EU Travel Rule and self-hosted wallets

Start with the parties to the transfer

Regulation 2023/1113 Article 2 covers crypto-asset transfers where a relevant CASP or intermediary CASP has its registered office in the EU. Article 2(4) excludes person-to-person transfers without a CASP. That exclusion concerns this regulation. It does not establish that an activity is outside all financial, sanctions or tax law.

A self-hosted address at one end does not remove the participating CASP's responsibilities. Record whether the transfer is outgoing or incoming, which provider serves each party, and whether the address belongs to the customer or a third party. The blockchain network and token name alone cannot answer these questions.

Articles 14 and 16 require information for transfers to or from self-hosted addresses. Their additional ownership/control assessment applies to amounts exceeding EUR 1,000. Do not turn that threshold into a general information exemption for smaller crypto transfers.

Distinguish information from verification

Article 14 specifies originator and beneficiary information. The fields include names, relevant ledger addresses and account numbers, additional originator identification information and identifiers subject to the conditions in the article. Use the exact legal field definitions in a data specification. The short labels below are workflow headings.

Under Article 14(4), information is submitted securely in advance of, or with, the transfer. It need not be written into the blockchain transaction itself. Publishing customer identity data on a public ledger is not a Travel Rule requirement.

Retain the reasoning for the outcome. A screen showing an address, an identity record and a transfer hash are different artifacts. The workflow should connect them without letting one artifact silently replace the others.

Design decisions for each transfer scenario

This DeFiSec worksheet helps a product team specify evidence and exception handling. It summarizes Articles 14, 16 and 17. It does not replace the full field requirements or a provider's risk assessment.

The final EBA Travel Rule report explains that one effective ownership/control assessment method can suffice, with additional methods when doubts remain. Do not implement the earlier draft's proposed two-method rule as an unconditional final requirement.

Test the workflow and its failure paths

For integration planning, Pharos Production's discussion of CASP onboarding and Travel Rule systems connects identity checks, transaction services and case management. Keep the statutory threshold and field definitions in your own requirements specification, then use that technical discussion to examine system handoffs.

Test an ordinary transfer, a missing message, contradictory customer details, a provider outage and a transfer already received on-chain. Verify who can release assets and how a decision is recorded. Use controlled test data and approved test environments. Production customer data is unnecessary for testing most validation failures.

Article 18 makes incomplete information relevant to the assessment of suspicious activity. A transfer marked technically complete still needs the applicable risk checks. For the separate tax-reporting data flow, read the DAC8 guide. For supplier continuity and testing evidence, use the DORA worksheet.