EU Crypto Travel Rule Now in Effect: Compliance Guide for US Firms Operating in Europe

The European Union’s recast Transfer of Funds Regulation—Regulation (EU) 2023/1113—became fully applicable on December 30, 2024, implementing the Financial Action Task Force (FATF) ‘travel rule’ for crypto-asset transfers across the bloc. For US-based crypto businesses serving European customers or operating through EU subsidiaries, compliance is no longer theoretical. This analysis examines what the regulation requires, who must comply, and what steps practitioners should take now.

Key Takeaways

• Full application began December 30, 2024 — Crypto-asset service providers (CASPs) licensed under MiCA must transmit originator and beneficiary data with crypto-asset transfers (Regulation 2023/1113, Art. 38)
• No de minimis threshold for CASP-to-CASP transfers — Unlike traditional wire transfers, crypto-asset transfers between CASPs require full data collection regardless of transaction value (Art. 14)
• Self-hosted wallet transactions require additional measures — Transfers exceeding €1,000 to or from non-custodial addresses trigger verification and enhanced due diligence requirements (Art. 14a)
• Extraterritorial effect through counterparty requirements — EU CASPs must implement risk-based procedures to detect non-compliant incoming transfers, effectively requiring non-EU counterparties to comply (Art. 15)
• Substantial penalties for non-compliance — Member states may impose administrative fines up to €5 million or 3% of annual turnover for legal entities (MiCA Art. 111)

Background: From FATF Guidance to EU Law

The travel rule originates from FATF Recommendation 16, which requires that originator and beneficiary information accompany wire transfers to combat money laundering and terrorist financing. In June 2019, FATF extended this requirement to virtual asset service providers (VASPs) through its Interpretive Note to Recommendation 15.

The European Commission proposed extending the existing Transfer of Funds Regulation to crypto-assets in July 2021. Following negotiations between the European Parliament and Council, Regulation (EU) 2023/1113 was adopted on May 31, 2023, published in the Official Journal on June 9, 2023 (OJ L 150), and entered into force on June 29, 2023. The regulation became applicable on December 30, 2024, coinciding with MiCA’s full application date.

What the Regulation Requires

Regulation 2023/1113 establishes information requirements for crypto-asset transfers in Title III, Articles 14-22. The core obligations differ based on whether the transfer occurs between two CASPs or involves a self-hosted wallet.

CASP-to-CASP Transfers

Under Article 14(1), the CASP of the originator must ensure that crypto-asset transfers are accompanied by the following information about the originator:

• Name
• Distributed ledger address (and account number, where applicable)
• Address, official personal document number, customer identification number, or date and place of birth

For the beneficiary, Article 14(2) requires:

• Name
• Distributed ledger address (and account number, where applicable)

Article 14(5) specifies that this information “shall accompany the crypto-asset transfer, regardless of the amount.” This represents a significant departure from the €1,000 threshold that applies to traditional fund transfers under the same regulation.

Self-Hosted Wallet Provisions

Article 14a addresses transfers involving distributed ledger addresses not associated with a CASP—commonly called self-hosted, unhosted, or non-custodial wallets. The regulation does not prohibit self-custody, but it imposes additional requirements:

For transfers exceeding €1,000 to or from a self-hosted address, the CASP must:

1. Verify whether the self-hosted address is effectively owned or controlled by their customer (Art. 14a(2)(a))
2. Apply risk-mitigating measures, including enhanced due diligence where warranted (Art. 14a(2)(b))

The regulation does not prescribe specific verification methods, leaving CASPs discretion to implement appropriate technical solutions. The European Banking Authority (EBA) is mandated to issue guidelines on verification procedures under Article 14a(5).

Who Is Affected

Directly Regulated Entities:

• All crypto-asset service providers authorized under MiCA (Regulation 2023/1114) in any EU member state
• Credit institutions and payment institutions offering crypto-asset services in the EU

Indirectly Affected US Entities:

• US exchanges operating EU-licensed subsidiaries (e.g., Coinbase Ireland, Kraken entities)
• US platforms serving EU-resident customers through passporting arrangements
• US custodians and OTC desks transacting with EU-licensed counterparties
• DeFi protocols with identifiable EU touchpoints (application remains uncertain—see below)

Article 15 requires receiving CASPs to implement “effective risk-based procedures” for detecting transfers that lack required information. This creates indirect pressure on non-EU entities: if a US exchange cannot provide compliant data, EU counterparties may refuse to process the transfer or terminate correspondent relationships.

Comparison to US Regulatory Approach

The United States has not finalized equivalent travel rule requirements for crypto-assets. FinCEN proposed rules in December 2020 addressing “Requirements for Certain Transactions Involving Convertible Virtual Currency or Digital Assets” (RIN 1506-AB47), but these remain pending. The proposed US framework differs from the EU approach in several respects:

Element	EU (Reg. 2023/1113)	US (Proposed)
Threshold for VASP-to-VASP	None (all amounts)	$3,000
Self-hosted wallet treatment	Enhanced verification over €1,000	Reporting over $10,000; recordkeeping over $3,000
Status	In force	Proposed only

This asymmetry creates operational complexity. US firms may need to collect EU-compliant data without corresponding US legal obligation, raising questions about data minimization under privacy frameworks. Conversely, EU firms receiving transfers from US counterparties may face information gaps.

Open Questions and Uncertainties

Several aspects of the regulation remain subject to interpretation or ongoing regulatory development:

DeFi Application: The regulation applies to CASPs as defined under MiCA. Whether and how travel rule obligations apply to decentralized protocols without identifiable service providers is unclear. Recital 22 of Regulation 2023/1113 notes that “fully decentralised” services without intermediaries fall outside scope, but determining when a protocol qualifies as “fully decentralised” remains contested.

Technical Implementation Standards: Article 14a(5) mandates EBA guidelines on self-hosted wallet verification. As of this analysis, practitioners should monitor EBA publications for binding guidance on acceptable verification methods.

Cross-Border Interoperability: The regulation does not mandate specific messaging protocols for travel rule data transmission. Industry solutions including TRUST (Travel Rule Universal Solution Technology), OpenVASP, and Sygna Bridge have emerged, but fragmentation remains a challenge.

Practical Implications

For US Firms with EU-Licensed Subsidiaries:

1. Conduct gap analysis — Map current AML/KYC data collection against Article 14 requirements; identify missing data fields
2. Implement messaging infrastructure — Deploy or upgrade travel rule messaging protocol for CASP-to-CASP data transmission
3. Establish self-hosted wallet procedures — Document verification methodology for transfers over €1,000 to/from non-custodial addresses
4. Update customer disclosures — Revise privacy notices and terms of service to reflect travel rule data processing and transmission
5. Coordinate group-wide — Ensure data flows between US parent and EU subsidiary comply with GDPR cross-border transfer requirements

For US Firms Without EU Presence:

1. Assess EU counterparty expectations — Contact EU-licensed exchanges and custodians to understand their incoming transfer policies
2. Evaluate voluntary compliance — Consider implementing travel rule capability to maintain EU market access
3. Monitor service continuity risk — Anticipate that non-compliant transfers may be delayed, rejected, or trigger enhanced scrutiny

For In-House Counsel and Compliance Officers:

1. Review vendor contracts — Ensure travel rule solution providers meet EBA expectations for data accuracy and security
2. Assess GDPR interaction — Travel rule data transmission involves personal data; confirm legal basis and implement appropriate safeguards
3. Document risk-based decisions — Article 15 requires documented risk assessment for anomalies; establish clear policies and audit trails

Enforcement Framework

National competent authorities in each EU member state supervise CASP compliance. Under MiCA Article 111, penalties for legal persons may include:

• Administrative fines up to €5 million, or
• Up to 3% of total annual turnover, or
• Up to twice the profits gained or losses avoided through the violation

The EBA coordinates supervisory practices under Article 117 and may issue opinions to ensure consistent application across member states. Early enforcement activity has been limited as regulators prioritize guidance over penalties during the initial application period, but this posture may shift.

Conclusion

The EU’s implementation of the crypto travel rule through Regulation 2023/1113 represents the most comprehensive application of FATF Recommendation 16 to virtual assets globally. For US firms, the regulation’s practical effect extends beyond EU borders: maintaining transactional relationships with EU-licensed entities now effectively requires travel rule compliance regardless of US regulatory status.

The immediate priority for affected firms is gap analysis—comparing existing data collection and transmission capabilities against regulatory requirements. Firms that delay implementation risk correspondent relationship disruption and potential exclusion from the EU’s substantial crypto market.

CryptoLaw.blog will continue monitoring EBA guidance, member state implementation, and enforcement developments. Practitioners should consult qualified counsel for advice on specific compliance obligations.

---

This article is for informational and educational purposes only and does not constitute legal advice. Reading this content does not create an attorney-client relationship. Laws and regulations in the cryptocurrency space change rapidly — consult a qualified attorney for advice specific to your situation and jurisdiction. Seth Goettelman is licensed to practice law in Wisconsin and Florida.