EU Transfer of Funds Regulation (TFR): The Crypto Travel Rule Explained for US Firms

The European Union’s Transfer of Funds Regulation—Regulation (EU) 2023/1113, published in OJ L 150, 9.6.2023—represents one of the most operationally demanding compliance frameworks ever imposed on the crypto industry. Often called the “crypto travel rule,” this regulation extends traditional wire transfer information requirements to crypto-asset transfers, requiring crypto-asset service providers (CASPs) to collect, verify, and transmit detailed originator and beneficiary information with every transaction.

For US-based crypto firms serving European customers—or contemplating EU market entry—the TFR creates compliance obligations that took full effect on December 30, 2024. If your platform touches EU customers or counterparties, understanding this regulation is not optional.

Key Takeaways

• No de minimis threshold for data collection: Unlike traditional wire transfer rules, the TFR requires originator and beneficiary data collection for all crypto-asset transfers—regardless of amount.
• Self-hosted wallet verification threshold: Transfers exceeding €1,000 to or from self-hosted wallets require CASPs to verify the identity of the wallet owner, not merely collect their name.
• Prohibition on anonymous transfers: CASPs cannot execute transfers where required information is missing. Article 19 explicitly bars transfers to anonymous or non-compliant service providers.
• Extraterritorial compliance burden: US firms facilitating transfers involving EU CASPs must comply with travel rule data requests or risk having transactions rejected.
• Full implementation occurred December 30, 2024: The grace period has ended. Enforcement is now live.

What Is the Transfer of Funds Regulation?

The TFR implements Financial Action Task Force (FATF) Recommendation 16—the “travel rule”—for crypto-assets within the EU. Regulation (EU) 2023/1113 recasts and extends the pre-existing Transfer of Funds Regulation (Regulation (EU) 2015/847, OJ L 141, 5.6.2015) to cover crypto-asset transfers alongside traditional fund transfers.

Legislative timeline:

• Adopted: May 31, 2023
• Published: June 9, 2023 (OJ L 150)
• Entered into force: June 29, 2023
• Fully applicable: December 30, 2024

The TFR operates in tandem with the Markets in Crypto-Assets Regulation (MiCA), Regulation (EU) 2023/1114 (OJ L 150, 9.6.2023). While MiCA establishes licensing and operational requirements for CASPs, the TFR addresses the specific anti-money laundering (AML) and counter-terrorist financing (CTF) data requirements for transfers those CASPs facilitate.

Scope: Who and What Is Covered?

Title III of the TFR (Articles 14-22) establishes the crypto-asset transfer regime. The regulation applies to “crypto-asset transfers”—defined under Article 3(19) as any transaction carried out at least partly by electronic means on behalf of an originator with a view to making crypto-assets available to a beneficiary through a CASP.

Covered Entities

• Originator CASPs: The CASP from whose platform the transfer originates
• Beneficiary CASPs: The CASP receiving the transfer on behalf of the beneficiary
• Intermediary CASPs: Any CASP that participates in the transfer chain between originator and beneficiary CASPs (Article 21)
• Payment service providers (PSPs): Where transfers involve both crypto-assets and fiat currency

Covered Transactions

• All CASP-to-CASP crypto-asset transfers
• Transfers from a CASP to a self-hosted wallet
• Transfers from a self-hosted wallet to a CASP
• Cross-border and domestic transfers within the EU
• Transfers involving third-country CASPs

What’s excluded: Purely peer-to-peer transfers between individuals not involving any CASP fall outside scope. The regulation activates only when a regulated entity touches at least one side of the transaction.

Core Obligations by Party

Originator CASP Obligations (Articles 14-15)

The CASP of the originator must ensure that the following information accompanies every crypto-asset transfer:

Required originator information:

• Full name
• Account number (the distributed ledger address or crypto-asset account identifier from which the transfer is made)
• One of the following: address, official personal document number, customer identification number, or date and place of birth

Required beneficiary information:

• Full name
• Account number (the distributed ledger address or crypto-asset account identifier to which the transfer is made)

Crucially, the originator CASP must verify originator information against reliable, independent sources before executing the transfer (Article 14(5)). For existing customers with verified KYC on file, verification is satisfied. For new customers, verification must occur before or at the time of transfer.

Beneficiary CASP Obligations (Articles 16-17)

The receiving CASP must:

1. Detect missing information: Implement effective procedures—whether real-time or post-transfer monitoring—to identify incomplete originator or beneficiary data
2. Request complete information: Where data is missing, request the full information set from the originator CASP
3. Risk-based response: Determine whether to execute, reject, or suspend the transfer based on risk assessment when information gaps exist
4. Consider SAR filing: Where an originator CASP repeatedly fails to provide required information, assess whether to file a suspicious activity report
5. Verify beneficiary information: Verify beneficiary details against customer records

Intermediary CASP Obligations (Article 21)

Where an intermediary CASP participates in a transfer chain, it must ensure that all originator and beneficiary information received travels with the crypto-asset transfer to the next CASP in the chain. The intermediary cannot strip or fail to forward required data.

Record-Keeping (Article 22)

All CASPs must retain complete originator and beneficiary information for five years from the date of the transfer. Records must be available to competent authorities upon request for AML/CTF supervision and investigation purposes.

Self-Hosted Wallet Requirements: The Critical Detail

The TFR’s treatment of self-hosted wallets (also called “unhosted” or “non-custodial” wallets) generated intense industry pushback during the legislative process. The final text creates a two-tier system:

All Transfers Involving Self-Hosted Wallets

For any transfer to or from a self-hosted wallet—regardless of amount—the CASP must collect and record the name of the natural or legal person who owns or controls the self-hosted wallet (Article 14(5), Article 16(2)).

Transfers Exceeding €1,000

For transfers to or from a self-hosted wallet that exceed €1,000 (or equivalent), the CASP must take additional measures to verify that the self-hosted wallet is owned or controlled by the claimed person.

The regulation does not mandate a specific verification method, allowing CASPs flexibility. Acceptable approaches may include:

• Cryptographic proof of ownership (the wallet owner signs a message with the private key)
• Documentary evidence linking the wallet address to a verified individual
• Risk-based technical analysis consistent with AML/CTF obligations

This verification requirement—rather than mere collection—represents the €1,000 threshold’s true significance.

Prohibition on Transfers to Anonymous or Non-Compliant Providers

Article 19 establishes an absolute prohibition: CASPs cannot execute transfers where the originator or beneficiary CASP is unable to be identified, or where the counterparty CASP cannot provide required information. This effectively requires CASPs to conduct counterparty due diligence before establishing correspondent relationships with other crypto service providers.

For US firms, this means: if a European CASP cannot verify your identity as a legitimate, identifiable service provider—and confirm you can send and receive travel rule data—they must refuse to process transfers to or from your platform.

How the EU TFR Compares to US Requirements

Element	EU TFR (2023/1113)	US FinCEN Travel Rule (31 CFR § 1010.410)
General threshold	No threshold—all transfers	$3,000 threshold
Self-hosted wallet rules	Explicit: collection for all; verification above €1,000	No explicit rules (2020 proposed rule never finalized)
Crypto-specific provisions	Yes, Title III of regulation	No; general funds transfer rules applied by analogy
Intermediary obligations	Explicit pass-through requirements (Art. 21)	Less detailed
Effective date	December 30, 2024	Original rule 1996; crypto-specific rules pending
Enforcement	National competent authorities; ties to MiCA licensing	FinCEN; potential BSA violations

Note: FinCEN proposed extending the travel rule explicitly to convertible virtual currency (CVC) in a December 2020 Notice of Proposed Rulemaking, but that rulemaking has not been finalized as of March 2026. US-based money services businesses apply existing BSA requirements, but the specific contours for crypto remain less defined than in the EU.

GDPR and Data Protection Considerations

Transmitting personally identifiable information (PII) alongside crypto transfers creates tension with the General Data Protection Regulation (GDPR), Regulation (EU) 2016/679.

However, the TFR explicitly addresses this. Article 23 confirms that processing personal data under the TFR is lawful where necessary for compliance with a legal obligation (GDPR Article 6(1)(c)). CASPs may—and must—process originator and beneficiary data to the extent required by the TFR without obtaining separate consent.

That said, GDPR principles still apply:

• Data minimization: Collect only what the TFR requires—no more
• Purpose limitation: Use travel rule data only for AML/CTF compliance
• Storage limitation: The five-year retention period is the maximum; delete data thereafter unless other legal obligations apply
• Security: Implement appropriate technical and organizational measures to protect transmitted data

Enforcement Framework

The TFR is directly applicable across all EU Member States—it requires no national transposition. However, enforcement authority rests with national competent authorities (NCAs), typically the same regulators overseeing MiCA compliance (e.g., BaFin in Germany, AMF in France, CBI in Ireland).

Article 24 requires Member States to establish “effective, proportionate and dissuasive” administrative sanctions for TFR violations. While specific penalty amounts vary by Member State, potential consequences include:

• Administrative fines
• Public statements identifying the violating entity
• Orders to cease conduct
• Withdrawal or suspension of MiCA authorization

The tie to MiCA licensing is critical: a CASP that systematically violates the TFR risks losing its authorization to operate in the EU entirely.

Practical Implications

Compliance Checklist for US Firms Serving EU Customers

☐ Map your EU exposure: Identify all products, services, and customer segments that involve EU counterparties or customers.

☐ Assess data collection gaps: Compare your current originator/beneficiary data fields against TFR requirements. Identify shortfalls.

☐ Implement travel rule messaging: Adopt a travel rule data transmission protocol. Options include TRUST (Coinbase), Sygna Bridge, OpenVASP, Notabene, or direct API integrations with EU counterparties.

☐ Establish counterparty due diligence procedures: Before transacting with a new EU CASP, verify they are MiCA-authorized and capable of receiving/transmitting travel rule data.

☐ Develop self-hosted wallet procedures: Create workflows for collecting wallet owner names on all self-hosted wallet transfers and verifying ownership for transfers above €1,000.

☐ Update terms of service: Ensure customer agreements disclose travel rule data collection and transmission obligations.

☐ Train staff: Customer support, compliance, and operations teams need clear guidance on travel rule requirements and escalation procedures.

☐ Configure transaction monitoring: Flag transfers where required travel rule data is missing or incomplete for manual review.

☐ Establish record-keeping: Retain travel rule data for at least five years with appropriate access controls.

For DeFi Protocols

The TFR applies to CASPs as defined under MiCA. Truly decentralized protocols with no controlling entity may fall outside scope—but this remains legally untested. Protocols should assess whether any aspect of their operations (front-ends, interface providers, governance token holders with control rights) could be deemed a CASP. European Banking Authority guidance on MiCA scope may clarify these boundaries.

Ongoing Developments to Monitor

• European Banking Authority (EBA) technical standards: The EBA is developing guidelines on TFR implementation, including data transmission formats and verification methodologies.
• National enforcement patterns: As NCAs begin enforcement, watch for administrative decisions that clarify interpretation of ambiguous provisions.
• Travel rule interoperability: Industry efforts to establish common messaging standards will affect operational costs and efficiency.
• US regulatory developments: FinCEN action on the 2020 proposed rule—or new rulemaking under subsequent administrations—will determine the extent of US-EU regulatory alignment.
• FATF updated guidance: The FATF continues refining Recommendation 16 guidance, and changes may prompt EU regulatory updates.

Conclusion

The EU Transfer of Funds Regulation establishes the world’s most comprehensive crypto-asset transfer transparency framework. By eliminating de minimis thresholds for data collection, imposing explicit self-hosted wallet obligations, and prohibiting transfers to non-compliant providers, the TFR creates a compliance environment where anonymity is effectively unavailable for any transaction touching the EU regulated sector.

For US firms, the practical reality is straightforward: if you serve EU customers or transact with EU-based CASPs, you must participate in the travel rule ecosystem. EU counterparties are legally prohibited from processing your transfers otherwise. The compliance burden is real, but so is the market access at stake.

CryptoLaw.blog will continue tracking TFR enforcement developments, national implementation variations, EBA technical standards, and the evolving relationship between EU and US crypto AML frameworks as this regulatory regime matures.

---

This article is for informational and educational purposes only and does not constitute legal advice. Reading this content does not create an attorney-client relationship. Laws and regulations in the cryptocurrency space change rapidly—consult a qualified attorney for advice specific to your situation and jurisdiction. Seth Goettelman is licensed to practice law in Wisconsin and Florida.