identifier, or customer identification number.

    Beneficiary:

    • registered name;
    • account number (or unique transaction reference number).

    Note: The approach to domestic transfers aligns with the provisions of the United Arab Emirates' Virtual Assets Travel Rule, whereas the approach to cross-border transfers does not.

    Batch file transfer

    Where several individual cross-border transfers from a single originator are bundled into a batch file for transmission, the originating VASP must ensure that the batch file contains the required originator information and that this information has been verified; that the batch file contains the required beneficiary information for each beneficiary; and that this information is fully traceable in the beneficiary's jurisdiction.

    Unhosted wallet verification

    Based on the UAE’s Virtual Assets Travel Rule, a VASP must perform enhanced due diligence on a customer before sending or receiving a virtual asset transfer to or from an unhosted wallet on behalf of that customer, including by requesting additional identification documentation and source of funds verification from that customer.

    VASP Due Diligence

    Required where a transfer has an equivalent value of USD 1,000 or more.

    Time and way to share the Information

    The required information shall be transmitted immediately and in a secure manner.

    Record retention

    5 years.

    Obligations of the originating VASP

    The originating VASP must:

    • obtain information about the originator and beneficiary from a client who initiated a virtual asset transfer;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
    • conduct VASP Due Diligence;
    • verify an unhosted wallet to which the virtual assets should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the beneficiary VASP

    The beneficiary VASP must:

    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet (if necessary);
    • conduct VASP Due Diligence;
    • verify an unhosted wallet from which the virtual assets were received (if applicable);
    • receive information about the originator and beneficiary from the originating or intermediary VASP (or obtain it directly from its customer if assets are received from an unhosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the intermediary VASP

    The intermediary VASP must:

    • receive information about the originator and beneficiary from the previous VASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
    • conduct VASP Due Diligence;
    • verify an unhosted wallet from which the virtual assets were received or to which they should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
    • keep records related to the transfer for as long as required by national legislation.

    Subject

    Details

    Status

    In force from February 7, 2023.

    Regulation

    Regulatory body

    Threshold

    None. The Travel Rule applies to all virtual asset transfers irrespective of value.

    Data to be shared

    Individual Person


    Originator:

    • full name;
    • account number or virtual asset wallet address;
    • residential address.

    Beneficiary:

    • full name;
    • account number or virtual asset wallet address.

    Legal Entity


    Originator:

    • registered name;
    • account number or virtual asset wallet address;
    • business address.

    Beneficiary:

    • registered name;
    • account number or virtual asset wallet address.

    Note: (i) The scope of the data is narrower than that prescribed under the UAE's Virtual Assets Travel Rule. In particular, it specifies that only a residential address must be transmitted, whereas the UAE's Virtual Assets Travel Rule requires the transmission of one of the following: address, national identity number, travel document number, customer identification number, or date and place of birth.


    (ii) Article 1(6) of the UAE Virtual Assets Travel Rule provides for a reduced data set (wallet/account number or unique reference number only) in respect of domestic Virtual Asset Transfers where the full data set is otherwise available to the beneficiary VASP by other means. In practice, this reduction is not available to VASPs: the CBUAE's AML/CFT Guidelines for Financial Institutions (para. 6.3.2) direct that, for the purposes of applying the wire transfer requirements to VASPs, all virtual asset transfers are to be treated as cross-border – a position mirrored in Cabinet Resolution No. (134) of 2025, Article 36(2), which omits any domestic carve-out from the VASP-specific minimum data set. The full data set set out above should accordingly be applied to every transfer, regardless of whether the originating and beneficiary VASPs are both licensed in the UAE.

    Subject

    Details

    Threshold-based data

    Based on the UAE’s Virtual Assets Travel Rule, where a virtual asset transfer is for a value below the daily aggregated amount of AED 3,500, VASPs are not required to verify the data – both for occasional transactions and for customers with whom the VASP has an ongoing business relationship – unless they have suspicions concerning the commission of a crime.

    Domestic vs cross-border transfers

    Based on the UAE’s Virtual Assets Travel Rule, in the case of domestic transfers where the verified data is available to the beneficiary VASP by other means:

    • the originating VASP is only required to include the wallet or account number, or the unique reference number of the virtual asset transfer, provided that this number enables the transaction to be traced back to the originator and the beneficiary; and
    • for such a virtual asset transfer, the beneficiary VASP or the supervisory authority may request the full set of data (name, wallet and additional identifiers), in which case the originating VASP must provide such data within three working days of receiving the request from the beneficiary VASP or the supervisory authority concerned.

    Batch file transfer

    Where multiple virtual asset transfers are batched, the required information must accompany each individual transfer within the batch.

    Unhosted wallet verification

    VASPs must apply enhanced due diligence for virtual asset transfers involving unhosted wallets, including additional customer identification and source of funds verification. Where required information is not provided, or where risks cannot be adequately mitigated, the VASP must decline, delay, or return the virtual asset transfer in accordance with its risk-based policies and procedures.

    VASP Due Diligence

    Required.


    Prior to entering into any transaction with a counterparty VASP or VASP in any other jurisdiction, VASPs must complete risk-based due diligence on such counterparty in order to mitigate AML/CFT risks.


    Prior to executing a virtual asset transfer, the originator’s VASP must confirm that the beneficiary’s VASP is appropriately regulated in its jurisdiction of incorporation or operation. VASPs must not execute virtual asset transfers to counterparties that are not appropriately regulated in the UAE or in a foreign jurisdiction. Where a counterparty VASP is unable to receive required information, the originator’s VASP must use best efforts to establish alternative secure communication channels and must reassess the relationship and associated risks where such issues persist.

    Time and way to share the Information

    The required information shall be transmitted immediately and in a secure manner.

    Record retention

    8 years.

    Obligations of the originating VASP

    The originating VASP must:

    • obtain information about the originator and beneficiary from a client who initiated a virtual asset transfer;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify an unhosted wallet to which the assets should be sent (if applicable);
    • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
    • conduct VASP Due Diligence (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the beneficiary VASP

    The beneficiary VASP must:

    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet (if necessary);
    • verify an unhosted wallet from which the assets were received (if applicable);
    • conduct VASP Due Diligence (if applicable);
    • receive information about the originator and beneficiary from the originating or intermediary VASP (or obtain it directly from its customer if assets are received from an unhosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the intermediary VASP

    The intermediary VASP must:

    • receive information about the originator and beneficiary from the previous VASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
    • conduct VASP Due Diligence (if applicable);
    • verify an unhosted wallet from which the assets were received or to which they should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
    • keep records related to the transfer for as long as required by national legislation.

    Subject

    Details

    Status

    In force from September 1, 2023.

    Regulation

    Regulatory body

    Threshold

    No threshold. The Travel Rule applies to all virtual asset transfers irrespective of value.

    Data to be shared

    Natural Persons:


    Originator:

    • full name;
    • account number (or unique transaction identifier if there is no account number);
    • one of the following: customer identification number; or address; or birth certificate number, passport number or national identity card number (or individual’s date and place of birth).

    Beneficiary:

    • full name;
    • account number (or unique transaction identifier if there is no account number).

    Legal Entities:


    Originator:

    • registered name (or trading name if no registered name);
    • account number (or unique transaction identifier if there is no account number);
    • one of the following: customer identification number; or address of originator’s registered office (or principal place of business if none or different).

    Beneficiary:

    • registered name (or trading name if no registered name);
    • account number (or unique transaction identifier if there is no account number).

    Subject

    Details

    Threshold-based data

    See the Domestic vs cross-border transfers section.

    Domestic vs cross-border transfers

    There is a difference.


    Domestic:


    Natural Persons:


    Originator:

    • full name;
    • account number (or unique transaction identifier if there is no account number).

    Beneficiary:

    • full name;
    • account number (or unique transaction identifier if there is no account number).

    Legal Entities:


    Originator:

    • registered name (or trading name if no registered name);
    • account number (or unique transaction identifier if there is no account number).

    Beneficiary:

    • registered name (or trading name if no registered name);
    • account number (or unique transaction identifier if there is no account number).

    As a general rule, the additional information – customer identification number, address, birth certificate number, passport number or national identity card number (or the individual’s date and place of birth) – is not required. However, the CASP of the beneficiary may also request this information, which the CASP of the originator must provide within three working days.


    Cross-border:


    If a cross-border cryptoasset transfer has an equivalent value of less than EUR 1,000, the following information shall be shared:


    Natural Persons:


    Originator:

    • full name;
    • account number (or unique transaction identifier if there is no account number).

    Beneficiary:

    • full name;
    • account number (or unique transaction identifier if there is no account number).

    Legal Entities:


    Originator:

    • registered name (or trading name if no registered name);
    • account number (or unique transaction identifier if there is no account number).

    Beneficiary:

    • registered name (or trading name if no registered name);
    • account number (or unique transaction identifier if there is no account number).

    If a cross-border cryptoasset transfer has an equivalent value of EUR 1,000 or more, the following information shall be shared:


    Natural Persons:


    Originator:

    • full name;
    • account number (or unique transaction identifier if there is no account number);
    • one of the following: customer identification number; or address; or birth certificate number, passport number or national identity card number (or individual’s date and place of birth).

    Beneficiary:

    • full name;
    • account number (or unique transaction identifier if there is no account number).

    Legal Entities:


    Originator:

    • registered name (or trading name if no registered name);
    • account number (or unique transaction identifier if there is no account number);
    • one of the following: customer identification number; or address of originator’s registered office (or principal place of business if none or different).

    Beneficiary:

    • registered name (or trading name if no registered name);
    • account number (or unique transaction identifier if there is no account number).

    Where a UK CASP does not know whether the counterparty (including any intermediaries) is a UK CASP, it may treat the transaction as a cross-border transaction.

    Batch file transfer

    Where the CASP of the beneficiary is carrying on business wholly outside the UK information on the batch must be submitted securely and simultaneously with the transfer. A batch file transfer is a bundle of individual inter-cryptoasset business transfers from a single originator. The Travel Rule applies to each of the underlying transfers forming the bundle. The information must be verified by the CASP of the originator on the basis of reliability and independence.

    Unhosted wallet verification

    Requirement applicable in cases of heightened risk.


    Where a CASP has determined that information should be requested, it should take reasonable steps to obtain the information from its own customer. In higher risk cases, firms should consider taking further steps to ascertain the source of funds in the unhosted wallet and thereafter consider authorising the transfer only if the control over the unhosted wallet can be reasonably established through appropriate solutions (e.g. micro deposit or cryptographic signature).

    VASP Due Diligence

    No requirement.

    Time and way to share the Information

    The required information shall be transmitted immediately and in a secure manner.

    Record retention

    Five years after the end of the customer relationship.

    Obligations of the originating CASP

    The originating CASP must:

    • obtain information about the originator and beneficiary from a client who initiated a virtual asset transfer;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
    • verify an unhosted wallet to which the assets should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information about the originator and beneficiary to the beneficiary or intermediary CASP; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the beneficiary CASP

    The beneficiary CASP must:

    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet (if necessary);
    • verify an unhosted wallet from which the assets were received (if applicable);
    • receive information about the originator and beneficiary from the originating or intermediary CASP (or obtain it directly from its customer if assets are received from an unhosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the intermediary CASP

    The intermediary CASP must:

    • receive information about the originator and beneficiary from the previous CASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating CASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which CASP controls the wallet;
    • verify an unhosted wallet from which the assets were received or to which they should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information about the originator and beneficiary to the beneficiary or intermediary CASP; and
    • keep records related to the transfer for as long as required by national legislation.

    Subject

    Details

    Status

    In force since 28 May 1996 (60 FR 220); applicability to CVC clarified 18 March 2013 (FIN‑2013‑G001).

    Regulation

    Regulatory body

    Threshold

    The Travel Rule applies only to transmittals of funds with an equivalent value of USD 3,000 or more.

    Data to be shared

    Natural Person


    Originator:

    • full name;
    • address;
    • account number, if the payment is ordered from an account.

    Beneficiary:

    • full name;
    • address;
    • account number;
    • any other specific identifier of the beneficiary.

    Legal Entity


    Originator:

    • full name;
    • address;
    • account number, if the payment is ordered from an account.

    Beneficiary:

    • full name;
    • address;
    • account number;
    • any other specific identifier of the beneficiary.

    Note: (i) Under 31 CFR 1010.410(f)(1)(vi) – as confirmed by FinCEN in FIN‑2010‑G004 (Q2) – the beneficiary's full name, address, account number and any other specific identifier are transmitted only to the extent received by the originator's financial institution. There is no affirmative duty on the originator's financial institution to obtain this data from the originator, and no duty on the beneficiary's financial institution to reject, hold or return transfers with missing or incomplete data. Originator data under 31 CFR 1010.410(f)(1)(i)-(ii) is subject to no such qualification.


    (ii) In addition, and irrespective of what is received from the originator, the originator's financial institution shall include in the transmittal order, at the time it is sent to a receiving financial institution:

    • amount of the transmittal order;
    • execution date of the transmittal order;
    • identity of the beneficiary's financial institution;
    • either the name and address or numerical identifier of the originator's financial institution.

    (iii) An intermediary financial institution shall pass on the above information to the extent received from the sender (31 CFR 1010.410(f)(2)); it bears no general duty to retrieve information not provided to it.

    Subject

    Details

    Threshold-based data

    —

    Domestic vs cross-border transfers

    No difference.

    Batch file transfer

    There are no special provisions.

    Unhosted wallet verification

    No requirement. May be applied based on risk assessment.

    VASP Due Diligence

    No requirement.

    Time and way to share the Information

    The money transmitter must obtain or provide the required regulatory information either before or at the time of the transmittal of value, regardless of how a money transmitter sets up their system for clearing and settling transactions, including those involving CVC.

    Record retention

    5 years.

    Obligations of the originating DASP

    The originating DASP must:

    • obtain information about the originator and beneficiary from a client who initiated a virtual asset transfer;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which DASP controls the wallet;
    • conduct DASP Due Diligence (if applicable);
    • verify an unhosted wallet to which the virtual assets should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information on the originator and the beneficiary to the next DASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the beneficiary DASP

    The beneficiary DASP must:

    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which DASP controls the wallet (if necessary);
    • conduct DASP Due Diligence (if applicable);
    • verify an unhosted wallet from which the virtual assets were received (if applicable);
    • receive information about the originator and beneficiary from the originating or intermediary DASP (or obtain it directly from its customer if assets are received from an unhosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating DASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the intermediary DASP

    The intermediary DASP must:

    • receive information about the originator and beneficiary from the previous DASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating DASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which DASP controls the wallet;
    • conduct DASP Due Diligence (if applicable);
    • verify an unhosted wallet from which the virtual assets were received or to which they should be sent (if applicable);
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information on the originator and the beneficiary to the next DASP in the transfer chain immediately and securely, and no later than the initiation of the blockchain transaction; and
    • keep records related to the transfer for as long as required by national legislation.

    Subject

    Details

    Status

    Not in force. Shall come into force on a date to be determined.

    Regulation

    Further information will be provided once the regulator releases additional details.

    Regulatory body

    Threshold

    Data to be shared

    Subject

    Details

    Threshold-based data

    Further information will be provided once the regulator releases additional details.

    Domestic vs cross-border transfers

    Batch file transfer

    Unhosted wallet verification

    VASP Due Diligence

    Time and way to share the Information

    Record retention

    Further information will be provided once the regulator releases additional details.

    Subject

    Details

    Status

    In force from July 20, 2021.

    Regulation

    Regulatory body

    Threshold

    The Travel Rule applies only to virtual asset transfers with an equivalent value exceeding EUR 1,000.

    Data to be shared

    Originator:

    • a) Full name;
    • b) Account number or virtual wallet (or a unique reference number);
    • c) Address or national identity number or the client's identification number or the date and place of his birth.

    Beneficiary:

    • d) Full name;
    • e) Account number or virtual wallet (or a unique reference number).

    Subject

    Details

    Threshold-based data

    —

    Domestic vs cross-border transfers

    No difference.

    Batch file transfer

    No special provisions.

    Unhosted wallet verification

    No requirement. May be applied based on risk assessment.

    VASP Due Diligence

    No requirement.

    Time and way to share the Information

    The required information shall be transmitted immediately and in a secure manner

    Record retention

    5 years.

    Obligations of the originating VASP

    The originating VASP must:

    • obtain information about the originator and beneficiary from a client who initiated a virtual asset transfer;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the beneficiary VASP

    The beneficiary VASP must:

    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet (if necessary);
    • receive information about the originator and beneficiary from the originating or intermediary VASP (or obtain it directly from its customer if assets are received from an unhosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the intermediary VASP

    The intermediary VASP must:

    • receive information about the originator and beneficiary from the previous VASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
    • keep records related to the transfer for as long as required by national legislation.

    Subject

    Details

    Status

    In force from 19 August 2022.

    Regulation

    Regulatory body

    Threshold

    No threshold. The Travel Rule applies to all virtual asset transfers irrespective of value.

    Data to be shared

    Originator:

    • a) Full name;
    • b) Account number (or unique transaction reference number);
    • c) Address, driving licence, passport or national identification document bearing the originator's pictorial image and evidencing the originator's identity or the originator's customer idetification number or date and place of birth.

    Beneficiary:

    • d) Full name;
    • e) Account number (or unique transaction reference number).

    Subject

    Details

    Threshold-based data

    USD 1,000

    • < USD 1,000: a), b), d), e). It is not necessary to verify the information on the originator and beneficiary unless there is a suspicion of money laundering, terrorist financing, or proliferation financing.
    • ≥ USD 1,000: a), b), c), d), e).

    Domestic vs cross-border transfers

    No difference.

    Batch file transfer

    In the case of a batch file transfer of virtual assets from a single originator, the obligation on the VASP of the originator to ensure that transfers of virtual assets are accompanied by the required information shall not apply to the individual transfers bundled together therein, provided that:

    • a) the batch file contains: (i) the name of the originator; (ii) where an account is used to process the transfer of virtual assets by the originator, the account number of the originator; or (iii) the address of the originator, the number of an issued government document evidencing the originator’s identity or the originator’s customer identification number or date and place of birth; and
    • b) the individual transfers of virtual assets carry the account number of the originator or a unique reference number.

    Unhosted wallet verification

    No requirement. May be applied based on risk assessment.

    VASP Due Diligence

    No requirement.

    Time and way to share the Information

    The required information shall be transmitted simultaneously or concurrently with the transfer of virtual assets.

    Record retention

    10 years.

    Obligations of the originating VASP

    The originating VASP must:

    • obtain information about the originator and beneficiary from a client who initiated a virtual asset transfer;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the originator by comparing it with the information gathered during the KYC or KYB;
    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the beneficiary VASP

    The beneficiary VASP must:

    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet (if necessary);
    • receive information about the originator and beneficiary from the originating or intermediary VASP (or obtain it directly from its customer if assets are received from an unhosted wallet) and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • verify information about the beneficiary by comparing it with the information gathered during the KYC or KYB;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified; and
    • keep records related to the transfer for as long as required by national legislation.

    Obligations of the intermediary VASP

    The intermediary VASP must:

    • receive information about the originator and beneficiary from the previous VASP in the chain and ensure that the received information is complete by comparing it with the requirements in the originating VASP's jurisdiction;
    • in accordance with the targeted financial sanctions regime, conduct AML screening against both the originator and beneficiary;
    • carry out wallet attribution to establish which type of wallet – custodial or unhosted – is used on the other end and, if it is a custodial one, establish which VASP controls the wallet;
    • conduct transaction monitoring and report to the FIU if a suspicious transaction is identified;
    • transmit information about the originator and beneficiary to the beneficiary or intermediary VASP; and
    • keep records related to the transfer for as long as required by national legislation.
    `}     {` `}