The Crypto Travel Rule: Phase One Deadlines for 2026
Global VASPs face new Travel Rule requirements in 2026. Mandates for self-hosted wallet verification and cross-border data transmission are now in force.
Compliance for Virtual Asset Service Providers (VASPs) is entering a new phase of enforcement. The Travel Rule, FATF Recommendation 16, now requires that originator and beneficiary information must travel with every virtual asset transfer to increase transparency.
Self-hosted wallet verification mandates
A significant shift in 2026 involves transactions with unhosted (self-custodial) wallets. In the EU, verification is now required for all transactions exceeding EUR 1,000 involving a self-hosted wallet.
Institutions are increasingly using Satoshi tests (micro-transactions) or cryptographic message signing to prove ownership of these wallets before allowing transfers to proceed.
Cross-border complexity and data sharing
The challenge for global VASPs is the lack of built-in identity layers on the blockchain. To comply, firms are adopting off-chain solutions that attach sender and recipient details to transactions before execution.
In jurisdictions like Brazil, phase one of these data transmission requirements must be completed by early 2027, with full cross-border interoperability following in 2028.
Crypto Travel Rule 2026 FAQ
- What information must travel with a crypto transaction?
- Under Recommendation 16, the originator's name, account/wallet number, and address must be shared with the beneficiary's institution. The beneficiary's name and account number must also be included.
- Is there a transaction threshold for the Travel Rule?
- The threshold varies by jurisdiction. In the EU, there is no minimum threshold for VASP-to-VASP transfers, while the US (under the BSA) currently enforces a $3,000 limit.
- How do you verify a self-hosted wallet?
- Verification often involves the user signing a specific cryptographic message with their private key or performing a micro-transaction to prove they control the wallet address.
- What happens if a counterparty VASP is non-compliant?
- Institutions must conduct due diligence on their counterparty VASPs. If a counterparty cannot securely receive or send the required data, the transaction may need to be held or rejected to maintain compliance.
Relevant Articles
MiCA Final Deadline: 60 Days for Crypto Firms
ESMA confirmed July 1, 2026 with no extensions.
May 11, 2026
AMLA 2026 Guidelines: The Shift to Living Risk Profiles
From periodic refresh to continuous monitoring.
May 11, 2026
The EUDI Wallet Deadline: Late 2026 Mandatory Rollout
What the eIDAS 2.0 deadline means for verification stacks.
May 11, 2026
What is deepidv?
Not everyone loves compliance — but we do. deepidv is the AI-native verification engine and agentic compliance suite built from scratch. No third-party APIs, no legacy stack. We verify users across 211+ countries in under 150 milliseconds, catch deepfakes that liveness checks miss, and let honest users through while keeping bad actors out.
Learn More