EU Travel Rule Compliance: TRUST, Notabene, Sumsub, 21 Analytics, Open Protocols or an In-House Build
Since 30 December 2024, an EU provider has had to send sender and recipient data with every crypto transfer it makes for a customer to another provider, at any amount, in a form that provider can read. Each option below, from Coinbase-led TRUST to a build on an open protocol, is scored on reach and data security, two of the European Banking Authority's (EBA) selection criteria, and on wallet checks, deployment, the DORA register entry, named EU users, governance and price.
Reviewed by Luis Medeiros, Field CTO at Protofire · Updated October 2026
The EU Travel Rule, set by the Transfer of Funds Regulation (EU) 2023/1113, requires a crypto-asset service provider (CASP) to send originator (sender) and beneficiary (recipient) data with every crypto transfer it makes for a customer to another provider, at any amount. Above EUR 1,000, it also checks that a self-hosted wallet (one no provider holds) is the customer's own. No network reaches every counterparty. TRUST, led by Coinbase, is the data-exchange network four active EU CASPs name, tied for the most here. Notabene and Sumsub are hosted, 21 Analytics runs on your servers, and TRP and TRISA are open protocols. GTR places 51 of its 116 members in EU states as of 18 October 2026; VerifyVASP and CODE mainly reach Asian venues. An in-house build reaches only what you implement and join.
Every route below, apart from manual web modes for low volumes, needs code linking a CASP's withdrawal and deposit flows to its provider or protocol; Protofire builds that code, and the in-house build, last below, takes far more of it than any vendor route. 21 Analytics' on-premise software or Notabene's customer-operated SafeGateway would remove most of that build. Protofire is an onchain engineering firm founded in 2016 that runs no Travel Rule network, has no license to provide financial services and gives no legal advice here. Most routes also need a DORA register entry, in our reading, as the scorecard shows, which our DORA third-party risk guide covers. How we counted: a named EU user is a firm on ESMA's interim MiCA register (read 18 October 2026) whose own page or release, or a vendor case study, names the route. Notabene's four are mostly wallet checks, firms only on GTR's, VerifyVASP's or TRISA's own lists are marked as such, and network sizes are the operators' own figures, except TRUST's, which comes from 21 Analytics.
Reach, data security, wallet checks, users and price: where do the eight routes differ?
8 options side by side: scroll the table sideways to see all of them.
How does each network, vendor or build carry Travel Rule data?
TRUST
- +Named as the data-exchange network in the help pages or releases of four active EU CASPs: Kraken, Revolut, SwissBorg and Safello
- +Coinbase says there is no central store: data goes member to member over end-to-end encrypted channels, after the receiving member proves it owns the deposit address
- +Per Coinbase, operating costs are split evenly among members, with a free membership option for smaller providers, and integration takes 2 to 6 weeks of engineering
- +TRUSThub, Coinbase's page says, lets members send data to, and receive it from, providers outside the network
- −Every member must pass an independent review of its data privacy and security protocols before joining
- −Coinbase's TRUST page shows member logos but no list or count; the figure in use, over 200, comes from integration partner 21 Analytics (April 2026)
- −Coinbase, itself an exchange, plays a leading role in operating the network; members review and vote on key decisions
- −Checks on self-hosted wallets are left to each member's own tooling
TRUST (Travel Rule Universal Solution Technology) is a network in which exchanges and custodians send Travel Rule data straight to each other. Coinbase's page, as archived on 29 September 2025, says "Information is sent directly from one TRUST member to another, through end-to-end encrypted channels". It adds that TRUST "never centrally stores sensitive customer information" and that the receiving exchange can "prove that it's the owner of the receiving crypto address before customer information is sent". Coinbase "plays a leading role in operating the TRUST network", while "key decisions are reviewed and voted on" by members. The network "evenly splits its operating costs among its members", offers "a free membership option for smaller VASPs" and puts integration "within 2-6 weeks of engineering time".
Four active EU CASPs name TRUST in their own words: Kraken's EU and UK transfer page (updated 6 March 2026) and Revolut's EU help page (archived 20 February 2026). SwissBorg says it "passed the Exiger audit", and the release Safello published on 17 September 2024 cites Regulation (EU) 2023/1113. The EU entities of all four are in ESMA's MiCA register. Gemini's EU and EEA page (20 July 2026) names TRUST too, but Gemini ceased operations in the EEA on 6 April 2026. Coinbase publishes no member count; 21 Analytics wrote on 23 April 2026 that the network "includes over 200 VASPs".
Coinbase's page also describes TRUSThub, which "enables TRUST members to send Travel Rule data to, and receive Travel Rule data from, non-TRUST members". Vendors plug in as well: 21 Analytics reaches TRUST from its on-premise software, and the custody platform Fireblocks signs the proof of address TRUST asks for, free and alongside any other provider. Self-hosted wallets stay with each member's own tooling: above EUR 1,000, Kraken offers a "Self-Certification", described as "a quick, one-click ownership verification with a 2FA security check", or a micro-transfer.
Notabene
- +Four EU CASPs name it in their own help pages, mostly for self-hosted wallet checks: Bitpanda in Austria, Finary in France, eToro's EU entity in Cyprus and Amdax in the Netherlands (May to October 2026)
- +A network claim of more than 2,300 connected institutions and 280+ customers (July 2026), counted in institutions where Sumsub, VerifyVASP and CODE count VASPs (virtual asset service providers)
- +Per its security page, customer-managed keys for signing and encryption, and an annual SOC 2 Type II audit covering security and privacy
- +A free tier for up to USD 10,000 of outgoing transfers a month, and a native integration in Fireblocks
- −Hosted; several data-storage regions are offered, but the security page names no EU one
- −Its ownership checks include a screenshot and a self-declaration, neither of which the EBA names in its list of methods, so the CASP's policy decides what to switch on above EUR 1,000
- −No full list of the protocols its gateway connects is published
- −On Fireblocks it cannot run alongside Sumsub or GTR in the same workspace
Notabene sells a hosted Travel Rule platform with its own network and a gateway, SafeGateway, that "builds secure clients for each Travel Rule messaging protocol" a customer is approved for. The gateway comes in three set-ups: built and operated by Notabene, built by Notabene and operated by the customer, or built and operated by the customer. The post announcing a strategic investment from Ripple on 23 July 2026 says the network "spans more than 2,300 connected institutions, 100+ global jurisdictions, and 280+ customers".
Four EU CASPs name the vendor on their own pages. eToro's Travel Rule page, modified 8 September 2026, says "Notabene is a third party application that connects with etoro". Below EUR 1,000 the customer ticks a "declaration checkbox" that the self-hosted wallet is their own, and above it signs a message. Bitpanda's wallet verification page (19 May 2026) has customers "Connect Notabene to the wallet" through WalletConnect, and Amdax's whitelisting page (5 October 2026) names notabene.id as the provider of its wallet connection. Finary's help page of 20 August 2026 sends customers to Notabene to prove ownership through WalletConnect, a Ledger signature or, as a fallback, a micro-transaction. Notabene's developer docs list signatures in schemes such as bip-137, bip-322 and eip-191 across 200+ wallets via WalletConnect, a micro-transfer, a screenshot and a self-declaration.
Notabene's security page shows an "Annual SOC 2 Type II Audit for Security and Privacy Categories by Johanson Group LLP", penetration tests by Cobalt and customer-managed keys. It says "Multiple regions for data storage are available", but names no EU region and shows no ISO 27001 certificate. The free SafeTransact-Rise tier covers up to USD 10,000 of outgoing transfers a month with unlimited incoming; larger plans are quoted on request. Fireblocks supports Notabene as a provider, and its documentation notes that Notabene "cannot run alongside Sumsub or GTR".
Sumsub
- +One vendor for KYC, transaction monitoring and the Travel Rule
- +Data hosted on AWS in Germany by default, with other countries and regions on request
- +Five messaging routes in its protocol documentation: its own protocol, TRP, GTR, CODE and Sygna Bridge, plus an email tool for counterparties on none of them
- +Certifications listed on its trust center, among them ISO/IEC 27001, 27017 and 27018, ISO 22301, ISO 9001, SOC 1 Type 1, SOC 2 Type 2 and PCI DSS
- −No TRUST, TRISA or Notabene route in its protocol documentation
- −The DORA records have to cover the eight firms in six countries behind its Travel Rule product, such as ComplyAdvantage (UK), TRM Labs (US) and GTR (Singapore), and the GDPR records six of them, since CODE (Korea) and Sygna are listed for DORA only
- −Self-declaration and screenshots are on its menu too, though its docs say 'We do not recommend these options' and keep self-declaration to 'where it is allowed by local regulations'
- −A firm that verifies customers with another KYC vendor adds Sumsub as a second platform for the Travel Rule alone
- −One EU CASP, Bitpanda, names it in its own help page, for incoming Travel Rule requests
Sumsub adds a Travel Rule product to its identity-verification and transaction-monitoring platform. Its protocol documentation covers TRP, the Sumsub protocol, GTR, CODE and Sygna Bridge plus an email notification tool; TRUST, TRISA and Notabene do not appear. Bitpanda, authorized in Austria, uses it for incoming requests: CASPs asking Bitpanda for Travel Rule data use a "secure partner platform" and "receive an email confirmation from Sumsub", according to Bitpanda's help page updated 6 August 2026.
For self-hosted wallets, Sumsub's unhosted wallet docs offer a digital signature, a micro-transfer (the Satoshi test), a self-declaration form and manual review by the compliance team. They say self-declaration "lacks strong verification and should only be used where it is allowed by local regulations", call screenshots "significantly weaker than cryptographic signature proofs" and add "We do not recommend these options".
Per its third-party processor list, Sumsub hosts data on AWS in Germany "by default", with other countries and regions "by request and if available". The list names ComplyAdvantage (UK, screening), Crystal (Netherlands), TRM Labs (US), GTR (Singapore), Reown (US), Fireblocks (UK), CODE (Korea) and Sygna (Taiwan) for the Travel Rule product, the last two listed for DORA purposes only. Sumsub's trust center lists the certifications, and its Travel Rule page counts "2,100+ VASPs in the Sumsub client directory". The Basic and Compliance plans cost USD 1.35 and 1.85 per verification, with monthly minimums of USD 149 and 299, and both list the Travel Rule as a paid feature.
21 Analytics
- +Sold as 100% on-premise, on the CASP's own infrastructure, with zero telemetry and, on the Enterprise tier, source-code escrow
- +Reaches TRUST members and TRP endpoints through one API since version 8.4.0 (9 October 2026), choosing the protocol per transfer
- +AOPP, its automated signed-message proof, plus manual signatures and micro-transfers for self-hosted wallets
- +ISO 27001:2022 certified for its own security management, per its homepage
- −The CASP's own team deploys and runs it (Docker, OpenShift or Kubernetes), upgrades included
- −No GTR, VerifyVASP, CODE or Sygna route; providers on neither TRP nor TRUST get email
- −One EU client with a published case study, Tangany (its homepage logos add firms such as BTC Direct, Finst and Bitstack)
- −Its visual proof, an upload of screenshots or videos, is not a method the EBA names, like the screenshot options of Notabene and Sumsub
21 Analytics sells 21 Travel Rule as software the CASP runs itself. Its homepage says "100% On-Premise" with "Zero telemetry", offers source-code escrow, shows an "ISO 27001:2022 Certified" information security management system and calls the firm "the leading contributor to the TRP standard". The documentation for version 8.4.0 lists TRP, TRUST and email as channels, and AOPP, signature proof, Satoshi test and visual proof for self-hosted wallets. AOPP, the Address Ownership Proof Protocol, automates the signed-message method from inside the customer's wallet. Its visual proof lets the CASP "upload multiple images or videos of a screen session" as evidence of ownership.
Version 8.4.0, released on 9 October 2026, brought "unified usage of TRP and TRUST via a single API", so the system picks the protocol for each transfer to a wallet address. The same release added ownership proofs on Optimism, Arbitrum, Avalanche and Gnosis Chain, and Solana proofs through the Phantom wallet.
Tangany, a Munich custodian authorized by BaFin, adopted it to "retain full data control, reduce DORA-related outsourcing risks" and use TRP and AOPP "without relying on closed networks", according to the vendor's case study. The case study adds that outsourcing to SaaS vendors under DORA "would require continuous oversight, including regular audits". On-premise software with updates still counts as an ICT service, register type S13 (software run on the CASP's own premises) in DORA terms, but data and its location stay on the CASP's servers.
TRP and TRISA (OpenVASP)
- +Royalty and license free, with public specifications: TRP 3.2.1 on GitLab and TRISA's MIT-licensed Envoy software
- +Peer-to-peer: OpenVASP says no TRP data or metadata goes to any third party, and TRISA's directory holds no transaction data
- +Interoperable with each other since 2023, and Envoy's Sunrise email reaches providers on neither protocol
- +Low fixed costs: OpenVASP membership is CHF 1,000 or 5,000 a year, half price for TRP users, and managed Envoy is USD 375 a month per node
- −No member count is published for either protocol; the only EU user with a published case study is Tangany, on TRP through 21 Analytics, and EU firms such as Bitonic and Northstake appear only on TRISA's own directory
- −TRP has no central directory: the customer brings a Travel Address from the receiving provider in place of a blockchain address
- −Neither specification covers the EUR 1,000 ownership check, which needs separate tooling
- −A self-hosted Envoy node is free but takes 4 to 6 weeks and your own staff, and only the managed service includes the Daybreak contact database for email
TRP (Travel Rule Protocol) began as a working group founded by Standard Chartered, ING and BitGo, according to its repository README, and is part of the OpenVASP Association, a Swiss non-profit in Zug. Its specification, at version 3.2.1 of 29 July 2024, sends an IVMS101 data payload (the shared data model for originator and beneficiary fields) over HTTPS with mutual TLS, in which both ends present certificates. It says "There is no single central body or organization behind the protocol, only collaboration" and that adoption is "royalty and license free", with implementation costs and GDPR arrangements left to the implementing provider. The originating provider "receives a special payment address, called Travel Address" from its customer, which encodes the receiving provider's endpoint. OpenVASP's TRP page lists 21 Analytics, Blockchain Intelligence Group and ospree as vendors and says "No data or metadata is ever exchanged with any third party".
TRISA (Travel Rule Information Sharing Alliance) came under OpenVASP's stewardship with effect from 1 October 2026, according to the TRISA and OpenVASP FAQ, so one association now stewards both open protocols. "Rotational Labs continues to operate and support the TRISA infrastructure on behalf of OpenVASP, as it has done since TRISA network operations began in 2020." TRISA verifies each provider before its Global Directory Service issues the certificates that encrypt messages; the directory runs in the United States, the EU and Singapore and is "not a central repository for Travel Rule transactions". Envoy, the MIT-licensed node, speaks TRISA and TRP; per the Envoy FAQ, self-hosting is free and takes 4 to 6 weeks, and the managed service costs USD 375 a month per node with a 6-month minimum.
The Envoy FAQ says "TRISA and TRP have been interoperable since 2023" and that TRISA "has also opened interoperability discussions with closed networks such as Binance GTR, Coinbase TRUST and VerifyVASP", with no result announced; until then, Sunrise email "reaches any out-of-network counterparty". OpenVASP's fees for providers are CHF 1,000 a year below 150 employees and CHF 5,000 above, with 50% off when they use TRP, and the FAQ says those rates will not rise before 1 January 2027. Both protocols carry IVMS101 data; the standard "was updated in 2023 as IVMS101.2023, although many current Travel Rule implementations still use variants of IVMS101.2020".
GTR (Global Travel Rule)
- +Its size can be read from a live public member API: 116 providers in 40 countries, 44 of them connected directly, on 18 October 2026
- +51 of those 116 sit in EU member states, 9 of them connected directly, among them Bybit EU, OKX Europe and Circle, the three of the nine in ESMA's MiCA register
- +Lists CODE, Sumsub, Sygna and Fireblocks as supported protocols, and reaches non-members by secure email
- +A free Trial version for testing and a web-based Manual mode for low volumes
- +End-to-end encryption (Curve25519) and hashed personal data, with ISO 27001, ISO 27701 and SOC 2 listed on its site
- −One company, Infozone Technologies in Singapore, runs it, and its homepage advertises direct access to Binance's ecosystem, tying the network's pitch to one exchange group
- −API access needs a KYB (know-your-business) review, a security questionnaire and a penetration test report dated within the last 12 months
- −Run from Singapore, with no EU hosting region stated
- −No published link to TRUST, TRP or TRISA, and the EU memberships rest on GTR's own list
GTR is run by Infozone Technologies Pte. Ltd. of Singapore, and its about page dates its founding to 2022. Its homepage advertises "Direct access to Binance's ecosystem". Members connect by API and webhooks over mutual TLS. The about page says "End-to-end encryption (Curve25519) ensures that neither GTR nor intermediaries can access plaintext user data". The homepage says personal information "is never stored in plain text" and is hashed with SHA-256, and that non-members receive "secure email notifications" with a link to the encrypted data. Its wallet verification product proves control of an unhosted wallet "through a simple QR code and signature flow".
On 18 October 2026 GTR's member API showed 116 providers in 40 countries, 44 connected directly and 5 Travel Rule solution providers. It places 51 members in EU member states. The 9 connected directly are Bybit EU (Austria), OKX Europe (Malta), Binance France, Circle (France), Binance Greece, Binance Poland, Ceffu PL, Paymonade (filed under Poland; its MiCA authorization is in Liechtenstein) and the ATM maker GENERAL BYTES (Czech Republic). The other 42 come through solution providers the API does not name. Of the nine, only Bybit EU, OKX Europe and Circle appear in ESMA's MiCA register.
Joining takes a KYB review and a security assessment, GTR's onboarding guide of 29 May 2026 explains; the API route also needs "a Penetration Test (Pentest) report dated within the last 12 months". A "free Trial Version" and a paid Professional version are offered, with no published price, and a Manual mode through a web interface serves "custodians, brokers, and VASPs with lower volumes".
VerifyVASP (with Sygna) and CODE
- +VerifyVASP claims 150+ member providers in 30+ jurisdictions, and its purchase of Sygna (announced 29 April 2026) brings Sygna's members over
- +VerifyVASP says encryption starts inside the member: its Enclave server sits in the member's own infrastructure, and the central relay stores no personal data
- +VerifyVASP says its European entity covers GDPR and DORA, and that it can keep data in a region through region-specific nodes
- +CODE claims 350+ providers in 60 jurisdictions and lists links to VerifyVASP, GTR, Sumsub, Sygna, Notabene and CryptoSwift
- −Few EU members, all from VerifyVASP's own directory: the four with a MiCA authorization are in Malta (Crypto.com's Malta entity, OKX Europe under its former name Okcoin Europe, Legion and Bequant), and CODE names no EU client
- −The VerifyVASP and CODE link is Korea-only: CODE's docs say exchanges on VerifyVASP support only domestic transactions within South Korea
- −No published VerifyVASP link to TRUST, TRP, TRISA, GTR, Notabene or Sumsub
- −Sygna members move to the Verified Network progressively, with no published date for the switch or for Sygna Bridge's end
VerifyVASP Pte. Ltd. is "a subsidiary of Upbit Global Pte. Ltd.", and on 29 April 2026 it announced the acquisition of Sygna, "a prominent Japan-based provider" and the owner of the Sygna Bridge network. Sygna's members are to join the Verified Network, VerifyVASP's own member network: "Existing members of Sygna will continue to operate without disruption and will be progressively onboarded onto the Verified Network", the release says. Each VerifyVASP member installs an Enclave server "within each VASP's infrastructure", and messages are relayed through a central server, per VerifyVASP's developer docs.
The VerifyVASP FAQ says personal data is encrypted by the originator's Enclave "before it is sent out" and that "VerifyVASP's central infrastructure does not store any PII" (personally identifiable information). It adds that "its European entity ensures GDPR compliance and also meets the new DORA requirements" and that "the network can accommodate local data residency by routing or handling data within region-specific nodes". The homepage claims 150+ member VASPs in 30+ jurisdictions. Its member directory lists Crypto.com's Malta entity, Okcoin Europe (now OKX Europe), Legion Malta and Bequant, all four in ESMA's register, and several other EU-registered members that are not. For self-hosted wallets, its VerifyWallet product uses "cryptographic digital signature challenges and micro-transactions".
CODE (CodeVASP) is run by CODE Inc. in Seoul. Its homepage claims 350+ VASPs in 60 jurisdictions, offers to "Connect across protocols with a single integration" to CodeVASP, VerifyVASP, GTR, Sumsub, Sygna, Notabene and CryptoSwift, and lists an unhosted wallet whitelist that verifies ownership through signature-based proof. Its interoperability docs narrow that: "Exchanges integrated with the VerifyVASP solution support only domestic transactions within South Korea". For an EU firm, these networks matter where customers move funds to Korean, Japanese or other Asian venues, and CODE can also be reached through Sumsub, which lists it among its protocols.
In-house build on an open protocolProtofire's model
- +Adapters can follow your own transfer data: the networks behind the largest share of your sent and received transfers come first, the reachability test of paragraph 26(b) of the EBA guidelines
- +One hold-and-release rule for every network: a withdrawal is broadcast only after its data has gone out, and a deposit is credited only after the beneficiary's details are verified, whichever network carried the message
- +TRUST membership, a GTR API link or a VerifyVASP Enclave can sit behind that one service as counterparties require
- −An open-protocol build talks only to TRP or TRISA counterparties until you add adapters; TRUST still needs membership and its review, and GTR's API mode a penetration test less than 12 months old
- −Counterparty detection, ownership flows, missing-data handling within deadlines of at most 3 or 5 working days, sanctions screening of Travel Rule data and records are all yours to build and test
- −Each protocol release, both IVMS101 versions (2020 and 2023), every network's rule changes and the tests with each counterparty stay on your roadmap as long as the service runs
- −Build cost is unknown in advance, since no figure for a full EU build has been published
- −Keeping data on your own servers needs no build: 21 Analytics sells that ready-made, reaching TRUST and TRP through one API, and Tangany chose it to keep full data control
Regulation (EU) 2023/1113 "should not mandate the use of a particular technology for the transfer of transaction information" (recital 50). The feedback table in the EBA's Travel Rule Guidelines states that the Regulation "does not require a centralised infrastructure to collect, transfer and receive data". A CASP can therefore run its own service: an IVMS101 data model mapped from its onboarding records, a TRP endpoint or a self-hosted Envoy node, and adapters to the networks its main counterparties use.
The originator's provider "shall not allow for the initiation, or execute any transfer, of crypto-assets before ensuring full compliance" (Article 14(8)). The EBA wants the data sent "no later than the initiation of the blockchain transaction" (paragraph 25), and the receiving provider verifies its customer's details "Before making the crypto-assets available" to them (Article 16(3)). Around that core sit five more parts. The service detects self-hosted addresses through "blockchain analytics, third-party data providers and identifiers used by messaging systems" (paragraph 77) and runs at least one paragraph 83 ownership method above EUR 1,000. Its reject, return or request logic follows the deadlines in paragraph 56: at most three working days inside the EU and five from outside, or up to seven for longer chains. It screens Travel Rule data against sanctions lists under EBA/GL/2024/14 from 30 December 2025, and keeps records for five years (Article 26).
The EBA groups systems as open-network, closed-network and protocol-agnostic, and says "Not all are interoperable, which means that CASPs might have to use multiple systems". FATF's 2025 best-practice paper records a UK case in which the FCA had a firm "integrate an additional Travel Rule solution", and a Japanese one in which a provider took its vendor's VASP list "at face value". Whoever builds the system, Hong Kong's guidance, as FATF summarizes it, makes clear that "the responsibility for ensuring Travel Rule compliance lies with the VASP". The only public effort figures for the parts of this route are integration times: 2 to 6 weeks for TRUST and 4 to 6 weeks for a self-hosted Envoy. The first test we would run is a withdrawal to a provider that cannot read the data: it should stay unsent until a second channel delivers the data or the transfer is declined, and either outcome should leave a record.
What should decide your Travel Rule setup?
four active EU CASPs say in their own help pages or releases that they exchange data through it, and TRUSThub covers non-members. Plan for the membership review and for self-hosted wallet checks of your own.
you want a managed gateway, a network claim of 2,300+ connected institutions and EU CASP users on record. Confirm the data region and that the gateway covers the protocols your counterparties use.
you already verify customers with Sumsub and want data hosted in Germany by default. TRUST members need another route, since Sumsub lists none.
you want on-premise software that reaches both TRUST and TRP through one API, as Tangany chose for data control. Your own team runs and upgrades it.
you can run an endpoint or an Envoy node and your counterparties already speak one of the two. Reach grows only as they adopt it.
your customers move funds to Binance entities, Bybit EU or OKX Europe, all on GTR's live member list. The API route needs a penetration test less than 12 months old.
the providers you need are Upbit-linked, Korean or former Sygna members. Few EU entities sit on either network.
you already run two or more networks and want one codebase deciding every send, hold, return and ownership check, with adapters, counterparty data and upkeep in the budget. Data control alone is sold ready-made, by 21 Analytics.
Where do custody platforms, smaller vendors and a bank's Swift route fit?
- Your custody platform narrows the choice: Fireblocks supports Notabene, Sumsub and GTR as Travel Rule providers and, for TRUST, signs the proof of address. Sumsub and GTR can share a workspace, Notabene cannot run with either, and "TRUST works alongside any provider", so a Fireblocks client can pair TRUST with Sumsub or GTR, or with Notabene alone.
- Newer and smaller vendors: Shufti, an identity-verification vendor, says its Travel Rule product can "Route through a direct VASP-to-VASP protocol, TRP, CODE and Binance GTR from a single API call", on the IVMS101 data standard. Ospree is one of the three TRP vendors on OpenVASP's list, with 21 Analytics and Blockchain Intelligence Group. For a small vendor, the figure that matters is which of your own counterparties it reaches today.
- A bank route through Swift: DekaBank and the consultancy zeb have tested Travel Rule data inside the Swift settlement messages MT542 and MT546 with Crypto Finance, Deutsche Börse's crypto subsidiary, and were in talks with other EU banks, Börsen-Zeitung reported on 20 July 2026. DekaBank appears in ESMA's register with Article 60 notifications for crypto custody and transfer services. A bank that only sends euros to or from a CASP applies the funds-transfer chapter of the Regulation instead.
- Record-keeping and continuity: the Travel Rule's five-year records under Article 26 sit next to MiCA's own duties, records of all crypto-asset services, activities, orders and transactions under Delegated Regulation (EU) 2025/1140 and continuity under Delegated Regulation (EU) 2025/299. Our page for CASPs and crypto exchanges lists them with the rest of a venue's compliance chain.
- Protofire's blueprints: the MiCA compliance stack blueprint assumes a CASP that holds, or will soon hold, its own MiCA authorization and already runs onboarding and AML for another regulated activity; its stack includes Notabene, Sumsub, 21 Analytics and Elliptic. The lapsed VASP migration blueprint covers a firm whose national registration has lapsed and that keeps its brand on an authorized provider's rail, including a switch of Travel Rule messaging with old and new running side by side.
FAQ
What is the EU Travel Rule?
What information must travel with a crypto transfer?
The information that must travel with an EU crypto transfer starts with the originator's name, distributed ledger address and any crypto-asset account number used, and either address with official document and customer numbers or date and place of birth (Article 14(1)). For the beneficiary, it is the name, distributed ledger address and any account number used (Article 14(2)).
A current LEI, or another official identifier, is added for either party where the message format has a field for it and the originator has given it to its provider. The data may travel separately, but "in advance of, or simultaneously or concurrently with" the transfer (Article 14(4)).
Is there a minimum amount for the EU Travel Rule?
What is the EUR 1,000 rule for self-hosted wallets?
Do CASPs verify self-hosted wallets below EUR 1,000?
How do you verify ownership of a self-hosted wallet?
A CASP verifies ownership of a self-hosted wallet by having the customer prove control of the address with "at least one" of the methods in paragraph 83 of the EBA's Travel Rule Guidelines. They are a signed message, a predefined micro-transfer, remote verification under the EBA's remote onboarding guidelines, or other technical means. One reliable method is enough, and methods are combined where one is not (paragraph 85).
The remote verification can be unattended, displaying the address, or attended. The micro-transfer is the "sending of a predefined amount" set by the CASP from and to the address, which vendors call the Satoshi test. The signature asks the customer "to digitally sign a specific message" with the address's key, and other technical means must leave the CASP "fully satisfied that it knows who owns or controls the address". The choice depends on "the technical capabilities of the self-hosted address", the robustness of each method and the risk (paragraph 84). A verified address can be whitelisted for later transfers, with controls to remove it if risk or control changes (paragraph 86).
Is self-declaration enough to prove wallet ownership?
What happens when the counterparty CASP cannot receive Travel Rule data?
Which Travel Rule providers do EU CASPs use?
Do Chainalysis or Elliptic offer Travel Rule messaging?
What changed for TRISA and Sygna in 2026?
Does the EU Travel Rule apply to banks and e-money institutions?
Is the EBA's grace period for Travel Rule systems over?
Who issues EU Travel Rule guidance now, the EBA or AMLA?
How should a CASP choose a Travel Rule solution?
How much does Travel Rule software cost?
Is a Travel Rule vendor an ICT third-party provider under DORA?
Does FATF's 2025 change to Recommendation 16 apply to crypto transfers?
How does GDPR apply to Travel Rule data?
Discussed on The Protocol Roundtable
All episodes
Why counterparty data is hard to get until the off-ramp
Pooja Shah, RainMoment at 55:20Episode 6 · Stablecoins Go Mainstream: Inside the New Payments Stack
Protofire connects the Travel Rule provider or protocol you pick to your transfer path. A withdrawal waits for its data to go out, a deposit is credited only after its data checks out, and a self-hosted wallet above EUR 1,000 first passes a signed-message or micro-transfer check, each step with its own audit record.
Travel Rule, KYC and KYT integration →Get a proposal
Tell us what you are building. An engineer reads it, we have a short call, and the written proposal follows within one business day.
Budget
An NDA is available from the first message and can cover anything you share. How it works