FATF Travel Rule

The FATF Travel Rule is the crypto-specific application of the Financial Action Task Force's Recommendation 16, which requires that originator and beneficiary information "travel" alongside a value transfer. Originally written for traditional wire transfers, FATF extended it to virtual assets in June 2019. Under the rule, a sending firm must collect, verify, and transmit identifying data about both the sender and recipient to the receiving firm whenever a transfer crosses a jurisdictional threshold — in effect, recreating correspondent-banking paperwork on top of a system that was designed not to need it.

What data and what threshold

For covered transfers, the originating provider must pass along the customer's full name, account or wallet identifier, and physical address (or a date of birth and customer ID number), together with the beneficiary's name and wallet identifier. FATF's baseline threshold is USD/EUR 1,000; in the United States, FinCEN's analogous rule applies at USD 3,000. National implementations vary in threshold, timing, and scope, which is one reason compliance across borders remains operationally messy. Note what this means structurally: the identifying data does not travel on the blockchain — Bitcoin has no field for it — but through parallel messaging channels between providers, creating a second, permissioned data layer shadowing the permissionless one.

The sunrise problem and compliance patchwork

Because countries adopted the rule at different speeds, a compliant VASP in one jurisdiction routinely faces counterparties in jurisdictions with no rule at all — the so-called sunrise problem. Add competing industry messaging protocols for exchanging the data, and the result is a compliance landscape where identical transfers are handled differently depending on the corridor. For users the visible symptoms are questionnaires: exchanges asking who a withdrawal is going to, whether the destination wallet is yours, and sometimes demanding proof of wallet ownership through a signed message or a micro-deposit before releasing funds.

The self-hosted wallet wrinkle

The rule binds Virtual Asset Service Providers (VASPs), not individuals. When a VASP sends to or receives from a self-hosted wallet, FATF guidance says the provider should collect and retain the counterparty's name and wallet address but need not transmit or verify that data, since there is no counterparty institution to receive it. Some jurisdictions gold-plate this with extra verification demands for self-hosted withdrawals; others follow the baseline. This is the regulatory boundary where custodial reporting meets sovereign self-custody — and it is precisely why withdrawing to keys you control is the moment your bitcoin stops accumulating third-party paperwork. Two peers transacting wallet-to-wallet fall outside the rule entirely, because neither is a service provider. Understanding where the perimeter sits lets you operate lawfully inside your rights: use regulated ramps knowing what they must record, then hold and transact under your own keys where the protocol, not a form, defines the rules.

The rule is also a moving target. FATF reviews implementation regularly and publishes updated guidance, each round tending to expand expectations — more jurisdictions covered, more transaction types in scope, more scrutiny of transfers involving self-hosted wallets. Individual countries layer their own variations on top: some have proposed verifying ownership of self-hosted wallets before permitting withdrawals to them, others have floated lowering thresholds toward zero. For users, the practical consequence is that the friction at regulated ramps tends to ratchet rather than relax, and the paperwork attached to a custodial relationship this year understates what it may involve in five. That trajectory, more than any single requirement, is why sovereign-minded Bitcoiners treat exchange accounts as doorways to pass through rather than places to live.

This entry is educational, not legal advice; requirements differ by jurisdiction. See also VASP (Virtual Asset Service Provider), the self-hosted wallet (regulatory view), and KYC for the identity layer the rule builds on.