The 6th Anti-Money Laundering Directive (AML6), combined with Regulation (EU) 2023/1113 (the Transfer of Funds Regulation, EU-TFR), implements the FATF Travel Rule for crypto-asset transfers across the EU. Together they impose originator/beneficiary information requirements on CASPs that significantly affect day-to-day crypto operations.
How do AML6 and the EU Travel Rule apply to crypto-asset transfers in 2026?
The 6th Anti-Money Laundering Directive (AML6), combined with Regulation (EU) 2023/1113 (the Transfer of Funds Regulation, EU-TFR), implements the FATF Travel Rule for crypto-asset transfers across the EU. Together they impose originator/beneficiary information requirements on CASPs that significantly affect day-to-day crypto operations.. Framework: Directive (EU) 2018/1673 (AML6) + Regulation (EU) 2023/1113 (EU-TFR) + Regulation (EU) 2024/1624 (AMLR) + EBA crypto AML guidelines. Scope: All EU CASPs handling crypto-asset transfers + custodial wallet providers + selected unhosted-wallet interactions. Key authority: EBA (technical standards) + national FIUs + national AML supervisors.
All EU CASPs handling crypto-asset transfers + custodial wallet providers + selected unhosted-wallet interactions
Key Authority
EBA (technical standards) + national FIUs + national AML supervisors
What the Travel Rule actually requires
For every crypto-asset transfer ≥€1,000 (and for all transfers if either side is high-risk), the originating CASP must transmit originator data (name, address, account/wallet identifier) to the receiving CASP. The receiving CASP must verify the beneficiary data. Below the €1,000 threshold, simplified due diligence applies but originator name + identifier are still required.
The unhosted-wallet question
Transfers between a CASP and an unhosted (self-custody) wallet require the CASP to take "reasonable steps" to verify the originator/beneficiary information. In practice this means CASP-side risk assessment of self-custody addresses, often using on-chain analytics tools (Chainalysis, Elliptic, TRM Labs). EU-TFR does NOT require CASPs to refuse unhosted-wallet interactions, but in practice many CASPs do so for transfers above thresholds.
Coverage gaps and grey areas
DeFi protocols without an identifiable operating entity are not subject to EU-TFR. P2P transfers between two unhosted wallets are not subject either. The boundary cases — DEX aggregators, smart-contract intermediaries, MEV bots — are subject to ongoing EBA guidance.
Practical CASP implementation
EU-TFR-compliant CASPs typically integrate Travel Rule messaging via shared protocols like Notabene, Sumsub TravelRule, or Trisa. The €1,000 threshold is per-transfer not cumulative — some compliance programmes apply more conservative cumulative monitoring as well.
Key dates
2018-10-23
AML6 adopted (Directive (EU) 2018/1673)
2023-05-31
EU-TFR adopted (Regulation (EU) 2023/1113)
2024-05-31
AMLR adopted (Regulation (EU) 2024/1624)
2024-12-30
EU-TFR full application — Travel Rule live for all EU CASPs
Is the Travel Rule the reason some EU CASPs blocked self-custody withdrawals?
In some cases yes, but more often it's a CASP's internal risk-policy interpretation rather than a Travel Rule mandate. EU-TFR does not require CASPs to refuse unhosted-wallet transfers, but it does require risk assessment. Conservative CASPs operationalise this as withdrawal restrictions for transfers above thresholds.
Does the Travel Rule apply to crypto-to-fiat off-ramps?
Crypto-to-fiat conversions are dual-track regulated: the crypto-asset transfer portion falls under EU-TFR; the fiat-transfer portion falls under the original Transfer of Funds Regulation (Regulation (EU) 2015/847) for SEPA payments. Both apply.
What is AMLA?
The Anti-Money Laundering Authority (AMLA) is the new EU agency created by Regulation (EU) 2024/1620 to supervise high-risk credit and financial institutions directly, including major CASPs. AMLA is headquartered in Frankfurt and starts direct supervision from 2027. It marks a shift from purely national-level AML supervision toward EU-direct supervision for the largest firms.
Related coverage
//Analytics consent·GDPR · ePrivacy · TTDSG
ChainChoice measures page views and conversions with two cookieless, EU-hosted services: Plausible and Cloudflare Web Analytics. Nothing loads until you accept, and rankings are identical either way.ChainChoice measures how the engine is used — page views, conversions, referrer — through two cookieless, EU-hosted services: Plausible and Cloudflare Web Analytics. No advertising cookies, no cross-site profile, no data resale. Neither script loads until you accept, and rankings are identical whether you accept or decline.