{"license":"CC-BY-4.0","licenseUrl":"https://creativecommons.org/licenses/by/4.0/","attribution":"ChainChoice (https://chainchoice.io)","category":"travel_rule_compliance","evidenceReadAt":"2026-09-30","generatedAt":"2026-11-12","criteria":[{"id":"protocol_reach","label":"Documented protocol reach and routing","weight":30},{"id":"failure_paths","label":"Failure, decline and timeout paths","weight":28},{"id":"unhosted_wallet_control","label":"Unhosted-wallet control, as documented","weight":24},{"id":"custody_and_go_live","label":"PII custody and testable go-live","weight":18}],"providers":{"sumsub_travel_rule":{"protocol_reach":{"s":8,"q":"The protocol to be used is selected depending on the counterparty VASP, if it supports any of the protocols. If the counterparty VASP does not support any known protocol, Sumsub attempts to send it an email notification.","u":"https://docs.sumsub.com/docs/protocols","d":"2026-09-30"},"failure_paths":{"s":9,"q":"No response was received within the requesting party's confirmation timeout. | No VASP could be attributed to the counterparty wallet address. The destination is therefore treated as an unhosted wallet. | The VASP was identified but cannot be reached through a protocol supported by both parties.","u":"https://docs.sumsub.com/docs/statuses-lifecycle-and-outcomes","d":"2026-09-30"},"unhosted_wallet_control":{"s":9,"q":"Sumsub applies signature proof for Unhosted Wallet Verification. With the WebSDK, you can generate a signature for supported wallets. | Integrated with the most popular wallets — Metamask, Ledger, Trezor, and any WalletConnect-compatible wallet.","u":"https://docs.sumsub.com/docs/unhosted-wallet-verification","d":"2026-09-30"},"custody_and_go_live":{"s":8,"q":"The test VASP is a Sumsub-hosted counterparty available only in Sandbox and reachable through the Sumsub protocol. | Start with the successful flow and then test waiting, decline, timeout, and finalisation scenarios. | Emails are not sent in Sandbox, so only the status can be tested.","u":"https://docs.sumsub.com/docs/test-data-exchanges-in-sandbox","d":"2026-09-30"}},"twentyone_analytics":{"protocol_reach":{"s":9,"q":"Depending on the counterparty VASP, 21 Travel Rule will automatically pick TRP or email to send the notification. | If a valid Travel Address is provided by your counterparty VASP this means you can use the TRP protocol. | If a VASP does not have TRP as a fallback, email can be used.","u":"https://docs.21analytics.ch/8.3.0/gui/transactions/outgoing_transaction.html","d":"2026-09-30"},"failure_paths":{"s":6,"q":"Can be either Executed , Declined , Cancelled or Registered .","u":"https://docs.21analytics.ch/8.3.0/gui/transactions/archived/detailed_transaction.html","d":"2026-09-30"},"unhosted_wallet_control":{"s":9,"q":"The method type used to show proof of ownership of the customer's self-hosted wallet. We currently have three options: | If the specified amount was not sent within the 48 hour time frame from the Date Created , the transaction will fail, and there will be no proof of ownership for this particular…","u":"https://docs.21analytics.ch/8.3.0/gui/self-hosted_wallets/proofs_overview.html","d":"2026-09-30"},"custody_and_go_live":{"s":8,"q":"21 Analytics has no means to access your deployment. In particular, 21 Analytics cannot access PII data, logging data or configuration data.","u":"https://docs.21analytics.ch/8.3.0/security.html","d":"2026-09-30"}},"notabene":{"protocol_reach":{"s":7,"q":"Network Discoverability; Address book (external); Blockchain analytics query; Select manually. | If none of the above flows are able to identify the counterparty, you should ask your customer to search for and select the correct one from our directory.","u":"https://devx.notabene.id/docs/counterparty-vasp-discoverability","d":"2026-09-30"},"failure_paths":{"s":9,"q":"\"COUNTERPARTY_POLICIES\", \"COUNTERPARTY_REJECTED\", \"COUNTERPARTY_NO_RESPONSE\", \"CANCELED_BY_INITIATOR\" | \"BENEFICIARY_ADDRESS\", \"BENEFICIARY_NOT_FOUND\" | Additional comment (required when reason is OTHER)","u":"https://devx.notabene.id/reference/rejecttransfer.md","d":"2026-09-30"},"unhosted_wallet_control":{"s":8,"q":"Notabene provides support for the following methods of wallet verification: | A Satoshi test is a verification process that involves sending a specified amount of cryptocurrency from the destination address within a particular time window to confirm control of the wallets private keys.","u":"https://devx.notabene.id/docs/self-hosted-wallet-verification-1","d":"2026-09-30"},"custody_and_go_live":{"s":8,"q":"Data at rest in AWS is encrypted using ECDH-1PU+XC20PKW. Data in transit is encrypted using TLS 1.2 or greater. | Based on their needs, VASPs can choose between three different options: | Encryption keys are, by default, managed by VASPs themselves.","u":"https://devx.notabene.id/docs/encryption-flows","d":"2026-09-30"}},"verifyvasp":{"protocol_reach":{"s":4,"q":"The VASP is a member of VerifyVASP or another Travel Rule protocol. Both parties have mutually configured each other as eligible VASPs for asset transfers.","u":"https://docs.verifyvasp.com/reference/travelrule-list-vasp-ids","d":"2026-09-30"},"failure_paths":{"s":8,"q":"Possible failure reason codes when data.result is DENIED or ERROR | Unrecognized wallet address | Insufficient originator information | Beneficiary name mismatch | Blocked due to internal policy | Verification request timed out","u":"https://docs.verifyvasp.com/reference/travelrule-callback","d":"2026-09-30"},"unhosted_wallet_control":{"s":3,"q":"Step 10: Develop an Enhanced Risk Mitigation Measure for Unhosted Wallets | Below are verification practices of varying reliability.","u":"https://docs.verifyvasp.com/reference/understanding-travel-rule","d":"2026-09-30"},"custody_and_go_live":{"s":10,"q":"This feature is opt-in and disabled by default . To enable it, set the VEGA_VERIFICATION_RETENTION_DAYS environment variable to the number of days to keep data.","u":"https://docs.verifyvasp.com/reference/travelrule-maintenance","d":"2026-09-30"}},"global_travel_rule":{"protocol_reach":{"s":7,"q":"However, this becomes challenging when your counterparty VASP has not yet integrated with the GTR Network. | The PII Retrieval Link can be accessed a maximum of 3 times and will automatically expire after 4 days. | 100% successful delivery of Out-of-Network emails cannot be guaranteed","u":"https://www.globaltravelrule.com/documentation/out-of-network/overview-out-of-network","d":"2026-09-30"},"failure_paths":{"s":8,"q":"The address cannot be found, or multiple sets of matches are found for one address. | Verification does not meet the Required PII compliance requirements for receiving VASP and contains mismatched or missing PII information. | GTR does not have a retry policy.","u":"https://www.globaltravelrule.com/documentation/error-handling","d":"2026-09-30"},"unhosted_wallet_control":{"s":7,"q":"qrcodeExpiredAt : the expiration time of the current single QR code session. After this time, your service may request a new QR code again with the same requestId . | verifyExpiredAt : the hard expiration time of the whole wallet verification request.","u":"https://www.globaltravelrule.com/documentation/wallet-verify/overview-wallet-verify","d":"2026-09-30"},"custody_and_go_live":{"s":8,"q":"In this type, Your VASP only needs to set up and remember a password consisting of 6 digits. The rest of Key Pair generation and configuration is handled by GTR. | Your VASP needs to share the Public Key with GTR while keeping the Private Key to your VASP itself.","u":"https://www.globaltravelrule.com/documentation/public-key-configuration","d":"2026-09-30"}},"codevasp":{"protocol_reach":{"s":8,"q":"Currently, CodeVASP is integrated with solutions such as Verify VASP, GTR, and Sygna, providing a wide-ranging network. | please discuss the procedure with CodeVASP first. We will provide separate guidance on the process for each VASP.","u":"https://docs.codevasp.com/en/docs/travel-rule/guides/02-Development/12-Interoperability-with-Other-Protocols","d":"2026-09-30"},"failure_paths":{"s":8,"q":"when the response time is exceeded. | BENEFICIARY_VASP_REQUEST_TIMEOUT | Beneficiary VASP does not respond.","u":"https://docs.codevasp.com/en/docs/travel-rule/guides/02-Development/10-Returning-Errors","d":"2026-09-30"},"unhosted_wallet_control":{"s":8,"q":"Unhosted Wallet Verification validates wallet ownership based on a signature proof from a user's personal (unhosted) wallet. | This process utilizes ECDSA (secp256k1) and keccak256 hashing.","u":"https://docs.codevasp.com/en/docs/unhosted-wallet/api-reference/01-Unhosted-Wallet-Introduction","d":"2026-09-30"},"custody_and_go_live":{"s":8,"q":"CodeVASP-Cipher Server is a module that can be used without coding encryption/decryption yourself, and can be deployed on your infrastructure. | This module does not send data to the CodeVASP server or store data","u":"https://docs.codevasp.com/en/docs/travel-rule/guides/02-Development/11-CodeVASP-Cipher-Server-Module-Guide","d":"2026-09-30"}},"ospree":{"protocol_reach":{"s":8,"q":"Each protocol may have prerequisites such as registration, membership approval, identity verification, certificates, keys, legal agreements, environment configuration, or provider-specific onboarding. | Future interoperability options:","u":"https://docs.ospree.io/developers/travel-rule/interoperability.md","d":"2026-09-30"},"failure_paths":{"s":8,"q":"VASP doesn't control the beneficiary wallet address. | There are missing required fields in the transaction data. | The identity record is not complete enough for compliance purposes. | The review period has exceeded the required compliance timeline.","u":"https://docs.ospree.io/developers/travel-rule/transfer-errors.md","d":"2026-09-30"},"unhosted_wallet_control":{"s":7,"q":"Ospree uses CAIP-122 to support a secure and standardized wallet verification flow based on message signing. | strict timestamps, ensuring the request is fresh and has not expired","u":"https://docs.ospree.io/learn/self-hosted-wallet.md","d":"2026-09-30"},"custody_and_go_live":{"s":7,"q":"Data storage depends on Ospree’s cloud infrastructure configuration and customer requirements. For enterprise customers, data residency and infrastructure details can be reviewed during onboarding or procurement. | data retention practices","u":"https://docs.ospree.io/learn/frequently-asked-questions.md","d":"2026-09-30"}},"veriscope":{"protocol_reach":{"s":6,"q":"TRISA endpoint TRP endpoint Sygna Bridge endpoint VerifyVASP endpoint Veriscope endpoint | VASPs respond to an attestation via a travel rule data-transmission protocol that both VASPs support.","u":"https://docs.veriscope.network/docs/latest/learn/discover.html","d":"2026-09-30"},"failure_paths":{"s":4,"q":"OR_DATA_REQ_FAILED oVASP backend failed to receive the request | OR_KYC_REQ_FAILED oVASP backend failed to receive the request","u":"https://docs.veriscope.network/docs/latest/learn/state-machines/state-machine-B.html","d":"2026-09-30"},"unhosted_wallet_control":{"s":5,"q":"Shyft Network offers the ability for VASPs to obtain cryptographic proof of user ownership of a wallet address. | Shyft User Signing is a web application that is hosted by Shyft Network.","u":"https://docs.veriscope.network/usersigning/latest/index.html","d":"2026-09-30"},"custody_and_go_live":{"s":8,"q":"If the test_vars parameter is not set, the sandbox will auto-accept the template sent. | Testing with Veriscope Sandbox Environment (aka Robot VASPs)","u":"https://docs.veriscope.network/docs/latest/learn/sandbox-environment.html","d":"2026-09-30"}},"sygna_bridge":{"protocol_reach":{"s":6,"q":"EMAIL_PROTOCOL: This category is determined based on the data in the Sygna server's wallet address directory. If the wallet address has been onboarded during the Sygna Email Protocol VASP account registration, it will be classified under this category.","u":"https://developers.sygna.io/reference/bridgewallet-address-filter.md","d":"2026-09-30"},"failure_paths":{"s":8,"q":"The Sygna Bridge protocol stops relaying transfer requests after the expiration date. | Default “30 days of expire date” if “expire_date” is not specified.","u":"https://developers.sygna.io/reference/bridgepermissionrequest-3.md","d":"2026-09-30"},"unhosted_wallet_control":{"s":4,"q":"The Sygna Wallet Address Filter (WAF) API is a key feature that enables you to determine whether a specific wallet address belongs to a VASP or an unhosted wallet based on the Sygna server's directory and your selected blockchain analytics (KYT) vendor.","u":"https://developers.sygna.io/reference/bridgewallet-address-filter.md","d":"2026-09-30"},"custody_and_go_live":{"s":8,"q":"Please provide us with the public.pem and keep the key.pem on a system that you consider to be secure to make certain that it is not exposed in any way.","u":"https://developers.sygna.io/docs/vasp-key-pair-1.md","d":"2026-09-30"}}}}