FATF's travel rule binds exchanges, not self-hosted wallets

Inherited archive entry · retained from the earlier edition. Its factual, legal and policy claims have not all been reverified for 19 September 2026. Research scope.

What the guidance requires, in the FATF's own words

The Financial Action Task Force 'adopted this Guidance at its June 2019 Plenary,' according to the FATF's own text, later updated in October 2021 in a document titled Updated Guidance for a Risk-Based Approach to Virtual Assets and Virtual Asset Service Providers (read here via an official regulator's mirror after FATF's own site declined every direct request). The guidance interprets Recommendation 15 to require that a 'virtual asset service provider' collect and transmit originator and beneficiary information — full name, account number, and identifying details such as address or date of birth — alongside a transfer, the same standard long applied to bank wire transfers. This is the rule usually shortened to 'the travel rule.'

Why it targets service providers, not transactions

The obligation attaches to the regulated intermediary, not the transfer itself: an exchange or custodial wallet provider must collect the data and pass it to the receiving provider alongside the transfer. That design assumes both ends of a transfer run through a business the guidance can reach. The Financial Stability Board's summary of the October 2021 update lists the guidance's focus areas, including 'addressing money laundering and terrorist financing risks in peer-to-peer transactions' and 'implementing the “travel rule” for information-sharing' — both sharpened because the 2019 text had not settled how compliance should work when one side of a transfer has no provider at all.

The boundary: a self-hosted wallet has no provider to comply

A wallet the user controls directly is not, by definition, a service provider, so it collects nothing and transmits nothing. The updated guidance treats transfers to addresses whose ownership cannot be verified as higher-risk and recommends enhanced due diligence at the regulated end, but it cannot compel a rule onto software nobody operates as a business. What changed for exchanges in practice was compliance cost and counterparty screening — verifying a receiving platform is itself compliant, and treating unverifiable withdrawal addresses as a risk signal — rather than a mechanism that closes the self-hosted-wallet gap outright. That gap is acknowledged, not solved, in the guidance itself.

Questions to carry forward

• Do both the sending and receiving ends of a transfer run through a provider able to collect and pass on the required data?
• Is a flagged transfer to a self-hosted address a compliance failure, or the guidance working as designed?
• Has a jurisdiction actually implemented the FATF standard in binding law, or does it only appear in endorsed guidance?

The travel rule extended a decades-old banking standard to a sector partly built to avoid needing an intermediary at all — which is why the guidance's own history, from a first version in 2019 to a revision addressing peer-to-peer transfers in 2021, tracks how much of that intermediary-based standard still could not reach.