The Crypto Travel Rule: FATF and Singapore Compliance Guide
The crypto Travel Rule explained: what FATF requires, Singapore's PSN02 rules and S$1,500 tier, unhosted wallets, and the KYC and messaging tools VASPs use.
WhaleHub Research
Last updated: October 2026
8 min read
Updated 23 October 2026: FATF figures from its June 2025 targeted update; Singapore rules from Notice PSN02 as summarised by the sources linked in the text.
The crypto Travel Rule requires exchanges, custodians and other virtual asset service providers (VASPs) to send identifying information about the sender and recipient along with every transfer they make for a customer, as banks do for wires. Singapore has enforced it since January 2020 under MAS Notice PSN02. Here is what it requires, where it gets hard, and how firms build the compliance stack, with iDenfy as the example identity layer.
What the Travel Rule requires
Under FATF Recommendation 16 as applied to virtual assets, the sending provider must obtain and hold accurate originator information and the required beneficiary information, and transmit it to the beneficiary's provider immediately and securely. The receiving provider must obtain and hold the same data and check it.
"Originator information" usually means name, account or wallet reference, and one more identifier such as a physical address, national ID number or date and place of birth. "Beneficiary information" is name and account or wallet reference. The point is the same as for bank wires: if a transfer later turns out to be criminal or sanctioned, both ends know who was involved.
Where the world stands
FATF's June 2025 targeted update found that 99 jurisdictions had passed or were passing Travel Rule legislation. But compliance with FATF's wider virtual-asset standard remained weak: only 29% of 138 jurisdictions assessed were largely compliant with Recommendation 15.
That gap is the practical problem. A Singapore exchange may be obliged to send data to a counterparty in a country with no Travel Rule, or no supervisor checking it. FATF calls this the "sunrise issue", and it is why firms need to know where each counterparty sits before deciding what to send.
How Singapore applies it: Notice PSN02
MAS implemented the Travel Rule through Notice PSN02, issued in December 2019 and in force since 28 January 2020. It applies to licensed digital payment token providers for transfers of every size, with a fuller data set above S$1,500.
| Transfer value | Originator data | Beneficiary data |
|---|---|---|
| S$1,500 or less | Name; account number or unique reference | Name; account number or unique reference |
| Above S$1,500 | Name; account number or reference; plus address, national ID number, or date and place of birth | Name; account number or reference |
Sources: Notabene and 21 Analytics summaries of PSN02. Check the notice and MAS's guidelines for the exact text. PSN02 sits alongside the rest of a licensee's AML/CFT duties: customer due diligence, screening, ongoing monitoring and suspicious transaction reporting. For the licensing context, see Singapore crypto regulation in 2026.
The hard case: self-hosted wallets
When a customer withdraws to their own wallet, or receives from one, there is no provider on the other side to exchange data with. Regulators, including MAS in its guidance to PSN02, expect providers to treat these transfers as higher risk rather than to stop them.
In practice that means collecting the customer's details about the wallet, screening the address with blockchain analytics, and for some transfers asking the customer to prove control, for example by signing a message. Summaries of Singapore's rules differ on how far the notice itself reaches here, so firms should rely on the MAS guidelines, not secondary summaries. For DeFi users the effect is visible: withdrawing from an exchange to a new wallet can trigger extra questions.
The compliance stack
Travel Rule compliance is not one tool. A provider needs verified customer identity to send, a way to find and message the counterparty, screening on both the person and the wallet, and records it can show a supervisor.
| Layer | What it does | Typical tools |
|---|---|---|
| Identity verification (KYC/KYB) | Verifies who the customer is, the data the Travel Rule sends | Identity-verification platforms such as iDenfy |
| AML screening and monitoring | Checks customers against sanctions, PEP and adverse-media lists, and re-checks over time | Often the same platform as KYC |
| Blockchain analytics | Scores wallet addresses and traces funds | Chain-analytics providers |
| Travel Rule messaging | Finds the counterparty VASP and exchanges originator and beneficiary data securely | Travel Rule networks and protocols |
| Case management and reporting | Records decisions, files suspicious transaction reports | Compliance case tools |
iDenfy: the identity layer
iDenfy is an identity-verification company from Lithuania whose platform covers the customer-data side of the stack: verifying identity documents with a face check at onboarding, screening against PEP, sanctions and adverse-media lists, and monitoring customers for risk changes afterwards.
Its crypto integration guide lists six building blocks: ID verification, AML screening, ongoing AML monitoring, face authentication to re-verify users before high-value withdrawals, a questionnaire for source-of-funds declarations, and webhooks that deliver results in real time. The re-authentication step matters for Travel Rule cases: when a large withdrawal goes out, the provider can confirm that the account holder, not someone who took over the account, is the one sending it.
iDenfy's documentation names the Travel Rule as a regulatory requirement crypto firms face; it does not present a Travel Rule messaging network of its own, so most firms pair an identity platform with a dedicated messaging solution. If you are at the Singapore FinTech Festival on 18-20 November 2026, the identity, analytics and Travel Rule vendors are the cluster of the exhibition worth walking together.
Where Travel Rule compliance usually breaks
Most failures are not about refusing to comply but about data that cannot reach the other side: different messaging networks, missing counterparties, or poor customer data at the start.
- Network mismatch. Two providers on different Travel Rule networks cannot always exchange data directly. Interoperability between networks has improved but is not universal.
- Unknown counterparties. Working out whether an address belongs to a VASP, and which one, is often the hardest step. Analytics tools help but are not perfect.
- Bad source data. If onboarding captured a wrong name or an unverified address, the Travel Rule passes the error along. Strong identity verification at the start is the cheapest fix.
- Inbound handling. Receiving providers must decide what to do when a transfer arrives with missing data: hold it, return it, or accept it and follow up. Without a written policy, staff decide case by case.
- Sunrise counterparties. Sending to a jurisdiction with no Travel Rule still requires a risk decision, and records of why it was made.
How Stellar anchors handle it
On Stellar, the regulated on- and off-ramps are anchors, and the ecosystem standards already carry the data the Travel Rule needs. SEP-12 defines how an anchor collects KYC information from a customer, and SEP-31, used for cross-border payments between anchors, has the sending anchor pass sender and receiver information to the receiving anchor alongside the payment. That makes Stellar payments between regulated anchors a natural fit for Travel Rule obligations. See stablecoin cross-border payments.
A short checklist for a new VASP
- Know which Travel Rule applies to you and where your counterparties are licensed.
- Verify every customer to the level your highest transfer tier needs.
- Screen people and wallet addresses, at onboarding and on an ongoing basis.
- Decide in advance how you treat self-hosted wallets and transfers to non-compliant jurisdictions.
- Keep records you can show a supervisor, and test the whole flow before launch.
Frequently asked questions
What is the crypto Travel Rule?
It is FATF Recommendation 16 applied to virtual assets: when a virtual asset service provider sends a transfer for a customer, it must collect information about the sender and recipient and pass it to the receiving provider, which must collect and check it too. It mirrors what banks have long done for wire transfers.
What is Singapore's Travel Rule threshold?
Singapore's Notice PSN02, in force since 28 January 2020, applies to transfers of all sizes. Above S$1,500 the sender's details must include more identifiers, such as an address, national ID number or date and place of birth. Below it, names and account numbers or wallet references are enough.
Does the Travel Rule apply to self-hosted wallets?
There is no counterparty provider to send data to, so the messaging part cannot apply in the same way. Regulators instead expect providers to treat these transfers as higher risk, collect information about the customer's wallet and, in some cases, verify ownership. Singapore's guidance to PSN02 covers this; check it for the exact requirements.
How many countries enforce the Travel Rule?
FATF's June 2025 targeted update said 99 jurisdictions had passed or were passing Travel Rule legislation. It also found only 29% of 138 assessed jurisdictions largely compliant with FATF's broader virtual-asset standard, Recommendation 15.
Does iDenfy handle the Travel Rule?
iDenfy provides identity verification and AML screening and monitoring, which is the customer-data side the Travel Rule depends on. Its crypto documentation lists the Travel Rule as an obligation crypto firms face, not as an iDenfy messaging product, so firms typically pair it with a separate Travel Rule network.
WhaleHub is a yield-optimization protocol on Stellar. We stake AQUA, aggregate ICE voting power, and auto-compound Aquarius rewards for stakers. This series explains the Stellar DeFi stack — and the wider market around it — in plain English.
Read more
DeFi on Stellar, with the rules in view
WhaleHub stakes AQUA, aggregates ICE voting power and auto-compounds Aquarius rewards, and publishes how each part can fail.
Launch the appThis article is for education only and is not legal, tax or financial advice. Rules summarised here come from the sources linked in the text as of the date shown and change often. Check the regulator's own publications, or ask a lawyer, before acting.