On 21 October 2020 Australia's Federal Court ordered Westpac to pay a 1.3 billion Australian dollar penalty, part of it under Australia's version of the travel rule. Westpac had sent 8,140 international transfers without some or all of the required transfer information and 2,400 without complete payer information, and its processes "did not identify these systemic failures for over five years". The court set 3 million Australian dollars for those 10,540 contraventions (the Federal Court's Westpac judgment, paragraphs 105, 108 and 191). The court explained why that matters: "full transparency of the origin of funds is essential for other financial institutions in funds transfer chains" (paragraph 109). A transfer that arrives without that data is one of the gaps AML transaction monitoring rules look for.
What does the Financial Action Task Force's travel rule require?
The Financial Action Task Force (FATF) sets the rule in Recommendation 16 of the FATF Recommendations, titled "Payment transparency". Financial institutions should "include required and accurate originator information, and required beneficiary information, on payments or value transfers and related messages", and keep it with the payment "throughout the payment chain" (FATF text, June 2026, p. 17). The stated purpose is to deny terrorists, money launderers and other criminals "unfettered access to payments or value transfers" (INR.16 paragraph 1).
The meaning of "travel" is literal: the data moves with the funds. FinCEN's Q&A on the US version, the Funds "Travel" Regulations, was first issued in 1997 and updated on 9 November 2010 (FinCEN). It treats banks and nonbank institutions alike, and it is not limited to wires: a transfer booked through "due from" and "due to" accounts between banks is covered (questions 8, 12 and 13). Since June 2019 the duty also reaches virtual asset service providers (VASPs), which "obtain and hold" the data and pass it on "immediately and securely". A bank that sends crypto for a customer carries the same obligations (INR.15 paragraph 7(b), p. 79).
What changed when the FATF revised Recommendation 16 in 2025?
In June 2025 the FATF revised R.16 and its interpretive note for new payment models and messaging standards. Data should be structured where possible, for example in ISO 20022 (INR.16 paragraph 4). Above the threshold a cross border payment carries the originator's address, the originator's date of birth for a person, the beneficiary's country and town, and a BIC, LEI or official identifier for a company where one exists (paragraph 9). The beneficiary's bank also has to guard against misdirected payments, for example by checking that the beneficiary's name and account number align (paragraph 30).
What data travels with a transfer, step by step?
Picture a 12,000 dollar payment from a manufacturer in Ohio to a supplier in Lisbon, through one intermediary bank (illustrative). It moves in four steps:
- Ordering bank. The chain starts here (INR.16 paragraph 6). The bank attaches the data and may not execute the payment without it (paragraph 23).
- Intermediary. It keeps the data with the payment and looks for transfers that lack it (paragraphs 24 and 26).
- Beneficiary bank. It looks for missing data after the event, or in real time where feasible, and verifies its customer (paragraphs 28 and 29).
- Decision. The intermediary or beneficiary bank decides under its policy whether to "execute, reject, or suspend" an incomplete transfer (paragraphs 27 and 31).
Table 1. What travels with a transfer above the threshold.
| Data | FATF wires (INR.16 paragraph 9) | US wires (31 CFR 1010.410(f), $3,000 or more) | EU crypto (Article 14) |
|---|---|---|---|
| Originator name | Yes | Yes | Yes |
| Originator account or unique reference | Yes | Yes, if ordered from an account | Ledger address and account |
| Originator address | Yes | Yes | Yes, or date and place of birth |
| Originator date of birth | Yes, for a person | No | Alternative to the address |
| Beneficiary name and account | Yes | As many as received | Yes |
| Beneficiary country and town | Yes | Address, as received | No |
| Company identifier | BIC, LEI or official identifier, where one exists | No | LEI where the field exists |
| Amount, date, recipient's bank | Banks identifiable (paragraph 7) | Yes | No |
Below a de minimis threshold of up to USD/EUR 1,000, FATF asks only for names and account numbers or a unique reference (paragraph 8).
How do the wire and crypto versions differ?
Take a 50,000 dollar wire from a New York bank to a Singapore bank it holds no account with (illustrative). It runs through correspondent banking, often as a cover payment: one message goes straight to the beneficiary's bank while the funds move through intermediaries (FATF glossary, p. 86). R.16 covers both types, serial and cover payments (INR.16 paragraph 3), and each intermediary keeps the data with the payment (paragraph 24).
Now a VASP sends 2 bitcoin to another VASP. A blockchain transfer has no field for a name, so the data travels beside it; it need not "be attached directly to the virtual asset transfers" (INR.15 footnote 49). The challenge is the counterparty. In the FATF's July 2026 targeted update, 18 of the 109 responding jurisdictions had not yet passed travel rule legislation.
What about transfers to and from unhosted wallets?
An unhosted, or self hosted, wallet is held by its user with no VASP behind it, so nobody receives the data. In the EU the crypto asset service provider still obtains and holds it, and above EUR 1,000 assesses whether its customer owns or controls the address (Regulation (EU) 2023/1113, Articles 14(5) and 16(2)). The sanctions side of R.16 still applies, including the ban on transactions with designated persons (INR.15 paragraph 7(b)). Before you send, the free crypto wallet risk check screens the address against OFAC, UN and EU sanctions and ransomware intelligence.
How can you tell a transfer breaks the travel rule?
From Minhac Celik, author of this entry: "A blank field is the easy catch; the harder one is a field that is filled but useless, such as a numeric code in place of the sender's name, which FinCEN said in 2019 does not satisfy the rule." FinCEN's May 2019 virtual currency guidance calls that swap "not complying" (p. 20).
Table 2. Travel rule red flags, by field.
| Sign | Field | Why it matters | Control |
|---|---|---|---|
| A code or pseudonym where the sender's name should be | Originator name | FinCEN prohibits code names (Q&A question 16) | Ask for the true name |
| No address, or no date of birth for a person, above the threshold | Originator address | Required by INR.16 paragraph 9 | Suspend and request |
| Beneficiary name does not align with the account | Beneficiary name, account | A sign of a misdirected payment (paragraph 30) | Hold and verify |
| Account number that hides the bank's country | Account number | Not allowed (paragraph 7) | Review the routing |
| Counterparty VASP cannot be identified | Beneficiary institution | The data has nowhere to go (INR.15 paragraph 7(b)) | Identify it before sending |
| Transfers just under the threshold | Amount | EU and UK rules count transfers that "appear to be linked" | Add them up |
| Self hosted wallet over EUR 1,000, no ownership evidence | Wallet address | EU Articles 14(5) and 16(2) | Assess ownership first |
| Required data only in free text | All fields | R.16 asks for structured data where possible | Ask for structured fields |
Which travel rule thresholds apply in the US, EU and UK?
Table 3. Travel rule thresholds by jurisdiction (read 22 October 2026).
| Jurisdiction | Rule | Wires | Crypto | Dates |
|---|---|---|---|---|
| FATF | R.16 and INR.16; INR.15 paragraph 7(b) | Full data above a de minimis threshold of up to USD/EUR 1,000 | Same duties as wires | VASPs June 2019; R.16 revised June 2025 |
| US | 31 CFR 1010.410(f); FinCEN guidance 2019 | $3,000 or more | $3,000 or more, or the equivalent in virtual currency | Q&A issued 1997; virtual currency guidance 9 May 2019 |
| EU | Regulation (EU) 2023/1113 | Full data; up to EUR 1,000 leaving the EU, names and accounts | Every transfer, any amount | 30 December 2024 |
| UK | MLR 2017 regulation 64C; retained Regulation 2015/847, Article 6 | Up to EUR 1,000 leaving the UK or Gibraltar, names and accounts | Names and accounts always; full data from £800 when a business outside the UK is involved | Crypto 1 September 2023; £800 from 30 June 2026 |
FATF caps the de minimis threshold at USD/EUR 1,000 (INR.16 paragraph 8), and jurisdictions implement the rule at different levels. The EU's crypto rule is the zero threshold case: crypto transfers carry the same data "regardless of their amount" (recital 30). SI 2026/621 cut the UK figure from 1,000 euros to £800.
How does travel rule compliance fit with monitoring and screening?
It sits between the two. Intermediary and beneficiary banks look for transfers that lack required data and act under their own policies (INR.16 paragraphs 26 to 28). Know your transaction scores the transfer against what the firm knows about the customer and the counterparty; the travel rule makes sure the names behind it arrive.
R.16 "does not specify whether or how the information transmitted should be screened against sanction lists" (footnote 51), yet those names are what a firm screens. complead, formerly Sanction Scanner, offers payment screening that checks both parties to a payment through the API while the transfer is still in progress.
In the same FATF survey, 83 percent of respondents (91 of 109) had passed travel rule legislation, up from 73 percent in 2025, but 55 of those 91 had not yet issued findings or taken supervisory action focused on travel rule compliance.
Each corridor needs a written policy for the transfer that arrives without the originator's address: execute it, reject it or suspend it, with a named owner who signs the policy (INR.16 paragraphs 27 and 31).
Related terms
- Know your transaction (KYT). Scoring each transfer.
- SWIFT or BIC code. A bank's identifier in payment messages.
- Correspondent banking. One bank serving another bank.
- gpi tracker. Tracking a SWIFT payment.
- Structuring. Splitting money under a threshold.
- Wire fraud. A scheme to defraud by wire.
