Under the SFC's VASP regime and the AMLO, the Travel Rule has been fully effective since 1 January 2024. It applies to virtual asset transfers of HKD 8,000 (~USD 1,000) and above, with full originator and beneficiary data required at or above that threshold.

And because settlement is immediate and irreversible, the SFC expects the counterparty data exchange to happen pre-transaction before the transfer executes, not concurrently and not after.

FATF Recommendation 16 is live as the global baseline. The EU's MiCA enforces a zero threshold. VARA is actively inspecting in the UAE. MAS, FINTRAC, AUSTRAC and the FSA are all tightening supervision.

Wherever you operate, the question has shifted from whether you screened a transfer to whether you can produce the record that says you did.

Compliance owes a defensible record for every transfer but often has no way to exchange counterparty data at volume. Engineering is told to "solve Travel Rule" and finds it's a network problem, not an API problem.

Fraud sees an unverified self-hosted wallet as a blind spot that KYC was never built to close. Three teams, one transaction, and no shared answer.

Travel Rule messaging, unhosted wallet verification, wallet screening and ongoing crypto monitoring each answer a different question, fail in a different way, and have to be evidenced separately.

Most stacks cover some of them well and assume the rest are covered too. Knowing exactly where yours stops is the first step.