The Travel Rule can be traced back to the Financial Action Task Force’s (“FATF”) recommendation that originator and beneficiary information should travel alongside wire transfers. It takes its form as Recommendation 16 within the 40 Recommendations issued by the FATF to establish a robust framework to combat money laundering and the financing of terrorism (“ML/TF”).

As the financial industry evolved, so too did the FATF Recommendations have to adapt to an ever-changing landscape. We can look to the updates of the Recommendation in 2012 and, most recently, in 2019, which brought most payment infrastructures used by licenced institutions within scope, with the latter update extending the standard to Virtual Asset Service Providers (“VASPs”).

In the European Union, the latest iteration comes in the form of Regulation (EU) 2023/1113, known as the recast “Transfer of Funds Regulation” (“TFR”). The TFR applies to EU operators active in the banking, payments and crypto-asset space, and has applied in full since 30 December 2024, deliberately aligned with the entry into application of the Markets in Crypto-Assets Regulation (“MiCA”).

The ultimate aim of the FATF, the European Union, national governments and national supervisory authorities is always the same: to curb the misuse of the financial system. Yet, with the rising cost of compliance set against the measurable effectiveness of the global AML/CFT regime, and more specifically the use of Travel Rule data in ML/TF investigations, one must ask whether the financial burden placed on licenced institutions is genuinely helping to deter illicit funds from flowing through the system and to help law enforcement catch the criminals already abusing it.

On the other hand, the evolution of payment infrastructures, and the multiplication of avenues to transfer value across borders while capturing the required Travel Rule data, presents a second-order risk. Different jurisdictions, different regulations, and the ever-present vulnerability to cyber-attacks and data breaches, generate a plethora of considerations which must be accounted for.

This article focuses on the newer, “higher-risk” activity that the latest regulatory update swept within its scope, namely Virtual Assets (“VAs”) and VASPs, while drawing out three questions that regulated institutions, supervisors and policymakers cannot avoid: what does the Travel Rule cost to run, what does it cost to protect the personal data it generates, and does it actually work?