Australia's travel rule for virtual asset transfers

Identify the transfer and your role before execution

A transfer of value can include money, virtual assets or property, but excludes physical currency and tangible property. For a virtual asset transfer, map the payer, payee, ordering institution, each intermediary and beneficiary institution. The same business can hold more than one role, and the payer and payee can be the same person.

Do this before the on-chain transaction is released. The distributed ledger may not carry the required personal information, so a separate transfer message may need to be sent before or at the same time as the blockchain transaction. Product design should prevent release when a required classification, identity field, message or counterparty decision remains unresolved.

Collect the required information

An ordering institution can use information already collected through CDD or an earlier transfer when it has no reason to doubt its adequacy or truth. If new transfer information conflicts with KYC information, review, update and reverify as required rather than passing the inconsistency downstream.

• Payer information: the payer's full name plus one or more prescribed identifiers, which can include date and place of birth, full business or residential address, an ordering-institution customer number or another unique identifier.
• Payee information: typically the payee's full name, subject to the transfer-specific rules and temporary verification provisions.
• Payer tracing information: an account identifier, custodial-wallet address and tag or memo, self-hosted-wallet address, or required transaction reference depending on the transfer.
• Payee tracing information: the destination account, custodial-wallet address and tag or memo, self-hosted-wallet address, or transaction reference required for the transfer type.

Apply the ordering, intermediary and beneficiary controls

The ordering institution collects the payer and payee information, verifies the payer information and sends the required transfer message and tracing information to the next institution. The intermediary takes reasonable steps to monitor that required information was received, passes it on without stripping material fields and keeps the required records.

The beneficiary institution monitors for missing required information and, where required, inaccurate payee information before making value available. For a virtual asset transfer, it generally must receive or otherwise obtain payer information, tracing information and the payee's full name before release. Document how missing, inaccurate or technically incompatible messages are held, investigated, corrected, rejected or escalated.

Classify custodial and self-hosted wallets

Before sending or making virtual assets available, determine on reasonable grounds whether the relevant wallet is custodial or self-hosted and who controls it. For a custodial wallet, determine whether the controller is required to be licensed or registered under laws that give effect to FATF recommendations and whether it has the required status. Reliable public registers, counterparty information and high-confidence blockchain or wallet data can support the conclusion.

An ordering institution must not accept an instruction to transfer to a beneficiary institution that is required to be licensed or registered but is operating without that status. A beneficiary institution must not make the transfer available where the sending wallet is controlled by an institution that is required to be licensed or registered but is not. Preserve the source, date and confidence of the classification.

Understand the self-hosted-wallet exemption

A transfer to a self-hosted wallet is exempt from passing travel-rule information to another business in the transfer chain because there is no beneficiary institution to receive it. The exemption is not a blanket CDD or information exemption. The ordering institution still collects and verifies payer information and collects the payee's full name and tracing information.

For an incoming transfer from a self-hosted wallet, the beneficiary institution obtains the payer information and tracing information and, if it does not already hold it, the payee's full name before making the virtual assets available. Its policies must identify the payer and describe the steps used to verify who controls the sending wallet. Separate AUSTRAC reporting for transfers involving unverified self-hosted wallets is scheduled to begin on 31 March 2029; it is distinct from SMRs and TTRs.

Protect messages and retain evidence

Assess whether the next institution can receive the message securely and protect its confidentiality. An ordering institution may have a basis not to pass specified information where the statutory security conditions are met, but it must keep the reasons. Do not send travel-rule personal information in an uncontrolled blockchain memo, support ticket or public transaction field.

Keep transaction records, payer, payee and tracing information, wallet classifications, licensing checks, missing-information alerts, security decisions, release or rejection decisions and applicable policies. AUSTRAC says travel-rule transaction and compliance records are generally retained for seven years and must be sufficient to reconstruct the transfer.