EU Travel Rule Guidance to Combat Money Laundering in Crypto
Following the entry into force of the Markets in Crypto-Assets Regulation (MiCA) in June 2024, another significant step took place last July with the publication of the European Banking Authority’s (EBA) final Travel Rule guidance under Regulation (EU) 2023/1113. This guidance is expected to affect crypto asset service providers (CASPs) in the European Union, including crypto exchanges, wallet providers, and intermediary CASPs.
What Is the Travel Rule?
The Travel Rule is an international standard designed to combat money laundering and terrorist financing by enhancing oversight of transfers. Formulated by the Financial Action Task Force (FATF), it requires financial institutions to retain and transmit identifying information about the originators and beneficiaries of transfers above a specified threshold.
Regulation (EU) 2023/1113
The main objective of Regulation (EU) 2023/1113 is to align the EU legal framework with the FATF’s anti-money laundering and counter-terrorist financing (AML/CFT) standards, which now also apply to CASPs. The regulation subjects CASPs to AML/CFT requirements concerning supervision and risk management similar to those imposed on credit institutions and other financial institutions. To support implementation, the regulation authorizes the EBA to issue guidance on applying the Travel Rule to the crypto industry.
The following are Travel Rule requirements for the EU crypto market, which will apply from December 31, 2024:
No minimum threshold – Crypto-asset transfers must comply with the applicable requirements regardless of their value. Unlike conventional money transfers, for which the required information may depend on the amount and geographic location, the requirements for crypto-asset transfers apply regardless of the transfer amount or whether the transfer is cross-border.
Identifying information is compulsory – Crypto-asset transfers must include information about the originator and beneficiary, including their names, distributed ledger addresses where the transfer is recorded on a distributed ledger, and crypto-asset account numbers where such accounts exist. Additional information about the originator, such as an address or official identification number, is also required. The guidance explains the information requirements for legal entities.
Policies and procedures are compulsory – CASPs must implement policies and procedures to identify incoming transfers that lack required information. These include methods for detecting missing or incomplete information, monitoring transfers in a timely manner according to the AML/CFT risk, and identifying factors that increase that risk.
Transaction management – If a CASP detects a transfer with missing information, it may execute, reject, return or suspend the transfer in accordance with its risk-based procedures. If it cannot reject the transfer—for example, because the crypto-assets have already been received—the receiving CASP must return the transfer to the sender. If it cannot return the transfer to the source address, it must take alternative measures, such as holding the assets in a secure account and coordinating with the sender’s CASP to arrange their return. When the information is incomplete but still allows the parties to be identified unequivocally, the receiving CASP may decide whether to execute, reject or return the transfer. If it decides to execute it, the CASP must document its rationale.
Reporting requirements – When a CASP identifies a counterparty’s failure to provide required information, it should consider reporting the non-compliance to its competent AML/CFT authority.
Requirements for self-custodial wallets – The obligations applicable to transfers between a CASP and a self-hosted wallet depend on the transfer amount and whether the wallet owner is a CASP customer or a third party:
- Transactions of EUR 1,000 or less: the CASP must collect and retain specified information about the originator or the beneficiary.
- Transactions exceeding EUR 1,000 where the wallet owner is a CASP customer: the CASP must verify that the wallet is owned or controlled by the customer using at least one method from a defined list.
- Transactions exceeding EUR 1,000 where the wallet owner is not a CASP customer: the guidance states that the obligation to verify the identity of the originator or the beneficiary can be fulfilled by collecting additional information from other sources or using other appropriate means.
For more information and expert advice on crypto matters, please contact a member of our team.