EU Transfer of Funds Regulation (TFR): Complete Guide to Travel Rule Compliance for Crypto-Assets

Since December 30, 2024, the European Union’s recast Transfer of Funds Regulation—Regulation (EU) 2023/1113—has been fully applicable, fundamentally reshaping compliance obligations for crypto-asset service providers operating in Europe. This regulation extends the FATF “Travel Rule” to crypto-asset transfers, requiring CASPs to collect, verify, and transmit originator and beneficiary information with every transaction.

The compliance stakes are significant. Unlike traditional wire transfers, which benefit from a EUR 1,000 de minimis threshold, crypto-asset transfers under the TFR have no minimum exemption. A transfer of EUR 5 triggers the same information requirements as a transfer of EUR 5 million. For CASPs processing high transaction volumes, this creates operational demands that exceed anything faced by traditional payment providers.

This guide provides a comprehensive analysis of TFR obligations, implementation challenges, and practical compliance strategies for CASPs, compliance officers, and legal practitioners.

Key Takeaways

• Mandatory since December 30, 2024: The TFR’s full application coincides with MiCA, creating an integrated compliance framework. See Regulation (EU) 2023/1113, Art. 38.
• Zero threshold for crypto transfers: Every crypto-asset transfer requires full Travel Rule information—no minimum value exemption exists. See Regulation (EU) 2023/1113, Recital 21.
• Self-hosted wallet complexity: Transfers involving unhosted wallets require additional due diligence, with identity verification triggered at EUR 1,000. See Regulation (EU) 2023/1113, Art. 14(5).
• Record-keeping mandate: CASPs must retain originator and beneficiary data for five years. See Regulation (EU) 2023/1113, Art. 21.
• Extraterritorial effect: Non-EU CASPs must provide compliant information to transact with EU counterparts, globalizing EU standards.

Regulatory Context: The EU AML Package

The TFR recast is one component of a comprehensive EU anti-money laundering legislative package adopted in 2023-2024. Understanding its place in this framework is essential for compliance planning:

• Regulation (EU) 2023/1113 (TFR Recast): Travel Rule for crypto-assets (this regulation)
• Regulation (EU) 2023/1114 (MiCA): Authorization and conduct rules for CASPs
• Regulation (EU) 2024/1620 (AMLR): Single EU AML Rulebook, directly applicable
• Directive (EU) 2024/1640 (AMLD6): Sixth AML Directive, member state implementation
• Regulation (EU) 2024/1620 (AMLA Regulation): Establishes the EU Anti-Money Laundering Authority

CASPs authorized under MiCA automatically become “obliged entities” under the AML framework, subject to customer due diligence, suspicious transaction reporting, and now, Travel Rule compliance under the TFR.

FATF Origins

The TFR implements FATF Recommendation 16, which requires countries to ensure that financial institutions include originator and beneficiary information with wire transfers. FATF extended this requirement to virtual asset service providers (VASPs) in its 2019 guidance, updated in October 2021. See FATF, Updated Guidance for a Risk-Based Approach to Virtual Assets and Virtual Asset Service Providers (Oct. 2021), ¶¶ 178-186.

The EU’s implementation goes further than FATF’s minimum standards in one critical respect: FATF permits a de minimis threshold of USD/EUR 1,000 for occasional transactions. The EU declined to adopt any threshold for crypto-asset transfers, citing the “specific money laundering and terrorist financing risks” associated with the speed and pseudonymity of blockchain transactions. Regulation (EU) 2023/1113, Recital 21.

Timeline and Effective Dates

Date	Event
July 20, 2021	European Commission proposal published
May 31, 2023	Regulation (EU) 2023/1113 adopted
June 9, 2023	Published in Official Journal (OJ L 150)
June 29, 2023	Entry into force (20 days after publication)
December 30, 2024	Full application date

The 18-month implementation period between entry into force and full application was designed to align with MiCA’s application date and allow CASPs time to implement technical compliance solutions.

Scope: Who Must Comply?

Covered Entities

The TFR applies to “crypto-asset service providers” as defined in MiCA, Article 3(1)(15). This includes entities authorized to provide any of the following services:

• Custody and administration of crypto-assets on behalf of clients
• Operation of a trading platform for crypto-assets
• Exchange of crypto-assets for funds or other crypto-assets
• Execution of orders for crypto-assets on behalf of clients
• Transfer services for crypto-assets on behalf of clients

See Regulation (EU) 2023/1114, Art. 3(1)(16).

Notably, entities providing only advice or portfolio management without custody or transfer functions may fall outside TFR scope, though they remain subject to other MiCA obligations.

Covered Transactions

A “transfer of crypto-assets” means “any transaction carried out on behalf of an originator through a [CASP] by electronic means with a view to making crypto-assets available to a beneficiary through a [CASP].” Regulation (EU) 2023/1113, Art. 3(10).

This captures:

• Transfers between accounts at the same CASP (internal transfers)
• Transfers between accounts at different CASPs
• Transfers to or from self-hosted wallets (with special rules)

Jurisdictional Reach

The TFR applies to transfers “sent or received by a [CASP] established in the Union.” Art. 2(1). This means:

• EU-to-EU transfers: Both sending and receiving CASP must comply
• EU-to-non-EU transfers: EU sending CASP must comply; must transmit information even if receiving entity is in non-compliant jurisdiction
• Non-EU-to-EU transfers: EU receiving CASP must have effective procedures to detect missing information and may be required to reject or suspend non-compliant transfers

Core Obligations: What Information Must Be Transmitted?

Originator Information (Art. 14)

The CASP of the originator must ensure that the following information accompanies or is made available to the CASP of the beneficiary:

• The name of the originator
• The originator’s distributed ledger address (where the transfer is recorded on a distributed ledger) or crypto-asset account number
• One of the following: the originator’s address, national identity number, customer identification number, or date and place of birth

Beneficiary Information (Art. 14)

For the beneficiary, the sending CASP must include:

• The name of the beneficiary
• The beneficiary’s distributed ledger address or crypto-asset account number

Verification Requirements

The CASP of the originator must verify the accuracy of originator information “on the basis of documents, data or information obtained from a reliable and independent source” before transferring the crypto-assets. Art. 14(5). In practice, this means robust KYC at customer onboarding.

The CASP of the beneficiary has reciprocal verification obligations. Under Art. 16, receiving CASPs must implement:

• Effective procedures to detect whether required information is missing or incomplete
• Risk-based procedures for determining whether to execute, reject, or suspend a transfer lacking required information
• Procedures to request complete information from the sending CASP within three working days

For transfers where complete information cannot be obtained, the receiving CASP must consider whether to file a suspicious transaction report. Art. 16(3).

Self-Hosted Wallets: Special Rules

Transfers involving self-hosted (unhosted) wallets—addresses not controlled by any CASP—present unique compliance challenges. The TFR addresses these in Article 14 with specific requirements that have generated significant industry debate.

Outgoing Transfers to Self-Hosted Wallets

When a CASP’s customer sends crypto-assets to a self-hosted wallet, the CASP must:

1. Collect information on the person who controls the self-hosted wallet (name)
2. For transfers exceeding EUR 1,000: Verify the information collected, including ensuring that its customer is the person who owns or controls the self-hosted wallet or obtaining and verifying information about the third-party owner

Incoming Transfers from Self-Hosted Wallets

When a CASP receives crypto-assets from a self-hosted wallet on behalf of its customer:

1. Collect information on the person who controls the sending self-hosted wallet
2. For transfers exceeding EUR 1,000: Verify the information, which may include requiring the customer to demonstrate that they control the sending wallet (e.g., through a signed message or small test transaction)

Proof of Ownership

The TFR does not prescribe specific technical methods for verifying self-hosted wallet ownership. Common approaches include:

• Satoshi Test: Requiring a small transaction from the wallet to prove control
• Cryptographic signature: Signing a message with the private key
• Third-party attestation: Using compliance tools that verify wallet ownership

The European Banking Authority (EBA) is expected to issue further guidance on acceptable verification methods.

Record-Keeping Requirements

Article 21 imposes mandatory record retention:

• CASPs must retain all originator and beneficiary information collected for a period of five years after the end of the business relationship or the date of the occasional transaction
• Records must be stored in a form that allows reconstruction of the transfer and makes information available to competent authorities upon request
• Personal data must be deleted after the retention period unless national law requires otherwise

Technical Implementation: Travel Rule Solutions

Unlike traditional finance, where SWIFT messaging provides standardized information transmission, no single protocol dominates the crypto Travel Rule landscape. CASPs must select and implement compliant solutions while managing interoperability challenges.

Available Standards and Protocols

• IVMS 101 (InterVASP Messaging Standard): An industry data standard developed by the Joint Working Group on InterVASP Messaging Standards, defining the data elements required for Travel Rule compliance
• TRISA (Travel Rule Information Sharing Architecture): An open-source, decentralized network for secure peer-to-peer Travel Rule messaging
• OpenVASP: An open protocol for Travel Rule message exchange

Commercial Solutions

Several vendors offer Travel Rule compliance platforms:

• Notabene
• Chainalysis (Travel Rule Solution)
• Elliptic
• Sygna
• Veriscope

Key selection criteria include: network reach (how many counterparties can you communicate with?), interoperability with other solutions, self-hosted wallet verification capabilities, and integration with existing compliance systems.

The Interoperability Problem

A persistent challenge is that CASPs using different Travel Rule solutions may be unable to exchange information seamlessly. Industry initiatives are working toward “universal interoperability,” but CASPs should assume that some counterparty communications will require manual processes or alternative channels until the market matures.

Enforcement and Penalties

Article 22 requires Member States to establish “effective, proportionate and dissuasive” sanctions for TFR violations. Enforcement is delegated to national competent authorities (typically financial regulators or FIUs).

Potential consequences include:

• Administrative fines: Amounts determined by national law
• Public censure: Publication of violations
• License suspension or revocation: Given TFR’s integration with MiCA, serious violations could jeopardize CASP authorization
• Personal liability: AMLD6 and national law may impose liability on management for compliance failures

The EU Anti-Money Laundering Authority (AMLA), once fully operational, will have supervisory powers over high-risk obliged entities and may directly supervise certain CASPs.

US Comparison: Regulatory Divergence

The US approach to crypto Travel Rule compliance remains less defined than the EU’s, creating challenges for CASPs operating transatlantically.

Under the Bank Secrecy Act, financial institutions must transmit specified information for funds transfers exceeding $3,000. 31 C.F.R. § 1010.410(f). However, FinCEN has not issued final rules specifically extending these requirements to convertible virtual currencies.

In December 2020, FinCEN proposed rules that would have:

• Lowered the Travel Rule threshold to $250 for transactions involving convertible virtual currencies or digital assets with legal tender status
• Imposed reporting and recordkeeping requirements for transactions involving unhosted wallets

See Requirements for Certain Transactions Involving Convertible Virtual Currency or Digital Assets, 85 Fed. Reg. 83840 (Dec. 23, 2020).

The proposal was not finalized and was subsequently withdrawn from the regulatory agenda. As of this writing, US-based virtual asset service providers are not subject to crypto-specific Travel Rule mandates beyond existing BSA requirements.

Practical implication: US CASPs transacting with EU counterparts must meet EU standards regardless of US domestic requirements. The EU’s rules effectively set the compliance floor for transatlantic crypto transfers.

Practical Implications

Compliance Checklist for CASPs

1. Travel Rule Solution: Implement a technical solution capable of transmitting and receiving required information with counterparties
2. KYC Enhancement: Ensure onboarding procedures capture all required originator data elements (name, address or ID number, account identifier)
3. Self-Hosted Wallet Procedures: Establish policies and technical processes for verifying self-hosted wallet ownership for transfers above EUR 1,000
4. Transaction Screening: Implement real-time screening to detect transfers with missing or incomplete information
5. Rejection/Suspension Policies: Define risk-based criteria for when to reject, suspend, or process transfers lacking required data
6. Record-Keeping: Configure systems to retain all Travel Rule data for five years
7. Staff Training: Train compliance and operations teams on new obligations
8. Policy Documentation: Update AML/CFT policies to reflect TFR requirements
9. Counterparty Due Diligence: Assess whether counterparty CASPs can meet Travel Rule information exchange requirements
10. SAR Procedures: Update suspicious activity reporting triggers to address Travel Rule failures

For Non-EU CASPs

• If serving EU customers, assess whether MiCA authorization is required (which triggers full TFR compliance)
• Regardless of authorization status, implement capability to transmit Travel Rule information to EU counterparts
• Expect EU CASPs to reject transfers that lack compliant information
• Monitor regulatory developments in your home jurisdiction for potential reciprocal requirements

For DeFi Protocols

• Purely decentralized protocols without identifiable service providers fall outside TFR scope
• Protocols with centralized elements (admin keys, fee collection, front-end control) risk classification as CASPs under MiCA, triggering TFR obligations
• “Decentralization theater” will not protect protocols that function as centralized services—substance over form applies

Open Questions and Ongoing Developments

• EBA Technical Standards: The European Banking Authority is expected to issue regulatory technical standards on various TFR implementation details
• AMLA Supervision: The scope of AMLA’s direct supervisory authority over CASPs remains to be defined
• Interoperability Solutions: Industry efforts toward universal Travel Rule interoperability continue
• Third-Country Equivalence: Future assessments of non-EU jurisdictions’ Travel Rule regimes may affect cross-border transfer handling

Conclusion

The Transfer of Funds Regulation recast establishes the world’s most comprehensive Travel Rule regime for crypto-assets. Its zero-threshold approach, combined with stringent self-hosted wallet requirements, creates compliance demands that exceed those faced by traditional financial institutions handling equivalent transaction volumes.

For CASPs authorized or operating under MiCA, Travel Rule compliance is no longer optional—it is a core license condition. The absence of any de minimis exemption means that compliance infrastructure must handle every transaction, regardless of value, creating significant operational and technical investment requirements.

The regulation’s extraterritorial reach also ensures that non-EU CASPs cannot ignore these requirements. Any entity wishing to transact with EU counterparts must be prepared to meet European standards, effectively globalizing the EU’s approach.

As the regulatory landscape continues to evolve—with AMLA becoming operational and EBA technical standards forthcoming—CASPs should treat current compliance as a foundation to build upon rather than a final destination.

---

This article is for informational and educational purposes only and does not constitute legal advice. Reading this content does not create an attorney-client relationship. Laws and regulations in the cryptocurrency space change rapidly — consult a qualified attorney for advice specific to your situation and jurisdiction. Seth Goettelman is licensed to practice law in Wisconsin and Florida.