Ready for
Travel Rule
Compliance?

The Financial Action Task Force (FATF) is the inter-governmental body responsible for reviewing and monitoring money laundering, terrorism financing, and other forms of organized crimes. In addition, they have developed the FATF Recommendations, a set of international standards that aid law enforcement in the fight against crime. More than 200 countries and jurisdictions have committed to complying with the FATF Recommendations.

Travel Rule requires both financial institutions and VASPs—otherwise known as Virtual Asset Service Providers (VASPs)—to collect personal data on participants in transactions exceeding 1,000 USD/EUR. As of today, different jurisdictions have different transaction threshold amounts. For financial institutions and VASPs, this means gathering exchange originators and beneficiary identifying information of both senders and recipients: physical address, unique ID number (national identity number, etc.), customer identification number, or date and place of birth.

If you are a financial institution or VASP located in any of the FATF-member countries, you will be required to comply with the FATF Recommendations, including the FATF Travel Rule.

Once a transaction request above the set threshold has been made, Global Travel Rule will obtain the relevant information of both the sender and recipient. This data, encrypted by a secure SHA-256 algorithm, will then be scanned to see if it meets regulatory requirements and determine whether it flouts the FATF Recommendations.

Global Travel Rule (GTR) will only store the transmittal information after encryption. However, GTR (Global Travel Rule) will not store user's PII information in plain text. Instead, information will be hashed and later encrypted by SHA-256, an algorithm used to ensure cryptographic security. The hashing is irreversible i.e. the original text cannot be recovered. GTR Central VASP Service will only receive encrypted hashed information.

Information is never stored in plain text. Instead, the information will be hashed using SHA-256 (Secure Hash Algorithm 256-bit) Algorithm, used for cryptographic security. Because SHA-256 produces irreversible and unique hashes, the original text cannot be recovered once the data is hashed and encrypted. The hashed information will be transmitted using Mutual TLS, or mTLS for short, which is used in a Zero Trust security framework to ensure that the parties at each end of the transaction are who they claim to be via proof of having the correct private key. The information within their respective TLS certificates provides additional verification. The information is made visible only to GTR, not among VASPs.