The travel rule for crypto operators

In banking it is an old rule: when you transfer money, the information on the originator and the beneficiary “travels” together with the payment. This is the travel rule. With virtual currencies this principle has become one of the most delicate points of anti-money-laundering compliance. For Swiss crypto operators it is not a technical detail: it is a condition for doing business.

What the travel rule is

The travel rule requires that, in a transfer of value, the originating institution passes on to the receiving one the identifying information on who is sending and who is receiving the funds. It originated in traditional payment traffic and derives from the international standards of the FATF, in particular from the recommendation on wire transfers, explicitly extended to virtual assets and their providers (the VASPs).

The aim is to prevent crypto transfers from becoming an opaque channel: anyone transferring virtual currencies on behalf of clients must be able to say who stands behind every movement.

How Switzerland applies it

Switzerland implements these standards through the Anti-Money Laundering Act (AMLA) and FINMA’s practice, and it does so with an approach known to be strict. In short, for transfers of virtual currencies the intermediary must:

• identify the originating client and establish the beneficial owner;
• collect and transmit the required information on the originator and, as far as possible, on the beneficiary;
• verify that the receiving counterparty is an intermediary subject to equivalent supervision.

The point where Switzerland stood out concerns transfers to external wallets: when funds leave the platform towards an address not managed by a supervised intermediary, the operator must still be able to verify that the destination wallet belongs to its client or that the client controls it. Exchanging data between platforms is not enough: control over the real recipient is required.

The knot of unhosted wallets

Self-hosted (or “unhosted”) wallets are the most concrete challenge. In a transfer between two exchanges, information can travel between two intermediaries. But when the client withdraws to their own private wallet, there is no counterparty to exchange data with. Here the operator must adopt procedures to verify ownership of the address — for example technical proof of wallet control — proportionate to the risk of the transaction.

This is what distinguishes a serious framework from an improvised one: you do not simply “pass on the data”, you govern the risk at the point where funds leave the supervised perimeter.

What the operator must oversee

To be compliant, a crypto operator subject to the rules must put in place:

1. Full KYC on originators and beneficial owners.
2. Collection and transmission of the required information on transfers.
3. Counterparty verification: is it a supervised VASP? Is it the client’s own wallet?
4. Technical travel-rule solutions interoperable with other providers.
5. Sanctions and list screening, with blocking of non-compliant transactions.
6. Monitoring and reporting of suspicious transactions to MROS.
7. Internal directives and training, with periodic AMLA audit.

The mistakes to avoid

• Treating the travel rule as technology alone: the tool helps, but without clear procedures and responsibilities it is not enough.
• Ignoring external wallets: that is precisely where the risk concentrates.
• Weak onboarding: if the initial KYC is fragile, all information transmitted downstream is fragile.
• No exception handling: what happens when the counterparty cannot be verified? A written rule is needed.

How we tackle it

Travel-rule compliance cannot be bought off the shelf: it is designed around the business model, the flows and the operator’s risk profile. SIH ONE handles the structuring and advisory: we frame the scope of the obligations, design procedures and directives, define the framework for external wallets and coordinate the choice of tools. Our team has hands-on experience as AMLA Compliance Officer, and this shows in the practicality of the setup. Activities subject to authorisation go through authorised partners.

Do you need to bring your crypto service into line with the travel-rule requirements? Let’s talk: we define the scope and build an audit-ready framework.