Crypto Travel Rule 2026: Swaps and Withdrawals Explained

The Travel Rule makes regulated crypto businesses send identifying details about the sender and receiver alongside a transfer. It applies to the companies, not to the blockchain — but it shapes what your exchange asks before it lets a withdrawal out. Below: thresholds by region, what changes at withdrawal, and where swaps sit.

Key takeaways

• The rules described here attach to businesses that hold customer accounts and funds. Fswap is non-custodial and account-free, and its own terms of use state it provides no custodial services while applying automated risk screening to deposit addresses.

• 83% of surveyed jurisdictions — 91 of 109 — have now passed Travel Rule legislation, up from 73% a year earlier (FATF 7th Targeted Update, July 2026).

• Enforcement lags the law: 60% of those jurisdictions — 55 of 91 — have not yet issued any findings, directives or enforcement actions on Travel Rule compliance (FATF, July 2026).

• The EU has no de minimis threshold at all: every crypto transfer by a regulated provider carries the data, in force since December 30, 2024 under Regulation (EU) 2023/1113.

• The UK threshold changed this summer: SI 2026/621, made June 9, 2026, replaced "1,000 euros" with "£800" in regulations 64C(4) and 64G(1)(b), taking effect 21 days later (legislation.gov.uk).

• The US threshold stayed at $3,000 under 31 CFR 1010.410: the proposal to cut it to $250 was withdrawn on April 16, 2025 (Travel Rule reference, status as at Sep 23, 2026).

In this article

• What is the Travel Rule?

• Where it applies: thresholds by region

• How it affects exchange withdrawals

• Does it apply to instant swaps?

• What it means in practice

• FAQ

This article explains publicly available rules as of October 8, 2026. It is general information, not legal advice. Requirements change, and how any specific service is classified is a question for that service and its regulator.

What is the Travel Rule?

The Travel Rule is the crypto application of FATF Recommendation 16, the standard that already governs bank wire transfers. It requires that identifying information about the sender and the recipient "travels" with a transfer between regulated providers, so the receiving institution knows who is on the other end.

Three things follow from that definition, and they explain most of the confusion around it:

• It binds companies, not blockchains. The data does not go on-chain. It moves between providers through separate messaging, before, with or alongside the transfer.

• It is a standard, not a law. FATF sets the recommendation; each jurisdiction writes its own version, which is why thresholds and required fields differ from country to country.

• It does not restrict what you may own or send. It governs what a regulated business must collect, transmit and keep when it handles a transfer on your behalf.

FATF revised Recommendation 16 at its June 2025 plenary. The changes treat the payment chain as starting with the institution that receives the customer's instruction, standardise sender and recipient details for cross-border payments above USD/EUR 1,000, and require anti-fraud tools such as verification of recipient details. Those revisions come into effect by the end of 2030, so what applies today is each country's current implementation — not the 2030 target.

Where it applies: thresholds by region

The single most practical difference between jurisdictions is the amount at which the full data set becomes mandatory.

Ordered from the strictest threshold to the most permissive. Thresholds and instruments from the Travel Rule reference table (status as at Sep 23, 2026) and, for the UK, directly from SI 2026/621 on legislation.gov.uk. Thresholds change — verify against the primary instrument before relying on any figure.

Two patterns are worth noting. The strictest regimes are not the newest: Switzerland has had a zero threshold since 2019, and the EU chose zero in 2023. And the US figure is the outlier in the other direction — $3,000, a number set for wire transfers in the 1990s and left alone when the proposal to lower it was dropped last year.

What must actually travel also differs. Under Article 14 of the EU regulation, the originator's provider sends the originator's name, distributed-ledger address and account number where one exists, plus an address, official document number and customer ID, or date and place of birth — with a legal entity identifier for companies. FATF's revised standard above USD/EUR 1,000 requires a verified originator name, an account or reference, and an address, national ID, customer ID or date of birth; below the threshold, names and account numbers without verification.

How it affects exchange withdrawals

For most people the Travel Rule shows up as extra fields on a withdrawal form. The pattern is consistent across venues, even if the wording differs.

• Who the recipient is. Sending to another exchange usually means selecting the destination provider from a list and giving the recipient's name, so the two providers can exchange data.

• Whether the wallet is yours. Sending to a self-hosted address often triggers a question about ownership. In the EU that is explicit above €1,000: the provider must take adequate measures to assess whether its own customer controls the address. In the UK the equivalent provision sits in regulation 64G, now pegged at £800.

• Proof of control. Where ownership has to be established, venues typically use a signed message from the wallet, a micro-deposit, or a screen recording. Which method is accepted is the venue's choice, not the regulation's.

• Holds and returns. A receiving provider that gets incomplete information may delay, request more, return the funds or reject the transfer. That is a designed behaviour, not a malfunction.

• Records. Providers generally retain this data for five years under the EU regime, so a withdrawal you make today is documented well beyond the day it settles.

Worth separating two things people conflate: the Travel Rule governs transfers between providers. Verification of who you are happens earlier, at account opening, under the ordinary customer due diligence rules — a different obligation with a different legal basis.

Does it apply to instant swaps?

This is the question the standards themselves are still working through, and the honest answer has three parts.

First, the obligation follows the business model, not the label. Travel Rule duties in the EU, UK and US regimes are written for providers that hold customer funds or accounts and execute transfers for them. A service that never takes custody and never opens an account sits differently in those definitions than an exchange does — but how any particular service is classified depends on its jurisdiction, its actual structure and its regulator's view. That is a legal determination, not something a blog post can settle. The structural difference behind it is covered in our comparison of custodial and non-custodial exchanges.

Second, regulators are actively closing the gap. FATF's July 2026 update notes that only four jurisdictions have imposed licensing requirements on DeFi arrangements and just two have licensed one, with a single jurisdiction reporting any DeFi enforcement action. That is a description of an unfinished regulatory frontier, not a permanent exemption — and the EU's own calendar is already visible, with rules affecting how providers serving the EU handle certain transfers arriving in 2027.

Third, your own obligations do not move. Tax reporting, sanctions compliance and the lawfulness of the funds are yours regardless of which service you use. Fswap runs an automated risk system on deposit addresses and states in its terms that it does not provide custodial services and that users remain responsible for their own tax obligations; the company's model and supported markets are described on its about page. Using a non-custodial swap changes who holds your coins and how many intermediaries collect data about you. It does not change what the law asks of you.

Ordered by how many regulated providers sit in the path, most first. The third row describes the model, not a legal classification: how any service is categorised depends on its jurisdiction, structure and regulator.

What it means in practice

Six things that make the difference between a smooth withdrawal and a three-day support thread.

1. Know your venue's threshold. In the EU and Switzerland there is none, so every withdrawal carries data. In the UK the extended set starts at £800; in the US, at $3,000.

2. Expect an ownership question on self-hosted withdrawals. Above €1,000 in the EU, or £800 in the UK, be ready to prove the receiving address is yours.

3. Keep the recipient's details exact. A name that does not match the destination account is the most common cause of a held transfer.

4. Do not split a withdrawal to stay under a threshold. Structuring is treated as a red flag in its own right and will attract more scrutiny than the original transfer would have.

5. Keep your own records. Transaction hashes, order IDs, dates and amounts — you will need them if a provider asks later, and for your tax filing regardless.

6. Check the rule, not the rumour. Thresholds moved twice in the last eighteen months: the US proposal was withdrawn in April 2025, and the UK figure changed in June 2026.

FAQ

What is the crypto Travel Rule?

The requirement that regulated crypto businesses transmit identifying information about the sender and recipient alongside a transfer, based on FATF Recommendation 16. The data moves between providers separately from the blockchain transaction, and each jurisdiction implements it with its own thresholds.

What is the Travel Rule threshold in 2026?

It depends on the country. The EU, Switzerland and Japan apply no threshold at all. The UK requires basic data at any amount and the extended set from £800 since June 30, 2026. The US threshold is $3,000 under 31 CFR 1010.410.

Did the US lower its $3,000 Travel Rule threshold?

No. The proposal to reduce it to $250 was withdrawn on April 16, 2025, leaving the $3,000 figure that has applied since 1996.

Does the Travel Rule apply to withdrawals to my own wallet?

The sending provider still has obligations. In the EU, for transfers above €1,000 to or from a self-hosted address, it must take adequate measures to assess whether its customer controls that address; the UK equivalent now sits at £800. In practice that means an ownership check, often a signed message or a micro-deposit.

Does the Travel Rule apply to non-custodial swaps?

The obligations in these regimes are written for businesses that hold customer funds and accounts, so a non-custodial, account-free service sits differently in the definitions. How a given service is classified depends on its jurisdiction and structure, and regulators are actively working on this area — FATF reports only four jurisdictions have licensing requirements for DeFi arrangements.

How many countries have implemented the Travel Rule?

91 of 109 surveyed jurisdictions — 83% — had passed Travel Rule legislation as of FATF's July 2026 update, with 11 more in the process. Enforcement is further behind: 55 of those 91 have issued no findings or enforcement actions yet.

Can I avoid the Travel Rule by splitting transfers?

No, and attempting it makes things worse. Breaking one transfer into smaller amounts to stay below a reporting threshold is treated as structuring, which is itself a flagged pattern in AML systems and can trigger closer review than the original transfer.

Conclusion

The Travel Rule is now the normal condition of using a regulated crypto business rather than an exception to it: 83% of surveyed jurisdictions have it on the books, and the strictest regimes apply it to every transfer regardless of size. Learn your venue's threshold, expect an ownership check on self-hosted withdrawals, keep your own records, and verify any figure against the primary instrument before you rely on it.

Need to move between crypto assets without opening another account? Get a live quote on Fswap — 4,300+ pairs, payout to the address you choose, on the web or in Telegram.