Virtual Asset Service Providers and the Travel Rule

1. Why This Topic Matters

Virtual assets (VAs) such as Bitcoin, Ether and stablecoins have moved from the fringes of finance into the mainstream, and with them has come a new class of financial crime risk. Criminals value VAs for the same reasons legitimate users do: they are fast, borderless, available 24/7 and can be moved without a traditional bank intermediary. Pseudonymity (a wallet address rather than a verified name), the ease of creating unlimited wallets, the use of mixers and privacy coins, and uneven regulation across jurisdictions make VAs attractive for laundering ransomware proceeds, darknet market revenue, fraud and scam proceeds, sanctions evasion and terrorist financing.

Regulators responded. In 2018 and 2019 the Financial Action Task Force (FATF) amended Recommendation 15 and issued an Interpretive Note making clear that Virtual Asset Service Providers (VASPs) must be licensed or registered, supervised, and subject to the same AML/CFT obligations as other financial institutions, including the Travel Rule found in Recommendation 16. For the CAMS exam, this topic sits inside Financial Crime Risks by Sector and candidates are expected to know the definitions, the obligations, the practical challenges and the red flags. Expect scenario questions that test whether you can identify a VASP, apply a risk-based approach and recognise suspicious VA activity.

2. Key Definitions You Must Know

Virtual Asset (FATF): A digital representation of value that can be digitally traded or transferred and can be used for payment or investment purposes. It does not include digital representations of fiat currency (for example a bank balance viewed online or a central bank digital currency), securities, or other financial assets already covered elsewhere in the FATF Recommendations.

Virtual Asset Service Provider (VASP): Any natural or legal person who, as a business, conducts one or more of the following activities for or on behalf of another person:
1. Exchange between virtual assets and fiat currencies
2. Exchange between one or more forms of virtual assets
3. Transfer of virtual assets (moving a VA from one address or account to another)
4. Safekeeping and/or administration of virtual assets or instruments enabling control over virtual assets (custodial wallet providers)
5. Participation in and provision of financial services related to an issuer's offer and/or sale of a virtual asset (for example ICO or token sale services)

Typical VASPs include centralised exchanges, custodial wallet providers, crypto ATMs (kiosks), over-the-counter (OTC) brokers and some payment processors. Under FATF's functional approach, the label a business gives itself does not matter; what matters is the activity performed. Even some decentralised finance (DeFi) arrangements may fall within scope if an identifiable person retains control or sufficient influence over the service.

Hosted vs. unhosted wallets: A hosted (custodial) wallet is controlled by a VASP on behalf of the customer. An unhosted (self-hosted or private) wallet is controlled directly by the user through their own private keys, with no intermediary. The distinction is critical for the Travel Rule because there is no counterparty VASP to send information to when funds go to or come from an unhosted wallet.

The Travel Rule: A requirement that originator and beneficiary information must be obtained, held and transmitted along with a transfer of funds, so that the information travels with the payment through the chain of intermediaries. It originated in the United States under the Bank Secrecy Act (31 CFR 1010.410(f)) in 1996 with a USD 3,000 threshold for funds transfers, and FATF extended the concept globally through Recommendation 16. In 2019 FATF applied it explicitly to virtual asset transfers between VASPs (and between VASPs and traditional financial institutions).

3. How the Travel Rule Works for Virtual Assets

Threshold: FATF sets a de minimis threshold of USD/EUR 1,000 for VA transfers, below which reduced information may apply (but countries can set lower thresholds or none). The United States applies its existing USD 3,000 Travel Rule to convertible virtual currency transfers by money services businesses. The European Union's Transfer of Funds Regulation (recast alongside MiCA) applies the rule to crypto-asset transfers with no minimum threshold. Always check which regime a question is referring to.

Information that must travel (FATF Interpretive Note to Recommendation 15):
Originator (sender) information:
- Name
- Account number or wallet address used to process the transaction
- Physical (geographical) address, or national identity number, or customer identification number that uniquely identifies the originator to the ordering institution, or date and place of birth
Beneficiary (receiver) information:
- Name
- Account number or wallet address

Obligations of the ordering (originating) VASP: Obtain and hold the required and accurate originator information, obtain and hold the required beneficiary information, submit this information to the beneficiary VASP (or financial institution) immediately and securely, and make it available on request to competent authorities. The information does not have to be attached directly to the blockchain transaction; it may be transmitted through a separate secure messaging channel, but it must be sent immediately, meaning before or simultaneously with the transfer.

Obligations of the beneficiary VASP: Obtain and hold the required originator information and the required and accurate beneficiary information, verify the beneficiary's identity where it has not already done so, monitor for missing or incomplete information, and have risk-based policies for deciding whether to execute, reject, suspend or return a transfer and whether to file a suspicious activity/transaction report.

Both parties must screen the names of originators and beneficiaries against sanctions lists and must conduct counterparty VASP due diligence: identifying who the other VASP is, whether it is licensed or registered, in which jurisdiction it operates, and whether it has adequate AML/CFT controls. FATF emphasises that a VASP should not send customer data to an unknown or unregulated counterparty.

Record retention: Travel Rule data must be retained for at least five years, consistent with Recommendation 11.

Technology solutions: Because blockchains were not designed to carry personal data, the industry has developed messaging protocols and compliance networks (for example TRISA, OpenVASP, the Travel Rule Protocol, IVMS 101 as a common data standard, and commercial providers such as Notabene, Sygna Bridge, CipherTrace Traveler and Shyft). The exam does not require memorising vendors, but you should understand that interoperability between solutions remains a challenge.

4. Practical Challenges and Risk Issues

The sunrise issue: Jurisdictions have implemented the Travel Rule at different times, so a compliant VASP in one country may need to send a transfer to a VASP in a country where there is no obligation (or capability) to receive the data. Firms must decide, on a risk basis, whether to proceed, restrict or decline such transfers.

Unhosted wallets: FATF does not require VASPs to apply the full Travel Rule to transfers with unhosted wallets, but it does expect VASPs to collect originator/beneficiary information from their own customer, treat such transfers as higher risk, and consider additional measures such as proof of wallet ownership. Some jurisdictions (for example the EU) require verification of ownership above certain thresholds.

Counterparty identification: A wallet address alone does not reveal whether it belongs to a VASP, a private individual or an illicit actor. Blockchain analytics tools are used to attribute addresses and assess risk exposure (for example to darknet markets, mixers, sanctioned entities or ransomware wallets).

Obfuscation techniques: Mixers and tumblers (such as the OFAC-sanctioned Tornado Cash and Blender.io), privacy coins (Monero, Zcash, Dash), chain hopping (rapidly converting between different VAs), peel chains, use of decentralised exchanges and cross-chain bridges, and peer-to-peer trading all hinder traceability.

Sanctions: OFAC has added specific VA wallet addresses to the SDN list and designated entire exchanges (for example Garantex, SUEX, Chatex) and mixing services. VASPs and financial institutions must screen addresses as well as names.

Data protection: Transmitting personal information cross-border raises privacy and data-protection compliance issues (GDPR and similar laws), which must be reconciled with AML obligations.

5. Red Flag Indicators (FATF 2020 Virtual Assets Red Flags Report)

Transaction patterns:
- Structuring VA transactions just below record-keeping or reporting thresholds
- Multiple high-value transactions in short succession or at staggered, regular intervals
- Depositing funds and immediately withdrawing or transferring them to a different VASP with no business rationale
- Converting fiat to VA and then to several other VAs in rapid succession (chain hopping) with fees that make no economic sense
- Large initial deposit inconsistent with the customer's profile followed by a full transfer out

Anonymity-related:
- Use of mixers, tumblers, privacy coins or privacy-enhancing protocols
- Transactions originating from or going to darknet markets, gambling sites or unlicensed exchanges
- Frequent use of VA kiosks (ATMs) or P2P platforms, especially in high-risk areas
- Use of VPNs, TOR, or IP addresses that do not match the customer's claimed location

Customer behaviour and source of funds:
- Incomplete or forged KYC documents, reluctance to provide information, or multiple accounts under different names from the same IP or device
- Customer who is elderly or inexperienced suddenly transacting large VA amounts (possible scam victim or money mule)
- Funds traceable to ransomware payments, investment or romance scams, or sanctioned jurisdictions
- Transfers to or from wallets associated with known illicit activity according to blockchain analytics

Geographic:
- Counterparty VASPs located in jurisdictions with weak or no VA regulation
- Transfers to or from countries subject to sanctions or on the FATF grey or black lists

6. Controls Expected of a VASP (and of Banks That Serve VASPs)

- Licensing or registration with the relevant authority (for example FinCEN registration as an MSB in the US)
- A risk-based AML/CFT programme with a designated compliance officer, independent testing and training
- Customer due diligence and enhanced due diligence, including source-of-funds and source-of-wealth checks for higher-risk customers
- Transaction monitoring that incorporates on-chain analytics as well as fiat activity
- Sanctions screening of names and wallet addresses
- Travel Rule data collection, transmission, receipt and reconciliation
- Suspicious activity reporting and record retention
- Counterparty VASP due diligence

Banks providing accounts to VASPs should treat them as a higher-risk customer category, understand the VASP's licensing status, business model and AML programme, and monitor for commingling of customer and operating funds, unusual fiat flows and nested or unlicensed exchange activity.

7. Exam Tips: Answering Questions on Virtual Asset Service Providers and the Travel Rule

Tip 1 - Anchor yourself in the FATF framework. The CAMS exam is globally oriented. When a question refers to VASPs, think FATF Recommendation 15 (VAs and VASPs must be regulated and supervised) and Recommendation 16 (Travel Rule). Know the five VASP activities by heart; a question may describe a business and ask whether it is a VASP. If the business performs one of the five functions as a business for others, the answer is yes, regardless of what it calls itself.

Tip 2 - Memorise the thresholds and know whose rule applies. FATF: USD/EUR 1,000 for VA transfers. US BSA Travel Rule: USD 3,000 for funds transfers including convertible virtual currency. EU: no threshold for crypto-asset transfers. If a question says FATF, answer 1,000. If it says US Bank Secrecy Act, answer 3,000.

Tip 3 - Know exactly what information must travel. Originator: name, wallet address or account number, plus one of physical address / national ID number / customer ID number / date and place of birth. Beneficiary: name and wallet address or account number. A common distractor lists information that is not required (for example the beneficiary's address or purpose of payment) or omits the originator's identifier.

Tip 4 - Remember that both VASPs have duties. Candidates often assume only the sending VASP is obligated. The beneficiary VASP must receive, hold and check the information, verify its own customer, and decide on a risk basis whether to accept, reject or return a transfer lacking required data. If a question asks what the receiving VASP should do when information is missing, the best answer involves risk-based follow-up and consideration of a suspicious transaction report, not automatic processing and not automatic rejection without analysis.

Tip 5 - Understand unhosted wallets and the sunrise issue. If a scenario involves a transfer to a self-hosted wallet, the correct answer typically involves collecting information from the VASP's own customer, treating the transfer as higher risk and applying risk-based enhanced measures, rather than applying the full counterparty Travel Rule (there is no counterparty VASP). If the scenario involves a counterparty in a jurisdiction that has not implemented the rule, the answer should reflect a documented risk-based decision and counterparty due diligence.

Tip 6 - Distinguish virtual assets from other digital value. E-money, CBDCs and online bank balances are digital representations of fiat and are not virtual assets under FATF. Securities tokens are covered by securities rules. Questions may test this boundary.

Tip 7 - Apply the risk-based approach and avoid absolutes. CAMS answers that say a VASP must never deal with unhosted wallets, must always reject transfers from a particular country, or should treat all crypto customers identically are almost always wrong. FATF explicitly permits a risk-based approach; the best answer is usually the one that assesses risk, documents the decision, applies proportionate controls and escalates where appropriate.

Tip 8 - Recognise red flags in scenarios. Look for rapid movement of funds through multiple VAs or VASPs, use of mixers or privacy coins, structuring below 1,000 or 3,000, IP/location mismatches, inconsistency between customer profile and transaction size, and links to darknet, ransomware or sanctioned addresses. When asked for the most suspicious indicator, prefer the one that shows deliberate obfuscation or a known illicit nexus over one that is merely unusual.

Tip 9 - Sanctions apply to wallet addresses. If a question involves a transfer to an address listed by OFAC or an exchange designated for facilitating ransomware or sanctions evasion, the correct response is to block or reject as required by the sanctions regime and report, not merely to file a SAR and continue.

Tip 10 - Know the compliance officer's correct sequence of actions. When a scenario describes suspicious VA activity, the expected order is usually: escalate internally, conduct enhanced review (including blockchain analytics), document findings, file a suspicious activity report with the FIU within the required timeframe, do not tip off the customer, and consider whether to restrict or exit the relationship. Answers that involve confronting the customer, informing the counterparty VASP of the investigation, or taking no action because the amount is below threshold are distractors.

Tip 11 - Read for the role in the question. Questions may place you as a compliance officer at a VASP, at a bank that banks a VASP, or at a regulator. The expected answer changes: a bank should perform enhanced due diligence on the VASP as a higher-risk customer; a VASP must implement the full programme including the Travel Rule; a supervisor focuses on licensing, registration and risk-based supervision.

Tip 12 - Use elimination. Discard answers that (a) misstate thresholds, (b) ignore the beneficiary VASP's duties, (c) treat unhosted wallets as prohibited or as carrying no obligations, (d) suggest the Travel Rule data must be written onto the blockchain itself, or (e) rely on anonymity as a legitimate justification for not collecting information. What remains is usually the correct, risk-based, FATF-aligned answer.

8. Quick Revision Summary

- FATF Recommendation 15: VAs and VASPs must be regulated, licensed or registered and supervised for AML/CFT.
- FATF Recommendation 16: Travel Rule; applied to VA transfers in 2019 with a 1,000 USD/EUR threshold.
- US Travel Rule threshold: USD 3,000; EU: no threshold.
- Five VASP activities: VA-to-fiat exchange, VA-to-VA exchange, transfer, safekeeping/administration, issuance-related services.
- Originator data: name, address/ID number/customer number/DOB and place of birth, wallet address. Beneficiary data: name, wallet address.
- Ordering VASP sends immediately and securely; beneficiary VASP receives, checks and acts on a risk basis; both screen sanctions and perform counterparty due diligence; retain records five years.
- Key challenges: sunrise issue, unhosted wallets, interoperability, mixers and privacy coins, DeFi, data protection.
- Red flags: structuring, chain hopping, mixers, IP mismatches, darknet/ransomware links, profile inconsistency, high-risk jurisdictions.
- Exam mindset: FATF definitions, correct thresholds, both-party obligations, risk-based approach, no absolutes, escalate and report without tipping off.