EU Travel Rule for Crypto: Understanding Regulation 2023/1113 and CASP Compliance Requirements

The European Union has fundamentally reshaped the compliance landscape for cryptocurrency businesses operating within its borders. Regulation (EU) 2023/1113—commonly referred to as the EU crypto travel rule—extends anti-money laundering traceability requirements from traditional wire transfers to crypto-asset transfers. Published in the Official Journal of the European Union on June 9, 2023 (OJ L 150, 9.6.2023), this regulation represents one of the most significant operational compliance challenges facing crypto-asset service providers (CASPs) since the sector’s inception.

This regulatory analysis examines the legal framework, practical compliance requirements, and strategic implications for CASPs navigating the EU travel rule. With the regulation now fully applicable, understanding these requirements is essential for any entity facilitating crypto-asset transfers involving EU persons or jurisdictions.

Key Takeaways

• Universal applicability: Regulation 2023/1113 requires CASPs to collect, verify, and transmit originator and beneficiary information for all crypto-asset transfers—with no de minimis threshold for CASP-to-CASP transfers.
• Self-hosted wallet threshold: Transfers to or from unhosted wallets exceeding €1,000 trigger enhanced verification obligations requiring CASPs to establish and document wallet ownership.
• Implementation timeline: The regulation entered into force on June 29, 2023, with full application commencing December 30, 2024, coinciding with MiCA’s application date.
• Extraterritorial impact: Non-EU CASPs transacting with EU-based CASPs must participate in compliant information exchange or risk transaction refusals—creating a de facto global compliance standard.
• GDPR intersection: CASPs must balance travel rule data collection against GDPR data minimization principles, requiring careful privacy impact assessments.

Legal Framework: From FATF Guidance to Binding EU Law

The EU travel rule implements Recommendation 16 of the Financial Action Task Force (FATF), which has required virtual asset service providers to apply traceability requirements since the FATF’s June 2019 interpretive note update. The FATF’s Updated Guidance for a Risk-Based Approach to Virtual Assets and Virtual Asset Service Providers (October 2021) provided detailed implementation expectations that heavily influenced the EU’s legislative approach.

At the EU level, Regulation (EU) 2023/1113 recasts and substantially amends Regulation (EU) 2015/847 on information accompanying transfers of funds. The recast regulation explicitly brings crypto-asset transfers within scope, establishing in Recital 9 that “transfers of crypto-assets should be subject to the same traceability requirements as wire transfers.“

The regulation operates in tandem with Regulation (EU) 2023/1114 (Markets in Crypto-Assets Regulation, or MiCA), which establishes the definitional framework for “crypto-assets” and “crypto-asset service providers.” Under MiCA Article 3(1)(5), a crypto-asset means “a digital representation of a value or of a right that is able to be transferred and stored electronically using distributed ledger technology or similar technology.” Regulation 2023/1113 incorporates these definitions by direct reference (Article 3).

Legislative History and Industry Negotiation

The European Commission’s original proposal, published in July 2021, sparked significant industry controversy. Early drafts contained provisions that would have required verification of self-hosted wallet ownership for all transfers regardless of amount—a requirement industry participants argued was technically infeasible and privacy-invasive.

During trilogue negotiations between the European Parliament, Council, and Commission, the €1,000 threshold for self-hosted wallet verification emerged as a compromise. The European Parliament had initially proposed a €1,000 threshold for CASP-to-CASP transfers as well, but this was rejected in the final text, leaving CASP-to-CASP transfers subject to travel rule requirements at any amount.

Scope: Covered Transfers and Obliged Entities

Material Scope

Article 2 of Regulation 2023/1113 establishes that the regulation applies to “transfers of crypto-assets” where at least one CASP acts on behalf of an originator or beneficiary. The regulation applies irrespective of:

• The underlying value denomination of the crypto-asset
• Whether the transfer is domestic within a Member State or cross-border
• The transfer amount (for CASP-to-CASP transfers)

The regulation distinguishes three transfer categories with different compliance implications:

Transfer Type	Threshold	Requirements
CASP-to-CASP	No threshold (all transfers)	Full originator/beneficiary information transmission
CASP-to-self-hosted wallet	€1,000	Ownership verification above threshold
Self-hosted wallet-to-CASP	€1,000	Ownership verification above threshold

Important exclusion: Purely peer-to-peer transfers between self-hosted wallets where no CASP is involved on either side fall outside the regulation’s scope. Recital 15 confirms: “Where the transfer of crypto-assets does not involve a crypto-asset service provider…this Regulation should not apply.“

Personal Scope: Obliged Entities

The primary obliged entities are CASPs as defined under MiCA Article 3(1)(15). This encompasses entities providing any of the following services:

• Custody and administration of crypto-assets on behalf of clients
• Operation of a trading platform for crypto-assets
• Exchange of crypto-assets for funds or other crypto-assets
• Execution of orders for crypto-assets on behalf of clients
• Transfer services for crypto-assets on behalf of clients

The regulation applies to CASPs authorized in the EU under MiCA, as well as to non-EU CASPs insofar as they conduct transfers with EU-based CASPs or customers. This creates significant extraterritorial compliance pressure.

Information Requirements: The Travel Rule in Practice

Originator Information (Article 14)

The CASP of the originator must ensure that crypto-asset transfers are accompanied by:

• The name of the originator
• The originator’s distributed ledger address (or, where no DLT address exists, the crypto-asset account number)
• The originator’s account number with the CASP
• One of the following: the originator’s address, official personal document number, customer identification number, or date and place of birth

Beneficiary Information (Article 14)

Required beneficiary information comprises:

• The name of the beneficiary
• The beneficiary’s distributed ledger address (or crypto-asset account number where no DLT address exists)

Verification Standards

Article 14(5) mandates that the originator’s CASP verify originator information “on the basis of documents, data or information obtained from a reliable and independent source” before executing the transfer. This verification requirement aligns with standard customer due diligence under Directive (EU) 2015/849 (AMLD4) and the forthcoming AML Regulation.

For the beneficiary’s CASP, Article 16 requires verification of beneficiary information upon receipt and implementation of “effective procedures, including, where appropriate, ex-post monitoring or real-time monitoring” to detect missing or incomplete information.

Data Retention

Under Article 20, CASPs must retain travel rule information for five years after the transfer date. Upon expiry of this period, personal data must be deleted unless national law requires longer retention for specific AML/CFT purposes. This retention period aligns with AMLD requirements but creates tension with GDPR storage limitation principles that CASPs must carefully manage.

Self-Hosted Wallet Verification: The €1,000 Threshold

The treatment of self-hosted (unhosted) wallets emerged as the regulation’s most contentious element. The final framework under Articles 14(5a) and 16(1a) establishes the following requirements for transfers exceeding €1,000:

For outbound transfers (CASP to self-hosted wallet):

1. The CASP must verify whether the self-hosted wallet address is owned or controlled by its own customer
2. If customer-owned, document the verification method
3. If not customer-owned (i.e., transfer to a third party’s self-hosted wallet), apply risk-based measures

For inbound transfers (self-hosted wallet to CASP):

1. The receiving CASP must collect information on the self-hosted wallet address
2. Verify whether the wallet is owned by the customer receiving funds
3. Document verification and apply enhanced monitoring where appropriate

Verification Methodologies

The regulation does not mandate specific verification technology, providing CASPs flexibility to implement solutions such as:

• Cryptographic proof: Signed messages demonstrating wallet control (e.g., signing a challenge message with the wallet’s private key)
• Micro-transaction verification: Requiring the customer to send a small specified amount from the wallet (Satoshi test)
• Third-party verification services: Blockchain analytics providers offering wallet attribution
• Documentary evidence: Screenshots or records demonstrating wallet setup/ownership

CASPs must ensure their chosen methodology provides reasonable assurance of ownership and document their rationale. The European Banking Authority may issue further guidance on acceptable verification standards.

Technical Implementation: The Interoperability Challenge

Unlike traditional wire transfers flowing through established messaging systems (SWIFT MT103/MT202), crypto-asset transfers lack a standardized protocol for transmitting travel rule data alongside or referencing the on-chain transaction. This creates the regulation’s primary operational challenge.

Article 21 requires travel rule information to be transmitted “immediately and in a secure manner” to accompany the crypto-asset transfer. The regulation does not specify technical standards, leaving implementation to market solutions and potential future EBA guidance.

Current Market Solutions

Several interoperability protocols have emerged:

• TRUST Network: Consortium-based solution with major exchange participation
• Travel Rule Protocol (TRP): Open-source messaging standard
• Sygna Bridge: API-based interoperability solution
• OpenVASP: Decentralized messaging protocol
• Notabene, Chainalysis Compliance, Elliptic: Commercial compliance platforms offering travel rule functionality

The Sunrise Problem

A critical operational issue arises when a compliant CASP initiates a transfer to a non-compliant or non-participating counterparty. Article 17 addresses this by requiring the beneficiary’s CASP to implement “risk-based procedures” for determining when to execute, reject, or suspend a transfer lacking required information.

In practice, compliant EU CASPs may need to:

• Maintain whitelists of verified compliant counterparties
• Reject or delay transfers to CASPs that cannot receive travel rule data
• Apply enhanced due diligence for transfers involving non-participating jurisdictions

This creates significant pressure on non-EU CASPs to adopt compliant infrastructure or face de facto exclusion from EU counterparty relationships.

GDPR Intersection: Balancing AML and Privacy

Regulation 2023/1113 operates within the broader EU data protection framework, creating inherent tension between travel rule data collection and GDPR principles. Article 22 explicitly addresses this intersection:

“The processing of personal data under this Regulation shall be subject to Regulation (EU) 2016/679 [GDPR]…“

Key compliance considerations include:

Lawful basis: Processing travel rule data is lawful under GDPR Article 6(1)(c) (legal obligation) and, for special category data potentially implicated in transaction patterns, must satisfy Article 9(2)(g) requirements.

Data minimization: CASPs must collect only the information specifically required under Articles 14-16 and avoid over-collection. Systems should be designed to capture mandated fields without extraneous personal data.

Cross-border transfers: Travel rule data shared with non-EU CASPs constitutes international data transfer under GDPR Chapter V. CASPs must implement appropriate safeguards (Standard Contractual Clauses, adequacy decisions, or derogations under Article 49).

Data subject rights: Customers retain GDPR rights including access (Article 15), rectification (Article 16), and erasure (Article 17, subject to retention requirements). CASPs must have procedures to respond to data subject requests.

DeFi Protocols: Regulatory Uncertainty

The regulation’s application to decentralized finance protocols remains legally unsettled. Regulation 2023/1113 applies to “crypto-asset service providers”—entities providing services “on behalf of” clients. Many DeFi protocols operate through autonomous smart contracts without a centralized service provider relationship.

The regulatory analysis turns on whether identifiable persons exercise sufficient control to constitute a CASP:

Factors suggesting CASP status may apply:

• Identifiable development team with ongoing protocol control
• Governance token holders exercising upgrade or parameter authority
• Fee extraction mechanisms benefiting identifiable parties
• Front-end interfaces operated by legal entities

Factors suggesting exemption:

• Fully immutable smart contracts with no administrative functions
• No identifiable party capable of implementing travel rule requirements
• Purely peer-to-peer functionality without intermediation

The European Securities and Markets Authority (ESMA) and EBA have signaled skepticism toward blanket claims of decentralization. MiCA Recital 22 notes that crypto-asset services provided “in a fully decentralised manner without any intermediary” fall outside scope, but emphasizes this exemption applies only to genuinely decentralized arrangements. Practitioners should anticipate substance-over-form analysis from regulators.

Comparison with U.S. Requirements

U.S.-based CASPs face a different regulatory landscape that creates cross-border compliance complexity:

Requirement	EU (Reg. 2023/1113)	U.S. (BSA/FinCEN)
CASP-to-CASP threshold	No threshold	$3,000 (31 C.F.R. § 1010.410)
Self-hosted wallet rules	€1,000 verification threshold	No finalized specific rule*
Data retention	5 years	5 years (31 C.F.R. § 1010.430)
Regulatory clarity	Comprehensive regulation	Guidance-based; enforcement uncertainty

*FinCEN proposed additional requirements for unhosted wallet transactions in December 2020, but Treasury withdrew the proposal in January 2021. No replacement rulemaking has been finalized.

FinCEN’s 2019 guidance (FIN-2019-G001) confirmed that money services businesses dealing in convertible virtual currency are subject to BSA requirements, including the funds transfer rule. However, application specifics remain subject to interpretive uncertainty absent comprehensive rulemaking comparable to Regulation 2023/1113.

Strategic implication: CASPs operating across both jurisdictions may find efficiency in adopting EU-compliant data collection universally, given the EU’s more prescriptive requirements. This also positions the entity favorably for potential future U.S. rulemaking.

Enforcement Framework

Article 23 mandates Member States establish “effective, proportionate and dissuasive” penalties for infringements. National competent authorities—typically the same bodies responsible for MiCA supervision—hold enforcement authority.

Potential sanctions include:

• Administrative fines (amounts determined by national law)
• Public statements identifying responsible parties
• Cease-and-desist orders
• Temporary prohibition of management functions
• Withdrawal of CASP authorization under MiCA

The interconnection with MiCA licensing creates powerful compliance incentives: travel rule violations could trigger supervisory action jeopardizing the CASP’s authorization to operate in the EU market entirely.

Practical Implications

For CASPs Authorized in the EU:

• ✓ Conduct gap analysis comparing current data collection against Articles 14-16 requirements
• ✓ Implement or integrate interoperable travel rule solution (assess TRUST, TRP, commercial platforms)
• ✓ Establish documented self-hosted wallet verification procedures with clear €1,000 threshold monitoring
• ✓ Update AML/CFT policies and staff training to reflect travel rule obligations
• ✓ Develop counterparty due diligence procedures for evaluating CASP compliance status
• ✓ Conduct Data Protection Impact Assessment addressing GDPR intersection
• ✓ Establish data retention and deletion procedures aligned with 5-year requirement

For Non-EU CASPs with EU Exposure:

• ✓ Assess transaction flows for EU counterparty or customer involvement
• ✓ Evaluate adoption of EU-compliant infrastructure to maintain counterparty relationships
• ✓ Implement data handling procedures satisfying GDPR international transfer requirements
• ✓ Monitor for EU CASP counterparty whitelisting requirements

For Self-Hosted Wallet Users:

• Expect wallet ownership verification requests for transactions exceeding €1,000
• Maintain records of wallet addresses under personal control
• Understand that privacy-focused practices may limit CASP service availability

Conclusion

Regulation (EU) 2023/1113 establishes the EU as a global leader in crypto-asset AML traceability requirements. For CASPs, compliance demands significant investment in data collection, verification, secure transmission infrastructure, and counterparty coordination. The €1,000 threshold for self-hosted wallet verification provides measured relief but does not eliminate the technical and operational challenges these requirements present.

The regulation’s extraterritorial effects—through EU CASPs’ counterparty requirements—will likely drive global adoption of travel rule compliance infrastructure, even in jurisdictions without equivalent domestic requirements. CASPs should monitor EBA technical guidance, national implementation measures, and early enforcement actions that will clarify supervisory expectations and establish compliance benchmarks.

As crypto-asset markets mature, the travel rule represents a fundamental shift toward the transparency standards long applied to traditional finance. CASPs that build robust compliance infrastructure now will be positioned advantageously as these requirements become global standard practice.

---

This article is for informational and educational purposes only and does not constitute legal advice. Reading this content does not create an attorney-client relationship. Laws and regulations in the cryptocurrency space change rapidly — consult a qualified attorney for advice specific to your situation and jurisdiction. Seth Goettelman is licensed to practice law in Wisconsin and Florida.