# The FATF Travel Rule, explained — Recommendation 16 in production

> FATF Travel Rule (Recommendation 16) explained — originator/beneficiary data, EU TFR, MASAK guidance, MiCA, IVMS 101 and Legichain's VaspFlow protocol.

Canonical: https://legichain.com/en/resources/fatf-travel-rule-explained

The **FATF Travel Rule** — formally FATF Recommendation 16 — requires
Virtual Asset Service Providers (VASPs) to exchange originator and
beneficiary information whenever a crypto transfer above a defined
threshold crosses between them. It is the single most consequential
piece of crypto-specific AML guidance issued in the last decade and is
being transposed into binding national law in every major jurisdiction
through 2026.

## What the protocol actually requires

For every transfer above the threshold (commonly **USD/EUR 1,000**;
the EU MiCA framework uses €1,000 and Türkiye's MASAK sets TRY 75,000
for crypto-asset transfers between VASPs), the *originating* VASP must:

1. Collect from its customer the **originator** identity — full name,
   wallet address, and either a unique customer reference or physical
   address / national ID / date and place of birth.
2. Collect from the destination VASP the **beneficiary** identity —
   full name plus the receiving wallet address.
3. Transmit both data sets, securely, to the destination VASP **before
   or simultaneously with the on-chain transfer**.

The destination VASP must mirror the obligation, screen the
counterparty profile against sanctions and PEP lists, and refuse the
transfer if information is incomplete or red-flagged.

## The compliance burden — and why it has been slow

The Travel Rule's stated goal is to bring crypto into the same regime
as traditional wire transfers (SWIFT MT103 / FedWire have carried
originator data for decades). Three factors slowed adoption:

- No single messaging standard. IVMS 101 emerged as the de facto data
  shape, but transport, signing and discovery layers are still
  fragmented across competing protocols (TRP, TRISA, OpenVASP,
  Sygna Bridge, Notabene, Mastercard CipherTrace).
- VASP-to-VASP discovery. Banks have BIC codes; VASPs needed to
  invent verified directories from scratch.
- Self-hosted wallet edge cases. A user withdrawing to their own
  hardware wallet is *not* a VASP-to-VASP transfer; jurisdictions
  diverge on whether and how the rule applies.

## Where Türkiye and the EU stand

The **MASAK Travel-Rule communiqué** brings Recommendation 16 into the
5549 framework. From the effective date, VASPs operating in Türkiye
must collect, transmit and retain originator/beneficiary data on all
qualifying transfers, with retention for **at least eight years**.

The **EU Transfer of Funds Regulation (TFR / Regulation 2023/1113)**,
in force from 30 December 2024, sets the EU-wide threshold at zero — yes,
every crypto transfer between EU-based VASPs requires originator and
beneficiary data, regardless of value. The MiCA framework cross-references
the TFR for VASP-to-VASP messaging.

## What VaspFlow brings to the table

We're building VaspFlow as a **lean, opinionated implementation** of
Recommendation 16. The design constraints we accepted up front:

- One HTTPS round-trip per transfer. No long-lived state.
- IVMS 101 compatibility for the data shape — but only the fields you
  actually need to send.
- Built-in counterparty VASP directory with public-key endpoints, so
  you don't run bilateral integration projects with every peer.
- Threshold and corridor logic on the originator side so the protocol
  doesn't trigger below the regulatory floor.
- Native integration with Legichain's blockchain AML, so a flagged
  counterparty raises an alert in your existing compliance queue.

## What to do this quarter

If you're a VASP operating in Türkiye or the EU and you haven't yet
selected a Travel Rule provider:

1. Confirm your applicable threshold (TRY 75,000 in Türkiye, €0 in EU).
2. Inventory your current counterparty VASPs.
3. Run a Recommendation 16 readiness audit against your withdrawal
   flow specifically — that's where most failures concentrate.
4. Talk to one or two providers — preferably ones whose pricing isn't
   tied to message volume. The design partner programme for VaspFlow
   guarantees fixed pricing through 2027 for the first ten partners.

The penalty for being unprepared isn't theoretical. Spanish and German
regulators have already issued first-batch fines against VASPs that
processed TFR-period transfers without originator data — six-figure
sums against exchanges measured in tens of millions of monthly users.
The audit will not wait until your engineering roadmap is ready.