Last updated: October 2026

The crypto travel rule requires the institution sending a virtual asset transfer to collect identifying information about the originator and the beneficiary and pass it to the institution receiving the transfer, the same rule banks follow for wires. In the United States it applies to transmittals of $3,000 or more, including convertible virtual currency since FinCEN's May 2019 guidance; under the Financial Action Task Force (FATF) standard that most other jurisdictions follow, countries may set a threshold no higher than USD/EUR 1,000, and the European Union sets none for transfers between service providers. The work that decides whether a travel rule program holds up is what happens when the other side is unknown, not yet regulated, silent or an unhosted wallet.

TL;DR

• The crypto travel rule is the travel rule for funds transfers, applied to virtual assets: the sender passes originator and beneficiary information to the receiver, which holds it.

• US: $3,000 or more (31 CFR 1010.410(f)), applied to convertible virtual currency by FinCEN guidance FIN-2019-G001 (May 9, 2019). A 2020 proposal to cut it to $250 was never finalized.

• FATF: countries may set a de minimis no higher than USD/EUR 1,000; below it, names and a wallet address still travel. The EU sets no minimum between providers.

• The hard cases are counterparties that cannot be identified, are not yet bound, never answer, or are unhosted wallets. Decide each in policy before sending.

What the crypto travel rule is

The crypto travel rule requires the institution sending a transfer of virtual assets to collect originator and beneficiary information and send it to the institution receiving the transfer, and requires the receiving institution to obtain and hold that information. FATF sets this out in paragraph 7(b) of the interpretive note to Recommendation 15 (INR.15) in the FATF Recommendations, updated June 2026, for virtual asset service providers (VASPs) and for financial institutions that send or receive virtual asset transfers for a customer.

For a US institution, the crypto travel rule is the recordkeeping and travel rule that already applies to wires at banks and nonbank financial institutions, which FinCEN applied to convertible virtual currency (CVC) in guidance FIN-2019-G001, issued May 9, 2019. Elsewhere, FATF Recommendation 15 requires countries to regulate VASPs, and INR.15 imports Recommendation 16's payment transparency rules for their transfers. It is the same rule on a new payment rail, and a US firm with foreign counterparties meets both versions.

The data must also be usable: FIN-2019-G001 says replacing a party's identity with a pseudonym or code the receiving institution cannot decode does not comply.

The US rule: $3,000 and convertible virtual currency

Under the FinCEN travel rule, 31 CFR 1010.410(f), a US financial institution sending a transmittal of $3,000 or more must include the transmittor's name, address and account number, the amount, the execution date and the identity of the recipient's institution, plus whatever recipient information it received with the order. FinCEN's guidance FIN-2019-G001 (May 9, 2019) applies this to convertible virtual currency, at $3,000 or its equivalent in CVC.

An intermediary passes on what it received (31 CFR 1010.410(f)(2)). The companion recordkeeping rule, 31 CFR 1010.410(e) for nonbanks and 31 CFR 1020.410(a) for banks, requires the sender to keep the same core data, and 31 CFR 1010.430(d) sets a five-year retention period. FIN-2019-G001 adds that the information must be sent before or at the time of the transfer, and it may travel in a separate message when the payment protocol cannot carry it.

The $250 proposal that never took effect

The US threshold is still $3,000. A joint Federal Reserve Board and FinCEN proposal of October 27, 2020 (85 FR 68005) would have cut it to $250 for transfers that begin or end outside the United States and written CVC expressly into the rule. It was never finalized: the Spring 2025 Unified Agenda lists it as withdrawn on April 16, 2025, and FinCEN's April 10, 2026 stablecoin proposal (91 FR 18582) says FinCEN intends to withdraw it. As of October 28, 2026, 31 CFR 1010.410(f) still reads $3,000.

The same payment-transparency rule for wires, and how it plays out across corridors, is covered in our guide to cross-border AML workflows.

FATF's travel rule for virtual assets

The FATF travel rule applies FATF Recommendation 16, the payment transparency standard, to virtual assets through INR.15 paragraph 7(b) of the FATF Recommendations, updated June 2026: originating VASPs obtain, hold and send the required originator and beneficiary information immediately and securely, and beneficiary VASPs obtain and hold it.

Countries may adopt a de minimis threshold no higher than USD/EUR 1,000 (INR.16 paragraph 8). Below it, FATF's Updated Guidance on Virtual Assets and VASPs (October 2021, paragraph 191) still expects VASPs to collect the names of the originator and beneficiary and a wallet address for each or a unique transaction reference, unverified unless there is a suspicion of money laundering or terrorist financing. The USD/EUR 1,000 in INR.15 paragraph 7(a) is a different threshold: it triggers customer due diligence on occasional transactions.

The same guidance (paragraph 179) treats every virtual asset transfer as cross-border, and the information need not be attached to the transfer on the blockchain itself (INR.15, footnote 49).

The June 2025 revision of Recommendation 16

FATF revised Recommendation 16 in June 2025 and retitled it Payment transparency, with changes to take effect by the end of 2030; it consulted on implementation guidance from June 24 to August 21, 2026. The revised text does not mention virtual assets itself. It reaches VASPs through INR.15 paragraph 7(b), and FATF's July 2026 targeted update on virtual assets describes the travel rule as Recommendation 16 applied to the virtual asset context.

Thresholds and required data: US, FATF and EU

Travel rule requirements differ by regime, and a transfer that touches two of these regimes has to meet both.

The US rule has the highest threshold and does not ask for a date of birth; the EU rule has no threshold between providers.

The above-threshold FATF list comes from revised INR.16 paragraph 9 (June 2025), which also asks for an identifier for legal persons where one exists; whether a VASP must use it before 2030 depends on the national rule that implements it.

Article 14 of Regulation (EU) 2023/1113, the recast Transfer of Funds Regulation, sets no amount threshold for crypto-asset transfers between crypto-asset service providers (CASPs). Under Article 14(4), the information goes in advance of, or at the same time as, the transfer, securely and in line with the GDPR. Article 37(3)(d) asks the European Commission to assess de minimis thresholds for crypto-asset transfers in a report due by June 30, 2027.

Finding and vetting the counterparty VASP

Before sending travel rule data, a VASP has to establish whether the beneficiary's wallet is held at another VASP and, if so, carry out due diligence on that counterparty, so it does not send customer data to an illicit or sanctioned actor unknowingly. FATF's October 2021 guidance (paragraphs 196 and 197) describes three steps: determine whether the counterparty is a VASP, identify it, and assess whether it is eligible. A vetted counterparty need not be re-vetted for every transfer, but the review should be refreshed periodically.

The first step is the hard one: in that guidance, FATF said it knew of no technically proven way to identify, from the wallet address alone, which VASP manages a beneficiary wallet in every case.

The obligation in INR.15 paragraph 7(b) attaches to each transfer, whatever messaging arrangement the two firms use, so a counterparty outside a firm's usual channel still has to be identified, vetted and sent the data. Practitioners ask what has to sit around the messaging itself. A head of growth for a payments product at a crypto/stablecoin payments company put it this way: "I want to get just a clarity on what kind of providers we need to include in order to be like with the full compliance stack."

The answer starts with policy: decide before any transfer is sent what happens when a counterparty cannot be identified, cannot be vetted or fails the review, and write it down.

The sunrise problem: when the other side isn't bound yet

The sunrise problem is that countries implement the travel rule at different speeds, so a VASP in a country that enforces it will deal with counterparties that are not yet required to send or receive the data. FATF's October 2021 guidance (paragraph 200) calls this the sunrise issue and says each VASP should decide, on a risk basis, how to deal with counterparties where the rule is not yet in force.

FATF's July 2026 targeted update on virtual assets, based on a survey conducted from February to June 2026, found that 91 of 109 responding jurisdictions had passed travel rule legislation and another 11 were in the process. Of those 91, 55, slightly more than half, had not yet issued findings or directives or taken enforcement or other supervisory action focused on travel rule compliance, according to the same February to June 2026 survey. Legislation in a counterparty's jurisdiction therefore does not mean the counterparty will exchange the data.

FATF's guidance (paragraph 201) gives examples of risk-based controls: restricting transfers to the VASP's own customer base, allowing only confirmed first-party transfers outside it, and enhanced monitoring. Paragraph 200 adds that an originating VASP can require travel rule compliance from a counterparty by contract or business practice, whatever its home rules say.

Non-response is the daily form of the problem. The head of growth for a payments product at the crypto/stablecoin payments company quoted above asked, on a later call, whether the whole flow stops when the counterparty never responds to the travel rule message. Decide that in policy before the transfer: which transfers wait, which proceed with a record of the attempt, and which stop.

Transfers to and from unhosted wallets

When one side of a transfer is an unhosted (self-hosted) wallet, the travel rule still applies to the VASP on the other side for its own customer: the VASP collects the originator and beneficiary information, but FATF does not expect it to send that information to the wallet. FATF's October 2021 guidance (paragraphs 203 and 204) adds that the VASP should scrutinize such transfers for its reporting and sanctions obligations and may impose extra limits on them.

Transfers between two unhosted wallets, which FATF calls peer-to-peer transactions, involve no VASP or other obliged entity to collect data or report. In FATF's July 2026 targeted update, 58 of 66 responding jurisdictions rated peer-to-peer transactions as high risk (survey conducted February to June 2026), and FATF called the missing reporting entity a structural gap.

The EU is more specific. Under Regulation (EU) 2023/1113, a CASP collects the information for any transfer to or from a self-hosted address and, above EUR 1,000, must take adequate measures to assess whether its own customer owns or controls the address (Articles 14(5) and 16(2)).

The United States has no rule written for unhosted wallets. FinCEN's December 23, 2020 proposal (85 FR 83840) would have imposed recordkeeping and identity checks on certain unhosted wallet transactions, but FinCEN formally withdrew it on October 6, 2026 (91 FR 63514); as of October 28, 2026, no US unhosted wallet rule is pending.

On-ramp and off-ramp are not equally hard

An executive (title not shown) at a cross-border B2B payments company handling fiat and digital assets described the on-ramp, where the company's own buyer supplies the wallet: "the on ramp I think is pretty risk controlled because the buyer is our customer. They're telling us what the coordinates of their wallet is, where we are going to pull the coin out of."

The same executive said the harder case is paying out to a wallet a supplier names, because there is no simple way to confirm who controls it. That is where an unhosted wallet policy has to be explicit: what the customer must show about the address, at what amount, and what happens when the answer falls short.

Stablecoins and the travel rule

Stablecoin issuers that operate as money services businesses are already subject to the US recordkeeping and travel rules, as FinCEN noted in its April 10, 2026 proposed rule on permitted payment stablecoin issuers (91 FR 18582). That proposal would apply both rules expressly to permitted payment stablecoin issuers and add payment stablecoins to the definition of a transmittal order, without otherwise changing the rules, so the $3,000 threshold would stay. As of October 28, 2026, it remains a proposal. FATF's July 2026 targeted update tells VASPs, including stablecoin issuers, to implement the travel rule.

Which firms may issue a payment stablecoin in the United States, and what the GENIUS Act requires of them, is covered in our guide to stablecoin compliance requirements.

Running the travel rule day to day

Travel rule compliance comes down to a short list of decisions, made in advance and written down:

1. Know which regime governs each transfer: the US $3,000 rule, the counterparty's jurisdiction, and EU rules for EU customers.

2. Decide counterparty policy: how the firm attributes a wallet to a VASP, vets it, refreshes the review, and handles a counterparty it cannot identify.

3. Decide what happens on non-response: which transfers wait, proceed with a record, or stop.

4. Decide unhosted wallet policy: what the customer must show about a self-hosted address, at what amount, and which limits apply.

5. Send the data before or with the transfer, securely, as FIN-2019-G001 and Article 14(4) of the EU regulation both require.

6. Keep the records: five years in the US under 31 CFR 1010.430(d).

7. Review unexpected counterparty data like any other alert, with the outcome documented.

8. Document every exception with the decision and the reason.

The head of growth quoted earlier asked which providers make up the full stack; that is easier to answer once each provider can be judged against these written decisions.

Common mistakes

• Treating the USD/EUR 1,000 in INR.15 paragraph 7(a), a due diligence threshold, as the travel rule de minimis.

• Quoting $250 as the US threshold; the 2020 proposal never took effect.

• Sending nothing below a de minimis threshold, where FATF still expects names and a wallet address.

Banks that offer crypto through fintech partners inherit these questions. How a bank oversees the AML programs of the fintechs it sponsors is covered in our guide to sponsor bank AML oversight.

How Oscilar fits

Oscilar is the agentic risk platform for fraud, credit, onboarding, and compliance, used by banks, sponsor banks and fintechs, including payments companies. It is a unified platform: real-time data fabric, device and behavior intelligence, rules, and case management in one stack, with agents native to it.

For firms that move crypto alongside fiat, the travel rule is one control in a wider AML program. The part Oscilar speaks to is the record: when an exception or an unexpected counterparty reaches an analyst as a case, the work and the decision sit in one place, with a full audit trail per decision with stored reasoning, human-in-the-loop by design. See how Oscilar supports AML for fintechs.

Frequently asked questions

Does the US travel rule apply to cryptocurrency?

Yes. FinCEN's guidance FIN-2019-G001 (May 9, 2019) treats convertible virtual currency transfers as transmittals of funds, so the travel rule in 31 CFR 1010.410(f) can apply at $3,000 or its equivalent in CVC.

What is the travel rule threshold for crypto in the US?

The US travel rule threshold for crypto is $3,000 or more. An October 2020 proposal to lower it to $250 for cross-border transfers was never finalized, and the Spring 2025 Unified Agenda lists it as withdrawn on April 16, 2025.

Does FATF set a minimum amount for the travel rule?

FATF lets each country choose a de minimis threshold no higher than USD/EUR 1,000 (INR.16 paragraph 8) but does not require one. Below it, FATF's October 2021 guidance still expects the names of the originator and beneficiary and a wallet address or transaction reference.

Is the EU's travel rule for crypto stricter than the US rule?

On thresholds, yes. Regulation (EU) 2023/1113, applying from December 30, 2024, sets no minimum for transfers between providers, and above EUR 1,000 a provider must assess whether its customer owns or controls a self-hosted address.

What happens if the receiving VASP cannot accept travel rule data?

The sending VASP decides on a risk basis, in written policy before the transfer. FATF's October 2021 guidance (paragraph 201) gives examples: restrict transfers to its own customers, allow only confirmed first-party transfers, or apply enhanced monitoring.

Do you need originator and beneficiary details for a transfer to a self-hosted wallet?

Yes, for your own customer. FATF's October 2021 guidance (paragraphs 203 and 204) says the VASP obtains that information from its customer but is not expected to send it to the wallet.

Will stablecoin issuers have to follow the travel rule?

In the US, issuers that operate as money services businesses already do, and FinCEN's April 10, 2026 proposal (91 FR 18582), still a proposal as of October 28, 2026, would apply it expressly to permitted payment stablecoin issuers. Which firms may issue a payment stablecoin in the United States, and what the GENIUS Act requires of them, is covered in our guide to stablecoin compliance requirements.