General information only. CryptoRegHub provides summaries for informational purposes and does not constitute legal or compliance advice. Always verify with official sources and consult qualified legal counsel before making compliance decisions.
CryptoRegHub provides plain-English summaries of crypto regulations for informational purposes only. This does not constitute legal, compliance, or financial advice. Regulations change frequently — always verify information with official sources and consult qualified legal counsel before making any compliance decisions.
Regulation (EU) 2023/1113 (the recast Transfer of Funds Regulation, or TFR) extends the EU's existing Travel Rule — previously applicable only to traditional fund transfers — to cover crypto-asset transfers. The regulation aligns the EU with FATF Recommendation 16 standards and requires CASPs to collect, verify and transmit identifying information about both the originator and beneficiary for every crypto transfer. Unlike the previous FATF-based standard which applied a EUR 1,000 threshold, the EU TFR applies to all transfers regardless of amount. The EBA published final Travel Rule Guidelines (EBA/GL/2024/11) on 4 July 2024, which became applicable simultaneously with the TFR on 30 December 2024. The Regulation entered into force on 29 June 2023 and has applied since 30 December 2024; the only transitional relief was in the EBA Guidelines, which allowed CASPs to compensate for technical limitations in messaging systems until 31 July 2025. The Regulation also amends the AML Directive to make all MiCA crypto-asset service providers obliged entities and to add duties on self-hosted-address risk assessment and on correspondent-type relationships with non-EU crypto firms, and it requires CASPs to have policies, procedures and controls to implement EU and national restrictive measures, specified in EBA/GL/2024/15 (applicable from 30 December 2025). From 10 July 2027 the restrictive-measures controls move to the EU Anti-Money Laundering Regulation (EU) 2024/1624.
Applies to crypto-asset service providers (CASPs) and intermediary CASPs where the CASP or intermediary CASP of either the originator or the beneficiary has its registered office in the EU — so an EU CASP is covered for every transfer it sends, receives or routes, and a non-EU CASP is reached whenever its counterparty CASP is EU-registered. Transfers executed through crypto-ATMs are in scope and e-money tokens are treated as crypto-assets. The Regulation also applies to payment service providers for transfers of funds. It does not apply to person-to-person transfers between self-hosted wallets with no CASP involved, or to transfers where both the originator and the beneficiary are CASPs acting on their own behalf. Every transfer between a CASP and a self-hosted wallet is in scope regardless of amount: the CASP must obtain and hold the originator and beneficiary information and make the transfer individually identifiable, and above EUR 1,000 it must additionally assess whether its customer owns or controls the self-hosted address.
Key requirements: (1) The originator's CASP must accompany every transfer with the originator's name, DLT address and/or account number, address with country, official document number and customer ID (or, alternatively, date and place of birth) and LEI where provided, plus the beneficiary's name, DLT address and/or account number and LEI where provided — submitted securely before or with the transfer, with the originator's details verified before the transfer and no transfer initiated until this is done. (2) No minimum threshold — all transfers, domestic and cross-border, including batch transfers (which may carry the data at batch level). (3) The beneficiary's CASP must detect missing or incomplete information, verify the beneficiary's details before making the assets available, and on a risk basis reject, return, request the information or suspend the transfer; intermediary CASPs must pass the information on and apply the same detection and decision procedures. (4) Where a counterparty CASP repeatedly fails to provide the information, the CASP must warn it, then reject future transfers or restrict or terminate the relationship, and report that counterparty and the steps taken to its competent authority. (5) For every transfer to or from a self-hosted wallet the CASP must obtain and hold the originator and beneficiary information and make the transfer individually identifiable; above EUR 1,000 it must assess whether its customer owns or controls the address using at least one EBA verification method; CASPs must also assess the ML/TF risk of self-hosted transfers and apply mitigating measures (AML Directive Art. 19a). (6) Policies, procedures and controls to implement EU and national restrictive measures, including screening of customers and of every transfer before assets are made available (EBA/GL/2024/15). (7) Respond fully and without delay to competent-authority enquiries, process the personal data only for AML/CFT purposes, give clients a GDPR notice covering the Regulation, keep records for five years, and provide a secure, independent and anonymous internal breach-reporting channel. (8) Messaging systems must transmit the full data set without gaps and maintain data integrity when converting formats.
Always refer to official sources to confirm current requirements. CryptoRegHub summaries are for general guidance only.
Large fines, licence revocation, or criminal referral risk
This summary is for general informational purposes only and does not constitute legal advice. Always verify with official sources and consult qualified legal counsel.