EU Transfer of Funds Regulation (TFR): A Compliance Guide to the Crypto Travel Rule

The European Union’s recast Transfer of Funds Regulation—Regulation (EU) 2023/1113—extends anti-money laundering wire transfer rules to cryptocurrency transactions. For crypto-asset service providers (CASPs) operating in or serving EU customers, the TFR imposes detailed obligations to collect, verify, and transmit customer information with every transfer.

Adopted on May 31, 2023, and applicable from December 30, 2024, the TFR works alongside the Markets in Crypto-Assets Regulation (MiCA) to form a comprehensive EU crypto regulatory framework. While MiCA governs licensing and market conduct, the TFR addresses money laundering and terrorist financing risks inherent in blockchain’s pseudonymity.

Key Takeaways

• Full Travel Rule for CASP-to-CASP Transfers: All transfers between CASPs must include complete originator and beneficiary information—no minimum threshold applies. Regulation (EU) 2023/1113, Art. 14(1).
• Self-Hosted Wallet Provisions: CASPs must apply risk-based measures for transfers involving unhosted wallets, with enhanced verification requirements for higher-risk scenarios. Art. 14(5).
• Application Date: December 30, 2024—the same date MiCA’s CASP provisions take full effect.
• No Standalone Operation: The TFR requires CASP authorization under MiCA as a precondition; unlicensed entities cannot comply their way into legality.
• Privacy Tensions: The regulation intersects with GDPR, requiring CASPs to balance AML data collection with data protection obligations.

Legal Framework and Context

The TFR implements Financial Action Task Force (FATF) Recommendation 16—the “travel rule”—which requires financial institutions to obtain, hold, and transmit originator and beneficiary information during fund transfers. FATF extended this recommendation to virtual asset service providers (VASPs) in June 2019.

The EU’s implementation is part of a broader AML reform package that includes:

• The Anti-Money Laundering Authority (AMLA): A new EU-level supervisor with direct oversight powers over high-risk obliged entities, including certain CASPs
• The Anti-Money Laundering Regulation (AMLR): Regulation (EU) 2024/1624, establishing harmonized AML/CFT rules
• The Sixth Anti-Money Laundering Directive (6AMLD): Directive (EU) 2024/1640, updating the institutional framework

The original Transfer of Funds Regulation—Regulation (EU) 2015/847—applied only to traditional payment service providers. The 2023 recast explicitly adds “crypto-asset service providers” and “transfers of crypto-assets” to its scope. See Regulation (EU) 2023/1113, Recitals (4)-(9).

Scope: Who Must Comply

The TFR applies to CASPs as defined in MiCA, Article 3(1)(15). This includes any legal person whose occupation or business includes providing one or more crypto-asset services to clients on a professional basis. Regulation (EU) 2023/1114, Art. 3(1)(15).

Entities within scope:

• Crypto-to-fiat and crypto-to-crypto exchanges
• Custodial wallet providers
• Platforms facilitating the transfer of crypto-assets
• Crypto payment service providers

Entities potentially outside scope:

• Truly decentralized protocols with no identifiable service provider (though this remains contested)
• Hardware and software wallet manufacturers (absent custodial services)
• Mining and validation activities (absent CASP functions)

The regulation covers all “crypto-assets” as defined under MiCA—a broad category that includes asset-referenced tokens, e-money tokens, utility tokens, and other tokens not qualifying for securities exemptions. Regulation (EU) 2023/1114, Art. 3(1)(5). NFTs may be included depending on their characteristics; fungible NFTs or those issued in large series fall within MiCA’s scope and consequently the TFR’s.

Information Requirements for Crypto Transfers

Article 14 of the TFR establishes the core information requirements. Unlike the €1,000 threshold in the original wire transfer rules, the TFR requires full information for all crypto-asset transfers between CASPs.

Required Originator Information

Per Article 14(1), the originating CASP must ensure the transfer is accompanied by:

• The name of the originator
• The originator’s account number (where an account exists and is used to process the transaction) or crypto-asset address
• The originator’s address, official personal document number, customer identification number, or date and place of birth

Required Beneficiary Information

• The name of the beneficiary
• The beneficiary’s account number or crypto-asset address

Verification Obligations

CASPs must verify the accuracy of originator information before transferring crypto-assets. Article 14(4) requires CASPs to implement effective procedures to detect whether required information is missing or incomplete—and to either reject the transfer or request the missing information before crediting the recipient.

Self-Hosted Wallet Transfers: The Controversial Provisions

The TFR’s treatment of “unhosted” or “self-hosted” wallets generated significant debate during the legislative process. Article 14(5) addresses transfers between CASPs and addresses not held by another CASP (i.e., self-custody wallets).

The regulation does not ban self-hosted wallet transfers. However, it imposes a risk-based framework:

For all transfers to/from unhosted wallets:

• The CASP must collect the same originator/beneficiary information as for CASP-to-CASP transfers
• The CASP must assess the ML/TF risk of the transfer
• The CASP must apply customer due diligence measures commensurate with the identified risk

Risk factors to consider include:

• Whether the wallet has transacted with addresses linked to illicit activity
• Transaction patterns suggesting structuring or layering
• Geographic risk factors
• The customer’s overall risk profile

Critically, the final text removed the €1,000 hard threshold that appeared in earlier drafts. Instead, CASPs must take a risk-based approach, potentially requiring wallet ownership verification for any higher-risk transfer regardless of amount. The European Banking Authority (EBA) is mandated to issue guidelines on the factors CASPs should consider. Regulation (EU) 2023/1113, Art. 14(5), Recital (23).

Ownership verification methods may include:

• Cryptographic proof (signing a message with the wallet’s private key)
• Satoshi test (micro-transaction from the customer-claimed address)
• Screen recording or screenshot verification
• Customer declaration (for lower-risk scenarios)

GDPR Intersection: Balancing AML and Privacy

The TFR creates tension with the General Data Protection Regulation (GDPR), Regulation (EU) 2016/679. CASPs must collect and transmit personal data to comply with the travel rule while simultaneously adhering to GDPR’s data minimization, purpose limitation, and storage limitation principles.

Key considerations:

• Legal basis: TFR compliance constitutes a “legal obligation” under GDPR Article 6(1)(c), providing lawful grounds for processing
• Data minimization: CASPs should collect only the information specifically required by the TFR—not additional data under the guise of compliance
• Retention periods: AML record-keeping requirements (typically five years) override shorter GDPR retention preferences, but data should not be kept beyond the statutory period
• Cross-border transfers: Transmitting personal data to non-EU CASPs must comply with GDPR Chapter V requirements on international transfers

Recital (28) of the TFR explicitly acknowledges this intersection, stating that processing must comply with GDPR and that data should be retained “only for as long as is necessary.”

How the EU Travel Rule Compares to US Requirements

The EU approach is more prescriptive than current US requirements:

Aspect	EU (TFR)	US (Current)
Threshold	No minimum; all transfers	$3,000 (31 C.F.R. § 1010.410(f))
Unhosted wallets	Risk-based verification required	No finalized rule (2020 proposal withdrawn)
Asset scope	All MiCA-defined crypto-assets	“Convertible virtual currencies”
Enforcement	National competent authorities + AMLA	FinCEN, state regulators

US-based CASPs transacting with EU-licensed counterparties will need to provide information consistent with TFR requirements or risk having transactions rejected.

Implementation Timeline

• May 31, 2023: TFR adopted by co-legislators
• June 9, 2023: Publication in Official Journal
• December 30, 2024: Full application date (aligns with MiCA CASP provisions)
• 2025-2026: EBA guidelines on unhosted wallet verification expected
• 2026: AMLA to assume supervisory functions for designated high-risk entities

Practical Implications

For EU-Licensed CASPs—Compliance Checklist:

1. Update customer onboarding to collect all required originator/beneficiary data fields
2. Implement or integrate with a travel rule messaging solution (TRUST, Notabene, Sygna, OpenVASP, or similar)
3. Develop policies for unhosted wallet transfers, including risk assessment criteria and ownership verification procedures
4. Establish procedures for handling transfers with missing information (rejection, hold, request)
5. Update privacy notices and GDPR documentation to reflect travel rule data processing
6. Train compliance staff on new obligations
7. Coordinate with legal counsel on GDPR-compliant international data transfers

For Non-EU CASPs: Prepare to provide TFR-compliant information for any transfer involving an EU-licensed counterparty. Consider whether serving EU customers requires adjusting global data collection practices.

For Self-Custody Users: Expect additional verification requests when withdrawing to or depositing from personal wallets. CASPs may require proof of wallet ownership, particularly for larger transfers or those flagged as higher-risk.

For DeFi Protocols: Protocols with identifiable front-end operators, governance token holders exercising control, or centralized components may face classification as CASPs—triggering TFR obligations. Truly decentralized, immutable smart contracts without identifiable operators present an unresolved regulatory question.

Conclusion

The EU Transfer of Funds Regulation establishes a rigorous travel rule framework for crypto-asset transfers, with particular attention to the self-hosted wallet question that many jurisdictions have avoided. By requiring risk-based verification for unhosted wallet transfers and eliminating de minimis thresholds for CASP-to-CASP transfers, the TFR sets a global high-water mark for crypto AML compliance.

Compliance is not optional for CASPs operating in the EU market—and non-compliance puts MiCA authorization at risk. CASPs should prioritize implementing interoperable travel rule solutions and developing clear policies for the nuanced unhosted wallet provisions before the next regulatory examination cycle.

Entities seeking to understand their specific obligations should consult qualified EU legal counsel, particularly given the ongoing development of EBA guidelines and national implementation measures.

---

This article is for informational and educational purposes only and does not constitute legal advice. Reading this content does not create an attorney-client relationship. Laws and regulations in the cryptocurrency space change rapidly — consult a qualified attorney for advice specific to your situation and jurisdiction. Seth Goettelman is licensed to practice law in Wisconsin and Florida.