The FATF Travel Rule — formally FATF Recommendation 16 — requires Virtual Asset Service Providers (VASPs) to exchange originator and beneficiary information whenever a crypto transfer above a defined threshold crosses between them. It is the single most consequential piece of crypto-specific AML guidance issued in the last decade and is being transposed into binding national law in every major jurisdiction through 2026.
What the protocol actually requires
For every transfer above the threshold (commonly USD/EUR 1,000; the EU MiCA framework uses €1,000 and Türkiye's MASAK sets TRY 75,000 for crypto-asset transfers between VASPs), the originating VASP must:
- Collect from its customer the originator identity — full name, wallet address, and either a unique customer reference or physical address / national ID / date and place of birth.
- Collect from the destination VASP the beneficiary identity — full name plus the receiving wallet address.
- Transmit both data sets, securely, to the destination VASP before or simultaneously with the on-chain transfer.
The destination VASP must mirror the obligation, screen the counterparty profile against sanctions and PEP lists, and refuse the transfer if information is incomplete or red-flagged.
The compliance burden — and why it has been slow
The Travel Rule's stated goal is to bring crypto into the same regime as traditional wire transfers (SWIFT MT103 / FedWire have carried originator data for decades). Three factors slowed adoption:
- No single messaging standard. IVMS 101 emerged as the de facto data shape, but transport, signing and discovery layers are still fragmented across competing protocols (TRP, TRISA, OpenVASP, Sygna Bridge, Notabene, Mastercard CipherTrace).
- VASP-to-VASP discovery. Banks have BIC codes; VASPs needed to invent verified directories from scratch.
- Self-hosted wallet edge cases. A user withdrawing to their own hardware wallet is not a VASP-to-VASP transfer; jurisdictions diverge on whether and how the rule applies.
Where Türkiye and the EU stand
The MASAK Travel-Rule communiqué brings Recommendation 16 into the 5549 framework. From the effective date, VASPs operating in Türkiye must collect, transmit and retain originator/beneficiary data on all qualifying transfers, with retention for at least eight years.
The EU Transfer of Funds Regulation (TFR / Regulation 2023/1113), in force from 30 December 2024, sets the EU-wide threshold at zero — yes, every crypto transfer between EU-based VASPs requires originator and beneficiary data, regardless of value. The MiCA framework cross-references the TFR for VASP-to-VASP messaging.
What VaspFlow brings to the table
We're building VaspFlow as a lean, opinionated implementation of Recommendation 16. The design constraints we accepted up front:
- One HTTPS round-trip per transfer. No long-lived state.
- IVMS 101 compatibility for the data shape — but only the fields you actually need to send.
- Built-in counterparty VASP directory with public-key endpoints, so you don't run bilateral integration projects with every peer.
- Threshold and corridor logic on the originator side so the protocol doesn't trigger below the regulatory floor.
- Native integration with Legichain's blockchain AML, so a flagged counterparty raises an alert in your existing compliance queue.
What to do this quarter
If you're a VASP operating in Türkiye or the EU and you haven't yet selected a Travel Rule provider:
- Confirm your applicable threshold (TRY 75,000 in Türkiye, €0 in EU).
- Inventory your current counterparty VASPs.
- Run a Recommendation 16 readiness audit against your withdrawal flow specifically — that's where most failures concentrate.
- Talk to one or two providers — preferably ones whose pricing isn't tied to message volume. The design partner programme for VaspFlow guarantees fixed pricing through 2027 for the first ten partners.
The penalty for being unprepared isn't theoretical. Spanish and German regulators have already issued first-batch fines against VASPs that processed TFR-period transfers without originator data — six-figure sums against exchanges measured in tens of millions of monthly users. The audit will not wait until your engineering roadmap is ready.