Travel Rule self-hosted wallet verification
The Travel Rule is why your exchange suddenly asks who owns the address you are withdrawing to. Here is what the rule requires for self-hosted wallets, and how verification usually works in practice.
What the Travel Rule is
FATF Recommendation 16 (the "Travel Rule") tells virtual asset service providers to pass originator and beneficiary information with qualifying transfers, similar to wire-transfer rules in traditional finance. In the European Union this is implemented by Regulation (EU) 2023/1113 on information accompanying transfers of funds and certain crypto-assets (often called the recast Transfer of Funds Regulation, or TFR). It applies alongside MiCA (Regulation (EU) 2023/1114), which authorises crypto-asset service providers.
Self-hosted / unhosted wallets
A self-hosted (also called unhosted or non-custodial) wallet is one where you control the private keys — hardware wallets, Sparrow, Electrum, MetaMask, and similar. There is no counterparty VASP to receive Travel Rule data, so the customer's own CASP must collect information from its customer and, in the EU above €1,000, verify that the customer owns or controls the address.
How ownership is verified
The EBA Travel Rule Guidelines (EBA/GL/2024/11) list reliable technical means, including a predefined micro-transfer and a digital signature over a specified message with the address key. Exchanges productise those as:
- Signature / WalletConnect flows — used by exchanges such as Kraken, Gemini, SwissBorg, Bitpanda, OKX and others.
- Satoshi / small deposit tests — used by Coinbase, Binance, Gate, Crypto.com and others.
- Screenshots or declarations — some CASPs (for example Bitvavo for screenshots) accept these when signing is impractical.
For a method-by-method walkthrough, see How to prove wallet ownership.
Privacy notes
- Signing a message does not broadcast a transaction, but the exchange learns that you control that address.
- Uploading an xPub (offered by some exchanges for Bitcoin) can reveal the whole account's address set and balance to the exchange.
- KeyProof's verifier runs locally in your browser and never asks for keys.
FAQ
Does the Travel Rule ban self-custody?
No. The EU Transfer of Funds Regulation and FATF guidance regulate how VASPs / CASPs handle information when their customers send to or receive from self-hosted wallets. Self-custody itself remains lawful in the EU; providers may still require ownership checks.
What is the €1,000 rule?
Under Regulation (EU) 2023/1113, for transfers involving a self-hosted address of more than €1,000, the CASP must verify that the self-hosted address is owned or controlled by its customer. Below that threshold, information collection still applies in many cases, but the ownership-verification duty is tied to that amount in the regulation.
What counts as proof of control?
The EBA Travel Rule Guidelines allow reliable means such as a predefined micro-transfer to or from the wallet, or a digital signature of a specified message using the private key of the address, among other approaches. Exchanges implement these as Satoshi tests, Signature tests, WalletConnect signing, screenshots or declarations.
Sources
Not legal advice. Jurisdictions outside the EU implement FATF Recommendation 16 differently.