#
Regulation (EU) 2023/1113 (the recast Transfer of Funds Regulation, or crypto 'Travel Rule') requires full originator and beneficiary information to accompany every crypto-asset transfer within, into, or out of the EEA involving a CASP, with no de-minimis threshold (unlike the €1,000 threshold applicable to certain fiat transfers). CASPs must additionally verify ownership/control of self-hosted wallets for transfers over €1,000, and third-country (non-EEA) providers cannot solicit or serve EEA clients outside a narrowly-construed reverse-solicitation exemption.
At the perimeter of this regime, third-country CASPs are prohibited from providing MiCA-regulated services to, or soliciting, EEA clients, except under the narrowly-construed reverse-solicitation exemption, where the client acts at its own exclusive initiative. This restriction, reinforced by ESMA's post-transition wind-down statement following the 1 July 2026 expiry of the Article 143(3) grandfathering period, means the cross-border transfer regime and the licensing perimeter now operate in close alignment: a third-country provider outside the reverse-solicitation exemption has neither a lawful basis to provide services under the licensing regime nor a lawful channel through which to solicit EEA clients directly.
Outlook
This module's near-term trajectory is one of continuity: the Travel Rule's information-accompaniment obligations, the self-hosted-address verification threshold and the record-retention period are all settled, harmonised hard law with detailed EBA implementing guidelines already in place. The principal item to watch is how the reverse-solicitation boundary is tested and enforced in practice now that the EU-wide transitional period has closed, since third-country providers previously operating under grandfathered status no longer have that basis for EEA client access. This module's substantive content is tracked separately from the aml_ctf illicit-finance analysis housed in the financial-integrity monitor's subscription baseline, and this baseline carries only the transfer-information mechanics themselves.
Cross-Border Transfer
The recast Transfer of Funds Regulation (TFR, Regulation (EU) 2023/1113) is confirmed incorporated into the EEA Agreement via EEA Joint Committee Decision No 42/2025, adopted by written procedure on 20 February 2025. The TFR's self-hosted-wallet provisions are directly relevant to any gambling-adjacent crypto-asset flow: for transfers exceeding EUR 1,000 to or from a self-hosted address, Article 14(5) obliges the originator's crypto-asset service provider, and Article 16(2) obliges the beneficiary's crypto-asset service provider, to take adequate measures to assess whether the address is owned or controlled by its customer. Recital 39 frames the underlying policy aim as verifying ownership or control of the self-hosted address.
The precise statutory language matters for compliance design: the obligation is to take adequate measures to assess ownership or control, not to achieve strict verification in every case. A gambling-adjacent crypto-asset service provider calibrating its self-hosted-wallet controls against this standard should build an assessment process proportionate to the EUR 1,000 threshold and the specific risk presented by the transfer, rather than importing a stricter verification standard the text does not itself impose. This distinction corrects an overstatement present in prior characterisations of the obligation as a strict verification mandate.
The EEA incorporation confirmation for the TFR rests on the same EEA Joint Committee decision package as MiCA's incorporation, and EEA-Lex records both instruments as in force in the EEA as at the research date, subject to the same caveat that a live fetch to reconfirm the current snapshot was blocked by robots.txt at research time.
Outlook
No further development to the self-hosted-wallet assessment duty itself was identified this cycle beyond this clarification of its operative standard. The principal matter to track going forward is how gambling-adjacent crypto-asset service providers operationalise the adequate-measures standard in practice, including whether any Member State regulator issues sector-specific guidance narrowing or illustrating what adequate measures look like for gambling-platform crypto-asset flows specifically, as distinct from the general crypto-asset-service-provider population.
1 earlier distinct update(s)
Cross-Border Transfer
A sectoral ban on transactions with Russian and Belarusian crypto-asset service providers and decentralised crypto platforms takes effect from 24 May 2026 under the EU's 20th sanctions package. This development is noted here for cross-border-transfer disambiguation purposes: the effective date has now passed relative to this cycle's observation date, meaning EEA-serving crypto-asset service providers should treat the ban as an in-force obligation rather than a forthcoming one. The full anti-money-laundering and sanctions-architecture analysis of this development is owned by the financial-integrity consumer under its D1 and D5 domains; this brief limits itself to the crypto cross-border-transfer nexus rather than duplicating that analysis.
One open interpretive question flagged this cycle is whether the sanctions package's provisions targeting decentralised platforms are enforceable against protocols that lack a clear EU establishment, a structural ambiguity inherent to applying entity-based sanctions architecture to non-custodial, decentralised infrastructure. This cycle's evidence does not resolve that question, and it remains a live gap for cross-border-transfer compliance planning.
Outlook
Watch for regulatory or judicial clarification on the enforceability of sanctions provisions against decentralised platforms lacking EU establishment, and for the practical compliance response of EEA-serving crypto-asset service providers now that the 24 May 2026 effective date has passed.
Sources and findings (5)
- T1 · Publications Office of the European Union / EUR-LexPublications Office of the European Union / EUR-Lex — Under Regulation (EU) 2023/1113, crypto-asset service providers must obtain, hold and share originator and beneficiary information with their transfer counterparts and make it available to competent authorities on request, extending the fiat-transfer 'travel rule' to crypto-asset transfers.retrieved M5bindingin force
- T1 · EUR-LexEUR-Lex — For transfers over €1,000 from a self-hosted address, the beneficiary CASP must assess whether the beneficiary owns or controls that address before making the crypto-assets available.retrieved M4bindingin force
- T1 · Publications Office of the European Union / EUR-LexPublications Office of the European Union / EUR-Lex — Crypto-asset service providers must retain records of originator/beneficiary transfer information for a period of five years, with an option for Member States to extend this to a further five years.retrieved M3bindingin force
- T1 · European Securities and Markets AuthorityEuropean Securities and Markets Authority — CASPs established outside the EEA cannot provide MiCA-regulated services to EEA clients or solicit them, in a business-to-business or business-to-consumer context, except where services are strictly provided at the client's own exclusive initiative under the narrowly-construed reverse solicitation regime.retrieved M4bindingin force
- T1Transfer of Funds Regulation (EU) 2023/1113 — Under Article 14(5) (originator CASP) and Article 16(2) (beneficiary CASP), for a transfer of more than EUR 1,000 to or from a self-hosted address, the CASP must take adequate measures to assess whether the address is owned or controlled by its customer (recital 39: verifying ownership or control)retrieved M5bindingin forcenew