EU Travel Rule for Crypto: The Transfer of Funds Regulation Explained (2025 Compliance Guide)

Since December 30, 2024, every crypto-asset service provider operating in the European Union has been required to comply with one of the most far-reaching anti-money laundering rules ever applied to digital assets. The EU’s Transfer of Funds Regulation (TFR)—formally Regulation (EU) 2023/1113—extends traditional financial “travel rule” requirements to cryptocurrency transactions, mandating that sender and recipient information accompany virtually every crypto transfer.

For US-based crypto companies with European operations, EU-regulated exchanges, and individual users of self-hosted wallets, the compliance implications are substantial and immediate. This analysis breaks down what the EU travel rule for crypto requires, how it compares to US approaches, and what practical steps affected parties must take.

Key Takeaways

• No de minimis threshold: Unlike traditional wire transfers, the EU travel rule applies to all crypto transfers regardless of amount—even a €1 transaction requires full information collection. Regulation (EU) 2023/1113, Recital 23.
• Unhosted wallet provisions: Transfers to or from self-hosted wallets trigger enhanced due diligence requirements, including mandatory wallet ownership verification for transfers exceeding €1,000. Regulation (EU) 2023/1113, Art. 14(5).
• Compliance deadline has passed: CASPs should have achieved full compliance by December 30, 2024. National authorities can now pursue enforcement actions.
• Counterparty blocking required: CASPs must refuse transfers to or from non-compliant providers. Regulation (EU) 2023/1113, Art. 19.
• Stricter than current US rules: The EU approach eliminates the $3,000/€1,000 threshold that applies to traditional wire transfers and current US crypto travel rule enforcement.

Legal Foundation: What Is the Transfer of Funds Regulation?

The Transfer of Funds Regulation (TFR), officially Regulation (EU) 2023/1113, was adopted on June 9, 2023, as part of the EU’s comprehensive crypto regulatory package alongside the Markets in Crypto-Assets Regulation (MiCA). The European Parliament approved the final text on April 20, 2023, following extensive negotiations that significantly modified the European Commission’s original 2021 proposal.

The TFR amends and extends the existing EU Wire Transfer Regulation (Regulation (EU) 2015/847) to cover crypto-asset transfers. It implements Recommendation 16 of the Financial Action Task Force (FATF)—the international standard-setter for anti-money laundering (AML) and counter-terrorist financing (CFT) rules.

Article 1 of the TFR states:

“This Regulation lays down rules on the information on originators and beneficiaries, accompanying transfers of crypto-assets, for the purposes of preventing, detecting and investigating money laundering and terrorist financing.”

See Regulation (EU) 2023/1113, Art. 1.

Scope: Who Must Comply with the EU Travel Rule for Crypto

Covered Entities: CASPs Under MiCA

The TFR applies to “crypto-asset service providers” (CASPs) as defined under MiCA. Regulation (EU) 2023/1114, Art. 3(1)(15) defines a CASP as “a legal person or other undertaking whose occupation or business is the provision of one or more crypto-asset services to clients on a professional basis.”

Covered services include:

• Exchange services: Both fiat-to-crypto and crypto-to-crypto exchanges
• Custody and administration: Custodial wallet providers holding crypto-assets on behalf of clients
• Transfer services: Platforms facilitating crypto-asset transfers on behalf of customers
• Trading services: Entities operating trading platforms or executing orders

The regulation applies to CASPs “established in the Union” and, critically, may affect those providing services to EU residents from third countries through the counterparty compliance requirements. See Regulation (EU) 2023/1113, Art. 2(1).

Covered Transactions

Article 3(3) of the TFR defines “transfer of crypto-assets” as:

“Any transaction carried out by electronic means on behalf of an originator through a crypto-asset service provider with a view to making crypto-assets available to a beneficiary through a crypto-asset service provider or through an address otherwise than through a crypto-asset service provider.”

This encompasses:

• CASP-to-CASP transfers (e.g., exchange to exchange)
• CASP-to-unhosted wallet transfers (e.g., exchange withdrawal to personal wallet)
• Unhosted wallet-to-CASP transfers (e.g., deposit from personal wallet to exchange)
• Both domestic and cross-border transfers

Excluded Transactions

The TFR does not apply to:

• Person-to-person transfers between unhosted wallets (no CASP involved)
• Crypto-assets that qualify as electronic money under Directive 2009/110/EC (covered by existing wire transfer rules)
• Transfers that do not involve a CASP as originator or beneficiary service provider

Core Requirements: Information That Must “Travel”

Originator Information (Sender)

Under Article 14(1) of the TFR, the originator’s CASP must ensure the following information accompanies every crypto transfer:

1. The name of the originator
2. The originator’s distributed ledger address (where the transfer is recorded on a DLT) or crypto-asset account number (where no DLT address exists or the transfer uses an internal account)
3. One of the following:
   • The originator’s address (domicile or residence)
   • Official personal document number
   • Customer identification number
   • Date and place of birth

Beneficiary Information (Recipient)

Article 14(1) also requires the following beneficiary information:

1. The name of the beneficiary
2. The beneficiary’s distributed ledger address or crypto-asset account number

Verification Requirements

The TFR imposes verification obligations on both sending and receiving CASPs:

Originator’s CASP (Article 14(5)): Must verify originator information “on the basis of documents, data or information obtained from a reliable and independent source” before transferring crypto-assets. This aligns with standard customer due diligence (CDD) requirements.

Beneficiary’s CASP (Article 16(1)): Must implement “effective procedures” to detect whether required originator and beneficiary information is complete. Article 16(2) requires the beneficiary CASP to verify whether the received information “corresponds” to information it holds on the beneficiary before making the crypto-assets available.

The Zero Threshold: A Fundamental Departure from Traditional Finance

The most significant—and controversial—aspect of the EU travel rule for crypto is the complete elimination of any de minimis threshold. Traditional wire transfers under Regulation (EU) 2015/847 apply a simplified regime for transfers under €1,000. The TFR offers no such relief for crypto.

Recital 23 of the TFR provides the regulatory rationale:

“Given the specific risks linked to crypto-assets, including the lack of a central body that can monitor and implement preventive or corrective measures, and the pseudonymous nature of transfers of crypto-assets, no threshold should be set below which a simplified due diligence regime applies.”

In practice, this means a €5 crypto transfer demands the same information collection, transmission, and verification as a €5 million transfer. Industry participants have criticized this as disproportionate and operationally burdensome, particularly for high-volume, low-value use cases like micropayments or gaming applications.

Unhosted Wallet Provisions: Enhanced Due Diligence Requirements

The treatment of self-hosted (“unhosted”) wallets proved the most contentious issue during the TFR’s legislative process. The final regulation imposes graduated requirements based on transfer value.

Transfers Exceeding €1,000

Article 14(5) establishes that when a CASP transfers crypto-assets to an address not associated with another CASP (an unhosted wallet), or receives crypto-assets from such an address, and the transfer exceeds €1,000, the CASP must:

1. Verify ownership or control: Confirm whether the unhosted wallet is owned or controlled by its customer
2. Collect standard information: Obtain and record the same originator/beneficiary information required for CASP-to-CASP transfers

Acceptable Verification Methods

The regulation does not prescribe specific verification methods, allowing flexibility. Industry practice has converged on several approaches:

• Cryptographic proof: Customer signs a specific message using the wallet’s private key, proving control
• Micro-transaction verification: Customer sends a small specified amount from the wallet
• Blockchain analytics: Analysis of wallet history and transaction patterns
• Customer attestation: Written declaration combined with other corroborating measures

Recital 29 emphasizes that CASPs should adopt a risk-based approach to verification, considering factors such as the customer’s risk profile, the nature of the customer relationship, and whether the wallet address has been previously verified.

Transfers Below €1,000

For unhosted wallet transfers below €1,000, the automatic verification requirement does not apply. However, CASPs must still:

• Record the transaction details
• Monitor for suspicious patterns (e.g., structuring to avoid the threshold)
• Apply enhanced due diligence where risk factors are present

What the TFR Does Not Do

Contrary to some early reports during the legislative process, the final TFR does not:

• Ban transfers to/from unhosted wallets
• Require verification for all unhosted wallet transfers regardless of amount
• Mandate specific verification technologies

Counterparty Compliance: The Network Effect

Article 19 creates what may be the TFR’s most powerful enforcement mechanism: compliant CASPs must refuse to deal with non-compliant ones.

Specifically, Article 19(1) states that CASPs shall not execute a transfer of crypto-assets where they become aware that the originator or beneficiary CASP “does not comply with this Regulation.” This creates a compliance network effect: non-compliant providers face exclusion from the EU crypto ecosystem.

Article 19(2) further requires CASPs to implement “risk-based procedures” to determine whether to execute, reject, or suspend transfers that lack complete information, and to take “appropriate follow-up action.”

Technical Implementation: The Interoperability Challenge

Unlike traditional wire transfers that flow through established messaging systems (SWIFT), crypto transfers lack a standardized infrastructure for transmitting travel rule data. This creates significant technical challenges.

Industry Solutions

Several technical protocols have emerged to address this gap:

• TRUST (Travel Rule Universal Solution Technology): Developed by a consortium including major US exchanges, TRUST provides a protocol for identifying counterparty CASPs and securely exchanging travel rule data.
• IVMS 101: An industry messaging standard published by the Joint Working Group on interVASP Messaging Standards, providing a common data model for travel rule information exchange.
• Proprietary solutions: Multiple vendors offer travel rule compliance platforms (Notabene, Sygna, Chainalysis Travel Rule, etc.) with varying degrees of interoperability.

Interoperability Gaps

A persistent challenge is that different CASPs may use incompatible solutions. The industry has not yet achieved universal interoperability, meaning some CASP-to-CASP transfers may require manual information exchange or may be blocked due to technical inability to transmit data.

Comparison with US Travel Rule Requirements

The EU’s approach is materially stricter than current US requirements, though this comparison requires distinguishing between current law and pending proposals.

Current US Framework

The US travel rule for financial institutions appears at 31 C.F.R. § 1010.410. This regulation requires transmittal of originator and beneficiary information for funds transfers of $3,000 or more. FinCEN has confirmed this rule applies to money services businesses handling “convertible virtual currency” (CVC). See FinCEN Guidance FIN-2019-G001 (May 9, 2019).

Required information under current US rules includes:

• Name and address of originator
• Amount of the transmittal
• Date of the transmittal
• Identity of the recipient’s financial institution
• Name of the recipient (for transmittals of $3,000 or more)

FinCEN’s 2020 Proposed Rule (Unfinalized)

In October 2020, FinCEN proposed a rule that would have:

• Lowered the travel rule threshold to $250 for international CVC transfers
• Required additional recordkeeping for transactions involving unhosted wallets
• Mandated counterparty identification requirements

See 85 Fed. Reg. 68010 (Oct. 27, 2020). This proposed rule was never finalized and, following a change in administration, has not been advanced. [Note for Seth: Please verify whether any FinCEN rulemaking has been finalized between late 2024 and March 2026.]

Key Differences: EU vs. US

Element	EU (TFR)	US (Current Law)
Threshold	€0 (no threshold)	$3,000 (31 C.F.R. § 1010.410)
Unhosted wallet verification	Mandatory above €1,000 (Art. 14(5))	No specific requirement
Counterparty blocking	Required (Art. 19)	Not required
Status	In force since Dec. 30, 2024	In effect

Implications for US Companies

US crypto companies face divergent compliance obligations depending on their operational footprint:

• US-only operations: Current $3,000 threshold applies; monitor FinCEN for potential changes
• EU-facing operations: Must comply with TFR when transacting with EU CASPs, regardless of US licensing status
• Dual operations: Should implement global travel rule compliance at the EU standard to avoid maintaining parallel systems

Data Protection Considerations: TFR Meets GDPR

The TFR’s extensive data collection requirements create tension with the EU’s General Data Protection Regulation (Regulation (EU) 2016/679). CASPs must navigate both frameworks simultaneously.

Recital 36 of the TFR acknowledges this tension, stating that the processing of personal data under the TFR is “subject to Regulation (EU) 2016/679.” This means CASPs must:

• Establish a lawful basis for processing (typically legal obligation under Art. 6(1)(c) GDPR)
• Apply data minimization principles—collect only what is required
• Implement appropriate security measures for travel rule data
• Address data subject rights requests (though AML exemptions may limit certain rights)
• Consider data retention obligations and limitations

Cross-border data transfers to non-EU CASPs must comply with GDPR Chapter V requirements, potentially requiring standard contractual clauses or other transfer mechanisms.

Enforcement and Penalties

Enforcement of the TFR falls to national competent authorities (NCAs) in each EU member state—typically the same authorities responsible for AML supervision of financial institutions.

Article 22 requires member states to establish penalty regimes that are “effective, proportionate and dissuasive.” While specific penalties vary by jurisdiction, MiCA provides a framework: under Regulation (EU) 2023/1114, Art. 111, NCAs can impose penalties of up to €5 million or 3% of annual turnover for legal persons, or up to €700,000 for natural persons.

Beyond direct penalties, non-compliance risks:

• License revocation: Serious or repeated violations may result in loss of MiCA authorization
• Counterparty blocking: Compliant CASPs must refuse transfers to non-compliant providers
• Reputational damage: Public disclosure of enforcement actions

Practical Implications

For EU-Licensed CASPs: Compliance Checklist

Full compliance should already be in place. CASPs should verify:

1. Data collection: Customer onboarding captures all required data elements (name, address/ID/DOB, account identifiers)
2. Transmission capability: Systems can transmit travel rule data to counterparty CASPs (via TRUST, IVMS 101-compliant solutions, or bilateral arrangements)
3. Counterparty identification: Procedures exist to identify whether a destination/source address is associated with a CASP
4. Unhosted wallet verification: Processes established for verifying ownership of unhosted wallets for transfers >€1,000
5. Incomplete transfer handling: Policies define how to handle transfers with missing information (reject, request information, suspend)
6. Recordkeeping: Travel rule data retained per AML record retention requirements (typically 5 years)
7. Staff training: Compliance personnel trained on TFR requirements
8. GDPR compliance: Privacy notices updated; data processing documented

For Non-EU CASPs Serving EU Customers

1. Assess exposure: Determine whether your operations trigger TFR obligations
2. Expect counterparty demands: EU CASPs will require travel rule data before completing transfers
3. Implement travel rule capabilities: Consider global implementation at EU standards
4. Evaluate geofencing: If compliance is impractical, consider whether to restrict EU customer access

For DeFi Protocols

Protocols without custodial elements or identifiable service providers may argue they fall outside CASP definitions. However, protocols with the following characteristics face compliance risk:

• Governance tokens controlled by identifiable entities
• Front-end interfaces operated by legal entities
• Custodial bridges or wrapped asset issuance
• Revenue-generating operations with identifiable beneficiaries

Legal analysis of specific protocol architecture is essential. The line between “software” and “service provider” remains contested.

For Individual Users

• Transfers from self-hosted wallets to EU CASPs above €1,000 require ownership verification
• Be prepared to prove wallet control (typically via message signing)
• Expect increased KYC friction when depositing to EU-regulated exchanges
• Peer-to-peer transfers between unhosted wallets remain unaffected

Looking Ahead: Regulatory Evolution

Several developments may affect TFR implementation:

• Technical standards: The European Banking Authority (EBA) may issue technical standards on implementation details
• DeFi guidance: Regulatory clarity on DeFi applicability remains pending
• International alignment: FATF continues refining travel rule guidance; other jurisdictions may adopt similar approaches
• Privacy-enhancing technology: Industry exploration of whether zero-knowledge proofs or similar technologies can satisfy compliance requirements while enhancing privacy continues, though no such approaches have received regulatory approval

Conclusion

The EU travel rule for crypto under Regulation (EU) 2023/1113 represents a fundamental shift in how cryptocurrency transactions are regulated. By eliminating any de minimis threshold, imposing verification requirements for unhosted wallet transactions, and mandating counterparty compliance blocking, the TFR creates the most comprehensive travel rule regime for digital assets in any major jurisdiction.

For US practitioners and businesses, the TFR’s impact extends well beyond Europe. US companies transacting with EU counterparties must meet EU standards regardless of US regulatory requirements. As the first comprehensive crypto regulatory framework takes effect, the EU’s approaches—including the travel rule—may influence regulatory developments in other jurisdictions.

The December 30, 2024 compliance deadline has passed. CASPs operating in the EU must be fully compliant. Those with gaps should prioritize immediate remediation and consider engaging specialized legal counsel to navigate these complex requirements before enforcement actions materialize.

---

This article is for informational and educational purposes only and does not constitute legal advice. Reading this content does not create an attorney-client relationship. Laws and regulations in the cryptocurrency space change rapidly — consult a qualified attorney for advice specific to your situation and jurisdiction. Seth Goettelman is licensed to practice law in Wisconsin and Florida.