Travel rule enforcement widens to transfers involving self-hosted wallets

Supervisors in several jurisdictions have extended travel rule expectations to transfers between exchanges and self-hosted wallets, requiring firms to collect originator and beneficiary details above defined thresholds.

The operational difficulty is verification. A self-hosted wallet has no institution behind it, so exchanges are left demonstrating that the customer controls the destination address, typically through a signed message or a small test transaction.

Both methods have failure modes. Signed messages are impractical on some hardware devices and smart-contract wallets, while test transactions add cost and delay and can be spoofed by an attacker who controls the withdrawal flow.

Compliance teams report a rise in false positives when address-screening tools flag counterparties several hops from a sanctioned entity, a threshold that varies by vendor and is rarely disclosed to customers.

Privacy advocates argue the requirements collect information disproportionate to the risk, particularly for routine self-custody withdrawals by verified customers.

Regulators counter that the alternative is an unmonitored gap in an otherwise supervised chain. Guidance issued this month keeps the thresholds but asks firms to document why a given verification method is appropriate.