FATF Travel Rule for Crypto 2026: Rules, Thresholds, Country Status

A compliance analyst at a mid-sized exchange in Dubai gets a withdrawal request for USDT worth a little over AED 3,500. Before the coins leave, she needs the sender's name, wallet or account number and home address, plus the name and wallet of the person receiving. If the destination is another exchange, that data has to travel with the transfer. If it is a private wallet, a different set of checks kicks in. That ritual, repeated millions of times a day across the world's crypto platforms, is the Travel Rule.

The idea is old. Banks have attached sender and recipient details to wire transfers for decades so that investigators can follow money. The Financial Action Task Force (FATF), the intergovernmental body that writes global anti-money laundering standards, extended the obligation to virtual asset service providers (VASPs) under Recommendation 15 and its interpretive note. Seven years on, most large markets have written it into law. Far fewer have checked whether anyone is actually doing it.

What the Travel Rule actually requires

Strip away the jargon and the rule asks three things of a VASP, which is any business that exchanges, transfers or holds crypto for customers.

• Collect. The sending VASP gathers originator information (name, account or wallet address, and usually a physical address or ID number) and beneficiary information (name and account or wallet address).
• Transmit. That data must reach the receiving VASP before or at the same time as the transfer, securely and not on the public blockchain.
• Check and hold. The receiving VASP must hold the information, check the beneficiary matches its own customer, and decide what to do when data is missing or looks wrong.

On top of this sit sanctions screening and suspicious activity reporting. The Travel Rule is the plumbing that makes those checks possible when value moves between two different firms.

Crypto made this harder than in banking for one structural reason. A bank wire always runs between two identifiable institutions over a known network. A blockchain address carries no label saying whether it belongs to a regulated exchange in Singapore, an unlicensed broker, or a person holding their own keys. So before a VASP can send data, it has to work out who, if anyone, is on the other side. That counterparty discovery problem is where most of the industry's money and engineering effort has gone.

The 2026 FATF scorecard: laws up, enforcement lagging

The FATF published its seventh targeted update on virtual assets on 16 July 2026. The headline numbers show steady progress on paper and a stubborn gap in practice. According to the 2026 report, 91 of 109 responding jurisdictions (83%) have passed Travel Rule legislation, up from 85 of 117 (73%) a year earlier, and 11 more are in the process.

The less flattering figure is enforcement. Of the 91 jurisdictions with a law, 55 had not issued a single supervisory finding, directive or enforcement action tied to Travel Rule compliance. A rule nobody inspects is, functionally, a suggestion. The FATF's broader Recommendation 15 ratings, based on mutual evaluations published as of April 2026, tell the same story: 34% of 149 assessed jurisdictions were largely compliant, 43% partially compliant and 22% non-compliant. Only one was fully compliant. As 21 Analytics noted in its summary, these survey answers are self-reported and not independently verified, so the true picture may be weaker.

The 2025 update had already flagged why this matters. It recorded the theft of $1.46 billion by North Korean actors from the exchange Bybit, the largest single virtual asset theft on record, with only 3.8% recovered at the time, and said stablecoins now feature in most on-chain illicit activity. The FATF's 2025 publication also noted that jurisdictions with materially important VASP activity make up about 98% of the global virtual asset market, which is why the FATF concentrates its pressure on that group.

A Travel Rule with no inspections is a form field, not a control.

How major jurisdictions apply it

The FATF sets the minimum. Countries then pick their own thresholds, data fields and treatment of private wallets. The differences are large enough that a single transfer can be fully compliant at one end and deficient at the other.

Jurisdiction	Legal basis and regulator	In force	Threshold	Notable feature
European Union	Transfer of Funds Regulation (EU) 2023/1113	30 Dec 2024	None: every transfer	CASP must verify ownership of a self-hosted wallet for transfers above EUR 1,000
United States	Bank Secrecy Act recordkeeping and travel rule; FinCEN	Applied to crypto via May 2019 guidance	$3,000	A 2020 proposal to cut the cross-border threshold to $250 was not adopted
United Kingdom	Money Laundering Regulations; FCA	1 Sep 2023	Applies to transfers; gaps handled case by case	Firms must check whether the receiving firm can accept the data before sending
Singapore	MAS Notice PSN02	28 Jan 2020	Fuller data above S$1,500	Basic originator and beneficiary data required at any amount
Dubai	VARA Compliance and Risk Management Rulebook	In force	Above AED 3,500	Explicit duty to watch for transfers split to stay under the threshold
India	PMLA (VDA notification of 7 Mar 2023); FIU-IND guidelines	Mar 2023	None set out in guidance	Applies to VDA transfers whether settled in fiat or crypto

The European approach is the strictest. The recast Transfer of Funds Regulation has no de minimis amount at all, and the receiving CASP must have the data before it makes funds available. Washington sits at the other end: FinCEN treats crypto transfers as covered by the same $3,000 rule that applies to bank wires. In October 2020, FinCEN and the Federal Reserve proposed dropping that to $250 for transfers that start or end outside the US, and explicitly writing convertible virtual currency into the definition of money. The domestic threshold would have stayed at $3,000.

The UK's regulator took a pragmatic line on the hardest operational problem, counterparties in countries that have not implemented the rule yet. The FCA's statement says UK firms must still collect, verify and store the data even if the receiving firm cannot accept it, and should make a risk-based call about whether to release incoming funds that arrive with missing details. Dubai's VARA rulebook requires the originator's name, wallet or account number and address, and the beneficiary's name and wallet, for any transfer above AED 3,500.

India folded VDA businesses into the Prevention of Money Laundering Act in March 2023, and FIU-IND's guidelines require sending providers to pass originator and beneficiary information to the receiving provider, as a Mondaq analysis sets out. For background on the wider Indian framework, see our explainer on India's crypto regulation in 2026.

A worked example: one transfer, three rulebooks

Consider an account holder in Dubai who wants to move USDT worth AED 10,000 from a VARA-licensed exchange to two places: half to a relative's account at an exchange in Frankfurt, half to her own hardware wallet.

1. AED 5,000 to the Frankfurt exchange. This is above VARA's AED 3,500 line, so the Dubai VASP must collect her name, account or wallet number and address, plus her relative's name and wallet, and transmit them. On the German side, EU rules apply with no threshold, so the receiving CASP must have the data before crediting the relative. Until complete data arrives, it should not make the funds available.
2. AED 5,000 to her own hardware wallet. No VASP sits on the other side to receive data. The Dubai platform still has to record the information and assess the unhosted-wallet risk under its rulebook. Had she done the same thing from an EU platform with a transfer above EUR 1,000, that CASP would have to verify she actually owns or controls the wallet,.
3. The tempting shortcut. Suppose she instead splits AED 10,000 into three transfers of AED 3,400 each, a day apart. Each sits under the threshold, but VARA's rulebook specifically tells VASPs to watch for structuring of this kind. Splitting is more likely to trigger a review than avoid one.

Now run a parallel case from the US. A customer sends $2,900 in USDC from a US exchange to a European CASP. On the US side, this sits under FinCEN's $3,000 trigger. On the EU side, the receiving CASP still needs complete originator data. A US platform that wants the transfer credited promptly has every reason to send the data anyway, because the receiving end can otherwise hold the funds. The strictest jurisdiction on either side of a transfer tends to set the real standard.

How VASPs comply in practice

Compliance teams typically build or buy a stack with four layers.

• Counterparty identification. Blockchain analytics and shared directories help a VASP decide whether a destination address belongs to a known, licensed platform, an unknown service or a private wallet.
• Messaging protocols. Several competing protocols carry Travel Rule data between VASPs. Interoperability between them is still imperfect, which is one reason transfers to smaller platforms sometimes stall.
• Data checks. The receiving side compares the beneficiary name against its own customer record and screens both parties against sanctions lists. For more on that screening layer, see our guide to crypto AML and sanctions compliance.
• Unhosted wallet controls. Ownership proofs, risk scoring of the destination address, and limits on transfers to wallets with exposure to mixers or sanctioned entities.

The weak spot is the "sunrise" problem: when a sender's country requires the rule and the receiver's does not, there may be no one ready to receive the data. The FCA's answer is to collect and store anyway. Many platforms respond by restricting withdrawals to counterparties they cannot verify. For users, this shows up as a pop-up asking for the recipient's full name, or a withdrawal held for review. Our explainer on self-custody versus custodial wallets covers why moving to a private wallet now triggers extra questions.

The bigger shift: Recommendation 16 rewritten for all payments

The crypto Travel Rule borrows from Recommendation 16, the FATF standard for wire transfers. On 13 June 2025, the FATF adopted a revised R.16 that applies to all cross-border payments. As CGAP explains, the revision sets a USD/EUR 1,000 threshold (countries may go lower, never higher). Above it, cross-border payments must carry the originator's name, account number and address, and the beneficiary's name, account number, country and town. Legal entities are identified by a BIC, LEI or similar code, and the data must be verified. Unusually, the FATF gave institutions until the end of 2030 to comply.

That matters for crypto because regulators increasingly treat stablecoin transfers as payments. The direction is convergence: bank wires, card-based cash withdrawals and token transfers carrying broadly similar data, often in structured ISO 20022 fields. Our piece on SWIFT and ISO 20022 explains that message standard.

Where the rule falls short

Three gaps stand out in the FATF's own data. First, peer-to-peer transfers between private wallets sit outside the rule entirely, and 58 of 66 jurisdictions that assessed them rate P2P activity as high risk, yet only 31 of 133 collect any market data on it. Second, decentralised finance is barely touched: 26 of 142 respondents have assessed DeFi risks and only one reported enforcement action against a DeFi arrangement. Third, licensing itself is thin. Only 59 of 149 jurisdictions met or mostly met the FATF criterion on VASP licensing and registration, and you cannot enforce a Travel Rule against firms you have not licensed. Our explainer on CASP, VASP and money transmitter licences covers that layer.

Our view: the Travel Rule is doing useful work on the regulated perimeter, where most retail volume still sits. It does far less against sophisticated actors who move through bridges, OTC brokers and unhosted wallets. The FATF's 2026 report describes exactly that pattern in North Korean laundering. The next phase of enforcement will be judged on whether supervisors start sanctioning VASPs that accept data-free transfers from high-risk counterparties.

What to watch next

• Mid-2027: the FATF's eighth targeted update, if it keeps its annual rhythm. The number to watch is how many of the 55 jurisdictions with no Travel Rule enforcement have taken action.
• 2027: first exchanges of crypto tax data under the OECD's Crypto-Asset Reporting Framework, which will layer tax reporting on top of the same customer data VASPs already collect. See our guide to crypto tax by country.
• Through 2030: banks and payment firms implementing the revised Recommendation 16, with a hard deadline at the end of 2030.
• US threshold: whether FinCEN revisits the $250 cross-border proposal as stablecoin payments grow under the new federal regime, covered in our guide to GENIUS Act and MiCA rules.

This article explains regulatory requirements in general terms and is not legal advice. Firms and individuals should check obligations with a qualified adviser in the relevant jurisdiction.

About this researchMuffinPay InsightsIndependent analysis of stablecoins, CBDCs, cross-border payments and digital public infrastructure. Every figure is linked to its source. Read our editorial standards →