Travel rule

The travel rule is the requirement that financial institutions sending, forwarding or receiving a funds transfer pass along identifying information about the sender (originator) and recipient (beneficiary), so the information "travels" with the payment. In the US it is set out in 31 CFR 1010.410(f); internationally it is FATF Recommendation 16, which FATF itself notes is also referred to as the "Travel Rule" in the context of virtual assets.

The US rule

Under 31 CFR 1010.410(f), a transmittor's financial institution in the US must include in any transmittal order of $3,000 or more the transmittor's name and account number, address, the amount, the execution date, the identity of the recipient's financial institution, recipient details received with the order, and the identity of the transmittor's institution. Intermediary institutions must pass the information along.

It covers more than banks. FinCEN's 2019 guidance on convertible virtual currency says CVC transactions that qualify as transmittals of funds may fall within the Funds Travel Rule, and that a transmittal of $3,000 or more "or its equivalent in CVC" may trigger its requirements.

FATF Recommendation 16

At its June 2025 Plenary, FATF agreed changes to Recommendation 16 to make the information in payment messages consistent and to clarify who in the payment chain must include it and keep it unchanged. FATF set the end of 2030 as the implementation deadline. National rules, not the FATF text, bind a given institution, so check the rule in each jurisdiction you operate in.

Why it matters in KYB review

When you onboard a payment company, a money services business or a crypto platform, you are relying on its travel-rule compliance for the flows that pass through your accounts. A partner that cannot send or receive originator data creates gaps in your own monitoring and in the information you can give law enforcement.

What an analyst checks

• Whether the applicant is in scope: money transmitter, virtual asset service provider, or neither.
• Its written policy for collecting, sending and receiving originator and beneficiary data.
• The tooling or protocol it uses for counterparties, especially for crypto transfers.
• How it handles transfers that arrive without the required data.
• Registrations and licences that go with the activity.

Common pitfalls

• Assuming a crypto business is out of scope because it calls itself a "software" company.
• Accepting a policy document as evidence the control runs. Ask how incomplete transfers were handled in practice.
• Applying one jurisdiction's threshold across all corridors.

Related terms

Money services business, partner-bank due diligence, enhanced due diligence, customer due diligence.

Sweat AI is an AI-native BPO for banks and fintechs, working onboarding and fraud queues. When you onboard payment or crypto businesses, our analysts map what each applicant has evidenced against your requirements, travel-rule controls included, and list what remains to request. Your team decides. See KYB for stablecoin and crypto platforms.