The Travel Rule in 2026: an operating guide for exchanges and payment platforms

The Travel Rule is the requirement that information about the sender and the recipient travels with a transfer. It started with bank wires. Since 2019, the Financial Action Task Force (FATF) has applied it to transfers between virtual-asset service providers (VASPs). For an exchange, wallet provider or payment platform, it is now an everyday operational task, not a future project.

This guide summarises where implementation stands, what changed in 2025, and what to build into the workflow.

Where implementation stands

In June 2025 the FATF published its sixth targeted update on virtual assets. It reported that 99 jurisdictions had passed, or were in the process of passing, legislation implementing the Travel Rule. It also published best practices on Travel Rule supervision. Passing a law is not the same as supervising it, though. The FATF still pointed to gaps in licensing and registration, and to difficulty dealing with offshore providers.

The same update describes the risks the rule is meant to address. The FATF reported that most on-chain illicit activity now involves stablecoins. It also cited an industry estimate of about USD 51 billion in illicit on-chain activity linked to fraud and scams in 2024. For platforms that move stablecoins, this explains why counterparties and supervisors increasingly ask for Travel Rule data as standard.

What the EU requires

In the EU, the Travel Rule for crypto-assets comes from Regulation (EU) 2023/1113 on information accompanying transfers of funds and certain crypto-assets. The European Banking Authority's Travel Rule Guidelines, issued on 4 July 2024 and applying from 30 December 2024, explain how payment service providers and crypto-asset service providers (CASPs) should:

• decide which information must accompany a transfer;
• detect missing or incomplete information;
• handle a transfer that arrives without the required information;
• treat transfers to or from self-hosted addresses, including how to identify and verify the person behind them.

The EU regime also places CASPs authorised under MiCA under the same anti-money-laundering requirements and supervision as credit and financial institutions. The EBA's amended ML/TF risk factor guidelines, which also apply from 30 December 2024, add crypto-specific risk factors. These include self-hosted addresses and the use of blockchain analytics.

For EU/EEA end users, crypto-asset services can only be provided through a separately authorised EU provider, and that provider's own controls apply.

The 2025 revision of Recommendation 16

On 18 June 2025, FATF revised Recommendation 16, the standard behind the Travel Rule. The changes reach beyond virtual assets to cross-border payments in general:

• Clear responsibilities in the payment chain. The chain is treated as starting with the institution that receives the customer's instruction.
• Standardised information. For cross-border peer-to-peer payments above USD/EUR 1,000, the name, address and date of birth of the parties should accompany the message.
• Fraud and error tools. Institutions will be expected to use tools such as verification of the recipient's account details.
• Card purchases. Card payments for goods and services remain exempt from the full requirements, with a clarified scope.

The changes are due to take effect by the end of 2030. In October 2025 the FATF published how compliance will be assessed in mutual evaluations. For platforms that combine fiat and stablecoin flows, this means the same customer data discipline will increasingly apply on both sides.

Designing the workflow

The Travel Rule is easier to meet when it is part of the payment design rather than a check added at the end:

1. Collect counterparty data at the right moment. Ask for recipient details when the beneficiary is created, not when the transfer is already queued.
2. Identify the counterparty type. Is the destination another virtual-asset service provider, a self-hosted wallet, or an unknown address? Each route has different data and verification steps.
3. Decide what happens when data is missing. Hold, request, return or reject: write the rule down, apply it the same way every time and record the outcome.
4. Screen both directions. Sanctions and risk screening applies to incoming and outgoing transfers.
5. Keep one record. Store the Travel Rule data, screening result and transaction reference together so they can be produced on request.
6. Map responsibility per programme. Through the licensed partner network, the controls of the provider that holds the permission apply. An independent institution runs its own Travel Rule programme.

Where Axora fits

Axora is a financial technology platform for exchanges, wallets, payment platforms and institutions. Onboarding, screening and verification are available to approved programmes as part of the operating workflow. Responsibility for Travel Rule compliance stays with the entity that holds the permission for each service. Specific Travel Rule tooling and supported counterparty networks are confirmed for each programme.

Next steps

• Compliance & Operations
• Explore Axora products: Platform
• See solutions by business type: Solutions
• For developers: Developers
• Talk to us: Contact