FATF Travel Rule for Crypto VASPs: US Compliance Guide 2026

The United States has applied a version of the Financial Action Task Force (FATF) Travel Rule to financial institutions since 1996, long before cryptocurrencies existed. In 2019, the Financial Crimes Enforcement Network (FinCEN) confirmed that the Bank Secrecy Act (BSA) Travel Rule applies to convertible virtual currencies (CVCs) and Virtual Asset Service Providers (VASPs). The US framework differs significantly from the EU's Regulation (EU) 2023/1113: the US threshold is $3,000 (not zero), registration is with FinCEN as a Money Services Business (MSB), and there is no unified federal crypto licensing framework comparable to MiCA. This guide details what US-based crypto businesses must do to comply in 2026.

This article is provided for informational purposes only and does not constitute legal, financial, or regulatory advice. Regulatory references are accurate as of the publication date. Consult a qualified professional for advice specific to your situation.

The US Travel Rule: BSA Framework for Crypto

The US Travel Rule is established under 31 CFR § 1010.410(f), which requires banks and other financial institutions to collect and transmit specific information about wire transfers above $3,000. FinCEN Guidance FIN-2019-G001 (May 2019) and FIN-2020-R001 (December 2020) confirm that this rule applies to convertible virtual currency businesses.

As of 2026, FinCEN's Travel Rule threshold for crypto transactions is $3,000 — three times higher than the EU's zero threshold for inter-CASP transfers and three times higher than the FATF baseline of $1,000. This difference creates compliance complexity for US firms serving EU customers or receiving transfers from EU-based CASPs.

Data Required Under the US Travel Rule

For crypto transactions at or above $3,000, the transmitting financial institution (including crypto exchange or VASP) must collect and transmit:

FinCEN Registration as an MSB

Any US-based business that exchanges, transfers, or provides administration of convertible virtual currency must register with FinCEN as a Money Services Business (MSB) under 31 CFR § 1022.380. This registration is a federal requirement separate from — and in addition to — state-level money transmitter licenses (MTLs). As of 2026, 48 states plus Washington DC require a state MTL for crypto businesses serving residents of that state, creating a complex multi-license patchwork that has no equivalent in the EU's MiCA single-passport framework.

US Regulatory Framework: FinCEN, OFAC, and State Regulators

FinCEN's AML/KYC Requirements

Under the BSA's anti-money laundering program requirements (31 CFR § 1022.210), every registered MSB dealing in crypto must maintain a written AML program that includes:

• Customer Identification Program (CIP) — collecting and verifying customer identity
• Suspicious Activity Report (SAR) filing for transactions above $2,000 (or any amount if suspicious)
• Currency Transaction Report (CTR) for cash transactions above $10,000
• Record retention for five years

FinCEN issued a Notice of Proposed Rulemaking (NPRM) in December 2020 to expand Travel Rule obligations to include an AML program requirement explicitly for crypto VASPs, with a proposed threshold reduction from $3,000 to $250 for international transfers. As of mid-2026, the final rule has not been published, but FinCEN examiners are increasingly applying the $3,000 threshold strictly.

OFAC Sanctions Screening

The Office of Foreign Assets Control (OFAC) administers economic sanctions programs that apply to all US persons and entities — including crypto businesses. Every VASP must screen customers and transactions against OFAC's Specially Designated Nationals (SDN) list and country-based sanctions programs (e.g., Russia, Iran, North Korea, Cuba).

OFAC's 2021 sanctions guidance on digital currency made clear that US VASPs must implement real-time sanctions screening of wallet addresses, using blockchain analytics tools to identify addresses associated with sanctioned entities. Failure to block a sanctioned transaction can result in civil penalties even if the VASP did not know about the sanctions connection (strict liability standard).

Corporate Transparency Act (CTA 2021)

The Corporate Transparency Act (CTA), effective January 1, 2024, requires most US companies (including crypto businesses) to report beneficial ownership information to FinCEN. Beneficial owners are individuals who own 25% or more of the company or exercise substantial control. This information feeds into FinCEN's beneficial ownership database, which VASPs may access in the future for enhanced due diligence purposes.

KYC Document Requirements for US Crypto VASPs

Documents for Individual Customers

Under FinCEN's CIP rules (31 CFR § 1020.220), VASPs must collect and verify:

• US passport or driver's license / state-issued ID — the two primary acceptable documents
• Social Security Number (SSN) or Individual Taxpayer Identification Number (ITIN)
• Date of birth and physical address
• For enhanced due diligence (EDD): proof of address (utility bill, bank statement) and source of funds documentation

Documents for Business Customers

For legal entities, VASPs must collect:

• Articles of Incorporation or equivalent state formation document
• Employer Identification Number (EIN) from the IRS
• Certificate of Good Standing from the state of incorporation (typically through the Secretary of State)
• Ultimate Beneficial Owner (UBO) information per the CTA — identity documents for all individuals owning 25%+
• Operating agreement and/or bylaws

CheckFile processes over 3,200 document types across 32 jurisdictions with 24-language OCR support, enabling US compliance teams to handle cross-border verification — from US passports to international ID documents — within a single KYC workflow.

Unhosted Wallets: FinCEN's Proposed Approach

Unlike the EU's explicit rule under Regulation (EU) 2023/1113, the US has not finalized rules on unhosted wallet verification. FinCEN's December 2020 proposed rulemaking would require VASPs to collect counterparty information for unhosted wallet transfers above $3,000 and to verify the identity of the counterparty for transfers above $10,000 — thresholds that differ significantly from the EU's €1,000 verification requirement.

Until the final rule is published, US VASPs apply a risk-based approach: higher-value transfers to or from unhosted wallets receive enhanced scrutiny, including collection of a customer certification about wallet ownership.

Travel Rule Messaging: US Market Challenges

The US crypto market has been slower to adopt standardized Travel Rule messaging protocols than the EU, partly because the $3,000 threshold means fewer transactions are technically in scope. However, US VASPs transacting with EU CASPs must comply with the EU's zero threshold on the EU side:

Compliance Checklist for US Crypto Businesses

• Register with FinCEN as an MSB at fincen.gov
• Obtain required state money transmitter licenses (MTLs) for each state of operation
• Implement a written BSA/AML program with Travel Rule procedures
• Collect and verify required data for all transactions at or above $3,000
• Screen all customers and transactions against OFAC SDN and consolidated sanctions lists
• File SARs within 30 days of detecting suspicious activity (60 days if no suspect identified)
• File CTA beneficial ownership reports with FinCEN for all covered corporate entities
• Retain all records for five years per BSA requirements

For additional context on the global AML framework, see our guide to FATF high-risk countries and transaction monitoring red flags.

Frequently Asked Questions

Is the US Travel Rule threshold really $3,000 — not $1,000 like FATF recommends?

Yes. The US Travel Rule threshold under 31 CFR § 1010.410(f) is $3,000 for all financial institutions, including crypto VASPs. The FATF baseline recommendation is $1,000. FinCEN has proposed reducing the international crypto threshold to $250, but that rule is not yet final as of mid-2026.

Do US VASPs need to comply with the EU Travel Rule (TFR 2023/1113)?

US VASPs that operate in the EU — or that transfer crypto to/from EU-based CASPs — may face EU Travel Rule compliance requirements through their EU counterparties. An EU CASP receiving a transfer from a US VASP will apply the EU zero threshold and require compliant Travel Rule data. US VASPs should work with EU counterparties to establish bilateral data-sharing workflows.

What is the penalty for violating the Travel Rule as a crypto business?

FinCEN can impose civil money penalties of up to $1 million per day for willful BSA violations, and up to $10,000 per day for negligent violations. Criminal penalties under 31 U.S.C. § 5322 include fines and imprisonment of up to 10 years for willful violations.

Does OFAC screening apply to DeFi platforms?

Yes, if a US person controls or operates a DeFi platform, OFAC's sanctions obligations apply. OFAC has sanctioned specific smart contract addresses, including Tornado Cash in 2022. US VASPs that interact with sanctioned addresses — even unknowingly — face strict liability for sanctions violations.

Does the CTA (Corporate Transparency Act) affect crypto trading companies?

Yes. Most US crypto businesses structured as LLCs, corporations, or limited partnerships must file beneficial ownership information with FinCEN under the CTA, unless they qualify for an exemption (e.g., SEC-registered entities or companies with more than 20 full-time employees and $5M+ in gross receipts).