Travel rule compliance for VASPs

The FATF Travel Rule — Recommendation 16, requiring virtual asset service providers to share originator and beneficiary information on transfers above a threshold — has been progressively adopted through 2023–2025. The compliance patterns are converging, and the implementation cost is stabilising.

Written March 2025 from a compliance-tooling review.

What the rule requires

For transfers above the applicable threshold (typically $1,000):

• Originator VASP transmits sender information (name, wallet address, account number).
• Beneficiary VASP receives and stores it.
• Both sides verify the information as far as they can.
• Records are retained for a period defined by local regulation.

The technical reality

• No native mechanism on public blockchains. The transaction on-chain carries only the wallet addresses. Information sharing happens off-chain, out of band.
• Multiple competing protocols. TRP (Travel Rule Protocol), OpenVASP, Sygna Bridge, Notabene, etc. Interoperability between them has been the focus of the last year.
• Counterparty identification is hard. Sending VASPs need to know which VASP holds the beneficiary wallet. This is a chicken-and-egg problem; industry directories have improved it.

What implementations look like now

• Most large VASPs use one or more travel rule solutions.
• Interoperability across solutions is decent but not seamless.
• The sunrise problem — VASPs in jurisdictions without travel rule enforcement — remains a source of friction.
• Self-custody transfers (from a VASP to a personal wallet) are handled with lower ceremony, though the definition of "self-hosted" varies by jurisdiction.

What to build for

• Support for multiple travel rule protocols; assume the beneficiary VASP might use a different one.
• Directory integration for counterparty lookup.
• Careful handling of transfers to and from self-custody wallets.
• Retention discipline for the transmitted information.

Travel rule compliance is now a routine operational cost, not a strategic issue. Implementing it well is what distinguishes a mature VASP from a startup one.