If your business moves USDC, USDT, PYUSD, or any other stablecoin on behalf of customers, the Travel Rule applies to you. FATF Recommendation 16 requires Virtual Asset Service Providers (VASPs) to exchange originator and beneficiary information on qualifying transfers, the same way SWIFT banks have done since 1996. The rule is now enforced in over 70 jurisdictions, and as of 2026 the EU's Transfer of Funds Regulation (TFR) drops the threshold to zero. This guide breaks down what stablecoin issuers, exchanges, custodians, and wallet providers need to collect, which TRP networks dominate compliance traffic, and how the self-hosted wallet carve-out actually works.
​

The Travel Rule is FATF Recommendation 16, adopted in its current crypto form in June 2019. It requires originating and beneficiary VASPs to obtain, hold, and transmit specified counterparty information on virtual asset transfers above a defined threshold. The rule "travels" with the transaction so law enforcement can trace funds and screen against sanctions lists.
​

Answer capsule: The Travel Rule forces crypto businesses to share sender and recipient identity data on stablecoin transfers, typically above $1,000 USD or €0 in the EU. It is enforced by FATF members and implemented through messaging networks like TRP, TRISA, Sumsub, Notabene, and Veriscope.
​

FATF defines a VASP as any entity conducting one or more of five activities for or on behalf of another person: exchange between virtual assets and fiat, exchange between virtual assets, transfer of virtual assets, safekeeping or administration, and participation in financial services related to issuance. In practice for stablecoins, this captures:

Purely self-custodial wallets that never hold customer assets (MetaMask, Rabby, Phantom in their default modes) sit outside the VASP perimeter. Smart contract protocols are also generally out of scope, though FATF's October 2021 updated guidance pulled some DeFi front-end operators into the definition where they exert sufficient control.
​

FATF Recommendation 16 mandates the originating VASP collect and send:

The beneficiary VASP must verify the information and screen the counterparty against sanctions lists (OFAC SDN, EU consolidated list, UN). Both sides retain records for five years. KYC at onboarding feeds this data set, so the Travel Rule sits downstream of customer due diligence, not in place of it.
​

Thresholds and effective dates vary, and the EU's TFR overhaul in 2026 is the most aggressive change. The comparison below reflects rules as of May 2026.

The EU figure is the headline. Under the TFR, every transfer of crypto-assets between CASPs requires full Travel Rule data regardless of value, and transfers to or from self-hosted wallets above €1,000 require additional verification that the customer controls the destination address.
​

FATF specifies the data; it does not specify the wire format. The industry has converged on a handful of interoperable messaging networks and KYC-tech vendors:

All five settle on IVMS 101 as the underlying data schema, the joint InterVASP standard ratified in 2020. So while the transport differs, the payload is portable.
​

FATF's October 2021 guidance and the EU TFR both acknowledge that a VASP cannot transmit Travel Rule data to a counterparty that is not itself a VASP. The treatment splits:

For stablecoin issuers operating their own redemption flows, the practical implication is that customer-initiated withdrawals to MetaMask or Phantom now need an ownership attestation step in the UI when the amount clears the threshold.
​

The EU's MiCA Regulation and TFR were intentionally aligned. MiCA covers issuance and conduct rules for EMTs (e-money tokens like USDC EURC) and ARTs (asset-referenced tokens). TFR covers transfer-level information sharing. A Circle or Paxos entity operating under MiCA must satisfy both: authorization as an EMT issuer and Travel Rule compliance on every redemption or transfer between CASPs. See our explainer on MiCA EMT vs ART tokens for the issuance side, and reserve attestation for the auditing side.
​

Enforcement has accelerated. The Enforcement has accelerated. The FCA, BaFin in Germany, and MAS in Singapore have all cited Travel Rule controls in supervisory action over the past two years.. BaFin in Germany has used TFR non-compliance as grounds to refuse MiCA passporting. In Singapore, MAS has revoked at least two DPT licenses citing AML failures that included Travel Rule gaps. In the US, FinCEN treats Travel Rule violations under the same BSA framework as other MSB compliance failures, with civil penalties up to $250,000 per violation and criminal exposure for willful conduct.
​

This guide synthesizes primary regulatory texts and vendor documentation reviewed in May 2026. Thresholds and effective dates were cross-checked against jurisdictional regulator publications. Implementation notes draw on public technical specifications from each protocol.