Lately, we’ve been hearing a recurring question from our customers and prospects: Is the EU Transfer of Funds Regulation (TFR) being postponed by six months? Let’s set the record straight.

The short answer: No, the TFR is not being delayed.

Understanding the Source of the Confusion

This misunderstanding likely stems from recent discussions around MiCA (Markets in Crypto-Assets) regulatory technical standards (RTS). As members of BlockchainForEurope, we’ve joined others in addressing concerns about MiCA’s RTS and its implementation timeline. The letter we co-signed with other industry members highlights several key challenges that MiCA introduces, including:

1. Timing and Legal Uncertainty: With less than two months left before MiCA’s application on December 30, 2024, delays in RTS adoption have left both national competent authorities (NCAs) and CASPs scrambling to prepare.
2. Inconsistent Transitional Periods: Divergent “grandfathering” clauses across Member States create a compliance patchwork—5 months in Lithuania versus 18 months in France—undermining the intended harmonization.
3. Foreseeable Delays and Risks: Without coordinated measures, we risk regulatory uncertainty, market disruptions, and reputational harm, detracting from MiCA’s goals.
4. Operational Challenges: CASPs face impractical requirements, such as applying in all Member States, while some states have ceased accepting pre-MiCA applications.
5. Proposed Mitigations: The letter calls for ESMA to issue a “no action” letter to promote consistency among NCAs and extend transitional arrangements.

How Does This Relate to TFR?

It’s crucial to understand that MiCA and TFR are separate regulations. While MiCA includes transitional or “grandfathering” clauses for existing CASPs, the TFR does not.

For TFR, there is no "traditional" transitional period. Under the EBA Travel Rule Guidelines, until July 31, 2025, CASPs may exceptionally use infrastructures or services with technical limitations, but are required to implement additional technical steps to ensure full compliance with the requirements. This does not exempt them from Travel Rule compliance. CASPs using such infrastructures are required to take additional technical steps to ensure full compliance with the Travel Rule during this period. This means that all existing CASPs, regardless of their new status, must fully comply with the TFR requirements by the official application date. Any delays or mitigations proposed under MiCA will not directly impact TFR timelines.

Failing to comply with the TFR by the December 30, 2024, deadline carries serious consequences, including the potential for service disruptions, reputational damage, and regulatory penalties. We recently explored this topic in detail in our article: The Consequences of Non-Compliance with the EU’s Travel Rule After December 30th. If you’re preparing for compliance, it’s worth a read.

At Notabene, we’re committed to helping businesses navigate these regulatory complexities. If you have questions or concerns about preparing for the TFR, we’re here to help. Feel free to reach out to our Regulatory & Compliance team at [email protected] 

Celebrating 25 Million Transfers and $500B in Transaction Volume Processed on the Notabene Network

We’re so proud to announce that Notabene has reached a significant milestone – processing over 25 million transactions and $500B in transaction volume through our secure Travel Rule compliance solution. This achievement underscores our position as the industry’s largest active Travel Rule network, as well as our commitment to facilitating secure and compliant cryptocurrency transactions on a global scale.

As a leader in Travel Rule compliance since 2020, Notabene has been at the forefront of enabling Virtual Asset Service Providers (VASPs) to meet regulatory requirements while maintaining the efficiency and speed that crypto users expect. Our solution has become an integral part of the crypto ecosystem, bridging the gap between traditional financial regulations and the innovative world of digital assets.

Reaching 25 million transactions is not just a number—it's a testament to the scale and impact of our solution in the crypto compliance industry. This milestone has far-reaching implications for the broader crypto ecosystem. It demonstrates that large-scale compliance is not only possible but can be achieved without sacrificing the speed and efficiency that are hallmarks of cryptocurrency transactions. It also shows that the industry is maturing, with VASPs increasingly prioritizing regulatory compliance as part of their operations.

By facilitating 25 million compliant transactions, Notabene has played a crucial role in driving Travel Rule compliance within the crypto industry. This has contributed to increased trust and legitimacy in the eyes of regulators and traditional financial institutions, while enabling our customers to grow their business in a scaleable way.

Our Journey to 25 Million

The path to 25 million transactions has been marked by continuous innovation, strategic partnerships, and overcoming significant challenges in partnership with our valued customer base. Along the way, we have:

• Launched our first Travel Rule solution in 2020
• Expanded our network to include VASPs from over 50 countries
• Implemented support for multiple blockchain protocols and countless crypto wallets
• Launched first of its kind Phased Implementation Plan to aid VASP roll out of Travel Rule
• Launched the first Travel Rule Certification program in the crypto industry
• Engaged extensively with regulators and industry associations to address some of the most complex challenges in implementing the Travel Rule
• Developed and released the Transaction Authorization Protocol (TAP), a decentralized protocol solution for the entire industry
• Launched our innovative SafeTransact for Networks, bringing a layer of compliance to the robust networks where transactions already occur
• Built a best-in-industry self-hosted wallet solution that provides end-users with an elegant UX with a simple and powerful embeddable component

And we’re just getting started.

We will continue to rapidly grow our network volume by adapting to rapidly evolving regulations, ensuring interoperability with various VASP systems, and maintaining the highest standards of data security and privacy.

As we celebrate this milestone, we want to highlight our commitment to being the leading provider of Travel Rule solutions in the cryptocurrency space. This achievement would not have been possible without the trust and collaboration of our partners, clients, and the dedicated Notabene team.

To VASPs not yet on our network, there’s never been a better time. Join the largest and most far-reaching Travel Rule compliance network in the crypto industry.

Contact our team to learn how Notabene can help your organization meet Travel Rule requirements and be part of the next 25 million transactions.

For compliance professionals across Europe, the Transfer of Funds Regulation (TFR) plays a pivotal role in enhancing transparency and combating money laundering and terrorist financing. While its primary objective is to align with the Financial Action Task Force’s (FATF) “Travel Rule” for European Union (EU) member states, it’s equally important—but sometimes overlooked—that it also applies to the European Economic Area (EEA) member states, namely Norway, Iceland, and Liechtenstein. This blog post delves into how the TFR extends to the EEA, ensuring a homogeneous regulatory framework across the region.

TFR in the EEA: Not Just an EU Regulation

The TFR was first established under Regulation (EU) 2015/847*, mandating that financial service providers share information accompanying transfers of funds. This regulation is designed to combat money laundering and terrorist financing by ensuring transparency in financial transactions. When the regulation was introduced, the EEA Joint Committee, responsible for aligning EEA non-EU members with relevant EU regulations, formally incorporated it into the EEA Agreement.

EEA Joint Committee Decision No. 198/2016*, adopted on 30 September 2016, amended Annex IX (Financial Services) of the EEA Agreement to include the TFR, thereby extending its applicability to Iceland, Liechtenstein, and Norway. This decision ensured that non-EU EEA members implement the TFR within their financial systems, thus aligning their AML measures with EU standards.

The Complete List of EEA Countries Impacted by the TFR

Understanding which countries the TFR applies to is key for compliance. Here’s the full list of EEA member states:

EU Member States (27 countries): 

• 🇦🇹 Austria
• 🇧🇪 Belgium
• 🇧🇬 Bulgaria
• 🇭🇷 Croatia
• 🇨🇾 Cyprus
• 🇨🇿 Czech Republic
• 🇩🇰 Denmark
• 🇪🇪 Estonia
• 🇫🇮 Finland
• 🇫🇷 France
• 🇩🇪 Germany
• 🇬🇷 Greece
• 🇭🇺 Hungary
• 🇮🇪 Ireland
• 🇮🇹 Italy
• 🇱🇻 Latvia
• 🇱🇹 Lithuania
• 🇱🇺 Luxembourg
• 🇲🇹 Malta
• 🇳🇱 Netherlands
• 🇵🇱 Poland
• 🇵🇹 Portugal
• 🇷🇴 Romania
• 🇸🇰 Slovakia
• 🇸🇮 Slovenia
• 🇪🇸 Spain
• 🇸🇪 Sweden

EEA EFTA States (3 countries): 

• 🇮🇸 Iceland
• 🇱🇮 Liechtenstein
• 🇳🇴 Norway
  

It’s worth noting that 🇨🇭 Switzerland, although part of the European Free Trade Association (EFTA), is not a member of the EEA and is therefore not directly subject to the TFR.

How the TFR Enhances AML/CFT Measures Across the EEA

The TFR strengthens AML and Counter Financing of Terrorism (CFT) measures by requiring payment service providers to attach detailed payer and payee information to transfers of funds. For the EEA as a whole, this means consistent AML compliance standards for financial institutions across both EU and non-EU EEA states.

When Regulation (EU) 2023/1113* updated the TFR, it further extended these obligations specifically for virtual asset service providers (VASPs), bringing them under the same AML/CFT standards. This update is part of the EU’s broader Markets in Crypto-Assets (MiCA) framework, which aims to regulate cryptocurrency service providers consistently across the EEA.

This update extended obligations to VASPs across the EEA as part of the region’s coordinated AML/CFT strategy and ensured that virtual asset transfers include necessary information about the originator and beneficiary, aligning with the FATF’s Travel Rule.

Implications of the TFR for Financial Institutions and VASPs in the EEA

The TFR’s incorporation into the EEA Agreement means that financial institutions, including VASPs in Iceland, Liechtenstein, and Norway, must now comply with the same AML requirements as those in the EU. This uniformity is essential for:

1. Legal Alignment: Ensuring a homogenous legal framework across all EEA member states.
2. Compliance Requirements: Enforcing the same level of scrutiny for fund transfers within the EEA, enhancing transparency and reducing regulatory disparities.
3. AML/CFT Strengthening: Bolstering defenses against money laundering and terrorism financing across borders, especially in high-risk sectors like virtual assets.

Why Compliance Professionals Shouldn’t Overlook EEA Obligations

For compliance officers, particularly those dealing with cross-border transactions, it’s essential to remember that the TFR’s obligations span the entire EEA. Ignoring the non-EU EEA countries—Norway, Iceland, and Liechtenstein—can lead to gaps in compliance, risking penalties and reputational damage. Every compliance framework and transaction protocol should therefore account for the TFR’s reach across these territories.

The TFR is not just an EU obligation; it applies to the entire EEA, including Iceland, Liechtenstein, and Norway. Its aim is to create a consistent and robust AML framework across Europe, aligning the EEA non-EU members with the EU’s AML/CFT standards. Compliance professionals and financial institutions should ensure that their policies and procedures reflect this broader scope of the TFR, safeguarding against regulatory and operational risks in today’s complex financial landscape.

Where to Find Further Guidance on EEA Compliance

The EFTA Secretariat offers access to legal texts and guidance on implementing EU regulations within the EEA, including the TFR. Additionally, each EEA EFTA state’s financial supervisory authority provides national guidelines to help institutions comply with the regulation’s requirements.

For more detailed information on the TFR’s integration into the EEA, refer to EEA Joint Committee Decision No 198/2016, published in the EEA Supplement to the Official Journal of the European Union. The official EFTA website also provides a repository of EEA-related legislative documents, ensuring that compliance professionals have the resources they need to meet EEA-wide AML standards.

*Sources

Regulation (EU) 2015/847 - https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32015R0847#ntr2-L_2015141EN.01000101-E0002

EEA Joint Committee Decision No. 198/2016 -  https://www.efta.int/sites/default/files/documents/legal-texts/eea/other-legal-documents/adopted-joint-committee-decisions/2016%20-%20English/198-2016.pdf

Regulation (EU) 2023/1113 - 3 https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32023R1113

NEW YORK, NY – November 12, 2024 – Notabene, a leading provider of cryptocurrency compliance solutions, today announced it has raised $14.5 million in a Series B funding round led by DRW VC, with participation from funds managed by Apollo, Nextblock, and Wintermute, along with existing investors CMT Digital, F-Prime, Green Visor Capital, Illuminate Financial, Jump Capital, ParaFi Capital, Signature Ventures, and Y Combinator. The funding will accelerate Notabene’s mission to make crypto payments a part of the everyday global economy by fostering open, secure, and compliant transactions.

Regulators now require crypto companies such as exchanges, wallet providers, and payment processors to securely exchange information about sender and receiver, just like they already do in traditional payments. This so-called Travel Rule is now a requirement in most global financial centers.

Having already helped process half a trillion dollars worth of transactions, Notabene is the leading global platform and network for compliant crypto payments. By automating the secure transfer of sensitive data between institutions, Notabene simplifies this complex process that is virtually impossible for companies to implement independently.

Kimberly Trautmann, Partner and Head of DRW VC, the round’s lead investor, emphasized the significance of Notabene’s work in this emerging financial ecosystem:

“Notabene offers a comprehensive and efficient way to track and disclose who an asset is being sent to, which is critical for those who facilitate the exchange, transfer, safekeeping, and administration of virtual assets (Virtual Asset Service Partners or VASPs) and need to be compliant with the Travel Rule. We believe Notabene is positioned to be the provider-of-choice, as it allows users to achieve real-time compliance, is protocol agnostic and does not require exposing sensitive information to other market participants.”

Notabene is expanding its focus to support the growing number of traditional financial institutions moving into digital payments. With over $20T in stablecoin transactions processed last year, global adoption is on the rise and poised to be crypto’s long-awaited killer use case. The key to unlocking stablecoins’ potential as fast, low-cost, borderless payments is a secure and transparent system – one that’s open and not controlled by any single entity. Notabene offers the essential infrastructure for compliance, reconciliation, and safety, enabling open, interoperable payment networks that will drive the next wave of adoption.

Notabene’s CEO, Pelle Brændgaard, underscores the company’s vision for the future of payments:

“We’ve already established ourselves as a pioneer in Travel Rule compliance, and now, as regulatory clarity grows and adoption scales, we are positioned to do the same for payments. By enabling secure, compliant, and open digital asset transactions, we’re helping shape the next generation of global financial infrastructure. Our philosophy of building open networks to maximize reachability between transacting counterparties will be a key driver of adoption with both crypto-native organizations, as well as incumbent players in traditional finance that are showing an increased interest in digital assets and blockchain payment solutions.”

Notabene’s platform has seen a rapid 10x increase in transaction volumes over the past year, totaling nearly $500 billion in transaction volume—solidifying the company’s role as a trusted provider in the compliance space. With over 165 companies using the platform, including some of the largest virtual asset service providers (VASPs) globally such as Copper, OKX, and Robinhood, as well as working relationships with regulatory bodies across hundreds of global jurisdictions, Notabene has built the largest network of transacting counterparties in the market today.

Alexander Ross, General Partner, Head of NYC for investor Illuminate Financial, added:

“As the existing market leader for Travel Rule compliance, we believe Notabene has the potential to become the “SWIFT network” for blockchain transactions. There is a desperate need for a secure network to share all transaction metadata. This will enable compliance with global regulations and is a key pillar to unlocking mass adoption of stablecoins for payments. We have been working with the founders since 2021 and believe they are the best positioned to execute this vision.”

With this raise, Notabene is set to continue its mission to bring crypto and stablecoins into everyday global payments. It will help grow the industry's only open compliant payments network to support more use cases and new market entrants.

“With $20 trillion in stablecoin transactions processed last year, stablecoins are emerging as the preferred method for fast, low-cost global payments,” said Pelle Brændgaard, Notabene CEO. “As regulatory clarity expands, traditional financial institutions are beginning to recognize stablecoins’ potential. Notabene’s role as a trusted compliance provider is critical to unlocking this potential and establishing stablecoins as a legitimate payment medium worldwide.”

About Notabene

Notabene is the leading crypto payment authorization network, enabling secure, transparent, and compliant transactions for financial institutions around the world. With a platform that facilitates transactions in over 80 jurisdictions, supports over 165 companies, and has processed half a trillion dollars in transaction volume, Notabene is setting the standard for compliant transactions in the digital asset space.

For more information, please visit notabene.id.

‍

Nearly five years ago when Alice, Ania, Andrés, and I sat down to start our journey to making crypto part of the everyday economy, we realized it was an amazing opportunity for us to really solve some of the foundational issues we saw were inherent in crypto and the crypto industry of 2020.

Trust between the many varied crypto native institutions, traditional finance, and global regulators seemed missing and, frankly, not many people cared back then. As early Bitcoin and Web3 developers, we believe in the importance of decentralization and people managing their own keys. And yet we also realized that institutions are as critical to scaling and making crypto safe for regular people and use-cases as they are in the cash-based economy.

Thus, our simple plan: to help crypto native companies trust each other and allow regulators to feel safe and comfortable for their constituents to entrust their money with this new generation of crypto native fintechs. This is ultimately about adoption of crypto and stablecoins globally with everyone and everywhere. 

Announcing our Series B

Today marks a significant milestone in Notabene's journey, as we announce our $14.5 million Series B funding round led by DRW VC, with participation from funds managed by Apollo, Nextblock, and Wintermute, along with existing investors CMT Digital, F-Prime, Green Visor Capital, Illuminate Financial, Jump Capital, Signature Ventures, and Y Combinator. This investment is a testament to our vision of building a trust infrastructure that enables all financial institutions—from crypto natives to traditional banks—to transact securely and confidently in the digital age.

It's noteworthy that DRW, Wintermute, and Jump (who co-lead our Series A) are all major players in providing the critical underlying liquidity that powers the crypto ecosystem. Their participation underscores their deep understanding of the importance of institutional trust infrastructure in driving the industry forward.

Our Journey So Far

We recognized early that the future of finance would require a new kind of trust infrastructure. Traditional finance relies on centralized gatekeepers, while crypto operates on trustless technology. We saw the need for a middle ground—a way for institutions to build trust through transparency and verifiable credentials while maintaining their autonomy.

What started as helping companies implement the Travel Rule has evolved into something much more fundamental: a decentralized trust network that enables any financial institution to verify, trust, and transact with counterparties globally. Today, having processed nearly $500B in transactions through our Transaction Authorization Network, we've proven that compliance and transaction volume can go hand in hand when built on the right foundation.

Why Institutional Trust Infrastructure Matters More Than Ever

The financial industry stands at a crossroads. Crypto natives have built incredible technology but struggle with trust. Traditional financial institutions have deep trust relationships but are constrained by legacy infrastructure. Fintech companies are bridging the gap but need better tools to build trust with both sides. These dynamics create the perfect conditions for a new kind of financial infrastructure built on verifiable trust rather than centralized gatekeepers.

Nowhere is this more evident than in the evolution of stablecoins. While stablecoins solve the fundamental challenge of instant, 24/7 settlement, they can only replace traditional settlement rails if institutions can trust who they're transacting with before they send funds. This is where our pre-transaction authorization infrastructure becomes crucial—enabling institutions to verify counterparty identity, assess risk, and ensure compliance before a single dollar moves.

What excites me most is seeing how our trust network enables entirely new ways of collaboration between different types of financial institutions. When a crypto exchange can instantly verify the compliance credentials of a traditional bank, when a fintech can prove its trustworthiness to multiple partners simultaneously, when institutions can maintain their high standards while embracing innovation—that's when we know we're building something transformative.

Building the Trust Network

This funding will accelerate our vision in three key areas:

1. Network Expansion: Our network of 165 customers and 1,600 profiles is just the beginning. We're building the world's most comprehensive network of verified institutional identities, enabling any financial institution to find and trust counterparties globally.

2. Trust Infrastructure: We're investing heavily in our pre-transaction authorization platform and decentralized trust infrastructure. This enables institutions to comply with regulations and build verifiably trusted relationships at the scale needed for stablecoins to become the next generation of settlement rails. By solving the "trust gap" that has held back institutional stablecoin adoption, we're helping create a future where instant, global settlement is the norm, not the exception.

3. Global Standards: We're working with regulators and industry leaders, particularly in the EU with MiCA and the US, to establish standards for institutional trust that work for everyone - from the most innovative crypto native to the most conservative bank. These standards will be crucial as stablecoins increasingly become part of the core financial infrastructure.

A Foundation Built on Trust

Our success comes from understanding that trust can't be enforced - it must be earned and verified. We've built a team that deeply understands both traditional finance's trust requirements and decentralized technology's innovative potential. This unique perspective allows us to bridge the gap between stablecoins' instant settlement capabilities and institutional finance's trust requirements.

DRW's Kimberly Trautmann captures this well: "Notabene offers a comprehensive and efficient way to track and disclose who an asset is being sent to, which is critical for Virtual Asset Service Partners. We believe Notabene is positioned to be the provider of choice."

To Our Stakeholders

To our customers: Thank you for your trust. We're committed to being your long-term partner in building compliant digital payment infrastructure. This funding will help us serve you better and support your growth.

To our team: Your dedication to solving hard problems while maintaining the highest compliance and security standards has brought us here. We're just getting started.

To our investors: Thank you for believing in our vision. We're building infrastructure that will reshape how value moves around the world.

The Road Ahead

The next phase of finance will be defined by how successfully different types of institutions can work together. This isn't just about compliance or technology, it's about building an ecosystem where traditional banks, fintechs, and crypto companies can each maintain their identity while building meaningful trust relationships with others.

We see a clear path to stablecoins becoming the backbone of institutional settlement. The technology for instant, 24/7 settlement exists today—what's missing is the trust infrastructure to make it work at scale. By solving the critical challenges of pre-transaction authorization and institutional trust, we're removing the final barriers to widespread stablecoin adoption.

We're creating a world where a bank can instantly verify a crypto exchange's compliance credentials, a fintech can prove its trustworthiness to multiple partners simultaneously, and innovation doesn't come at the cost of trust. A world where institutions don't need centralized gatekeepers to trust each other because they have the tools to verify trust directly. A world where settling a cross-border payment is as instant and simple as sending an email but with all the trust and security that institutions require.

Our journey continues, and we're more excited about what's ahead. If you're interested in being part of building this trust-based future - whether as a customer, partner, or team member - we'd love to hear from you.

The future of finance is being built today, and it's being built on verifiable trust relationships between sovereign institutions. We're proud to be leading the way. Our vision of crypto being a key part of the everyday economy is closer than ever.

‍

‍

Pelle Brændgaard is the CEO and co-founder of Notabene. Follow him on Twitter @pelleb for more insights on the future of compliant digital payments.

When I spoke about the Dawn of Travel Rule at the GBBC Members Forum, I spoke about the importance of not only sending and receiving Travel Rule messages, but responding to them as well.

Why is this so important? Simply put, at this point in our Travel Rule timeline (5 years since first adoption), supervisory authorities are starting to evaluate the effectiveness of Travel Rule. This means taking a closer look at one key requirement, which is responding to Travel Rule messages. Depending on the jurisdiction, it is no longer okay to only send a transfer and state to a regulator that “As a VASP, I am Travel Rule Compliant”. You will have to also demonstrate that you have been responding to incoming messages from counterparties.

Why Responding Matters

As the industry evolves, responding accurately to Travel Rule requests is not just a "nice-to-have" feature; it’s a compliance obligation that can impact a firm’s ability to do business. Let’s take a closer look at some of the key reasons why.

1. Compliance Requirements

Many jurisdictions have regulations explicitly mandating that VASPs engage in a two-way dialogue for Travel Rule compliance. This means that merely sending the required information is not enough—you must also respond to missing or incomplete data, and provide follow-up information when requested by counterparties or authorities. Failure to do so can put your business at risk of non-compliance and possible subject to fines or penalties.

Let’s take a look at just a few jurisdictional regulations (this is not the exhaustive list) that emphasize not only the need to send and receive required information but also the importance of responding to travel rule messages. You might note that these rules are primarily in the context of providing required transfer details back when there is incomplete or missing information.

European Union

The EU’s Transfer of Funds Regulation (TFR) goes beyond requiring accurate originator and beneficiary information. It mandates that CASPs (Crypto Asset Service Providers) request missing details and actively respond to counterparty requests to rectify discrepancies. Specifically, Article 16(1) and Article 17 of the TFR require prompt follow-up and compliance checks. Full details at the bottom of this article.

United States

The FinCEN Travel Rule requires U.S.-based VASPs to provide specified information for transactions over $3,000. This includes responding to any queries or compliance checks from counterparties. Ignoring such requests or failing to engage can be seen as regulatory non-compliance, particularly in the context of suspicious transactions. Full details at the bottom of this article.

United Kingdom

Under the Money Laundering Regulations (MLR), VASPs are required to take proactive steps if information is missing or incomplete. For example, if a discrepancy is detected, the VASP must request the missing information, delay the transaction, or, in some cases, even return the crypto assets. Such procedures necessitate a robust response mechanism. Full details at the bottom of this article.

Singapore

Under the Payment Services Act (PSA), the Monetary Authority of Singapore (MAS) implements FATF’s Travel Rule. VASPs must gather, verify, and transmit required information, and are expected to “provide value transfer information” by a certain time frame which can only be done through a response. For example, the legislation states that “In a value transfer where the amount to be transferred is below or equal to S$1,500…….the ordering institution shall provide the value transfer originator information and value transfer beneficiary information set out in paragraph 13.4(a) to (d) within 3 business days of a request for such information…” Full details at the bottom of this article.

Across these global regulations, the emphasis is clear: while sending and receiving information is essential, responding to travel rule transfers is equally important. This includes engaging with counterparties to verify, request additional information, and ensure compliance with AML/CFT obligations. A lack of response or failure to follow up on incomplete or suspicious transfers can result in non-compliance and regulatory scrutiny.

2. Counterparty Trust and Business Relationships

VASPs are increasingly choosing to limit their transactions to compliant counterparties. This trend is evident in Notabene’s own research, where 66% of surveyed VASPs reported restricting withdrawals with entities that do not comply with the Travel Rule. Failing to respond to a Travel Rule message sends a strong signal to your counterparties that your business may not be fully committed to compliance, leading them to potentially cut off transactions altogether.

3. Operational Efficiency and Risk Management

Failing to respond promptly to Travel Rule messages can create bottlenecks in your transaction workflows, resulting in increased operational costs and slower settlements. Having an automated system like Notabene’s SafeTransact that not only sends and receives messages but also monitors and responds to them can help streamline compliance processes and reduce the risk of human error.

Real-World Implications: What Happens When You Don’t Respond?

If a VASP fails to respond to a Travel Rule message, several scenarios could unfold:

Regulatory Penalties and Fines

Non-compliance can result in significant fines or penalties from regulatory bodies.

Counterparty De-Risking

If a counterparty sees that you are not responding to compliance messages, they may choose to de-risk by ceasing all business activities with your VASP, resulting in lost revenue and a damaged reputation.

Loss of Market Access

As global jurisdictions begin implementing stricter compliance rules, VASPs that are flagged for non-compliance may find themselves unable to operate in key markets.

Notabene’s Approach: Streamlining and Automating Responses

The complexity of responding to Travel Rule messages often stems from inconsistent regulations across jurisdictions. Notabene’s solution simplifies this by offering a unified platform that helps businesses automatically detect missing or incomplete data, sends requests for clarification, and ensures compliance through automated responses.

Notabene’s SafeTransact for Networks automates the end-to-end compliance process, enabling customers to respond to Travel Rule requests in real-time, ensuring compliance without disrupting business operations.

Responding to Travel Rule messages is not just about meeting regulatory expectations; it’s about building trust in the industry. As the market matures, businesses that invest in compliance today will be best positioned to thrive tomorrow.

By actively responding to Travel Rule messages, your business is not only complying with global regulations but also paving the way for more secure and efficient transactions, making you a preferred partner for other VASPs and financial institutions.

Want to learn more about how Notabene’s solution can help streamline your Travel Rule compliance? Book a call with our team today.

‍

‍

Addendum

European Union (EU) - Transfer of Funds Regulation (TFR) (Regulation (EU) 2015/847)

Articles 16(1) and 17 of the Transfer of Funds Regulation outline the responsibilities of Crypto Asset Service Providers (CASPs) to ensure that all transfers include accurate and complete originator and beneficiary information. They also specify that CASPs must request missing information  from the sender's VASP and actively engage when information is incomplete. Responding  to these situations is crucial for compliance.

“crypto-asset service providers should ensure that the information on the ... originator and the beneficiary is not missing or incomplete.” (Par. 28)

“With the aim of assisting payment service providers and crypto-asset service providers to put effective procedures in place to detect cases in which they receive transfers of funds or transfers of crypto-assets with missing or incomplete information on the payer, payee, originator or beneficiary and to take effective follow-up action, “ (Par. 51)

“To enable prompt action to be taken in the fight against money laundering and terrorist financing, payment service providers and crypto-asset service providers should respond promptly to requests for information on the payer and the payee or on the originator and the beneficiary from the authorities responsible for combating money laundering or terrorist financing in the Member State where those payment service providers are established or where those crypto-asset service providers have their registered office” (Par. 53)

Further, according to the final Travel Rule Guidelines¹ by the European Banking Authority that accompany the TFR paragraph 56 states:

“Where the PSP, IPSP, CASP or ICASP requests required information that is missing, it should set a reasonable deadline by which the information should be provided. This deadline should not exceed three working days for transfers taking place within the Union, and five working days for transfers received from outside of the Union, starting from the day the PSP, CASP, IPSP or ICASP identifies the missing information”

¹https://www.eba.europa.eu/sites/default/files/2024-07/6de6e9b9-0ed9-49cd-985d-c0834b5b4356/Travel%20Rule%20Guidelines.pdf

‍

United States - Financial Crimes Enforcement Network (FinCEN) Travel Rule (31 CFR 1010.410)

The FinCEN Travel Rule mandates U.S. based VASPs (CVC’s) and financial institutions to collect, retain, and transmit specified information on fund transfers over $3,000. Responding to requests for additional details or missing information is required, particularly in suspicious cases or incomplete transfers.

“The money transmitter must obtain or provide the required regulatory information either before or at the time of the transmittal of value, regardless of how a money transmitter sets up their system for clearing and settling transactions, including those involving CVC” (Fincen Guidance FIN-2019-G001)

United Kingdom - The Money Laundering and Terrorist Financing (Amendment) (EU Exit) Regulations 2019

The UK’s Money Laundering Regulations (MLR) require VASPs to ensure full compliance with AML/CTF requirements, including receiving and transmitting required travel rule information.  Further, there are requirements around reporting to FCA those that do not provide the required information back. Hence this really underscores the responsibility of VASPs to respond to inquiries from counterparties and authorities when information is missing or insufficient.

“(2) Where the cryptoasset business of the beneficiary becomes aware that any information required by regulation 64C to be provided is missing or does not correspond with information verified by it under Part 3, the cryptoasset business of the beneficiary must— (a) request the cryptoasset business of the originator to provide the missing information; (b) consider whether to make enquiries as to any discrepancy between information received and information verified by it under Part 3; and (c) consider whether— (i) to delay making the cryptoasset available to the beneficiary until the information is received or any discrepancy resolved; and (ii) if the information is not received or discrepancy resolved within a reasonable time, to return the cryptoasset to the cryptoasset business of the originator. (3) In deciding what action to take under paragraph (2)(c) the cryptoasset business must have regard to— (a) the risk assessments carried out by the cryptoasset business under regulations 18(1) (risk assessment by relevant persons) and 18A(1) (risk assessment by relevant persons in relation to proliferation financing); and (b) its assessment of the level of risk of money laundering, terrorist financing and proliferation financing arising from the inter-cryptoasset business transfer……."

(5) The cryptoasset business of a beneficiary must report to the FCA repeated failure by a cryptoasset business to provide any information required by regulation 64C as well as any steps the cryptoasset business of the beneficiary has taken in respect of such failures.  (Par 64D)

Singapore - Payment Services Act (PSA) and FATF Travel Rule Implementation

Under the Payment Services Act (PSA), the Monetary Authority of Singapore (MAS) implements FATF’s Travel Rule. VASPs must gather, verify, and transmit required information, and are expected to “provide value transfer information” by a certain time frame which can only be done through a response. For example,  “In a value transfer where the amount to be transferred is below or equal to S$1,500…….the ordering institution shall provide the value transfer originator information and value transfer beneficiary information set out in paragraph 13.4(a) to (d) within 3 business days of a request for such information…….”

As of 30 December 2024, compliance with the Transfer of Funds Regulation (TFR) and respective EBA Guidelines is mandatory for any CASPs operating in the EU.

▶︎ Watch this special video message from Lana Schwartzman, Head of Regulatory & Compliance at Notabene, explaining why compliance with TFR is so important, as what consequences may face CASPs that fail to comply.

A common misconception that we hear is that there is a “grace period” that delays the need to comply until July of this year. While it is true that the EBA guidelines foresee a transitional period until July 31, 2025, during which CASPs may exceptionally use infrastructures or services with certain technical limitations, this does not exempt them from Travel Rule compliance. CASPs using such infrastructures are required to take additional technical steps to ensure full compliance with the Travel Rule during this period.

This provision from the EBA Guidelines gave rise to misinterpretations that many are now incorrectly viewing as a grace period or exemption. The EBA already clarified that this is not the case. In page 51 of the final Guidelines “the EBA stresses that non-compliance with Regulation (EU) 2023/1113 is not accepted”. In fact, paragraph 24 of the EBA Guidelines clearly states that the technical limitations “need to be compensated by additional technical steps or fixes to fully comply with these Guidelines”.

It is therefore very clear that the TFR obligations must be fully complied with as of December 30, 2024. 

CASPs that repeatedly or systematically fail to accompany crypto-asset transfers with the required information on the originator and beneficiary may face severe penalties and consequences under the Transfer of Funds Regulation and related EU directives. All told, the risks that a company faces by not complying with TFR are substantial. 

Let’s have a look at the potential consequences of non-compliance with the TFR.

1. Financial Penalties

One of the most immediate and tangible consequences of non-compliance is the imposition of financial penalties. These can be substantial and may vary depending on the severity of the breach and the specific regulations in each EU member state. The regulation allows for substantial monetary sanctions:

• Standard Penalty: A maximum administrative fine of at least twice the amount of the benefit derived from the breach (if determinable) or a minimum of €1,000,000.
• Enhanced Penalties for Financial Institutions: For CASPs classified as credit or financial institutions, the penalties can be more severe:
  • Legal Persons: Fines of up to €5,000,000 or 10% of the total annual turnover, whichever is higher.
  • Natural Persons: Fines of up to €5,000,000

Keep in mind that penalties can accumulate, potentially resulting in daily fines. In addition, increased compliance costs and operational burdens may be necessary to resolve deficiencies, resulting in additional financial burden.

*Source: Article (3) of Directive (EU) 2015/849

2. Criminal and Administrative Sanctions

In more severe cases, particularly those involving deliberate non-compliance or gross negligence, entities and individuals may face criminal or administrative sanctions. This can include:

• Criminal liability for Chief Compliance Officers (CCOs) or executives responsible for overseeing AML/CFT protocols
• Administrative sanctions that could significantly impact business operations
  • Public Statement: Authorities may issue a public statement identifying the CASP and detailing the nature of the breach.
  • Cease and Desist Order: The CASP may be ordered to stop the non-compliant behavior and refrain from repeating it.
  • Authorisation Suspension or Revocation: For authorized CASPs, their operating license may be suspended or withdrawn entirely.
  • Managerial Ban: Individuals responsible for the breach, including those in managerial positions, may face a temporary ban from exercising managerial functions in obliged entities.

  *Source: Article 29 of the TFR and Article 59(2) and (3) of Directive (EU) 2015/849)

3. Regulatory Sanctions

While exact details may vary, it's likely that regulatory sanctions for non-compliance could be severe:

• Suspension or revocation of operating licenses within the EU
• Restrictions on certain activities or prohibitions on cross-border crypto-asset transfers

4. Reputational Damage

In the highly regulated EU market, reputation is crucial. Non-compliance can lead to:

• Loss of trust from customers and partners
• Negative publicity that can be challenging to overcome
• Long-term impact on business relationships and growth opportunities

5. Heightened Regulatory Scrutiny

Entities found to be non-compliant will likely face increased attention from regulators:

• More frequent audits and inspections
• Increased reporting obligations, adding administrative burdens and costs
• Requirements to submit additional documentation to demonstrate compliance improvements

6. Counterparty Risks

Non-compliance can also affect business relationships, as partners may be hesitant to work with non-compliant entities, leading to lower transaction volumes and overall business success.

• Counterparties may report non-compliance to regulators. CASPs must report the repeatedly non-compliant counterparties to the competent authority responsible for Anti-Money Laundering/Counter-Terrorist Financing (AML/CTF) supervision within three months of identifying the non-compliance.
• Counterparties of CASPs that repeatedly or systematically fail to accompany crypto-asset transfers with the required information on the originator and beneficiary may be required to reject incoming transfers and terminate the existing business relationship or all reject future transfers from the non-compliant counterparty.

While no one has a crystal ball, the consequences of non-compliance with the EU's TFR after December 30th, 2024, are far-reaching and potentially severe. From financial penalties to reputational damage, the possible risks suggest that CASPs and other obligated entities should take seriously the need to be fully prepared with a TFR-ready Travel Rule solution when the regulation comes into force.

As the Head of Regulatory and Compliance at Notabene, I've been at the forefront of discussions about one of the most pressing issues keeping compliance officers awake at night: How do you handle non-compliant deposits under the Travel Rule in the EU and other jurisdictions?

The implementation of the Travel Rule is an essential step in ensuring compliance with anti-money laundering (AML) and counter-terrorist financing (CTF) regulations. But this regulatory evolution brings a real challenge—how should Crypto Asset Service Providers (CASPs) respond when they receive non-compliant deposits? The issue isn’t only theoretical; it’s something that every CASP will face.

The Challenge of Non-Compliant Deposits

With the implementation of the Travel Rule, non-compliant deposits are an inevitable reality. These can arise from various scenarios(^1) that beneficiary CASPs must be prepared to address such as:

1. Deposits originating outside of approved CASPs
2. Deposits from approved CASPs with insufficient Travel Rule information
3. Deposits from approved CASPs with inconsistent beneficiary information
4. Deposits from approved CASPs where the originator is not an allowed person 

Without a clear policy or well-defined workflow, the risks are high and these issues can disrupt the user experience, complicate operations, and even lead to asset loss. Each scenario requires a well-thought-out policy and workflow to address it effectively while minimizing disruption to user experience.

Non-Compliance Under the EU’s TFR (Regulation 1113/2023)

In the EU, Travel Rule under the TFR (Regulation 1113/2023)(^2) places significant responsibility on beneficiary CASPs. Articles 14, 16, and 17 of the regulation clearly outline the need for accurate originator and beneficiary information to be included with each transaction. The challenge lies in the fact that beneficiary CASPs can't proactively block incoming deposits. They must rely on the originating CASP's compliance to meet their obligations. This creates a complex situation where beneficiary CASPs must navigate between regulatory compliance and customer service. Despite beneficiary CASPs having less control over incoming deposit flows than originating CASPs, they must still enforce compliance, using methods such as post-monitoring or suspending suspicious transactions.

Under Article 17, CASPs must implement risk-based procedures to determine whether to execute, reject, return, or suspend transfers of crypto-assets that lack the required information. Non-compliant transactions must be carefully reviewed, with potential responses ranging from requesting missing data to returning the crypto-assets to the originator.

But the process isn't simple. For instance, a transfer may originate from a wallet that no longer belongs to the sender. Or, the originator may have no account with an approved CASP. How do you return the funds then? The answers are not always straightforward, and the EU’s TFR leaves room for a risk-based approach to address these scenarios.

Developing a Policy for Travel Rule Non-Compliant Deposits

At the heart of handling non-compliant deposits is the necessity of a clear, risk-based policy which is part of every industry best practice. This policy must account for several key steps:

1. Withhold assets until compliance is achieved: If the necessary Travel Rule information is missing, the assets should not be made available to the beneficiary until compliance is ensured. This may require collecting additional information or performing enhanced due diligence.
2. Return non-compliant assets promptly: Where compliance cannot be achieved, CASPs should have clear procedures for returning the assets to the originator. This process should be timely to avoid user frustration while ensuring that the return itself is secure and complies with AML/CTF obligations.
3. Avoiding technical complications in the return process: Blockchain transactions, particularly those involving aggregated wallets, present additional challenges. Simply sending the funds back to the originating address may not always be feasible or safe. Instead, CASPs should establish secure, alternative methods to return funds while protecting against illicit activity.
4. Reassess relationships with non-compliant counterparties: CASPs should monitor their counterparties’ compliance levels. Repeated non-compliance from a particular CASP may necessitate reevaluating the relationship, issuing warnings, applying enhanced due diligence, or even terminating the partnership. And let's not forget that there is a requirement of reporting of non-compliance of CASPs to national authorities. 
   

The Return Dilemma

One of the most challenging aspects of handling non-compliant deposits is the return process. The FATF guidance and local regulations don't prescribe specific requirements for return policies, leading to varied practices among VASPs.
Key considerations for a return policy include:

1. Where to return the assets
2. Who to return the assets to
3. Whether Travel Rule compliance applies to the return transaction

While there’s no universally accepted answer, the principle of reliability and a risk-based approach may guide your actions. For instance, can you confidently rely on a blockchain address used in a Travel Rule message for returning assets? Often, the answer is no. Wallet addresses change, can become dormant, and may result in commingled assets. 

A more cautious approach is to confirm the originator’s identity and account details through both on-chain screening and direct communication with the counterparty. This ensures that the return process doesn’t inadvertently violate AML/CTF rules.

These are the practical steps for compliance that you can take:

1. Develop clear policies for handling non-compliant deposits
2. Implement robust monitoring systems to detect non-compliant transactions
3. Establish a detailed workflow for the return process
4. Communicate policies clearly to users to minimize disruption
5. Regularly reassess relationships with repeatedly non-compliant counterparties

Notabene’s Role: Helping CASPs Navigate Non-Compliance

At Notabene, our platform helps CASPs identify and manage non-compliant CASPs with precision. By offering insights into missing Travel Rule data and alerting users to potential non-compliant transactions, we help CASPs maintain compliance while minimizing disruption. Additionally, our reporting tools allow CASPs to generate comprehensive lists of non-compliant transactions, simplifying their decision-making process and enhancing their regulatory reporting.

The Path Forward: A Risk-Based Approach

Handling non-compliant deposits under the Travel Rule is complex, but not insurmountable. As the regulatory landscape continues to evolve, staying informed and adaptable will be key to success in the world of crypto compliance. The road ahead may be challenging, but with the right policies, workflows, and tools such as Notabene in place, compliance can be achieved without sacrificing user experience. At Notabene, we’re committed to helping CASPs and regulators strike this critical balance.

If you would like to speak with Notabene about  implementing a risk-based compliance solution for your unique needs, book a call with our team today.
‍

References

^1 This is not an inclusive list
^2 https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32023R1113

Differences between national Travel Rule requirements can be challenging for VASPs to navigate. Various regulators have interpreted and applied the Travel Rule differently, leading to various approaches across jurisdictions regarding:

• Timeline for enforcement of Travel Rule requirements

• Required originator and beneficiary information

• Compliance thresholds

• Transactions to/from self-hosted wallets

• Counterparty VASP due diligence obligations

• Transacting during the Sunrise Period

A transaction could be within the scope of Travel Rule requirements for one counterparty and outside the scope for the other. This issue is especially complex during the Sunrise Period. Even after the Travel Rule is fully implemented, national framework differences will likely continue to cause friction for VASPs.

‍

Practical examples to illustrate these challenges

In Estonia, virtual asset service providers (VASPs) are not required to collect or transmit beneficiary names. However, a beneficiary VASP in another jurisdiction may expect to receive beneficiary information and could be obliged to reject transactions where this information is missing.

Canadian originator VASPs must collect and transmit the beneficiary’s physical address. However, originator VASPs in other jurisdictions may not have this requirement. As a result, Canadian VASPs may often receive incomplete information that nonetheless meets the requirements of the originator VASP’s domestic framework.

In the United States, an originator VASP is required to collect and transmit Travel Rule information only when the transaction exceeds $3,000. In contrast, a beneficiary VASP in the European Union requires this information for transactions of any value.

‍

A non-exhaustive list of the differences in required originator and beneficiary information across jurisdictions

Approaches to the Challenges of Cross-Border Transactions

Below we discuss what can be done about the challenges associated with cross-border transactions, initiatives that are already in place, and which stakeholders are best positioned to drive solutions to these challenges:

FATF

Although global harmonization of Travel Rule requirements would certainly solve these challenges for VASPs, this is not a realistic solution and is not something that the Financial Action Task Force (FATF) would or could mandate. National frameworks will also inevitably vary because, as the FATF points out, regulators take into account different risk profiles, contexts, and approaches to risk mitigation. [1] As such, the FATF Standards permit variation from the FATF’s Travel Rule, provided the minimum requirements are met.

REGULATORS

It is essential that regulators implement clear Travel Rule requirements for VASPs and that the frameworks address how VASPs should treat cross-border transactions where the requirements vary.

The U.K.’s Joint Money Laundering Steering Group's (JMLSG) guidance addresses this by ignoring cross-border discrepancies in the Travel Rule’s application. For instance, if a U.K. VASP complies with U.K.-specific requirements, it’s considered compliant even when dealing with jurisdictions that have more stringent rules. ^[2] On the other hand, if a U.K. VASP receives a deposit with incomplete or incorrect information, it must seek the missing details, irrespective of the originating VASP’s local thresholds. ^[3] 

We encourage the adoption of a more flexible deposit policy than the one that theJMLSG has adopted to facilitate smoother cross-border transactions. For example, a more lenient policy could permit VASPs to accept deposits without full Travel Rule information for transactions below the threshold set in the originating VASP’s country based on a risk assessment.

TRAVEL RULE SOLUTIONS

Travel Rule solutions are generally best positioned to ease some of the challenges for VASPs in facilitating cross-border transactions, especially when these transactions are happening at scale.

Notabene embeds jurisdictional requirements from more than 20 jurisdictions. Specifically, the system has encoded the applicable compliance thresholds and required information scope in each supported jurisdiction. This allows VASPs to validate their Travel Rule transfers against the Travel Rule requirements applicable in both their own and their counterparty’s jurisdiction. Using the available settings, VASPs can decide whether a Travel Rule transfer is required for a given transaction. They can make this decision based on their own compliance threshold or by considering the lowest threshold amount of the jurisdictions involved in the transaction.

VASPS

VASPs’ Travel Rule policies and processes should proactively address cross-border transactions. These policies need to take into account the differences across national frameworks and what actions are mandated by applicable domestic regulations. Additionally, partnering with the right Travel Rule solution can remove some of the operational complexity associated with cross-border transactions. When assessing different options, VASPs should closely assess the solution’s jurisdiction coverage and functionality when it comes to cross-border transactions.

‍

Notabene’s 2024 status check

‍

From a technical perspective, the differences in Travel Rule requirements across jurisdictions can be effectively reconciled. Solutions like Notabene’s jurisdictional validation are key in the process. However, from a policy perspective, it is crucial to ensure that VASPs are free to transact with foreign counterparties, despite the differences in requirements.

A risk-based approach that allows decisions on whether to accept transactions with missing information should be adopted. This flexibility is necessary in cases where the originator VASP is not legally obligated or able to provide the required information. Adopting stricter approaches might, in practice, prevent VASPs from accepting a significant number of transactions from their foreign counterparts.

‍

{{report2="/cta-components"}}

‍

Since the Travel Rule was first applied to cryptocurrency by FinCEN in 2019, and with the Financial Action Task Force (FATF) following suit with its own related recommendations, self-hosted wallets (also known as non-custodial wallets) have come under increased scrutiny.

In October 2021, FATF released its Updated Guidance for a Risk-Based Approach to Virtual Assets and Virtual Asset Service Providers (VASPs). This guidance builds upon FATF’s initial 2019 recommendations, including directives on peer-to-peer (P2P) transactions—cryptocurrency exchanges that occur without the involvement of a VASP or other obliged entity. 

While the standards do not apply to transactions solely between self-hosted wallets, FATF highlighted the potential money laundering and terrorist financing (ML/TF) risks they pose. Moreover, FATF clarified that transactions involving self-hosted wallets can fall under the scope of the Travel Rule under certain circumstances.

VASPs: What to Expect When Transacting With Self-Hosted Wallets

VASPs face significant implementation challenges due to varying regulatory requirements across jurisdictions. 

• In regions such as the EU, UK, and Gibraltar, VASPs are required to collect information on their clients' self-hosted wallets. 
• In Singapore and Germany, VASPs must go a step further and verify the identity of the self-hosted wallet owner. 
• Liechtenstein mandates enhanced due diligence.
• Switzerland requires both identity verification and proof of ownership.

Many in the cryptocurrency community have expressed concerns about these measures. Since blockchain is inherently public, sharing personal information associated with a self-hosted wallet could potentially expose the entire transaction history of that client, going beyond what the Travel Rule requires from traditional financial institutions.

Despite these concerns, VASPs must integrate solutions and establish processes to comply with FATF’s recommendations. 

Below is an overview of what FATF expects from VASPs when interacting with self-hosted wallets:

‍

1. Obtain the Originator and Beneficiary Information from the VASP’s Customer (¶ 295)

When sending or receiving a virtual asset transfer to a self-hosted wallet, the originator and beneficiary information must be obtained from the VASP’s customer, as there is no other VASP from which to obtain the information. This requirement generally applies to transactions above USD 1,000/EUR, but this threshold might vary depending on how jurisdictions implement it.

To remain compliant, VASPs must collect all the necessary Travel Rule information, such as names, account numbers or wallet addresses, addresses or IDs, birth dates, and birthplaces, without compromising user experience. 

Blockchain analysis solutions like Chainalysis KYT enable VASPs to identify Travel Rule transactions, ensuring frictionless data collection automatically. In combination with solutions like Notabene, VASPs can gather the necessary data in a user-friendly way and automatically detect the jurisdictional requirements and thresholds applicable to each transaction.

‍

2. Enforce AML/CTF Obligations (¶ 295 & 296)

Travel Rule guidance applies only above certain thresholds, which vary depending on the jurisdiction. However, VASPs are required to perform Know Your Customer (KYC) checks and implement transaction monitoring, regardless of whether their customer’s transactions meet the Travel Rule requirements.

Tools like Notabene can assist compliance teams in efficiently implementing the data collection and verification process for the owner of a self-hosted wallet. Integrating a Travel Rule solution with an automated transaction monitoring tool allows VASPs to identify which transactions meet the Travel Rule threshold immediately. Additionally, these tools help compliance teams automatically detect if transactions are related to potential high-risk activities and take action when historical transactions become risky in light of new regulatory information through continuous monitoring.

Implementing the right solution enables compliance teams to adapt more efficiently to ongoing industry changes. If a solution flags a high number of false positives, analysts may have to allocate significant time to investigating non-critical alerts. Worse still, incorrect data could lead them to draw inaccurate conclusions.

‍

3. Implement Additional Risk Mitigation Measures (¶ 297)

Additional risk mitigation measures may be necessary when interacting with self-hosted wallets. FATF’s guidance considers transactions with self-hosted wallets potentially higher risk, providing VASPs with options to treat them accordingly. These measures can range from imposing additional limitations and controls to avoiding interactions with self-hosted wallets altogether.

FATF advises VASPs to observe patterns of conduct, evaluate local and regional risks, and review information and bulletins issued by regulators and law enforcement to form their own risk assessments. Although this recommendation is optional, it raises concerns about the potential impact on industry adoption, as self-hosted wallets are integral to the cryptocurrency ecosystem. They are commonly used for legitimate purposes, such as securely moving funds and holding long-term investments.

Blockchain analysis tools can equip VASPs with the necessary data regarding self-hosted wallets to conduct comprehensive risk assessments, mitigate risks, and support their decisions in front of regulators.

‍

‍Global Approaches to Self-Hosted Wallet Regulation

VASPs face numerous challenges due to differing requirements across jurisdictions. The FATF’s third targeted update on the global implementation of its standards revealed that around 70% of jurisdictions are still undecided on their approach to transactions between VASPs and self-hosted wallets. Among the jurisdictions that have made decisions, about 40% align with FATF recommendations, requiring VASPs to collect relevant beneficiary or originator information from their customers. Additionally, 25% of these jurisdictions have implemented mitigation measures or transaction limitations, such as identity verification of self-hosted wallet owners or enhanced due diligence procedures.

• In Liechtenstein, VASPs are not required to apply the Travel Rule to transactions with self-hosted wallets. However, they must enforce enhanced risk mitigation measures, such as using blockchain analytics to assess transaction risks, collecting documentation on the purpose of the transaction, and requiring customers to prove ownership of their self-hosted wallets when transacting with them.
• Japan closely aligns with FATF recommendations. VASPs in Japan are required to collect the necessary information from their customers regarding the owner of the self-hosted wallet involved in a transaction. However, there is no obligation to verify this information. This approach, requiring data collection without verification, is widely adopted and can also be seen in jurisdictions like Gibraltar and the European Union for transactions amounting to 1,000 EUR or less.
• The European Union follows a stringent approach when dealing with self-hosted wallets, as outlined in the revised Transfer of Funds Regulation. For transactions exceeding 1,000 EUR, European CASPs (Crypto Asset Service Providers) must verify the ownership of the self-hosted wallet, whether they are sending or receiving funds. This wallet ownership verification requirement aligns with FATF recommendations and is similarly applied in other jurisdictions like Hong Kong and Portugal.
• Switzerland has adopted one of the strictest approaches to self-hosted wallet transactions. Under Article 10 of FINMA’s guidelines, Swiss VASPs are required to identify and verify the identity of the self-hosted wallet owner, regardless of whether the transaction involves another VASP or a self-hosted wallet. This requirement ensures that VASPs can prevent problematic payments by ensuring all transactions meet stringent identity verification standards.

‍

What the data says about self-hosted wallets

In December 2020, when the Treasury’s 72-page NPRM for transactions with self-hosted wallets and certain foreign jurisdictions came out, Chainalysis analyzed the data on cryptocurrency transactions involving self-hosted wallets.

The data shows that the majority of the funds held in self-hosted wallets often come from VASPs, which are related to investing purposes or are used by individuals or organizations to move funds between regulated exchanges. It is important to mention that the 2021 data didn’t vary significantly in comparison to the 2020 analysis. There are still three trends related to the usage of self-hosted wallets.

1. The vast majority of the Bitcoin funds transferred to self-hosted wallets came from VASPs

During Q3 of 2021, almost 83% of the bitcoin sent from one self-hosted wallet to another originated from cryptocurrency exchanges, and only 2% came from illicit services. This means that in the vast majority of cases, law enforcement can investigate illicit activity related to self-hosted wallets by working with cryptocurrency exchanges, which are obligated entities, and obtaining KYC information from them through legal process.

2. The majority of bitcoin sent to non-VASPs are eventually sent to a VASP

Many transfers sent and received by self-hosted wallets have VASPs on the other side of the transaction. If cryptocurrency is being used for illicit purposes, criminals will eventually need to cash out their illicit proceeds. This means going through a cryptocurrency exchange (we can see this behavior reflected in our data). As long as they are in a country that regulates cryptocurrency exchanges – and this list is growing – exchanges will collect KYC information. Access to this information is vital to financial crime investigations.

During Q3 2021, the percentage of funds that were not sent to an exchange service decreased from 29% to 18% in comparison with Q2 2020. Meanwhile, the percentage of funds sent to exchanges increased from 62% to 71%. This means that crypto holders moved the funds they were holding inside self-hosted wallets to an exchange, maybe to take out some profits due to the crypto bull market we experienced this year.

‍

3. The transaction activity levels among self-hosted wallets highly suggest that their primary use is for investment

After funds are deposited to a self-hosted wallet from an exchange, the percentage of bitcoin moved to another self-hosted wallet in a given month is significantly low. The majority of the bitcoin stays in the original wallet for a long period of time. On average, the funds originated from a VASP to self-hosted wallets move only once a month, which likely indicates that the primary use case is investment.

Chainalysis’ robust blockchain dataset provides key insights into the role of self-hosted wallets in the cryptocurrency ecosystem. If the main purpose of these regulatory requirements is to decrease illicit transactions and avoid money laundering, targeting self-hosted wallets may not accomplish the intended objective.

Chainalysis's blockchain analysis data makes it clear that self-hosted wallets are not inherently risky and do not inhibit law enforcement’s ability to investigate the illicit use of cryptocurrency. Blockchain analytics can inform risk analysis and compliance programs so that compliance teams can mitigate risks responsibly and effectively.

What’s next?

Travel Rule guidelines have already been released by the regulators and VASPs have a deadline to build compliance programs to comply with it. We know this process can be overwhelming, but luckily, there are many available solutions to facilitate this process for VASPs, and there will likely be many more as the cryptocurrency industry continues to overlap with the traditional financial system.

Chainalysis and Notabene have created an integrated solution that helps VASPs save time and money while looking to meet the complete Travel Rule requirements and build their own risk assessment on self-hosted wallets.

Our integration covers a variety of compliance needs that can simplify the technical and operation integration process. Notabene’s end-to-end Travel Rule solution provides counterparty wallet identification tools, a VASP due-diligence directory, and a secure dashboard to help financial institutions manage counterparty risks without hindering user experience. In conjunction with Chainalysis, VASPs can immediately identify counterparties’ wallet types, get automatic transaction alerts on risky activity, and perform continuous monitoring, all in one place.

Choosing the right partners can save compliance teams time, resources, and protect the company from additional regulatory scrutiny or even fines.

Contact the Chainalysis and Notabene teams for more information.

The Travel Rule requires Virtual Asset Service Providers (VASPs) to identify and conduct due diligence on their counterparty VASP or financial institution. However, national Travel Rule frameworks tend to be silent or vague on this topic.

Conducting VASP due diligence generally involves obtaining information about the counterparty VASP’s registration/licensing status, its ability to securely hold Travel Rule information, whether it is tied to illicit actors or sanctioned persons, and its level of anti-money-laundering, counter-terrorism financing (AML/CTF) compliance. The aim of performing this due diligence is to ensure that VASPs avoid dealing with illicit or sanctioned actors and to gain assurance that a counterparty VASP can comply with the Travel Rule and protect the confidentiality of shared information.

‍

Counterparty VASP Due Diligence Challenges Faced by VASPs

VASPs face three main challenges in implementing due diligence processes:

1. Difficulty Accessing Information

Beyond identifying counterparties, VASPs struggle to make risk-based decisions due to the scarcity of publicly available information. Verifying whether a counterparty VASP is licensed or registered is particularly hard given the limited number of public registers. Furthermore, assessing a VASP’s adherence to AML/CTF standards is challenging without directly engaging each potential counterparty, which becomes impractical at scale.

2. Lack of Standardization

Currently, there is no uniform standard for conducting VASP due diligence. Additionally, national frameworks for the Travel Rule often lack clear criteria for due diligence.

3. Operational Costs

Conducting VASP due diligence requires resources, which involve either purchasing the relevant compliance tools (to the extent they are available) and/or allocating personnel to perform these due diligence assessments.

‍

The FATF acknowledged these challenges in its June 2023 Targeted Update, reporting that VASPs struggle to effectively conduct due diligence on counterparty VASPs ^[1]. This difficulty is further exacerbated by the existence of unregulated and unlicensed VASPs, making it even more challenging to gather information to assess these entities’ possible connections to illicit activities or sanctioned individuals, as well as their compliance with AML/CTF standards. Notabene’s industry survey supports these observations. Despite the significant drop in prominence since last year, a notable percentage of respondents (29%) continues to send Travel Rule information transfers to all VASPs, regardless of any due diligence assessment. Additionally, counterparty due diligence ranks as the least adopted compliance check among respondents, only ahead of the options “None” and “Other” (see Chapter 3, Section 8 of Notabene’s 2024 State of Crypto Travel Rule Compliance Report).

Approaches to VASP Due Diligence Challenges

FATF

The FATF can do little to solve the operational challenges associated with a VASP’s due diligence process apart from sharing recommendations on how a jurisdiction should implement VASP due diligence requirements. As such, the FATF does the following:

• Makes a clear distinction between the due diligence process required for establishing a correspondent relationship and the process required for Travel Rule purposes ^[2].
• Strongly encourages jurisdictions to maintain and publicize information on VASPs that are registered or licensed in their jurisdiction, to give VASPs access to information needed to perform counterparty due diligence in line with Recommendations 16 and 13 ^[3].
• Clarifies that VASPs need to independently perform due diligence ^[4] — a contentious point that has hindered Travel Rule interoperability efforts. Operators of Travel Rule protocols may resist interoperability to maintain control over the network. However, the FATF emphasizes that VASPs must still independently assess counterparty risk, highlighting that being part of closed Travel Rule networks does not eliminate a VASP’s need to verify information and meet domestic obligations.
• Suggests that the Wolfsberg Correspondent Banking Due Diligence Questionnaire be used as a starting point for the VA industry to develop its own risk-based best practices ^[5].

Regulators

It is not desirable that national regulators specify prescriptive criteria for conducting VASP due diligence, yet it is necessary that regulators understand the current challenges associated with evaluating counterparty VASPs and thus provide VASPs with practical guidance. In 2023, Hong Kong’s SFC offered valuable granularity in their detailed guidance on counterparty due diligence measures ^[6], identifying several criteria that VASPs should consider to determine whether a counterparty is eligible, such as the quality and effectiveness of regulations and supervision, the Travel Rule status in their jurisdiction, and the existent AML/CTF and data protection controls.

‍
National legislators and regulators should also strive to adhere to FATF guidelines on this topic to facilitate the emergence of a global standard for VASP due diligence. However, the European Transfer of Funds Regulation deviates from FATF guidelines by labeling the relationships between domestic CASPs and foreign VASPs as correspondent relationships due to their “ongoing and repetitive” nature. This divergence raises concerns about proportionality and scalability.
‍

Regulators may also consider incorporating exceptions for carrying out due diligence when appropriate, such as in the context of transactions between domestic VASPs that are both supervised by the same authority, or prescribing scenarios where simplified due diligence measures are permissible.

Joint Industry Initiatives

Finding solutions to some of the challenges associated with VASP due diligence can be championed by joint industry initiatives. In fact, there is already work underway to address this.
‍

In 2023, the Global Digital Finance (GDF) members association published the GDF Virtual Asset Due Diligence Questionnaire ^[7]. The questionnaire was designed to provide an overview of a VASP’s AML policies and practices, and it is suggested that VASPs use it to onboard counterparty VASPs or that financial institutions use it to onboard VASPs.

Travel Rule Solutions

Travel Rule solutions and other service providers can offer tools to assist VASPs in operationalizing and scaling due diligence efforts.

‍
Notabene customers can easily access and monitor their counterparties within the Notabene Network. By integrating with VASPNet and Global Legal Entity Identifier Foundation (GLEIF), Notabene provides real-time, verified data about counterparty VASPs’ regulatory statuses and incorporation information. Furthermore, VASPs can also request, review, and share an adapted version of GDF’s questionnaire between selected parties in a secure and encrypted manner.

‍

{{cta-learnmore10="/cta-components"}}

‍

VASPs

VASPs are encouraged to engage in global and local industry initiatives focused on VASP due diligence. Considering the significant impact of VASP due diligence on Travel Rule compliance, it is important that VASPs keep this in mind when selecting a Travel Rule solution to partner with.

Additionally, VASPs should cooperate with their counterparty’s due diligence efforts by providing any requested information. Ideally, VASPs should make their information available to as wide a network of trustworthy counterparties as possible. This would enable other VASPs to conduct due diligence more efficiently.

Notabene’s 2024 Status Check

In 2023, there was significant progress in clarifying and operationalizing counterparty due diligence obligations. The FATF clarified that this due diligence must be carried out independently, which helped the industry to advance with a unified understanding of these obligations. The publication of GDF’s questionnaire was a substantial contribution toward standardizing VASP due diligence. As detailed in Chapter 3, Section 8, our survey results indicate a substantial shift: the proportion of VASPs sending Travel Rule transfers to all counterparts without specific criteria dropped from 52% in 2023 to 29% in 2024. This change highlights a growing commitment to counterparty due diligence obligations.

‍

{{report2="/cta-components"}}

The European Union's Transfer of Funds Regulation (TFR) and the associated Travel Rule Guidelines from the European Banking Authority (EBA) are set to significantly impact how Crypto Asset Service Providers (CASPs) handle crypto-asset transactions. As these regulations come into effect, it is crucial for CASPs to understand the key requirements and prepare for compliance. 

This blog highlights the top 10 things European CASPs need to know about the upcoming Travel Rule compliance enforcement.

1. Comprehensive Data Collection Requirements

Under Article 14, paragraphs 1 and 2 of the TFR, CASPs must ensure that all transfers include specific details about the originator and beneficiary.

This includes:

Natural persons

Legal persons

This comprehensive data collection ensures that all parties in a transaction can be unambiguously identified.

2. Robust Monitoring Systems

Beneficiary CASPs must implement robust monitoring systems to detect and manage non-compliant transactions. These systems should be capable of identifying missing, incomplete, or meaningless information and should align with the risk levels associated with money laundering and terrorist financing. ^[1]

{{european2="/cta-components"}}

3. Handling Non-Compliant Transactions

When a transaction lacks the required information, CASPs have four options: execute, reject, return, or suspend the transfer. The appropriate action depends on the specific circumstances and the risk assessment results. ^[2]

4. Managing Non-Compliant Counterparties

Repeated non-compliance by counterparties requires CASPs to reassess their relationships. This includes applying stricter monitoring and verification measures, potentially terminating business relationships, and reporting non-compliant counterparties to the relevant authorities. ^[3]

5. Verifying Self-Hosted Wallet Transactions

For transactions involving self-hosted wallets, the requirement to use two methods for wallet ownership verification has been removed. CASPs are now required to use only one method by default for verifying wallet ownership/control. ^[4]

6. Understanding Different Self-Hosted Wallet Transaction Scenarios 

The TFR categorizes self-hosted wallet obligations based on the transaction amount and whether the wallet owner is a customer of the CASP. These scenarios include transactions of 1,000 euros or less, transactions over 1,000 euros where the wallet owner is a CASP customer, and transactions over 1,000 euros where the wallet owner is not a CASP customer.

‍

7. Implementing Appropriate Risk Mitigation Measures on Self-Hosted Wallet Transactions

CASPs should adopt a risk-based approach to transactions involving self-hosted wallets and implement any necessary risk mitigation measures proportional to the identified risks. These measures may include verifying the identity of the transfer's originator or beneficiary, requesting additional information, and conducting enhanced ongoing monitoring of transactions. ^[5]

8. Ensuring Compliance with General Obligations

CASPs must ensure compliance with several general obligations, such as:

• Information transmission infrastructure: Must be fully capable of transmitting information without technical limitations. A transitional period until July 31, 2025, allows for exceptions with compensatory policies in place. ^[6]
• Compliance timing: Information must be transmitted immediately and securely, before or at the same time the crypto-asset transfer is completed. ^[7]
• Joint accounts: Transfers from joint accounts, addresses, or wallets must include information about all holders. ^[8]‍
• Information submission changes: Initial information submissions cannot be changed unless requested by the beneficiary CASP or if an error is identified. Subsequent CASPs must be informed and required to detect any missing or incomplete information. ^[9]

9. Evaluating Payment and Messaging Systems (Travel Rule solutions)

Payment and messaging system requirements: CASPs must evaluate selected messaging or payment protocols based on the following aspects:

• Communication with internal core systems and counterparty messaging or payment systems.
• Compatibility with other blockchain networks.
• Reachability, including the ability to reach counterparties and the success rate of transfers.
• Detection of transfers with missing or incomplete information.
• Data integration, security, and reliability. ^[10]

10. Preparing for the Future

By July 1, 2026, the European Commission will assess the necessity for additional measures to mitigate risks associated with self-hosted wallet transactions. This evaluation will encompass examining the efficacy and proportionality of verification mechanisms and considering potential restrictions. ^[11]

‍

{{european1="/cta-components"}}

‍

The upcoming Travel Rule compliance regulation imposes comprehensive requirements on CASPs to ensure the integrity of crypto-asset transactions. By understanding and adhering to these requirements, CASPs can effectively manage transaction information, monitor compliance, handle non-compliant transactions, and manage relationships with non-compliant counterparties. This regulatory framework not only helps in mitigating risks associated with money laundering and terrorist financing but also fosters a more secure and transparent crypto-asset ecosystem in the European Union.

‍

Want to learn more? Read our blogs on beneficiary VASPs' transaction requirements under the TFR and the upcoming self-hosted wallet requirements.