Why the FATF Travel Rule still splits VASP compliance in 2026

Seven years after the Financial Action Task Force (FATF) extended its Travel Rule to crypto, compliance in 2026 still splits sharply by jurisdiction: 85 of 117 surveyed jurisdictions have passed implementing law, but most have yet to enforce it, leaving Virtual Asset Service Providers (VASPs) to navigate a patchwork the industry calls the “sunrise problem.”

The FATF Travel Rule requires the originator and beneficiary VASPs in a crypto transfer to exchange verified customer information for transactions above the USD/EUR 1,000 threshold. By 2025, 85 jurisdictions had passed implementing legislation, up from 65 in 2024 (FATF 2025 Targeted Update). Yet supervision lags adoption, and the practical result is a market where the same transfer is mandatory on one side and unenforced on the other. This analysis maps how the European Union, United Kingdom, United States and Singapore diverge, what enforcement looks like, and where the rules are heading.

Key Facts:

• The Travel Rule applies to crypto transfers above the USD/EUR 1,000 threshold; originator and beneficiary VASPs must exchange verified data — FATF, 2025
• 85 of 117 jurisdictions had passed implementing legislation by 2025, up from 65 in 2024 — FATF 2025 Targeted Update
• Roughly 59% of jurisdictions with laws have issued no Travel-Rule-specific enforcement action — FATF, 2025
• EU Transfer of Funds Regulation (Regulation (EU) 2023/1113) applies from December 30, 2024, with no de minimis threshold — EUR-Lex
• UK Money Laundering Regulations Travel Rule in force since September 1, 2023 — FCA / Elliptic
• Singapore’s MAS Notice PSN02 has applied to all transfer sizes since January 28, 2020 — MAS
• Binance’s US settlement reached $4.3 billion on November 21, 2023 over Bank Secrecy Act and AML failures — US Department of Justice

Methodology and sources

This analysis draws on primary regulator documents: the FATF 2025 Targeted Update on Implementation of the FATF Standards on Virtual Assets and VASPs and its 2025 revisions to Recommendation 16; the EU Transfer of Funds Regulation (Regulation (EU) 2023/1113) and the European Banking Authority (EBA) Travel Rule Guidelines (EBA/GL/2024/11); the UK Money Laundering Regulations 2017; the US Financial Crimes Enforcement Network (FinCEN) recordkeeping and Travel Rule under the Bank Secrecy Act (BSA); and the Monetary Authority of Singapore (MAS) Notice PSN02. The jurisdictional scope is the EU, UK, US and Singapore as of June 2026; enforcement figures are drawn from FATF survey data and named settlement documents. The caveat: thresholds and supervisory intensity change frequently, and primary regulator guidance always supersedes summaries.

Related:Retail FX leverage caps hold at 30:1 as enforcement goes offshore

The sunrise problem: one rule, uneven dawns

The “sunrise problem” describes the Travel Rule taking effect at different times across jurisdictions, so a VASP in a fully regulated market routinely transacts with counterparties in markets where the rule is not yet live or not enforced. The originating VASP must collect and transmit data the receiving VASP may have no obligation — or technical means — to accept. That asymmetry slows transfers, fragments data standards, and exposes compliant firms to the awkward choice of blocking otherwise-legitimate transactions or accepting counterparties that cannot reciprocate.

What is the sunrise problem in the crypto Travel Rule? It is the gap created when jurisdictions adopt the FATF Travel Rule on different timelines, leaving cross-border transfers governed by mismatched rules. A VASP in the European Union, where the Transfer of Funds Regulation has applied since December 30, 2024 with no de minimis threshold, must send full originator and beneficiary data on every transfer — even to a counterparty in a jurisdiction with no live Travel Rule obligation. The receiving firm may be unable to process that data or legally indifferent to it. The result is inconsistent enforcement expectations, settlement friction, and a compliance burden that falls hardest on firms in the strictest regimes, which is precisely the distortion FATF’s harmonisation effort was meant to remove.

“The FATF update to Recommendation 16 is both timely and necessary.”

— Delphine Forma, Head of Policy Europe, Solidus Labs (Sumsub)

How four jurisdictions diverge

The headline rule is shared; the implementation is not. The EU applies the strictest version — full data on every transfer, no minimum — while the US retains a higher $3,000 threshold inherited from its pre-crypto wire-transfer regime. The UK carves out domestic-only transfers, and Singapore applies the rule to all sizes but reserves the fullest data set for transfers above SGD 1,500. These are not cosmetic differences: they determine which transactions must carry data, what data must travel, and what a firm’s liability looks like when a counterparty cannot comply.

Sources: FATF, EUR-Lex (Regulation (EU) 2023/1113), FCA, FinCEN, MAS. Last updated: June 2026.

Why enforcement lags adoption

Passing a Travel Rule and policing it are different undertakings, and the FATF data shows the gap plainly: roughly 59% of jurisdictions with implementing law have issued no Travel-Rule-specific supervisory finding or enforcement action. Supervisors face a genuinely hard task — verifying that data was collected, transmitted, and acted on across borders requires technical tooling and counterparty cooperation that many authorities lack. The more mature regimes are starting to move, with Japan’s Financial Services Agency, for example, publishing summaries of supervisory actions so other VASPs can see what failings were identified.

The single most common implementation failure in 2026 is operational, not legal: firms buy a Travel Rule messaging protocol before fixing the Know Your Customer (KYC) layer that feeds it. A Travel Rule message a firm cannot populate — because the underlying KYC stack never captured the counterparty wallet or beneficiary details — is a violation, not a success. That mirrors the broader compliance-sequencing problem visible in the way the US stablecoin KYC rule stops at the issuer’s door, and in how the EU’s AMLA single rulebook tries to standardise supervision the Travel Rule still lacks.

Enforcement context: what the big cases signal

The most consequential AML enforcement in crypto remains Binance’s $4.3 billion settlement with US authorities on November 21, 2023, resolving Bank Secrecy Act, unlicensed-money-transmission and sanctions violations with the Department of Justice, FinCEN and the Office of Foreign Assets Control (OFAC). While the case spanned more than the Travel Rule, its core finding — that the exchange failed to maintain an effective AML program capable of monitoring and reporting the transfers flowing across it — is exactly the capability the Travel Rule is designed to build. The settlement reset industry expectations: large VASPs now treat originator and beneficiary data handling as a board-level liability, not a back-office task.

The deterrent effect is uneven, however, because it concentrates in the jurisdictions with both the rule and the will to enforce it. A VASP operating from a market that has adopted the Travel Rule on paper but issued no enforcement action faces a very different risk calculus from one supervised by FinCEN or the FCA. That divergence is the enforcement face of the sunrise problem, and it is why harmonised standards on paper have not yet produced harmonised behaviour in practice — a pattern that also runs through the way MiCA’s market-abuse regime diverges from the UK and US.

What this means for VASPs, banks and compliance teams

For compliance and legal teams, the operational implications are concrete. First, KYC must precede protocol: the data the Travel Rule requires has to be captured at onboarding and at the point of transfer, or the messaging layer is worthless. Second, counterparty due diligence now extends to a counterparty’s regulatory home — firms must know whether a receiving VASP can lawfully accept and act on Travel Rule data, and document the decision to transact when it cannot. Third, multi-jurisdiction VASPs must run to the highest applicable standard, because an EU nexus pulls in the no-threshold TFR regardless of where the counterparty sits.

For banks providing services to VASPs, the Travel Rule is becoming a gating criterion: a crypto firm that cannot demonstrate end-to-end data handling is a correspondent-banking risk. For fund managers and custodians, the practical takeaway is that settlement times and counterparty lists will narrow toward firms that can reciprocate compliant data exchange, much as the staking and licensing splits documented in our analysis of how crypto staking rules divide the US, EU and UK are reshaping which products firms can offer where.

The FATF’s 2025 revision confirmed the Travel Rule applies to all “payments or value transfers and related messages,” not only conventional wire transfers.

— FATF, 2025 revisions to Recommendation 16 (Mayer Brown)

The forward view

The direction is toward convergence, slowly. The FATF’s 2025 revisions to Recommendation 16 broadened and clarified the standard, with further implementation guidance expected in late 2026 to push jurisdictions toward consistent national rules. Forma’s caution is the structural counterpoint: harmonised recommendations do not equal harmonised law, because each jurisdiction still chooses how far to go.

“Implementation remains the responsibility of individual jurisdictions, each of which must decide how and to what extent they’ll translate the recommendations into national law.”

— Delphine Forma, Head of Policy Europe, Solidus Labs (Sumsub)

Three contested questions remain open into 2027: whether the US finalises its long-proposed reduction of the cross-border threshold to $250; whether the EBA’s guidelines harden into uniform enforcement across EU national competent authorities rather than 27 interpretations; and whether interoperability between competing Travel Rule messaging protocols matures enough to remove the technical excuse for non-compliance. Until those resolve, the sunrise will keep rising at different hours.

TL;DR

The FATF Travel Rule requires VASPs to exchange verified originator and beneficiary data on crypto transfers above USD/EUR 1,000, but in 2026 implementation remains uneven: 85 of 117 jurisdictions have passed laws (up from 65 in 2024), yet roughly 59% have brought no Travel-Rule-specific enforcement. The EU applies the strictest version (no threshold, from December 30, 2024); the US keeps a $3,000 threshold; the UK exempts domestic transfers; Singapore covers all sizes. The resulting “sunrise problem” leaves compliant firms transacting with counterparties that cannot reciprocate. FATF’s 2025 Recommendation 16 revision and guidance due late 2026 aim to close the gap.

FAQ

What is the FATF Travel Rule?

It is a FATF standard requiring the originating and receiving Virtual Asset Service Providers in a crypto transfer to collect and exchange verified information about the sender and recipient for transactions above the USD/EUR 1,000 threshold, mirroring long-standing rules for bank wire transfers.

Which jurisdictions enforce the Travel Rule in 2026?

By 2025, 85 of 117 surveyed jurisdictions had passed implementing legislation, including the EU, UK, US and Singapore. However, the FATF reports that roughly 59% of jurisdictions with laws have issued no Travel-Rule-specific enforcement action, so adoption is far ahead of supervision.

What is the Travel Rule threshold?

The FATF threshold is USD/EUR 1,000. Implementation varies: the EU applies no de minimis (every transfer), the US uses a $3,000 threshold, the UK applies a EUR/£1,000 threshold with domestic transfers exempt, and Singapore covers all sizes with wider data required above SGD 1,500.

What is the sunrise problem?

The sunrise problem is the uneven, staggered adoption of the Travel Rule across jurisdictions, which leaves a compliant VASP transacting with counterparties that are not yet obligated or able to exchange the required data — creating settlement friction and inconsistent enforcement expectations.

What happens if a VASP breaches the Travel Rule?

Penalties depend on jurisdiction, from uncapped FCA financial penalties in the UK to AML penalties of up to €5 million or 10% of turnover in the EU and BSA civil penalties in the US — where Binance’s broader AML settlement reached $4.3 billion in November 2023.

How is the Travel Rule changing?

The FATF revised Recommendation 16 in 2025 to confirm the rule applies to all payments and value transfers and related messages, with further implementation guidance expected in late 2026 to drive more consistent national rules.

This article is informational analysis only and does not constitute legal, regulatory, tax, or investment advice. Regulatory frameworks change frequently and interpretation depends on facts and circumstances; primary documents and official regulator guidance always supersede summaries. Firms should consult qualified legal counsel and their relevant supervisory authority before taking any action based on the analysis above.