Introduction
With deadlines looming in many jurisdictions to implement FATF Recommendation 16, also known as the “travel rule”, crypto has been front and centre of the anti-financial crime spotlight. While the travel rule was first adopted in 2019 by the Financial Action Task Force (FATF), a recent targeted update from June 2023 shows that member countries struggle to implement it. According to the update, over half of those surveyed have not taken any measures to implement the rule. While progress has been made since the survey, the topic of the travel rule and the associated ‘sunrise issue’, which refers to its uneven and phased worldwide adoption, continues to be significant. Delving deeper into this topic, FINTRAIL explores some common challenges firms face in implementing the crypto travel rule while unpacking the state of play in key jurisdictions.
A refresher: what is the travel rule? 💸
The travel rule, which comes under FATF’s Recommendation 16, “requires virtual asset service providers (VASPs) to obtain, hold, and transmit required originator and beneficiary information, immediately and securely, when conducting virtual asset (VA) transfers.” By doing so, VASPs and financial institutions can conduct effective sanction screening, detect suspicious transactions, and essentially bring crypto assets under the same regulatory umbrella as other types of financial transfers such as wires. The threshold amount is $1,000 or €1,000 - meaning that any transfer over this amount requires identifiable information to be shared on the originator and beneficiary.
The travel rule stipulates that transactions above $1,000 or €1,000 require the following information to be transmitted:
The originator VASP
The originator’s name
The originator’s wallet address
The originator’s physical address, national identity number, customer identification number, or date and place of birth
The beneficiary VASP
The beneficiary’s name
The beneficiary’s wallet address
For transactions below the $1,000 or €1,000 threshold, the following information must still be transmitted:
The originator VASP
The originator’s name
The originator’s VA wallet address or a unique transaction reference number for VA transfers
The beneficiary VASP
The beneficiary’s name
The beneficiary’s VA wallet address or a unique transaction reference number for VA transfers
As countries work to transpose the travel rule into their own regulatory frameworks at varying rates, here’s the current state of play for key jurisdictions:
The United Kingdom 🇬🇧
On 17th August the Financial Conduct Authority (FCA) published a statement outlining the expectations for UK businesses complying with the travel rule. Since the publication of the FATF Recommendation, the UK has amended its Anti-Money Laundering and Terrorist Financing regulations (MLRs) accordingly. The recent statement from the FCA highlights that firms must adhere to the travel rule from 1 September 2023.
In addition to full compliance with the rule, the expectations outlined by the FCA include taking reasonable steps and due diligence for compliance, regularly reviewing the implementation status of the rule in other jurisdictions to adapt business processes appropriately, and responsibility for compliance even when using third-party suppliers.
When sending crypto asset transfers to a jurisdiction without the travel rule, the FCA specifies that firms take all reasonable steps to indicate that the firm can receive the required information. If the firm cannot, the UK firm must abide by the MLRs, collecting, storing, and verifying the information appropriately. Receiving crypto-asset transfers from a jurisdiction without the travel rule requires a risk-based assessment before making the funds available to the beneficiary. Decisions should consider the jurisdiction(s) in which the sending firm operates and the status of the travel rule in those countries.
The European Union 🇪🇺
In the EU, the Transfer of Funds Regulation will implement FATF’s travel rule and extend wire transfer requirements to crypto providers. The regulation will have no minimum, meaning all transactions will require identification information to be shared, regardless of the amount. The law also covers transactions above €1,000 from self-hosted wallets when interacting with hosted wallets managed by crypto-asset service providers.
Explainer: What are self-hosted wallets?
Self-hosted wallets are digital wallets where the user has sole control over their private keys, permitting them to store, send, and receive crypto without needing a centralised platform or intermediary.
The regulation will apply from 30 December 2024.
The United States 🇺🇸
In May 2019, the Financial Crimes Enforcement Network (FinCEN) published clarifying guidance on applying existing regulations to convertible virtual currencies. The consolidating document clarifies the inclusion of virtual currencies in the travel rule initially created for fiat currencies. The threshold in the US is currently $3,000, though a proposed rule change was made to lower the threshold to $250 for international transfers, though this has not yet gone into effect.
Challenges to implementation
Among the notable challenges to the travel rule’s implementation, the ‘sunrise issue’ speaks to the staggered and nonuniform application of the rule across jurisdictions. For example, Singapore and Japan have already implemented the travel rule, on 28 January 2020 and 1 June 2023 respectively, whereas countries in the EU have until the end of 2024. These different timelines pose challenges as firms must send information to firms in countries that may not be mandated to receive or transmit data. Additionally, there may be jurisdictional variances as countries transpose the travel rule into their own national regulations differently. The United States, for example, currently has a threshold of $3,000 rather than FATF’s recommended $1,000. These differences mean VASPs are tasked with navigating cross-border variations.
Recognising the uneven global application, the FATF noted that VASPs should consider additional control measures for countries with weak implementation, such as rigorous monitoring of transactions with VASPs based in higher risk countries, “placing amount restrictions on transactions, or intensive and frequent due diligence.”
Another key practical challenge is technology requirements, as the rule requires firms to deploy complex technology solutions that were previously unavailable. In Australia, where the travel rule has yet to be transposed into national law, officials said in 2021 that there were insufficient technological capabilities to implement the rule adequately. VASPs must exchange data with other VASPs through messaging protocols, and varying formats raise interoperability issues. Other concerns stem from navigating data privacy, data processing requirements, and security concerns. All these factors make the practical implementation of the travel rule a daunting task.
How FINTRAIL can help
FINTRAIL is experienced in working with VASPs, including cryptocurrency trading platforms and traditional firms with exposure to crypto-assets in the UK, Europe, APAC and globally. We help VASPs around the world ensure regulatory compliance and an effective implementation of the travel rule. Through the provision of the highest quality consultancy services, based on deep sectoral experience and pragmatism, we help firms reduce their exposure to financial crime.