On 15 November 2024, the Financial Intelligence Centre issued Directive 9 to enforce the requirements of Recommendation 16, commonly known as the "Travel Rule", with an effective date of 30 April 2025. The Travel Rule applies to crypto asset transfers and creates compliance obligations for crypto asset service providers ("CASPs").
This blog post explains the Travel Rule and outlines the steps required for implementation.
What is the Travel Rule?
The Travel Rule originates from the Financial Action Task Force ("FATF"), an independent inter-governmental organisation established in 1989 to combat money laundering and terrorist financing.
FATF’s Recommendation 16 was developed to prevent criminals from having unfettered access to wire transfers for moving their funds, and to detect such misuse.
In terms of FATF's Travel Rule, all financial institutions must collect, verify, and transmit basic information about the sender and beneficiary of a wire transfer. Directive 9 adapted the application of the Travel Rule to the context of crypto asset transfers.
What is required for the implementation of the Travel Rule?
Directive 9 creates obligations for ordering, recipient, and intermediary CASPs which facilitate the domestic and cross-border transfers of crypto assets.
The Travel Rule can be implemented in three steps, as set out below.
Step 1: Understand the applicable obligations
The obligations applicable to a CASP will differ depending on its classification as an ordering, recipient, or intermediary CASP:
- Ordering CASPs must obtain and verify prescribed information regarding the sender and beneficiary of the crypto assets, and transmit such information to the recipient CASP. In addition, the ordering CASP must identify and conduct due diligence regarding the recipient CASP.
- Recipient CASPs must verify the accuracy of the information received, and implement risk-based policies to determine when to execute, reject, or suspend a transaction, including the appropriate follow-up action.
- Ordering and recipient CASPs must develop and implement effective risk-based policies and procedures for the treatment of crypto asset transfers that involve unhosted wallets.
- Intermediary CASPs must ensure that all information is transmitted, and implement risk-based policies to determine when to execute, reject, or suspend a transaction, including the appropriate follow-up action.
Step 2: Extend KYC and verification workflows
An as accountable institution in terms of items 12 and 22 of Schedule 1 to FICA, every CASP is already required to implement and comply with customer due diligence (herein "KYC").
To implement the Travel Rule successfully, existing KYC and verification workflows must be extended to accommodate the additional rules and information listed in step 1.
Step 3: Update the existing RMCP
Directive 9 requires that measures to implement the Travel Rule are included in a CASP's existing Risk Management and Compliance Programme (herein "RMCP").
The RMCP must be updated ahead of the compliance deadline to include the rules, measures, and risk-based policies referred to in step 1.
What are the consequences of non-compliance?
A CASP that fails to comply with the Travel Rule is subject to administrative sanctions in accordance with section 45C of FICA, which may include financial penalties and reputational harm through the publication of an administrative decision.
Key takeaways
The implementation of the Travel Rule requires the adoption and extension of technical and organisational measures which must be undertaken by 30 April 2025 to ensure compliance with Directive 9. Following the three-step approach, The Travel Rule can be implemented swiftly and appropriately, in line with the specific obligations of the CASP.