Most markets now have travel rule laws, but far fewer enforce them. Two industry voices explain how firms handle the gap, and the rules show what a transfer with missing details should trigger.

Banks have sent sender and recipient details with wire transfers for decades. The crypto travel rule asks exchanges and custodians to do the same for crypto transfers. In practice, that is much harder. A firm may not know who is on the other side of a transfer, whether they are regulated, or which messaging system they use.

So we asked industry leaders one question: what has complying with the crypto travel rule been like in practice, and how do you handle transfers to counterparties who are not compliant yet? We wanted first-hand experience over commentary. Two respondents answered. Neither runs a travel rule programme, so we set their replies against the rules and the latest FATF data.

Where the crypto travel rule stands

The crypto travel rule is now law across most major markets. In its July 2026 update, the Financial Action Task Force said 91 of 109 surveyed jurisdictions (83%) had passed crypto travel rule laws, up from 73% a year earlier, according to LearnSignal. However, 55 of those 91 had yet to issue any findings, directives or enforcement actions. Only one of 149 jurisdictions assessed was fully compliant with FATF’s crypto standard.

That gap creates what the industry calls the sunrise issue. A firm in a market with the rule must still deal with counterparties in markets without it. Meanwhile, the thresholds differ too. The UK rule has applied since September 2023 to transfers of €1,000 or more. In the EU, the rule has applied since 30 December 2024 with no minimum for transfers between crypto firms. In the US, the long-standing Bank Secrecy Act rule applies at $3,000.

Interoperability is the daily problem

Our first respondent leads a risk management company that works on compliance risk, and he was open that his answer draws on FATF and European Banking Authority guidance rather than first-hand experience.

“The biggest difficulty with the travel rule is usually interoperability. Counterparties may use incompatible compliance systems, or operate in markets where the rule isn’t fully in place yet. That means extra verification work, delayed transfers and more pressure on compliance teams.

With counterparties that aren’t compliant yet, apply risk-based controls instead of processing transfers automatically. Check their regulatory status, ask for missing information through secure channels, document each decision, and suspend or reject transfers when you can’t get what’s required. Repeated failures should lead to closer scrutiny or limits on future transfers.”

Omer Malik, CEO, ORM Systems

His summary of the crypto travel rule matches the guidance. Several competing messaging protocols carry crypto travel rule data, and they do not always talk to each other. As a result, a firm may need to check whether a counterparty can receive data before every new transfer. His point on repeated failures also reflects EU law. Under the Transfer of Funds Regulation, a firm whose counterparty repeatedly fails to send required data should issue warnings, then restrict or end the relationship and report it to its regulator.

Hold, ask, log, return

Our second respondent offered the most practical answer, while noting that she works as an AI implementation consultant rather than in crypto compliance.

“When a counterparty hasn’t sent the originator and beneficiary details, hold the transfer and ask for them in writing with a fixed deadline. I’d give them five working days, and the travel rule that applies to your licence decides what counts as complete. Don’t release anything early, not even a small test amount, because a partial transfer to an unverified party is still a transfer you can’t explain later. Keep a log of who was asked, what they sent and why you released or refused it. If the deadline passes with no reply, refuse the transfer and return the funds to the sender.”

Lilach Bullock, AI Implementation Consultant and Fractional CMO, Lilach Bullock

Her process fits the crypto travel rule in both the UK and the EU. UK rules require a risk-based approach when a transfer arrives without the required details. The receiving firm should either delay making the funds available or return them, Elliptic explains. The EBA’s travel rule guidelines also expect firms to decide whether to reject, return or suspend.

However, her five working days is her own choice, not a crypto travel rule deadline. Neither the UK nor the EU sets a fixed window. Firms should set one in their own crypto travel rule policy and apply it consistently. Her advice against test transfers is cautious rather than required, but it makes sense. A small payment to an unverified party still counts as a transfer.

Self-hosted wallets add another layer

Transfers to self-hosted wallets raise a separate crypto travel rule question. There is no counterparty firm to send data to. In the EU, a firm must check that its customer owns or controls a self-hosted wallet for transfers above €1,000. FATF also found that 88% of jurisdictions that rated peer-to-peer risk rated it high. Therefore, many firms ask customers to prove wallet ownership through a signed message or a small verification payment.

What firms should build

Taken together, the advice points to a short list for crypto travel rule compliance. First, keep a register of counterparties, their licence status and the protocols they support. Next, set a written policy for missing data, with a fixed deadline and clear outcomes. Then log every hold, request and decision. Finally, review repeat offenders and act on them.

Regulated crypto firms are also changing how they work with banks, as our report on Ripple’s trust bank approval showed. Custodians face the same data demands, as our piece on BitGo and WisdomTree described. European licences add further duties, as our report on Flowdesk’s payment licence found.

What to watch next

Several signals will shape the crypto travel rule in 2027. FATF will keep pressing jurisdictions that have passed laws but not enforced them. In the EU, supervisors are reviewing how crypto firms licensed under MiCA handle missing data and repeat offenders. Meanwhile, stablecoin rules in the US and UK will bring more payment firms into scope.

Above all, the lesson from our respondents is clear. The crypto travel rule works only when firms treat missing data as a reason to stop, not a box to tick. Hold the transfer, ask in writing, log the outcome and return what cannot be verified.

FintechBits covers payments, banking and fintech developments for readers in the US and UK. This article is for information only and is not financial or legal advice. Views expressed are those of the FintechBits editorial team.