Introduction

The Travel Rule, originally developed by the Financial Action Task Force (FATF), is a critical component of anti-money laundering (AML) and counter-terrorist financing (CFT) efforts in the crypto industry.

Under the EU's Markets in Crypto-Assets Regulation (MiCA), Crypto-Asset Service Providers (CASPs) are required to implement the Travel Rule, which mandates the collection, verification, and transmission of specific information about the originator and beneficiary for crypto-asset transfers.

This regulation aims to enhance transparency and traceability in crypto transactions, aligning the crypto industry with traditional financial sector standards. Key requirements include collecting and verifying customer information, implementing risk-based procedures, handling transfers involving self-hosted wallets, maintaining records, and ensuring compliance with data protection laws. CASPs must adapt their systems and processes to meet these requirements, balancing regulatory compliance with user experience and operational efficiency.

This document provides a comprehensive overview of the Travel Rule requirements, implementation challenges, and practical considerations for CASPs operating under MiCA.

Travel Rule Requirements Under MiCA

Based on Regulation (EU) 2023/1113 (TFR) and the EBA Travel Rule Guidelines, critical requirements for crypto exchanges include:

  1. Information Collection (TFR: Article 14(1) and (2)):
    1. Originator: name, crypto-asset account number or distributed ledger address, address (including country), official personal document number, customer ID number (or date and place of birth), and LEI (if available).
    2. Beneficiary: name, crypto-asset account number or distributed ledger address, and LEI or, in its absence, any other available equivalent official identifier of the beneficiary.
  2. Verification (TFR: Article 14(6) and Article 16(3)):
    1. The originator's CASP must verify the accuracy of the originator's information before initiating a transfer. This verification should be based on documents, data, or information from reliable and independent sources.
    2. The beneficiary's CASP must verify the beneficiary's information before making the crypto-assets available. This is to ensure the integrity of the information throughout the transfer chain.
  3. Transfer of Information (TFR: Article 14(4)):
    1. All required information must accompany the transfer of crypto-assets.
    2. The information should be submitted securely, either in advance of the transfer, simultaneously with it, or concurrently.
    3. The information doesn't need to be attached directly to the transfer itself, but it must be readily available to appropriate authorities upon request.
  4. Risk-Based Procedures (TFR: Article 16(1) and 17(1); EBA Guidelines: Section 4.5 and 4.6):
    1. CASPs must implement effective procedures to detect transfers with missing or incomplete information.
    2. They need to establish risk-based procedures to determine whether to execute, reject, return, or suspend such transfers.
    3. These procedures should include monitoring during and after transfers, and should be commensurate with the level of ML/TF risk associated with the transfer.
  5. Self-Hosted Wallets (TFR: Article 14(5) and 16(2)):
    1. For all transfers involving self-hosted wallets, CASPs must obtain and hold the required information on both the originator and the beneficiary.
    2. For transfers exceeding €1,000 to or from a self-hosted address, CASPs must take adequate measures to assess whether the address is owned or controlled by their customer.
    3. This may involve using blockchain analytics tools or other verification methods.
  6. Record Keeping (TFR: Article 26(1)):
    1. CASPs must retain all collected information for a period of five years.
    2. After this period, personal data should be deleted unless national law provides otherwise.
    3. Member states may allow or require further retention for up to an additional five years if necessary for preventing, detecting, or investigating money laundering or terrorist financing.
  7. Compliance and Reporting (TFR: Article 23 and 18; EBA Guidelines: Section 4.7):
    1. CASPs must implement internal policies, procedures, and controls to ensure compliance with the regulation.
    2. They must report suspicious transactions to the relevant Financial Intelligence Unit (FIU).
    3. This includes considering missing or incomplete information as a factor when assessing whether a transfer is suspicious.
  8. Data Protection (TFR: Article 25):
    1. All personal data processing must comply with the General Data Protection Regulation (GDPR).
    2. CASPs must provide new clients with the information required under GDPR Article 13 before establishing a business relationship or carrying out an occasional transaction.
    3. The processing of personal data under this regulation should be only for the purposes of preventing money laundering and terrorist financing.
  9. No De Minimis Threshold (TFR: Recital 30):
    1. There is no general de minimis threshold for crypto-asset transfers between CASPs. All such transfers, regardless of amount, are subject to the Travel Rule requirements.
    2. For transfers involving self-hosted wallets (TFR: Article 14(5) and 16(2)):
      1. Basic information collection is required for all transfers.
      2. For transfers exceeding €1,000, CASPs must take additional steps to assess whether the self-hosted address is owned or controlled by their customer.
  10. Batch Transfers (TFR: Article 15):

Batch file transfers are bundles of several individual transfers of crypto-assets put together for transmission. The regulation specifies: