FinCEN Travel Rule for Crypto: Thresholds and Duties

How the FinCEN Travel Rule applies to crypto

The FinCEN Travel Rule requires covered financial firms to pass certain sender and recipient details with some crypto transfers. It supports anti-money laundering and counter-terrorist financing efforts by making transfer records easier to trace. Under the Bank Secrecy Act (BSA), covered firms must keep records and share data for transfers of $3,000 or more.

The rule does not apply to every crypto user or wallet. It applies to covered businesses, such as some money services businesses (MSBs), when they handle qualifying transfers. A business that deals in virtual currency may count as an MSB, based on what it does.

In practice, the sender’s service provider gathers the required details and sends them to the receiving provider. Each covered firm must also keep the records required for its role. The rule is about business duties, not a blanket ban on private crypto transfers.

• The threshold is generally $3,000 or more for covered transfers.
• Required details include names, addresses, account numbers, and financial institutions.
• A self-hosted wallet alone is not a covered financial firm.
• A provider may still have duties when it handles a transfer involving that wallet.

What information must travel with a transfer?

For covered transfers, the originator is the person or business sending funds. The beneficiary is the person or business receiving them. FinCEN’s rules call for identifying details about both parties, along with details about the firms handling the transfer.

Required data can include each party’s name, address, and account number. The record must also identify the financial institutions or other covered firms involved. Which fields apply can depend on the transfer and the role of each firm.

Firms need a process to collect, check, send, and retain the data. They should set clear steps for missing or mismatched information. A provider should not assume that a wallet address alone meets the rule’s data needs.

For the exact record and transmission duties, read the federal funds transfer recordkeeping rule. It sets out key recordkeeping and data-sharing requirements under FinCEN’s rules. Firms should assess the full rule against their own services and risk controls.

The $3,000 threshold and how it works

The U.S. threshold for these record and data duties is generally $3,000 or more. It is not limited to transfers above $3,000. A transfer worth exactly $3,000 can meet the threshold.

For example, a covered provider handling a $3,500 transfer must assess the Travel Rule duties. The same applies at $3,000. A smaller transfer may fall outside this specific threshold, but other BSA duties can still apply.

Do not treat the threshold as a general reporting limit for all crypto activity. Travel Rule duties differ from suspicious activity reporting, which has its own rules and triggers. Firms need to assess each obligation on its own facts.

Firms should also consider how they value a crypto transfer in U.S. dollars. The value may change quickly, so controls should account for the time and method used to assess it. Written procedures can help staff apply the threshold in a consistent way.

Which firms and wallet transfers are affected?

FinCEN’s rules can cover an MSB that accepts and transmits value, including certain businesses that handle convertible virtual currency. The label a firm uses does not decide its status. Its actual services and role in a transfer matter.

Some crypto exchanges and other virtual asset service providers (VASPs) may be covered when their work fits the MSB rules. A VASP is an industry term, not a separate exemption from U.S. law. Firms should review how they receive, move, or send customer funds.

A self-hosted wallet is controlled by its user, rather than by a third-party provider. The wallet itself is not directly subject to the Travel Rule. But a covered provider may have duties when sending funds to, or receiving them from, a self-hosted wallet.

For example, a customer may move crypto from an exchange to a personal wallet. The exchange must assess its own duties and gather information as its rules require. The wallet owner does not become a covered MSB just by holding or sending crypto for personal use.

Penalties and the cost of getting it wrong

Failure to meet BSA duties can bring civil penalties and, in serious cases, criminal consequences. The outcome depends on the facts, the conduct, and the rules that apply. There is no single penalty that fits every Travel Rule breach.

Weak controls can also lead to exam findings, added oversight, and harm to a firm’s standing with banks or business partners. Missing data may make it harder to trace funds or review suspicious activity. Those risks can grow when gaps affect many transfers.

Firms can lower risk by assigning clear owners for Travel Rule controls. They should test data capture, transfer screening, record storage, and exception handling. Staff training and periodic reviews help show that the process works in practice.

Keep records of key decisions, including how the firm assessed its MSB status and threshold checks. Escalate transfers with missing or conflicting details under written procedures. Get legal advice when the business model or a transaction raises doubt.

What may change as crypto rules develop?

Crypto services and transfer methods keep changing, while U.S. rules still rest on the BSA and its regulations. Firms should not assume that an industry standard replaces their legal duties. They need to watch for new FinCEN guidance and rule changes.

Cross-border transfers can raise added questions because firms may face rules in more than one country. The Financial Action Task Force (FATF) has set global guidance for virtual asset providers. That guidance can shape local rules, but it is not itself U.S. law.

Plan for change by keeping procedures easy to update. Review vendor tools, data fields, and transfer routes when services change. A sound program links legal review with day-to-day checks, rather than treating compliance as a one-time setup.