EU Crypto Travel Rule: Complete Guide to Regulation 2023/1113 Compliance for CASPs

The European Union’s extension of anti-money laundering travel rule requirements to crypto-asset transfers represents one of the most consequential regulatory developments for digital asset businesses operating in or serving European customers. Regulation (EU) 2023/1113—the recast Transfer of Funds Regulation (TFR)—entered into force on June 29, 2023, with application beginning December 30, 2024, coinciding with MiCA’s full application date.

This regulation imposes stringent obligations on crypto-asset service providers (CASPs) to collect, verify, and transmit originator and beneficiary information with every transfer—regardless of value. For US-based firms with European operations or customers, understanding these obligations is essential for continued market access.

Key Takeaways

• No value threshold: Unlike FATF’s suggested €1,000/USD 1,000 threshold and FinCEN’s $3,000 threshold, the EU crypto travel rule applies to all crypto-asset transfers regardless of amount. See Regulation 2023/1113, Recital 20.
• Application date: The regulation applies from December 30, 2024, per Article 38. CASPs must have compliance infrastructure fully operational.
• Self-hosted wallet requirements: For transfers exceeding €1,000 to or from unhosted wallets, CASPs must collect counterparty information and assess whether enhanced due diligence applies. See Article 14.
• Anonymous accounts prohibited: Article 16 explicitly prohibits CASPs from maintaining anonymous crypto-asset accounts or accounts using anonymity-enhancing mechanisms.
• Extraterritorial scope: Any CASP providing services to EU residents or processing transfers involving EU-based counterparty CASPs must comply, regardless of the CASP’s domicile.

Legal Framework and Legislative History

The EU crypto travel rule implements Financial Action Task Force (FATF) Recommendation 16 in the crypto-asset context. FATF’s June 2019 Interpretive Note to Recommendation 15 (the “VASP Guidance”) explicitly extended travel rule requirements to virtual asset service providers, requiring them to obtain and transmit originator and beneficiary information.

The European Commission published its legislative proposal (COM/2021/422 final) on July 20, 2021, as part of a broader AML/CFT package. Following trilogue negotiations between the Commission, Parliament, and Council, the final text was adopted and published in the Official Journal on June 9, 2023 (OJ L 150, 9.6.2023, p. 1–20).

The regulation recasts and extends the original Transfer of Funds Regulation (EC) No 1781/2006 and its successor Regulation (EU) 2015/847, which governed information requirements for traditional payment service providers. The recast explicitly brings crypto-asset transfers within scope.

Key Policy Rationale

The elimination of de minimis thresholds for crypto-assets—departing from both FATF recommendations and traditional payment frameworks—reflects the EU’s assessment that crypto-assets present heightened money laundering and terrorist financing risks. Recital 20 of the regulation states:

“In order to ensure the effective traceability of crypto-asset transfers, the requirements in this Regulation should apply without any thresholds, given the particular characteristics of crypto-assets, including the ease with which any thresholds could be circumvented.”

Scope: Which Entities Must Comply

The regulation applies to “crypto-asset service providers” as defined in Article 3(1)(15) of Regulation (EU) 2023/1114 (MiCA). Per MiCA Article 3, this includes entities providing any of the following services:

• Custody and administration of crypto-assets on behalf of clients
• Operation of a trading platform for crypto-assets
• Exchange of crypto-assets for funds or other crypto-assets
• Execution of orders for crypto-assets on behalf of clients
• Placing of crypto-assets
• Reception and transmission of orders for crypto-assets
• Providing advice on crypto-assets
• Providing portfolio management on crypto-assets
• Providing transfer services for crypto-assets on behalf of clients

The regulation applies when either the originator’s service provider or the beneficiary’s service provider, or both, are located in the EU or are CASPs licensed under MiCA. Article 2(1) establishes this scope.

Treatment of Decentralized Protocols

Regulation 2023/1113 does not explicitly address decentralized finance (DeFi) protocols. However, MiCA Recital 22 indicates that services provided in a “fully decentralised manner without any intermediary” may fall outside scope. The operative question is whether any identifiable entity provides services that meet CASP definitions—regardless of whether the underlying protocol is technically decentralized.

The European Securities and Markets Authority (ESMA) has not yet issued definitive guidance on DeFi treatment under travel rule requirements. Entities providing interfaces, front-ends, or other intermediation for DeFi protocols should conduct careful analysis of whether their activities constitute CASP services.

Information Requirements for CASP-to-CASP Transfers

Article 4 specifies the information that must accompany transfers between CASPs:

Originator Information (Article 4(1)):

• The name of the originator
• The originator’s account number (where an account is used to process the transaction) or the crypto-asset address (where the transfer is registered on a network using distributed ledger technology)
• The originator’s address, or national identity number, or customer identification number, or date and place of birth

Beneficiary Information (Article 4(2)):

• The name of the beneficiary
• The beneficiary’s account number or crypto-asset address

The originator’s CASP must verify the accuracy of originator information before transferring crypto-assets (Article 4(4)). This verification must be based on documents, data, or information from reliable and independent sources.

Beneficiary CASP Obligations

Article 8 imposes verification obligations on the beneficiary’s CASP. Before making crypto-assets available to the beneficiary, the beneficiary’s CASP must verify the accuracy of beneficiary information. This pre-release verification requirement exceeds obligations in traditional payment frameworks and creates operational challenges for real-time settlement.

Where required information is missing, Article 8(2) requires the beneficiary’s CASP to reject the transfer or request complete information before making assets available. Article 17 requires CASPs to implement effective risk-based procedures for determining when to execute, reject, or suspend transfers lacking required information.

Self-Hosted Wallet Requirements: Article 14

Article 14 addresses transfers involving “unhosted wallets”—self-custodied wallets where users control private keys without CASP intermediation. This provision generated significant controversy during the legislative process.

Transfers Exceeding €1,000

For transfers to or from an unhosted wallet exceeding €1,000 (or the equivalent), Article 14 requires the CASP to:

1. Collect counterparty information: Obtain the name of the natural or legal person using the unhosted wallet
2. Assess ownership: Determine whether the unhosted wallet is owned by the CASP’s customer or by a third party
3. Verify as appropriate: Apply risk-based verification measures to the counterparty information

Article 14(5) clarifies that CASPs must consider these transfers in their overall risk assessment and apply enhanced due diligence where risk factors indicate higher money laundering or terrorist financing risk.

Verification Methods

The regulation does not prescribe specific verification methods for unhosted wallet transfers. Industry approaches have included:

• Cryptographic message signing (proving the customer controls the unhosted wallet)
• Satoshi tests (micro-transfers to verify control)
• Documentary verification for third-party counterparties
• Blockchain analytics to assess wallet history and risk profile

CASPs should document their verification methodology and ensure it aligns with the risk-based approach required by Article 14(5).

Comparison with US and International Frameworks

The EU’s approach differs materially from other major jurisdictions:

Element	EU (Reg. 2023/1113)	US (FinCEN)	FATF Recommendation
Value Threshold	None	$3,000 (31 C.F.R. § 1010.410)	USD/EUR 1,000 suggested
Self-Hosted Wallets	Collection and risk assessment >€1,000	No specific rule; proposed 2020 rulemaking (RIN 1506-AB47) not finalized	Guidance pending; not explicitly required
Verification Timing	Pre-transfer (originator); pre-release (beneficiary)	Recordkeeping focus	Varies by jurisdiction
Covered Entities	CASPs per MiCA definition	Money services businesses per 31 C.F.R. § 1010.100(ff)	VASPs per FATF definition

FinCEN issued a Notice of Proposed Rulemaking in October 2020 (RIN 1506-AB47; 85 FR 68010) proposing to lower the travel rule threshold for convertible virtual currencies to $250 and to require reporting for transactions involving unhosted wallets. This proposed rule has not been finalized. US-based CASPs serving EU customers must comply with the more stringent EU requirements for those transactions.

Enforcement and Penalties

Article 22 requires Member States to designate competent authorities responsible for supervision and enforcement. These are typically national financial supervisors or dedicated AML authorities.

Article 23 requires Member States to establish penalties for violations that are “effective, proportionate and dissuasive.” While the regulation does not specify maximum penalties (unlike MiCA, which caps administrative fines), penalties must reflect the gravity of the violation.

Under MiCA Article 111, which governs CASP supervision more broadly, administrative penalties for serious breaches can reach:

• Up to €5,000,000 for natural persons
• Up to €15,000,000 or 12.5% of total annual turnover for legal persons (whichever is higher)

Travel rule violations would likely be assessed under Member State implementing measures, potentially incorporating MiCA’s penalty framework for licensed CASPs.

Practical Implications

For Crypto-Asset Service Providers

• Compliance infrastructure audit: Review existing travel rule solutions against Regulation 2023/1113’s requirements. Solutions designed for FATF-baseline compliance or the US $3,000 threshold are insufficient.
• Protocol interoperability: Implement messaging protocols (IVMS101, OpenVASP, TRISA, Travel Rule Protocol) compatible with EU counterparty CASPs. The lack of universal standards remains an operational challenge.
• Unhosted wallet procedures: Develop documented procedures for transfers exceeding €1,000 to or from self-hosted wallets, including verification methodology and risk assessment frameworks.
• Reject and hold procedures: Establish clear procedures for handling transfers with incomplete information, including communication protocols with counterparty CASPs and timeframes for resolution.

For DeFi Protocols and Interfaces

• Entity analysis: Evaluate whether any identifiable entity—protocol foundation, front-end operator, DAO with legal personality—could be characterized as a CASP under MiCA definitions.
• Geographic assessment: Consider whether EU geographic restrictions are appropriate if compliance is not feasible.
• Monitor regulatory developments: ESMA guidance on DeFi treatment is expected but not yet published.

For US Firms with EU Customers

• Assess triggering activities: Determine whether serving EU customers or processing transfers with EU-based CASPs requires compliance regardless of US domicile.
• MiCA authorization: Evaluate whether continued EU market access requires MiCA authorization, which would fully subject the firm to Regulation 2023/1113.
• Dual compliance framework: Implement systems capable of applying US requirements (where applicable) to US-only transactions and EU requirements to EU-touching transactions.

Implementation Timeline and Current Status

Key dates for Regulation 2023/1113:

• June 9, 2023: Publication in Official Journal
• June 29, 2023: Entry into force (20 days after publication per Article 38)
• December 30, 2024: Application date, coinciding with MiCA’s full application

The European Banking Authority (EBA) is developing guidelines on risk factor assessment and customer due diligence measures relevant to travel rule compliance. CASPs should monitor the EBA’s AML/CFT workstream for additional guidance.

Conclusion

Regulation (EU) 2023/1113 establishes the world’s most stringent crypto travel rule framework. The absence of value thresholds, explicit requirements for self-hosted wallet transfers, and pre-release verification obligations for beneficiary CASPs create compliance challenges that exceed other major jurisdictions.

With the regulation now applicable, CASPs must ensure their compliance infrastructure meets EU requirements for any transactions touching the European market. This includes not only EU-licensed CASPs but potentially any service provider with EU customers or EU-based counterparties.

As enforcement develops and additional regulatory guidance emerges from ESMA and the EBA, the practical contours of compliance will continue to evolve. CryptoLaw.blog will monitor developments and provide updates on significant enforcement actions and regulatory guidance.

---

This article is for informational and educational purposes only and does not constitute legal advice. Reading this content does not create an attorney-client relationship. Laws and regulations in the cryptocurrency space change rapidly—consult a qualified attorney for advice specific to your situation and jurisdiction. Seth Goettelman is licensed to practice law in Wisconsin and Florida.