The Travel Rule is a banking rule that now applies to crypto. When an exchange or another regulated provider (a VASP, short for virtual asset service provider) sends bitcoin for you to another provider, it must also send your name and account details, and the recipient’s, to the company on the other side. In the EU that happens with every such transfer; in the US, from $3,000.
This guide shows what data travels and when, which transfers the rule covers and where it stops, and which privacy habits still work within the law: holding your coins in a wallet only you control (self-custody), CoinJoin where it is legal and your own node. It matters because a purchase on a regulated exchange ties your identity to the coins you withdraw, and the public blockchain shows where those coins go next.
Step-by-Step Guide to Navigating Crypto Regulation and the Travel Rule
The six steps go in order: the first three show what the rule collects and where it stops, the last three what you can still do for your privacy.
Step 1: Identify which jurisdictions apply to your transactions. The Travel Rule has been adopted unevenly across countries. The Financial Action Task Force (FATF) sets the guidelines, but each nation implements its own version. If you are transacting through a VASP licensed in the EU, the EU’s Transfer of Funds Regulation applies (MiCA is the separate EU law that licenses those providers). In the US, FinCEN enforces similar requirements through the Bank Secrecy Act. Check the regulatory status of every platform you use, because each one may collect different data depending on its jurisdiction.
Step 2: Understand what data gets shared. Under the Travel Rule, VASPs must transmit the originator’s (sender’s) name and account number or wallet address alongside the beneficiary’s (recipient’s) name and account number or wallet address. The US adds your address, the amount and the date; the EU adds your home address, ID document number and customer number, or your date and place of birth, as the diagram below shows. In the US this applies to transfers of $3,000 or more; in the EU, since 30 December 2024, it applies to every crypto transfer between providers, whatever the amount. The data is not written on the blockchain: the two institutions exchange it privately, before or with the transfer. Knowing what gets transmitted helps you make informed decisions about which transactions to route through regulated platforms.
Step 3: Evaluate self-custody options. Transfers between personal wallets (unhosted wallets, which no company holds for you) are outside the Travel Rule, because the rule puts its duties on providers, not on the people using them. Moving Bitcoin to a self-custodied wallet after purchasing from an exchange creates a point where Travel Rule tracking ends, though the initial purchase remains recorded. In the EU your exchange must still record whose wallet it sends to and, above €1,000, check that the address is yours, for example by asking you to sign a message with it (our first withdrawal lesson shows how). Use hardware wallets like Coldcard, Trezor, or Ledger for long-term self-custody, bought from the maker’s own store.
Step 4: Use privacy-preserving transaction methods where legally appropriate. A CoinJoin, one transaction built together by several people so outsiders cannot tell which of its equal outputs is yours, cuts the on-chain link between the coin you put in and the mixed coin you get back, as long as the others aren’t one party pretending to be many and the coordinator, if there is one, is honest. As of November 2026 the working tools are Wasabi Wallet with an independent coordinator, Ginger Wallet (its terms exclude US nationals and anyone located in the US), Ashigaru and JoinMarket NG. Sparrow Wallet no longer mixes (it removed Whirlpool in 2024), and the original JoinMarket software is archived and unsafe to use. Our CoinJoin lesson compares them. After withdrawing from a regulated exchange, running your Bitcoin through a CoinJoin round before moving to cold storage adds a layer of on-chain privacy. Always verify that using CoinJoin is legal in your jurisdiction before proceeding.
Step 5: Maintain records for your own protection. Even if you prioritize privacy, keep personal records of transactions, acquisition dates, and cost basis. Tax obligations exist independently of the Travel Rule, and having clear records protects you in the event of an audit. Use tools like Sparrow Wallet’s labeling feature to tag UTXOs with source information that only you can see.
Step 6: Monitor regulatory changes. The FATF updates its guidance regularly, and individual countries frequently adjust their implementations. Subscribe to regulatory news sources and follow organizations like Coin Center or the Electronic Frontier Foundation that track and advocate around cryptocurrency regulation. The rules that apply today may shift within months.
Common Mistakes to Avoid
1. Assuming all exchanges handle your data the same way. Different VASPs implement Travel Rule compliance using different technical solutions. Some use the TRISA protocol, others the Travel Rule Protocol (TRP) maintained by the OpenVASP Association, or proprietary systems. The quality of data encryption in transit and the scope of information retained varies significantly. Research your exchange’s specific compliance infrastructure rather than assuming uniform data handling standards.
2. Confusing pseudonymity with anonymity on-chain. Bitcoin’s base layer is pseudonymous, not anonymous. Every transaction is permanently recorded on the public blockchain. When a regulated VASP tags your withdrawal address with your identity, chain analysis firms can trace subsequent transactions. The Travel Rule makes this linkage even more explicit by formalizing the data sharing between institutions. Do not assume that moving Bitcoin between your own wallets breaks this chain without additional privacy measures.
3. Ignoring the difference between withdrawal and peer-to-peer transactions. Withdrawing Bitcoin from a KYC exchange creates a permanently documented link between your identity and that UTXO. Peer-to-peer purchases through platforms like Bisq, HodlHodl, or RoboSats may not trigger Travel Rule data sharing, but they carry their own risk profiles including counterparty risk and potentially higher premiums. Evaluate each method on its own merits rather than treating all acquisition channels as equivalent.
4. Reusing addresses after implementing privacy measures. If you run your Bitcoin through CoinJoin to break transaction links and then consolidate outputs into a previously used address, you undo the privacy gains. Each CoinJoin output should be treated as a separate UTXO with its own spending strategy. Address reuse is one of the most common privacy mistakes in Bitcoin.
5. Neglecting to run your own node. When you rely on a third-party node or a light wallet that connects to someone else’s server, your transaction queries and balance checks leak information about your addresses. Running your own Bitcoin full node through software like Bitcoin Core, Umbrel, or RaspiBlitz ensures that your wallet queries remain private. This becomes especially important in a regulatory environment where surveillance capabilities are expanding.
Frequently Asked Questions
Does the Travel Rule apply to Bitcoin transactions between personal wallets?
In most jurisdictions, the Travel Rule currently applies only to transactions involving VASPs (exchanges, custodians, and other regulated entities). Transfers between your own self-custodied wallets, or direct peer-to-peer transfers between individuals, typically fall outside its scope. However, the EU’s Transfer of Funds Regulation, in force since 30 December 2024, makes exchanges record the details of every transfer to or from an unhosted wallet and, above €1,000, check whether the address belongs to their customer. The regulatory trend is toward broader coverage, so this is an area to monitor closely.
Can I use CoinJoin to avoid Travel Rule data collection?
CoinJoin does not prevent a VASP from collecting and sharing your data at the point of transaction. If you buy Bitcoin on a regulated exchange, it already has your identity and records the address you withdraw to; it passes your details on when it sends coins to another provider (in the US, from $3,000). What CoinJoin does is break the on-chain link between the UTXO you withdrew and any subsequent spending, making it harder for chain analysis firms to trace where your funds go after leaving the exchange. It is a post-acquisition privacy tool, not a compliance avoidance mechanism.
What happens if a VASP fails to comply with the Travel Rule?
VASPs that fail to implement Travel Rule compliance face regulatory enforcement actions including fines, license revocations, and criminal charges against operators. For you, the practical point is the same either way: a regulated exchange collects these details and passes them on, so the privacy you control begins once the coins are in a wallet you hold.
How does the Travel Rule affect Lightning Network transactions?
The rule follows the provider, not the network. Custodial Lightning wallets (like those offered by some exchanges) fall under existing regulations, because the company holding your funds is a provider. Non-custodial Lightning wallets that connect to your own node operate outside the Travel Rule, which puts its duties on providers, not on individuals. The nodes a Lightning payment passes through do not receive your name.
Will the Travel Rule eventually cover all Bitcoin transactions?
The FATF’s own guidance (updated in October 2021) says peer-to-peer transfers between wallets people hold themselves are not explicitly covered by its standards, because those standards put obligations on intermediaries, not on individuals. Where a country judges that risk to be high, the FATF suggests adding duties at the providers instead, such as record-keeping for transfers to and from self-hosted wallets, or limits on which addresses a provider will pay. The EU’s record-keeping for self-hosted wallets, in force since 30 December 2024, works this way. So the likely direction is tighter rules where coins enter and leave exchanges and payment processors, while a payment between two self-held wallets stays outside the rule.
Related Resources
- KYC vs Non-KYC Bitcoin: Privacy Paradox — Deep analysis of navigating privacy requirements when holding both KYC and non-KYC Bitcoin in the current regulatory environment.
- Buying Bitcoin Without KYC: RoboSats, Bisq and P2P Exchanges — Comprehensive overview of non-KYC acquisition channels and how they fit within broader privacy strategies.
- Bitcoin CoinJoin: Mixing Strategies Guide — Technical breakdown of CoinJoin implementations and their effectiveness for on-chain privacy.
- Lightning Network Regulation: Access Challenges — How emerging regulations specifically affect Lightning Network access and usage patterns.
- Digital Security for Bitcoin Asset Holders — Practical operational security guide for protecting your Bitcoin privacy across all transaction types.
