Travel Rule for crypto transfers – self-hosted wallets and the €1,000 threshold
The EU Travel Rule already applies. Regulation (EU) 2023/1113 has applied since 30 December 2024 and establishes requirements for information accompanying certain crypto-asset transfers. For a crypto-asset service provider (CASP), the first question is whether a regulated service provider is involved—not simply whether the amount exceeds €1,000. That threshold concerns an additional assessment of control over a self-hosted address; it is not a general exemption from information requirements.
Who is covered—and when do the rules not apply?
This guide is intended mainly for Swedish CASPs, compliance officers, transfer operations teams and advisers. Article 2 covers, among other things, crypto transfers involving an originating, beneficiary or intermediary CASP established in the EU. A transfer directly between two individuals without any CASP is generally outside the Regulation's requirements for crypto transfers involving service providers. Other legislation may still apply.
A self-hosted address is an address not linked to a CASP within the meaning of the Regulation. The address alone does not show who controls it, whether a transfer is lawful or whether the person is a CASP customer.
Decision matrix: CASPs, self-hosted addresses and €1,000
| Situation | Key question | Evidence to retain |
|---|---|---|
| CASP to CASP | Does the required originator and beneficiary information accompany the transfer at the appropriate time? | Role, counterparty, mandatory fields, secure channel and transfer reference. |
| CASP to self-hosted address | Has the originating CASP obtained the required data? Above €1,000, has it assessed whether the address is owned or controlled by the originator? | Address type, value, timestamp, source, additional control and decision. |
| Self-hosted address to CASP | Has the beneficiary CASP obtained the relevant data and identified the transfer? Above €1,000, is ownership or control by the beneficiary assessed? | Customer relationship, transfer reference, conversion and risk assessment. |
| Direct individual-to-individual without a CASP | Does the transfer fall outside these provisions on crypto-asset transfers? | Evidence that no CASP is involved; do not infer this merely from an address. |
Articles 14 and 16 impose role-specific duties. This matrix cannot replace legal classification, technical controls or separate anti-money-laundering obligations.
What information must accompany the transfer?
Under Article 14 the originating CASP must ensure that relevant originator and beneficiary information accompanies a crypto-asset transfer. The exact fields depend, among other matters, on the use of a distributed-ledger address or an account number. Information must be transmitted securely and within the timing set by the Regulation. Under Article 14(8), the originating CASP must not initiate or execute the transfer before the Article's requirements have been met.
Under Articles 16–17, a beneficiary CASP must have procedures to detect missing or incomplete data and assess what to do with affected transfers. An intermediary CASP has separate obligations under Articles 19–21. Always document which CASP role your organisation performs.
Are transfers below €1,000 exempt?
No. The Travel Rule does not start at €1,000. Information requirements can apply below that amount where a CASP is involved. Articles 14(5) and 16(2) impose an additional duty to take appropriate measures to assess ownership or control of a self-hosted address where the transfer exceeds €1,000. This is not a general exemption for smaller transfers.
The EBA Travel Rule Guidelines (EBA/GL/2024/11) elaborate on identifying self-hosted addresses, using customer information and assessing the applicable amount and control method. Record the valuation time, exchange rate and verification approach. Consult the full rules and guidelines in the specific case.
Three practical scenarios
Scenario 1: €600 from a CASP to a self-hosted address
A customer wants to send €600 from their CASP to a self-hosted address. The amount does not make the Travel Rule irrelevant. The firm must still follow applicable information and risk controls. The specific above-€1,000 address-control obligation is not triggered by the amount alone, but other risk-based duties may apply.
Scenario 2: €1,500 from a self-hosted address to a CASP
A CASP receives a transfer worth €1,500 for a customer. The beneficiary CASP must identify the transfer and collect relevant information under Article 16, and take appropriate measures to assess whether the self-hosted address is owned or controlled by the beneficiary. A screenshot is not automatically sufficient evidence.
Scenario 3: direct private transfer without a CASP
Two individuals transfer crypto-assets directly between self-hosted addresses without a CASP. This scenario generally falls outside this Regulation's crypto-asset transfer requirements. Reassess if a CASP actually participates or other legislation applies.
Operational checklist and evidence trail
- Determine scope, service and role: originating, beneficiary or intermediary CASP.
- Identify whether the counterparty is a CASP or whether a self-hosted address is involved; use reliable technical and customer information.
- Record a transfer ID, date, amount, relevant conversion rate and applicable information requirements; store personal data securely.
- Verify required originator and beneficiary data and their timely, secure transmission.
- When the conditions are met, assess ownership or control of the self-hosted address and distinguish evidence from assumptions.
- Record missing information, escalation, risk measures and authorised decisions; keep sensitive material in access-controlled systems.
- Follow up on exceptions and process changes. A completed checklist does not automatically authorise a transfer.
Common mistakes and boundaries
- Treating €1,000 as a general Travel Rule exemption.
- Assuming every individual with a crypto wallet is a CASP.
- Confusing originating, beneficiary and intermediary CASP obligations.
- Sharing personal customer information in unsecured email or open spreadsheets.
- Equating a green administrative status with legal approval.
- Ignoring separate AML and sanctions requirements.
Frequently asked questions about the Travel Rule
Does the Travel Rule apply to every crypto wallet?
No. The Regulation covers specified transfers, including those involving a CASP. A direct private transfer without a CASP generally falls outside its crypto-asset transfer provisions.
Is €1,000 an exemption?
No. Articles 14(5) and 16(2) concern additional steps to assess ownership or control of a self-hosted address. Other information requirements can apply below the threshold.
Must a customer's identity always be verified again?
Specific data and verification requirements apply, including rules on when prior verification may be relied upon. Check the relevant article and actual customer due-diligence evidence.
Is a screenshot enough to prove wallet control?
Not automatically. The method must reliably demonstrate relevant ownership or control under the applicable provisions and EBA guidance.
Can a template replace a Travel Rule system?
No. A template supports documentation; it does not replace secure data exchange, customer due diligence, technical verification or authorised decisions.
Related document package: Document package for the Travel Rule, wallet checks and an evidence log.
Legal sources, date and scope
Primary source: Regulation (EU) 2023/1113, in particular Articles 2, 14–18, 19–21 and 40. Guidance: EBA/GL/2024/11, applicable since 30 December 2024. Editorial source check: 12 November 2026. This is general information, not legal advice for a specific transfer. Check subsequent amendments, applicable supervisory requirements and guidance before acting.
