FATF Travel Rule: What Exchanges Must Store About You

The travel rule requires exchanges and brokers to record, pass on and keep information about the sender and recipient of every crypto transfer. In the EU it has applied since 30 December 2024 through the Transfer of Funds Regulation (EU) 2023/1113, with no minimum amount. What gets stored is your name, your wallet address or account number, your postal address or date of birth, and the same basic data for the recipient. If you send more than €1’000 to your own wallet, the exchange must check that it belongs to you. In the EU the data is generally kept for five years, in Switzerland for ten; for customer data the clock starts when the customer relationship ends.

How MiCA regulates the exchanges themselves and how you prove wallet ownership in practice is covered in MiCA and bitcoin. What exchanges report to the tax office is a separate duty, explained in DAC8 and CARF. This article is about what the travel rule stores, who sees it and for how long.

Where the travel rule comes from: FATF Recommendation 16

The Financial Action Task Force (FATF) is the intergovernmental body that sets standards against money laundering and terrorist financing. Germany, Austria and Switzerland are members. Its Recommendation 16 has applied to bank transfers since the 1990s: whoever sends money passes on the sender's name and account so the receiving bank knows where it comes from. The name "travel rule" comes from the fact that the information travels with the money.

In June 2019 the FATF extended its standards to "virtual asset service providers", meaning exchanges, brokers and custodians. It recommends a threshold of USD or EUR 1’000 below which fewer checks are needed. Each country decides whether to adopt that threshold. For transfers between two providers, the EU decided not to.

The FATF regularly reviews how far its members have implemented this. Its reports have shown the same picture for years: many countries have laws, but providers often cannot exchange data because the counterparty sits in a country without a travel rule. This is called the "sunrise issue": the rule dawns at different times in different countries.

The EU rule: Regulation (EU) 2023/1113

In the EU the crypto travel rule is set out in the Transfer of Funds Regulation (EU) 2023/1113, which has applied since 30 December 2024. As a regulation it applies directly in Germany and Austria. In Germany it replaced the earlier national Crypto Asset Transfer Ordinance; supervision lies with BaFin, in Austria with the FMA.

The regulation distinguishes three cases:

Incoming transfers work the same way in reverse: the receiving exchange must detect missing information and may hold back the credit until it is resolved. That is why a deposit sometimes hangs for a day while the exchange asks about the sender.

What data the exchange stores about you

Exactly what travels is set out in Art. 14 of the regulation. For the sender:

• name
• the address of the sending wallet, or the account number at the exchange
• postal address including country, ID document number, customer number or date and place of birth
• for companies, the LEI or an equivalent identifier where available

For the recipient:

• name
• wallet address or account number
• for companies, the LEI where available

Added to this are the amount, time, transaction ID and the outcome of every check. If the exchange verifies your own wallet, it also stores the proof: the signed message, the test transfer or the screenshot.

Take that last point seriously. The travel rule ties your wallet address firmly to your name, in a database that authorities can access on request. How chain analysis finds further addresses from a known one, and what you can do about it, is described in Bitcoin privacy.

The €1’000 threshold in bitcoin

The threshold is set in euros. So the bitcoin amount at which the check applies falls as the price rises. With a savings plan that builds up for months and then goes to the hardware wallet in one go, you quickly end up above it.

Convert amounts between euros and sats with the sats calculator.

Switzerland: FINMA Guidance 02/2019

Switzerland is not in the EU, but it implemented the travel rule earlier and more strictly. FINMA Guidance 02/2019 "Payments on the blockchain", issued in August 2019, makes clear that the rules for bank transfers in the FINMA Anti-Money Laundering Ordinance also apply to crypto transfers, with no threshold.

The practical consequence from the start: a Swiss institution may only send crypto to its own customers or to other supervised institutions that accept the information. Payments to external wallets are only allowed once the institution has verified that the wallet belongs to its customer. Anyone in Switzerland who buys bitcoin from a bank or a regulated broker and withdraws to their own hardware wallet has known this proof since 2019, even for 50 francs.

The duties apply to financial intermediaries under the Anti-Money Laundering Act: institutions supervised directly by FINMA and those affiliated with a self-regulatory organisation (SRO). Since 1 October 2026 a revised Anti-Money Laundering Act has applied in Switzerland; it changes nothing fundamental about the travel rule for crypto.

How long the data is kept

The Transfer of Funds Regulation itself refers to anti-money-laundering law for retention. For identity and customer data, the periods do not start with the transfer but with the end of the business relationship. As long as you have your account, that data stays stored.

On top of this, the exchange as a company has tax record-keeping duties, such as § 147 of the German Fiscal Code. And whatever has been reported to an authority, for example in a suspicious activity report or a DAC8 report, stays there under that authority's own rules.

Who may see the data

Under the regulation, travel rule data serves only to combat money laundering and terrorist financing. The exchange may not use it for marketing. Access is available to:

• the receiving or sending exchange: it gets your data with every transfer between providers.
• the financial intelligence unit: in Germany the FIU at customs, in Austria the money laundering reporting office at the Federal Criminal Police Office, in Switzerland MROS. It receives data when a suspicious activity report is filed.
• prosecutors and courts: by order in criminal proceedings.
• supervisors: BaFin, FMA, FINMA during inspections.
• tax authorities: for tax purposes there is the separate DAC8 channel; in individual cases they can request information.

You have a right of access under the GDPR (Art. 15), and in Switzerland under the Federal Act on Data Protection. You cannot have the data deleted before the period ends, because retention is required by law.

What you can do in practice

• Withdraw less often, and have the same address verified. Many exchanges keep a verified address on file permanently. For privacy it is still better to use a new address for each withdrawal, but then each one must be verified.
• Be honest. If you send to someone else's wallet, name the recipient. False information in an anti-money-laundering check can get your account closed.
• Keep your own records. Save the exchange's confirmation of the wallet verification. It helps you show the tax office later that a withdrawal was a transfer between your own wallets, not a sale.
• Know what P2P means. If you buy without a provider, for example through Bisq, the travel rule does not apply. What that means legally and practically is covered in Bitcoin without KYC.