If you try to move crypto from a European exchange to a wallet you control and the exchange asks who owns the address, or asks you to prove it, you are meeting the "Travel Rule". Since 30 December 2024 it has been written into EU law as Regulation (EU) 2023/1113, and the European Banking Authority has published detailed guidelines on how exchanges should apply it. This guide sets out, from the text of the regulation and the guidelines, what is required, what is not, how ownership checks work in practice, and how to avoid a held or returned transfer.
Scope note: this is general information based on the primary texts listed at the end, not legal advice. National supervisors and individual exchanges can apply the rules differently within what the regulation allows, so your exchange's own terms and help pages come first for your account. We describe what the rules say, not what any particular exchange does.
The short answer
- The rule: Regulation (EU) 2023/1113 requires crypto-asset service providers (CASPs) to send information about the sender and the recipient with every crypto transfer, and to collect that information when a transfer involves a wallet that is not held at a CASP. It applies from 30 December 2024.
- Your own wallet is called a "self-hosted address": a ledger address not linked to a CASP or to a similar provider outside the EU (Article 3(20)).
- At any amount, your exchange must obtain and hold the sender and recipient information for a transfer to or from your own wallet, and be able to identify that transfer individually (Articles 14(5) and 16(2)).
- Above EUR 1,000, the exchange must in addition take adequate measures to assess whether the address is owned or controlled by you (same articles). This is where message-signing requests and small test transfers come from.
- What is not covered: a person-to-person transfer carried out without any CASP involved (Article 2(4)).
- What can go wrong: an exchange may not execute a transfer before it complies (Article 14(8)), and an exchange that receives a transfer with missing information must decide, on a risk basis, whether to execute, reject, return or suspend it (Article 17).
Where the rule comes from
The "Travel Rule" is the name for a standard, first applied to bank transfers, that information about the sender and recipient should "travel" with the money. Regulation (EU) 2023/1113, adopted on 31 May 2023, extends it to crypto-assets and recasts the older rules for transfers of funds. Article 40 states that it "shall apply from 30 December 2024".
Article 2(1) sets the geographic scope: the Regulation applies to transfers of crypto-assets, including transfers executed by means of crypto-ATMs, where the CASP, or the intermediary CASP, of either the sender (the "originator") or the recipient (the "beneficiary") has its registered office in the Union. That has a practical consequence for readers outside the EU too: if you use a non-EU exchange to send to or receive from an EU exchange, the EU exchange is covered.
The European Banking Authority (EBA) then issued Guidelines EBA/GL/2024/11, the "Travel Rule Guidelines", which also apply from 30 December 2024. According to Finland's financial supervisor, which published them, they specify what information should accompany a transfer, set out the policies exchanges need for handling missing information, and "provide guidance on measures to identify and assess money laundering and terrorist financing risks regarding transfers of crypto-assets to or from a self-hosted address". They replace the supervisors' earlier joint guidelines from 2017. Under the EBA's founding regulation, financial institutions "shall make every effort to comply" with such guidelines. In practice, the guidelines explain much of what you experience at the withdrawal screen.
What information travels with a transfer
Article 14 lists the data the sender's exchange must attach, or send separately in a secure way, in advance of or at the same time as the transfer. The information does not need to be written into the blockchain transaction itself.
| About | Information required (Article 14(1) and (2)) |
|---|---|
| The sender (originator) | Name; the sender's ledger address (and the account number at the exchange where one exists); address of residence including country, official personal document number and customer identification number, or alternatively date and place of birth; the legal entity identifier where available and provided |
| The recipient (beneficiary) | Name; the recipient's ledger address (and the account number where one exists and is used); the legal entity identifier where available and provided |
Before sending, the sender's exchange must verify the accuracy of the sender information from a reliable and independent source (Article 14(6)). That requirement is deemed met where you were already identified when you opened your account under the EU anti-money laundering directive (Article 14(7)). The exchange also "shall not allow for the initiation, or execute any transfer" before it has complied (Article 14(8)). The data must be submitted "in a secure manner and in accordance with Regulation (EU) 2016/679", the GDPR (Article 14(4)).
Your own wallet: what the regulation says
Article 3(20) defines a self-hosted address as "a distributed ledger address not linked to either of the following: (a) a crypto-asset service provider; (b) an entity not established in the Union and providing services similar to those of a crypto-asset service provider". A hardware wallet, a software wallet you control and a paper wallet all fit. An address at another exchange does not.
For transfers from your exchange to your own wallet, Article 14(5) says the exchange "shall obtain and hold" the sender and recipient information "and shall ensure that the transfer of crypto-assets can be individually identified". It then adds: "in the case of a transfer of an amount exceeding EUR 1 000 to a self-hosted address, the crypto-asset service provider of the originator shall take adequate measures to assess whether that address is owned or controlled by the originator."
For transfers the other way, Article 16(2) mirrors it: the receiving exchange must obtain and hold the information, and for an amount exceeding EUR 1,000 "from a self-hosted address" it must take adequate measures to assess whether you own or control the address. Both articles are "without prejudice to specific risk mitigating measures" taken under the anti-money laundering directive.
How the EUR 1,000 line is measured
The EBA guidelines (paragraphs 81 and 82) say the exchange should check whether the transfer amounts to or exceeds EUR 1,000 at the moment the transfer was ordered, for the sending exchange, or at the time of receipt, for the receiving one. The value is the euro value of the crypto-asset at the time of the transfer, "regardless of any transaction fees". So the threshold is about the value of what moves, converted at that moment, which means the same quantity of coins can be under the line one day and over it another.
Two readings are worth keeping apart. Below the line, the exchange still collects the information and keeps the transfer individually identifiable. Above the line, the ownership assessment is added. One wording difference to note: the regulation says "exceeding EUR 1 000", while the EBA guideline speaks of transfers that amount to or exceed it, so an exchange may apply its checks from exactly EUR 1,000.
How exchanges check that you own the address
The regulation says "adequate measures" without defining them. The EBA guidelines (paragraph 83) fill the gap. An exchange "should use at least one" of the following:
- Unattended verification of the kind described in the EBA's remote customer onboarding guidelines, with the address displayed.
- Attended verification under the same guidelines.
- A predefined amount sent from and to the self-hosted address to the exchange's account, "preferably the smallest denomination" of the asset, set by the exchange.
- A digitally signed message: "requesting the customer to digitally sign a specific message into the account and wallet software with the key corresponding to that address".
- Other suitable technical means that allow a reliable and secure assessment and leave the exchange "fully satisfied that it knows who owns or controls the address".
The guidelines say the choice should depend on the technical capabilities of the address, the robustness of each method and the money laundering risk (paragraph 84). Where one method is not reliable enough alone, the exchange should combine methods (paragraph 85). That is why an exchange may ask for more than one thing, for example both a signed message and a short video check.
Whitelisting
Paragraph 86 explains the idea behind the "add this address to your withdrawal whitelist" step. Once an exchange is fully satisfied that the address is yours, it should document this and "may not need to re-apply the measures above to subsequent transactions" involving the same address. The exchange should, however, keep controls to notice if the risk of the address or its ownership changes, and should remove the address from the whitelist if there are indications you no longer control it. Doing the verification once, calmly, is usually better than doing it for every large withdrawal.
If the wallet belongs to someone else
Sometimes the address is controlled by a third party, for example a relative's wallet or a company wallet. Paragraph 89 says the exchange can still treat the verification as done if it collects additional data from reliable and independent sources, such as blockchain analytics, third-party data and public information, or uses other suitable means so that it knows the identity of the sender or recipient and can show that to its supervisor. Expect more questions, and expect that some exchanges may decline such transfers under their own policy. Nothing we read obliges an exchange to accept them.
What is not covered
Article 2(4) lists two exclusions for crypto-asset transfers: where "both the originator and the beneficiary are crypto-asset service providers acting on their own behalf", and where the transfer "constitutes a person-to-person transfer of crypto-assets carried out without the involvement of a crypto-asset service provider". The second is the situation where you send coins from one self-hosted wallet to another with no exchange at either end. The Travel Rule as written does not reach it.
We want to be careful about what follows from that. It does not mean transfers between self-custody wallets are free of other rules, or that exchanges cannot ask about your funds' history under their own anti-money laundering duties. It only means this specific regulation's data requirements do not apply to a pure wallet-to-wallet transfer.
Why a withdrawal or deposit gets held, returned or rejected
Four provisions explain most of what readers describe as "my transfer is stuck".
1. The sending exchange cannot send yet. Article 14(8): it "shall not allow for the initiation, or execute any transfer" before ensuring full compliance. If your declaration is incomplete, or the ownership check is pending, the withdrawal waits.
2. The receiving exchange finds information missing. Article 17(1) requires "effective risk-based procedures" for determining whether to execute, reject, return or suspend a transfer lacking the required information, and, where information is missing or incomplete, to act "on a risk-sensitive basis and without undue delay". A deposit from an address you have not declared can therefore be returned or held.
3. Missing information raises the suspicion score. Article 18 tells the receiving exchange to treat missing or incomplete information as a factor when assessing whether a transfer or related transaction is suspicious and should be reported to the national financial intelligence unit. Repeated failures by another exchange to provide the information can lead the receiving exchange to restrict or end its relationship with that exchange and to report the failure to its supervisor (Article 17(2)).
4. The risk assessment flags the address. The EBA guidelines (paragraph 88) say exchanges should apply at least one risk-mitigating measure where, for example, they become aware that the information about the person behind a self-hosted address is inaccurate, or find unusual or suspicious transaction patterns. The guidelines say exchanges rely on "technical means including but not limited to blockchain analytics" to identify what is at the other end of a transfer (paragraph 77). In our reading, an address that analytics tools flag as risky can therefore draw extra questions.
None of these provisions says that a transfer must be refused whenever the wallet is self-hosted. They say the exchange must be able to identify the transfer, hold the information, and, above the threshold, satisfy itself about ownership.
A practical sequence
- Read your exchange's withdrawal and wallet-verification page first. It will say which of the EBA methods it uses. We cannot tell you that from the regulation.
- Verify and whitelist before you need to move a large amount. A first verification during a market move is the worst time to discover your wallet does not support the method the exchange wants.
- Use an address you control and can sign with. Many wallet apps and hardware wallets can sign an arbitrary message with the key behind a single address. If yours cannot, ask the exchange which other method it accepts. The guidelines list several.
- Sign only what the exchange's own interface presents. A "message" signature proves you control the key and does not reveal it. Signing a transaction is a different act that moves funds. Check what your wallet displays before approving anything. If a page or a person outside the official app asks you to "verify your wallet" by entering a seed phrase, that is a scam: no verification method in the guidelines requires it.
- For the test-transfer method, send exactly what the exchange asks, from the address you are declaring, and keep the transaction ID. The point of the method is that the transfer comes from the address in question.
- Declare the owner honestly. If the address belongs to someone else, say so. A false declaration can cost you the account, and the guidelines expect the exchange to cross-check where it can.
- For deposits from your own wallet to the exchange, declare the origin address in advance if the exchange allows it, and expect the same questions above EUR 1,000.
- Keep records. If a transfer is returned or suspended, the exchange's support will ask for the declaration, the verification and the transaction hash. Our guides to hardware wallets and to multisig setups cover how to keep wallets you can prove control of.
One practical note, which is our observation and not something the regulation says: wallets that use several keys, such as multisig, may not fit every exchange's message-signing flow. In that case the test-transfer method or another method the exchange accepts is the way to proceed, and it is worth asking before you set up a new wallet for exchange withdrawals.
Privacy: what the exchange will know, and what you can do about it
The Travel Rule changes what the exchange holds about you and your wallets. It collects your identity data, your address and the address of the counterparty, and it keeps that information, which links your identity to those addresses. Article 14(4) requires the data to be handled in accordance with the GDPR, which gives you rights of access and information about processing. Your exchange's privacy notice should say how long the data is kept. The anti-money laundering framework, separately, sets retention periods that the exchange must follow.
Where the data goes is the limit of what we can state from the sources. The regulation requires transmission between exchanges in a secure manner. It does not describe a central database. How exchanges exchange this data technically, through messaging protocols and providers, is a matter of their systems and not of the regulation. If you want to understand where your information goes, the privacy notice and a GDPR access request are the proper tools.
How the EU compares with the UK and the US
The Travel Rule is a global standard, but the rules differ. Our review was limited to primary sources we could read, so this section is deliberately short.
| Jurisdiction | What the primary source says | What we did not verify |
|---|---|---|
| European Union | Regulation (EU) 2023/1113 applies from 30 December 2024. Information on all crypto transfers; ownership assessment for self-hosted addresses above EUR 1,000. | How each national supervisor and exchange applies it |
| United Kingdom | The FCA says that from 1 September 2023 cryptoasset businesses must collect, verify and share information about cryptoasset transfers under Part 7A of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017. Industry guidance is published by the JMLSG. | The UK treatment of transfers involving wallets not held at a business, and any thresholds |
| United States | The federal travel rule text in 31 CFR 1010.410(f) sets a threshold of $3,000 for transmittal orders by financial institutions located in the United States. | How it applies to crypto platforms in detail, and the status of a separate proposal on unhosted wallets |
If you live in the UK or the US, treat the table as a pointer to where to read, not a full answer. For the broader EU regulatory picture, including who may offer crypto services, see our MiCA compliance guide. The same data that exchanges now collect under the Travel Rule is also relevant to tax reporting, which we cover in our DAC8 guide.
What we could not verify
- How individual exchanges implement the checks. The regulation and the guidelines set the floor and allow choices.
- The text of national supervisors' additional guidance, if any.
- The exact current UK treatment of transfers to unhosted wallets, and the current status of US proposals on unhosted wallets.
- Whether transfers below EUR 1,000 that are linked or repeated are treated as a single transfer by a given exchange. The regulation's text for funds mentions linked transactions, and exchanges have their own anti-structuring controls, but we did not find a rule in the crypto articles that settles it.
- The EUR-Lex page for the regulation could not be loaded by our tools. We read the official text as published by the EU Publications Office and the EBA guidelines as published by the Finnish supervisor.
Frequently asked questions
Is the Travel Rule a ban on withdrawing to my own wallet?
No. The regulation requires the exchange to collect and hold information and, above EUR 1,000, to assess whether you own or control the address. It does not prohibit transfers to self-hosted wallets.
Does it apply to amounts below EUR 1,000?
The exchange must still obtain and hold the sender and recipient information and be able to identify the transfer individually. The ownership assessment is required above EUR 1,000.
How can I prove I own a wallet?
The EBA guidelines list unattended and attended verification, sending a predefined small amount from the address, signing a specific message with the key of that address, or other suitable technical means. The exchange chooses at least one.
Does it cover transfers from one of my wallets to another?
Not if no exchange is involved. Article 2(4) excludes person-to-person transfers carried out without a crypto-asset service provider.
Why was my deposit returned?
The receiving exchange must decide on a risk basis whether to execute, reject, return or suspend a transfer lacking the required information (Article 17). Declare the origin address and owner in advance where your exchange allows it, and ask support what it needs.
Will I need to give my seed phrase?
No. None of the verification methods in the guidelines involves handing over a seed phrase or private key. A request for one is a scam.
Sources
- Regulation (EU) 2023/1113 of 31 May 2023 on information accompanying transfers of funds and certain crypto-assets (recast), Official Journal L 150, 9.6.2023, EUR-Lex: Articles 2, 3(20), 14 to 18, 40.
- European Banking Authority, Guidelines EBA/GL/2024/11 on information requirements in relation to transfers of funds and certain crypto-assets transfers under Regulation (EU) 2023/1113 (Travel Rule Guidelines), sections 4.8.1 to 4.8.5, paragraphs 76 to 90; published by the Finnish Financial Supervisory Authority as a PDF with its release of 28 November 2024.
- Financial Conduct Authority, FCA sets out expectations for UK cryptoasset businesses complying with the Travel Rule.
- Electronic Code of Federal Regulations, 31 CFR 1010.410.
Limits of our research: quotations from the regulation come from the official text as published by the EU Publications Office, since the EUR-Lex page was not reachable by our tools. We did not review national supervisors' guidance or exchange-specific procedures. This guide is general information and not legal advice.