The EU Travel Rule and Bitcoin Self-Custody: What the €1,000 Ownership Check Means

The EU Travel Rule is the requirement, set by Regulation (EU) 2023/1113, that regulated providers attach the sender's and recipient's details to every Bitcoin transfer they handle. As of October 22, 2026, it applies across the EU, with no minimum amount. When you withdraw more than €1,000 to your own wallet, your provider must also assess whether that wallet is really yours. Wallet-to-wallet transfers made without any provider fall outside the Regulation.

Yes. The Regulation applies to "transfers of crypto-assets," and Article 3(14) of Regulation (EU) 2023/1113 borrows the definition of crypto-asset from MiCA, the EU's Markets in Crypto-Assets Regulation.

Article 3(1)(5) of MiCA, Regulation (EU) 2023/1114, defines a crypto-asset as "a digital representation of a value or of a right that is able to be transferred and stored electronically using distributed ledger technology or similar technology." Bitcoin fits that definition.

On December 30, 2024. The Regulation was adopted on May 31, 2023 and published in the Official Journal on June 9, 2023, and its Article 40 states: "It shall apply from 30 December 2024."

The EBA published its Travel Rule Guidelines on July 4, 2024. Under paragraph 10, they "apply from 30 December 2024."

The two instruments have different legal force. The Regulation is EU law and binds directly in every Member State. The Guidelines are not legislation: under paragraph 3, national authorities "must notify the EBA as to whether they comply or intend to comply" with them.

Crypto-asset service providers do, not individual holders. Article 3(1)(15) of MiCA defines a crypto-asset service provider as "a legal person or other undertaking whose occupation or business is the provision of one or more crypto-asset services to clients on a professional basis."

The services listed in Article 3(1)(16) of MiCA include "providing custody and administration of crypto-assets on behalf of clients," "exchange of crypto-assets for funds" and "providing transfer services for crypto-assets on behalf of clients." In plain terms, that covers exchanges, brokers and custodians serving customers.

Providers that pass a transfer along are covered too. Under Article 19 of the Regulation, an intermediary provider must ensure that the sender and recipient information it receives travels with the transfer, and must keep records of it.

No. Article 2(4)(b) of the Regulation excludes "a person-to-person transfer of crypto-assets carried out without the involvement of a crypto-asset service provider." Recital 22 repeats that the Regulation "should not apply to person-to-person transfers of crypto-assets" of that kind.

Sending sats from your own wallet to a friend's own wallet involves no provider, so the Regulation does not reach it. Article 2(4)(a) also excludes transfers where both sender and recipient are providers acting on their own behalf.

Your provider must attach identifying details about both ends of the transfer. Under Article 14(1) of the Regulation, the sender's provider must include:

Under Article 14(2), the transfer must also carry the recipient's name and distributed ledger address. Article 14(4) requires the information to be sent "in advance of, or simultaneously or concurrently with, the transfer," securely and in line with EU data protection law.

There is no minimum amount. Article 14 contains no threshold, and recital 30 states that crypto-asset transfers are subject to the same requirements "regardless of their amount." Recital 27 adds that no exemption should be granted to "domestic low-value transfers of crypto-assets."

Your provider collects the information from you and records the transfer. A self-hosted address is, under Article 3(20) of the Regulation, a distributed ledger address not linked to a crypto-asset service provider or to a similar provider established outside the EU.

When you withdraw to such an address, Article 14(5) requires your provider to "obtain and hold" the sender and recipient information and to "ensure that the transfer of crypto-assets can be individually identified." Since nobody sits at the other end to receive the data, paragraph 80 of the EBA Guidelines tells providers to "collect the information on the originator or beneficiary from their customer."

Providers must first spot that the address is self-hosted. Under paragraph 77 of the Guidelines, they should use available technical tools, such as blockchain analytics and third-party data providers. Paragraph 79 says the sender's provider makes this assessment before initiating the transfer.

It is an extra check for larger transfers to or from your own wallet. Article 14(5) of the Regulation provides that, for a transfer "of an amount exceeding EUR 1 000 to a self-hosted address," the provider "shall take adequate measures to assess whether that address is owned or controlled by the originator."

The EBA Guidelines explain how to measure the amount. Under paragraph 81, the sender's provider tests the threshold when the transfer is ordered, and the recipient's provider when it is received. Under paragraph 82, the value in euros uses the exchange rate at the time of the transfer, "regardless of any transaction fees."

The EBA lists five methods, and the provider must use at least one. Under paragraph 83 of the Guidelines, they are:

For Bitcoin, the smallest denomination is one satoshi. Under paragraph 84, the choice of method depends on the wallet's technical capabilities, how reliable each method's assessment is, and the money laundering risk. Under paragraph 85, a provider should combine methods where one alone is not reliable enough.

Once the provider is "fully satisfied," paragraph 86 lets it record the address and skip the check for later transfers to and from it, which the Guidelines call "whitelisting." The provider must remove the address from the list if the risk changes or if there are signs you no longer control it.

The provider can still complete the check, but it needs more. Under paragraph 89 of the Guidelines, where a third party owns or controls the address, the provider may rely on additional reliable and independent data. It may also use other suitable means, if it is fully satisfied that it knows the identity of the sender or recipient and can demonstrate this to its regulator.

The same rules run in reverse. Under Article 16(2) of the Regulation, the recipient's provider must obtain and hold the sender and recipient information for a transfer "from a self-hosted address." For an amount "exceeding EUR 1 000," it must assess whether the address "is owned or controlled by the beneficiary."

Under paragraph 79 of the EBA Guidelines, the recipient's provider makes its assessment before the Bitcoin is made available to you. Under paragraph 63, requests for missing information about such transfers go "directly to the CASP's customer," meaning you.

Yes, if information is missing or the risk is high. Article 17(1) of the Regulation requires the recipient's provider to apply risk-based procedures "for determining whether to execute, reject, return or suspend a transfer of crypto-assets." When information is missing, it may ask for it before making the assets available.

The EBA Guidelines go further. Under paragraph 64, where the sender or recipient "cannot be unambiguously identified," the provider "should not execute the transfer." Under paragraph 62, it should also consider how to treat the self-hosted address in future, which may include rejecting later transfers.

Higher-risk transfers attract more scrutiny. Article 38 of the Regulation inserted Article 19a into the EU's Anti-Money Laundering Directive, Directive (EU) 2015/849. It requires providers to assess the risks of transfers to or from self-hosted addresses and to apply measures such as "requiring additional information on the origin and destination of the transferred crypto-assets" or "conducting enhanced ongoing monitoring of those transactions."

Paragraph 88 of the Guidelines tells providers to apply at least one of those measures where information is inaccurate or patterns look unusual. Paragraph 90 tells them to report suspicious transfers to the national Financial Intelligence Unit.

No. Nothing in Regulation (EU) 2023/1113 requires an individual to register a wallet, obtain a license or seek permission to hold their own keys. Every obligation in it falls on providers, and recital 38 confirms that the requirements apply to transfers involving self-hosted addresses where a provider is involved.

What the rule changes is the record. Every withdrawal to your own wallet, and every deposit from it, leaves your provider holding your identifying details next to your address. Above €1,000, it also leaves a record that the provider assessed whether you control that address.

The rules point to a few predictable steps when you move sats between an EU provider and your own keys:

None of this applies to a transfer between two self-hosted wallets with no provider involved, which Article 2(4)(b) leaves outside the Regulation.

It is the requirement in Regulation (EU) 2023/1113 that crypto-asset service providers attach the sender's and recipient's details to every Bitcoin transfer they handle. It has applied across the EU since December 30, 2024, with no minimum amount. It binds providers, not individuals holding their own keys.

No, if no provider is involved. Article 2(4)(b) excludes "a person-to-person transfer of crypto-assets carried out without the involvement of a crypto-asset service provider." Moving sats between two self-hosted wallets, or to a friend's self-hosted wallet, is outside the Regulation.

Under Article 14(5), when a provider sends more than €1,000 to a self-hosted address, it must take adequate measures to assess whether the address is owned or controlled by its customer. Article 16(2) applies the same test to deposits above €1,000 from a self-hosted address.

Paragraph 83 of the EBA Guidelines lists five methods: unattended verification, attended verification, sending a predefined small amount to and from the address, signing a specific message with the address's key, or other reliable technical means. The provider must use at least one, and combine methods where needed.

No. Article 14 of Regulation (EU) 2023/1113 sets no threshold for attaching sender and recipient information, and recital 30 states that the requirements apply "regardless of their amount." The €1,000 figure only triggers the extra ownership check for self-hosted addresses.

Yes. Under Article 17(1), the recipient's provider decides on a risk basis whether to execute, reject, return or suspend a transfer with missing information. Under paragraph 64 of the EBA Guidelines, it should not execute a transfer when the parties cannot be unambiguously identified.

No. Regulation (EU) 2023/1113 places every obligation on crypto-asset service providers. It contains no requirement for individuals to register a wallet or obtain permission to hold their own keys. It governs what providers collect and check when Bitcoin moves to or from a self-hosted address.

This article is general information and not legal advice.

The Travel Rule applies across the EU, but national rules on Bitcoin still differ. Compare how more than 140 countries treat legality, self-custody and tax on The Bitcoin Act's interactive Global Bitcoin Regulatory Map: https://thebitcoinact.xyz/bitcoin-legal-map

The Bitcoin Act covers Bitcoin law and regulation, with news every Tuesday and analysis every Sunday. You can subscribe here: https://thebitcoinact.xyz