What is the travel rule?
The travel rule requires virtual-asset service providers to collect and transmit identifying information about the originator and beneficiary of a crypto transfer, so the data “travels” with the transaction — the crypto adaptation of FATF Recommendation 16, long standard in wire transfers. In the EU it applies through the Transfer of Funds Regulation alongside MiCA, with no de-minimis floor for VASP-to-VASP transfers; Türkiye implements the same logic for crypto asset service providers through MASAK’s AML framework and the post-2024 CMB licensing regime.
What it means operationally
Three flows, three treatments. VASP-to-VASP: originator info (name, account/wallet identifier, and further identifiers by regime) must accompany the transfer, typically via dedicated travel-rule messaging protocols — the counterparty must be identified as a VASP and its regulatory status diligenced. Self-hosted (unhosted) wallets: providers must apply risk-based measures and, above thresholds, verify ownership of the wallet — the operationally hardest piece. Sanctions overlay: travel-rule data feeds screening; incomplete data is itself a red flag requiring a documented response (reject, return, or suspend).
Why product teams should care early
Travel-rule compliance is architecture, not paperwork: wallet-identifier formats, counterparty-VASP discovery, messaging-protocol integration and data-protection treatment of the transmitted personal data (it is personal data — KVKK/GDPR apply to the pipeline) all constrain design. Exchanges seeking a Turkish CASP licence should expect MASAK expectations on transfer information and counterparty controls to be tested in the application file.
Does the travel rule apply to DeFi?
Where no intermediary service provider exists, there is no obliged entity — but interfaces, custodial wrappers and front-ends increasingly get characterised as service providers; the perimeter is the live debate.
What information travels?
At minimum originator name and account/wallet identifier plus beneficiary equivalents; fuller identifiers (address, ID number, birth data) attach as amounts and regimes escalate.