EU Transfer of Funds Regulation: Crypto ‘Travel Rule’ Compliance Requirements for US Operators

The European Union’s recast Transfer of Funds Regulation (TFR), Regulation (EU) 2023/1113, extends the FATF ‘Travel Rule’ to all crypto-asset transfers — with no minimum threshold. The regulation became applicable on December 30, 2024, alongside MiCA’s full application. US-based crypto-asset service providers (CASPs) serving EU customers or processing transfers involving EU counterparties face immediate compliance obligations.

Bottom line: If your platform touches EU crypto transactions, you must now collect, verify, and transmit originator/beneficiary information for every transfer — regardless of amount.

Key Takeaways

• Zero-threshold rule: Unlike traditional fund transfers (€1,000 threshold) and US requirements ($3,000), the TFR requires Travel Rule compliance for crypto transfers of any amount. (Article 14(1), Regulation 2023/1113)
• Unhosted wallet verification: Transfers exceeding €1,000 to or from self-custodied wallets require CASPs to verify the customer owns or controls that wallet. (Article 14(5))
• Application date: December 30, 2024 — the regulation is now in force with no transition period for new market entrants.
• Extraterritorial effect: Non-EU CASPs must comply when processing transfers involving EU-based CASPs or EU customers.
• Significant penalties: Member states must impose “effective, proportionate and dissuasive” administrative sanctions, with MiCA providing for fines up to €5 million or 3% of annual turnover for natural persons, and up to €15 million or 12.5% of annual turnover for legal entities. (Article 111, Regulation 2023/1114)

Regulatory Background and Effective Dates

The TFR originated as a European Commission proposal on July 20, 2021 (COM(2021) 422 final), implementing Financial Action Task Force (FATF) Recommendation 16 for virtual assets. After extensive trilogue negotiations between the Commission, Parliament, and Council, the final text was adopted on May 31, 2023, and published in the Official Journal on June 9, 2023.

Key dates:

• Entry into force: June 29, 2023 (20 days after OJ publication)
• Application date: December 30, 2024 (concurrent with MiCA Title III-VI application)
• Grandfathering: CASPs operating before December 30, 2024 under member state regimes had until July 1, 2025 to obtain MiCA authorization (Article 143, MiCA) — this window has now closed

Core Compliance Obligations

Information Collection Requirements

Under Article 14 of the TFR, the originating CASP must collect and verify the following before executing any crypto-asset transfer:

Originator information (Article 14(1)):

• Full name
• Distributed ledger address (the “account number”)
• At least one of: (i) address, (ii) national identity number, (iii) customer identification number, or (iv) date and place of birth

Beneficiary information (Article 14(1)):

• Full name
• Distributed ledger address

Information Transmission Requirements

This is the critical “Travel Rule” element: the collected information must accompany the transfer and be transmitted to the beneficiary CASP. Article 14(3) requires this information to be transferred:

• “Immediately” — meaning simultaneously with or before the crypto-asset transfer settles
• In a “secure manner” — requiring use of compliant messaging protocols
• To the beneficiary CASP — who must verify receipt and screen against sanctions lists before making funds available

Critically, the beneficiary CASP must implement “effective procedures” to detect missing or incomplete information (Article 15) and may be required to reject or suspend transfers that lack required data.

Unhosted Wallet Provisions

Article 14(5) imposes additional requirements when a CASP facilitates transfers to or from unhosted (self-custodied) wallets:

For transfers exceeding €1,000:

• The CASP must “assess whether” the unhosted address “is owned or controlled by” the customer
• This assessment must be based on “adequate” AML risk-based measures

Practical implementation: Most CASPs are requiring customers to sign cryptographic messages proving control of external wallet addresses, or are analyzing on-chain transaction patterns to verify ownership claims. Some platforms have set internal policies requiring verification for all unhosted wallet transfers, not just those above €1,000.

Note: Self-custody itself remains legal. The TFR does not prohibit unhosted wallets — it imposes verification duties on the CASP, not the wallet holder.

Who Must Comply

Directly subject to TFR:

• MiCA-authorized CASPs (all service categories)
• Credit institutions and payment institutions offering crypto services under MiCA
• Electronic money institutions issuing e-money tokens

Indirectly affected (compliance required for EU transactions):

• US exchanges processing transfers to/from EU CASPs
• Non-EU platforms serving EU customers (even via reverse solicitation claims — these are narrowly construed)
• Custodial wallet providers holding assets for EU persons

Uncertain applicability:

• DeFi protocols with identifiable governance structures — ESMA has indicated in its October 2024 consultation (ESMA75-453128700-949) that protocols with “identifiable natural or legal persons” may not qualify for the “fully decentralized” exclusion under MiCA Article 22(1)
• Layer-2 networks and bridges — applicability depends on whether operators qualify as CASPs

Comparison: EU vs. US Travel Rule Requirements

Requirement	EU (TFR)	US (31 CFR § 1010.410; FinCEN Guidance FIN-2019-G001)
Threshold for Travel Rule	€0 — all crypto transfers	$3,000 for transmittals of funds (domestic and international)
Unhosted wallet verification	Required above €1,000	Not yet required — proposed rule (85 Fed. Reg. 83840) remains unfinalized
Required originator data	Name, address/ID, DLT address	Name, address, DLT address (for $3,000+)
Transmission requirement	Must accompany all transfers	Must accompany transfers $3,000+
Sanctions screening	Explicit requirement (Article 15)	OFAC compliance independently required

Key implication: US operators cannot simply extend their domestic compliance frameworks to EU operations. The zero-threshold rule and unhosted wallet provisions require dedicated EU compliance procedures.

Technical Compliance Solutions

To transmit Travel Rule information between institutions, CASPs must implement interoperable messaging protocols. Leading solutions currently in use include:

• TRUST (Travel Rule Universal Solution Technology): Consortium-backed protocol supported by major US exchanges including Coinbase, Kraken, and Gemini
• Sygna: Widely adopted in Asia-Pacific markets with growing EU presence
• OpenVASP: Open-source protocol with decentralized architecture
• Notabene: Commercial Travel Rule compliance platform with broad CASP integration

CASPs should verify that their chosen solution is interoperable with EU counterparties and supports the specific data fields required under TFR Article 14.

Practical Implications

Immediate action items for US-based CASPs:

1. Determine EU exposure: Identify whether you serve EU customers, process transfers involving EU CASPs, or hold assets for EU persons. If yes to any, TFR applies to those transactions.
2. Implement Travel Rule messaging: If not already deployed, integrate a Travel Rule protocol (TRUST, Notabene, etc.) capable of transmitting Article 14 data elements to EU counterparties.
3. Update KYC collection: Ensure your onboarding captures the specific data elements required under TFR — particularly the “address or official document number or date and place of birth” alternative for originators.
4. Develop unhosted wallet procedures: Create clear policies for verifying customer ownership/control of external wallet addresses for transfers above €1,000. Document your risk-based methodology.
5. Train compliance staff: EU transactions now have different (stricter) requirements than US domestic transfers — ensure your team understands the distinctions.
6. Review counterparty relationships: Confirm EU exchange partners are MiCA-authorized and TFR-compliant. Transfers to non-compliant counterparties create regulatory risk.

For DeFi protocol operators:

Seek qualified EU legal counsel to assess whether your protocol’s governance structure brings it within MiCA/TFR scope. If you have identifiable developers, a DAO with concentrated voting power, or a legal entity receiving protocol revenue, the “fully decentralized” exclusion may not apply.

Conclusion

The EU Transfer of Funds Regulation establishes the world’s most comprehensive crypto Travel Rule regime. Its zero-threshold approach and unhosted wallet verification requirements exceed any current national framework and will likely influence regulatory developments in other jurisdictions. For US operators, the compliance burden is significant — but so is the opportunity: the EU represents a massive, now clearly-regulated market for digital asset services.

CASPs that implement robust TFR compliance now will be well-positioned as similar requirements emerge globally. Those that delay risk exclusion from EU markets and potential enforcement action.

CryptoLaw.blog will continue to monitor TFR enforcement developments, ESMA guidance on DeFi applicability, and member state implementation measures.

---

This article is for informational and educational purposes only and does not constitute legal advice. Reading this content does not create an attorney-client relationship. Laws and regulations in the cryptocurrency space change rapidly — consult a qualified attorney for advice specific to your situation and jurisdiction. Seth Goettelman is licensed to practice law in Wisconsin and Florida.