How to Comply with Liechtenstein's Travel Rule Requirements 2026

Understanding how to comply with Liechtenstein’s travel rule requirements is now a front-line obligation for every crypto-asset service provider (CASP) and virtual-asset service provider (VASP) that touches the principality. The convergence of three regulatory layers, FATF Recommendation 16, the EU Transfer of Funds Regulation (TFR) with its zero-threshold extension to crypto-asset transfers, and Liechtenstein’s own FMA supervisory provisions under Art 23b of the Due Diligence Ordinance, means that compliance teams can no longer treat travel-rule data exchange as a future project. This guide maps the legal framework, walks through the required data fields and VASP-to-VASP transmission standards, explains unhosted-wallet verification workflows, and provides an operational checklist that engineering and compliance teams can implement immediately.

Quick Answer, Who Must Act and the Primary Compliance Decision

The travel rule in crypto compliance requires financial institutions and VASPs to collect, hold and transmit specific originator and beneficiary information whenever virtual assets are transferred. FATF Recommendation 16 sets the international baseline. In the EEA, the recast Transfer of Funds Regulation extends that obligation to crypto-asset transfers at a zero-value threshold, meaning every transfer triggers data-sharing duties, regardless of amount.

If you are a CASP or VASP operating in, or sending transfers to or from, Liechtenstein, you must collect and verify traveller data before the transfer settles, transmit that data to the counterparty institution, and retain records for the period mandated by Liechtenstein’s anti-money-laundering legislation. The Liechtenstein Financial Market Authority (FMA) enforces these obligations through its domestic transpositions, principally the Token and Trustworthy Technology Service Provider Act (TVTG) and Art 23b of the Supervisory Provisions on Due Diligence Obligations. Non-compliance exposes firms to supervisory action, remediation orders and, in serious cases, licence withdrawal.

Legal Framework Mapped, How Liechtenstein’s Travel Rule Requirements Fit Together

FATF Recommendation 16, the International Baseline

FATF Recommendation 16 (commonly called the “Travel Rule”) requires VASPs and financial institutions to obtain, hold and transmit required originator and beneficiary information immediately and securely when conducting virtual-asset transfers. The FATF’s Best Practices on Travel Rule Supervision paper specifies that compliance requires VASPs to ensure that certain information requirements accompany payment flows, covering both VASP-to-VASP and VASP-to-unhosted-wallet scenarios. Under R16, the minimum information set includes the originator’s name, account number or unique transaction reference, and address (or national identity number, customer identification number, or date and place of birth), together with the beneficiary’s name and account number.

EU Transfer of Funds Regulation (TFR), Zero-Threshold Implications

Regulation (EU) 2015/847 on information accompanying transfers of funds was extended to cover crypto-asset transfers across the EEA. The critical difference from the traditional wire-transfer regime is the zero-value threshold: unlike fiat transfers, where simplified data may apply below EUR 1 000, the EU Transfer of Funds Regulation crypto provisions require full originator and beneficiary data for all crypto-asset transfers, regardless of value. This means a transfer of EUR 5 triggers the same data obligations as one of EUR 500 000. The regulation interacts directly with the Markets in Crypto-Assets Regulation (MiCA), which governs the licensing and conduct framework for CASPs across the EEA.

For firms holding a MiCA licence or operating under transitional arrangements, the TFR zero-threshold obligation is already fully enforceable.

Liechtenstein Specifics, TVTG and FMA SPV Art 23b

As an EEA member, Liechtenstein has implemented the 4th and 5th EU Anti-Money Laundering Directives as well as the Transfer of Funds Regulation. Domestically, the TVTG (Token and Trustworthy Technology Service Provider Act) governs the registration and supervision of TT service providers. Art 23b of the FMA’s Supervisory Provisions on Due Diligence Obligations transposes the travel rule into actionable supervisory requirements, giving the FMA power to supervise and enforce data-collection and transmission duties. Industry observers note that the practical effect of the Liechtenstein framework is an operational zero threshold, effectively requiring travel-rule compliance from the first franc.

Firms operating under a Liechtenstein passport into the broader EEA must satisfy both the domestic FMA requirements and the host-state expectations for inbound services.

Who and When, Scope and Thresholds in Practice

The travel rule threshold under the EU TFR for crypto-asset transfers is zero, there is no de minimis exemption. This is a critical distinction from the fiat wire-transfer regime, where transfers below EUR 1 000 may carry reduced data requirements. For VASPs and CASPs operating in Liechtenstein, every virtual-asset transfer triggers full data obligations.

Compliance teams should apply a three-step decision process to determine whether a transfer falls within scope:

1. Is the transfer a crypto-asset transfer? If it involves virtual assets (as defined by FATF and MiCA), it falls within the travel rule scope. Internal movements between wallets controlled by the same VASP for the same customer are generally excluded, but transfers between different customers, even on the same platform, are in scope.
2. Is there a counterparty VASP/CASP? If the receiving institution is an identified VASP or CASP, the transfer is a VASP-to-VASP transfer, and the full data exchange is required before settlement. If the transfer is to an unhosted (self-custodied) wallet, the originating VASP must still collect originator data and apply additional verification steps (see the unhosted wallet section below).
3. Is the transfer cross-border or domestic? Both cross-border and domestic transfers are in scope. For cross-border transfers involving jurisdictions outside the EEA, enhanced due diligence may apply, particularly where the counterparty jurisdiction has not implemented the FATF travel rule.

For VASP licensing and jurisdictional requirements more broadly, firms should confirm that both their home-state registration and any host-state notifications align with the travel rule obligations in each jurisdiction where they operate.

Required Data Fields and VASP-to-VASP Mapping

Collecting the right data, in the right format, at the right time, is where compliance meets engineering. The EU TFR and FATF Recommendation 16 together define a minimum dataset that must accompany every qualifying crypto-asset transfer. The table below maps each requirement to the authoritative field definition and a recommended internal VASP field name and format for implementation.

Minimum Dataset, Quick Reference

For the originator address field, where a full residential address is not available, the TFR permits a substitute identifier such as a national identity number, customer identification number, or date and place of birth. The key requirement is that the substitute must allow the beneficiary institution to request and receive the full address from the originator institution within three working days.

Recommended Transmission Formats and TRP Considerations

The Travel Rule Protocol (TRP) is an open standard for exchanging crypto-asset transfer-related data between VASPs, as contemplated by FATF Recommendation 16. TRP is not the only option, alternatives such as TRISA and OpenVASP also exist, but TRP has gained traction in the EEA ecosystem due to its vendor-neutral design and interoperability focus.

Regardless of protocol, the data payload should include, at minimum, the fields listed in the table above. A compact example of a VASP-to-VASP data exchange in JSON format is provided in the practical examples section below. Engineering teams should implement API-level validation that rejects outbound transfers where any required field is null or empty, returning an appropriate error code (e.g., TRAVEL_RULE_DATA_INCOMPLETE) to the front end.

For transfers where the beneficiary VASP does not support TRP or any compatible messaging protocol, the originating VASP must attempt reasonable alternative methods (secure email, encrypted API) and document the attempt. If the data cannot be transmitted, the transfer should not proceed, a hard stop is the correct compliance posture under the current EU TFR regime.

Unhosted Wallet Checks, Proof-of-Ownership and AOPP Workflows

Legal Basis and GDPR Considerations

When a customer withdraws crypto assets to an unhosted (self-custodied) wallet, there is no counterparty institution to receive traveller data. The originating VASP must nevertheless collect and verify originator information and satisfy itself as to the identity of the person controlling the destination wallet. Processing personal data for this purpose is lawful under the EEA data-protection framework when it is necessary for compliance with a legal obligation, here, the AML/TFR requirements. Data minimisation applies: collect only what is necessary, retain it only for the statutorily required period, and do not repurpose the data. For a detailed analysis of data protection and crypto in Liechtenstein, consult the companion guide in our Payments & Digital Assets cluster.

Practical Verification Methods, AOPP, Satoshi Test and Message Signing

Three methods are commonly used to verify ownership of an unhosted wallet:

• Address Ownership Proof Protocol (AOPP). The customer signs a message with the private key associated with the destination wallet address, proving control. The VASP verifies the cryptographic signature. This is the fastest and most privacy-preserving method.
• Satoshi test (micro-transfer test). The VASP sends a small, randomised amount to the destination wallet and asks the customer to confirm the exact amount received. This proves the customer has read access to the wallet, though not necessarily signing control.
• Manual message signing. The customer signs a challenge message provided by the VASP using their wallet software. The signed message is submitted alongside the withdrawal request and cryptographically verified by the VASP.

Industry observers note that AOPP is increasingly the preferred method because it combines strong cryptographic proof with data minimisation, the VASP needs only a signature, not additional identity documents beyond what is already held under KYC.

When Enhanced Due Diligence Applies

Enhanced due diligence (EDD) is triggered in several scenarios involving unhosted wallets: transfers to or from wallets linked to sanctioned addresses (identified via blockchain analytics screening), transfers above a risk-calibrated internal threshold (many firms set this at EUR 1 000 or its equivalent), transfers involving jurisdictions identified by the FATF as high-risk, and situations where behavioural indicators suggest layering or structuring. Where EDD is triggered, the VASP must document the additional measures taken and, where appropriate, file a Suspicious Activity Report (SAR) with Liechtenstein’s Financial Intelligence Unit.

Operational Checklist, What Compliance Teams Must Implement

The following twelve-point checklist translates Liechtenstein’s travel rule requirements into actionable items for compliance, product and engineering teams:

1. Travel rule policy. Draft and board-approve an internal travel rule policy that references FATF R16, the EU TFR and FMA SPV Art 23b. Assign a named travel-rule compliance officer.
2. Onboarding verification. Ensure KYC procedures collect the full originator dataset (name, address/substitute identifier, account identifier) at onboarding, not at the point of transfer.
3. Real-time VASP-to-VASP exchange. Integrate a travel-rule messaging solution (TRP, TRISA, OpenVASP or bilateral API) to transmit and receive beneficiary/originator data before settlement.
4. API field validation. Implement server-side validation that blocks outbound transfers where required travel-rule fields are null. Return error code TRAVEL_RULE_DATA_INCOMPLETE.
5. Unhosted wallet flow. Build a dedicated withdrawal workflow that triggers AOPP or message-signing verification for unhosted wallet destinations.
6. Sanctions screening. Screen all destination wallet addresses and beneficiary names against OFAC, EU and Liechtenstein sanctions lists in real time, prior to settlement.
7. Recordkeeping. Retain all travel-rule data, verification evidence and transmission logs for the statutory retention period under Liechtenstein’s AML legislation.
8. Suspicious activity reporting. Establish internal escalation procedures so that SAR filing with Liechtenstein’s FIU occurs within the required timeframes when EDD triggers are hit.
9. Internal escalation matrix. Define clear escalation paths for edge cases: unresponsive counterparty VASPs, partial data, sanctions hits, and uncooperative customers.
10. Testing and QA. Run quarterly end-to-end tests of travel-rule data flows, including simulated failures, to verify that hard-stop controls function correctly.
11. Audit trails. Maintain immutable logs of every travel-rule data exchange, including timestamps, message hashes and counterparty identifiers.
12. FMA disclosure templates. Prepare template responses for FMA supervisory questionnaires and on-site inspections, covering travel-rule policies, systems architecture and sample transaction data.

Enforcement, Penalties and Regulator Expectations in Liechtenstein

The FMA is the primary regulator responsible for AML compliance and enforcement against all financial institutions and TT service providers in Liechtenstein. The Liechtenstein Chamber of Lawyers separately supervises its own members. For CASPs and VASPs, the FMA conducts both routine supervisory reviews and thematic inspections focused on travel-rule readiness.

Early indications suggest that the FMA’s enforcement posture for 2026 emphasises supervisory dialogue and remediation over punitive measures, provided firms demonstrate good-faith implementation efforts. However, persistent non-compliance or wilful omissions can lead to formal remediation orders, the suspension of specific service lines, administrative fines, or, in extreme cases, revocation of the FMA registration. The FMA cooperates with EEA supervisory authorities and the FATF mutual evaluation process, meaning that cross-border enforcement referrals are a realistic risk for firms operating through Liechtenstein passports into other EEA states.

Practical Examples and Sample Policies

Sample VASP-to-VASP Data Exchange (Compact JSON)

The following JSON snippet illustrates a minimal compliant travel-rule data payload. All PII is redacted for publication purposes:

{
  "originator": {
    "name": "[REDACTED]",
    "account_id": "bc1q[REDACTED]",
    "address": {
      "country": "LI",
      "postal_code": "9490"
    }
  },
  "beneficiary": {
    "name": "[REDACTED]",
    "account_id": "0x[REDACTED]"
  },
  "tx": {
    "amount": "0.5",
    "currency": "ETH",
    "date": "2026-07-15",
    "id": "0xabc123[REDACTED]"
  },
  "vasp_originator": "VASP-LI-FMA-00042",
  "vasp_beneficiary": "VASP-DE-BAFIN-01234"
}

Sample Unhosted Wallet Verification Request

Below is a template notification that a VASP might send to a customer initiating a withdrawal to an unhosted wallet:

“To process your withdrawal to wallet address [FIRST 6 AND LAST 4 CHARS SHOWN], we require proof of ownership. Please sign the following challenge message using your wallet software and submit the signature via the secure upload link: Challenge: [UNIQUE_CHALLENGE_STRING]. This step is required under Liechtenstein and EU anti-money-laundering regulations. Your personal data will be processed solely for compliance purposes and retained for the statutory period.”

Conclusion

Knowing how to comply with Liechtenstein’s travel rule requirements is no longer optional, the zero-threshold EU TFR regime, FATF Recommendation 16 and the FMA’s domestic supervisory provisions under Art 23b together create an enforceable obligation on every crypto-asset transfer. Compliance teams should prioritise implementing the data-field mapping, VASP-to-VASP messaging integration and unhosted-wallet verification workflows outlined in this guide. Firms that act now will be well-positioned for FMA supervisory reviews and cross-border EEA operations; those that delay face escalating regulatory risk.

Sources

1. FATF, Best Practices on Travel Rule Supervision
2. EUR-Lex, Regulation (EU) 2015/847 (Transfer of Funds Regulation)
3. Finanzmarktaufsicht Liechtenstein (FMA), Anti-Money Laundering
4. Regierung.li, Official English Translation of Liechtenstein Due Diligence Act
5. EUR-Lex, Directive (EU) 2015/849 (AMLD4/5 consolidated)