Virtual-asset transfer screening and the travel rule: explained

A payments firm operating between the United States and the European Union begins routing stablecoin settlements through a newly acquired virtual-asset service provider. The compliance team runs counterparty names through its screening tool, finds no hits, and proceeds. Six months later, a regulator inquiry arrives – not because a designated person was missed on a list, but because the transfer-data obligations were never met and a wallet cluster linked to a restricted end-user was never identified. The exposure was structural, not a lookup failure.

Virtual-asset transfer screening and the travel rule bis / ear vs eu is one of the most consequential divergence points in cross-border compliance today. Under the US export-control regime administered by BIS, the primary lens is end-use and end-user: the EAR attaches to the item or technology being moved, including software and certain cryptographic tools, and the question is who receives it and to what end. The EU travel rule operates under a zero-threshold funds-transfer regime: originator and beneficiary information (the data that must accompany a transfer) is required for every crypto-asset transfer between service providers, regardless of value. These are different regulatory architectures addressing overlapping risks. A business operating under both must satisfy both – and the stricter obligation governs where the two conflict.

This analysis maps the US and EU positions criterion by criterion, identifies where the gap in obligations creates real compliance exposure, and sets out the practical steps a cross-border business should take before the next transfer is processed. As of January 2026, both regimes are in active development, and the analysis below reflects the position as currently understood – verify the current position before relying on it.

What legal architecture does each regime use for virtual-asset transfers?

The US and EU approaches to virtual-asset transfer screening rest on fundamentally different legal architectures, and understanding that difference is the starting point for any cross-regime analysis.

Under the BIS / EAR regime, the primary mechanism is export-control classification. Software, technology, and certain cryptographic items are assigned an ECCN (Export Control Classification Number under the US Commerce Control List) or, where no classification applies, designated EAR99. A virtual-asset transfer is not itself an export of goods; however, the underlying software platforms, cryptographic algorithms, and technology components used to operate a virtual-asset service can fall within the scope of the EAR. When those items are transferred – or when the technology is released to a foreign person within the United States (a deemed export) – the EAR's licence requirements and end-use controls apply. The BIS / EAR framework therefore approaches the virtual-asset sector obliquely: it catches the infrastructure and the tools, not the transfer record itself.

OFAC's parallel framework addresses the transfer directly. The SDN List (OFAC's list of Specially Designated Nationals and blocked persons) and the 50 percent rule (OFAC's rule treating entities owned 50 percent or more by blocked persons as themselves blocked) mean that a virtual-asset service provider must screen every counterparty and every wallet address against the consolidated list. Blockchain analytics is now used by US regulators to trace wallet clusters; a designation can extend to addresses associated with a designated person. That is the US sanctions dimension of virtual-asset screening – it sits alongside, but is distinct from, the BIS / EAR export-control dimension.

The EU regime takes a different path. Under the EU transfer-of-funds framework, which applies a zero-threshold rule to crypto-asset service providers, originator and beneficiary information is required for every transfer between service providers regardless of amount. This is a data-completeness obligation. It does not replace sanctions screening; it runs alongside it. The EU asset-freeze prohibitions under the relevant Council Regulations extend to making funds or economic resources available, directly or indirectly, to or for the benefit of listed persons – and that prohibition covers virtual assets as it covers any other form of value.

The practical implication is this: a cross-border business operating a virtual-asset platform must manage at least three distinct obligations simultaneously – BIS / EAR classification of the technology it uses and transfers, OFAC sanctions screening of counterparties and wallets, and EU travel-rule data completeness. None of these substitutes for another.

How does the BIS / EAR end-user test apply to virtual-asset transactions?

Under the EAR, the end-user and end-use analysis is the central control mechanism for virtual-asset-adjacent technology, and it operates through two distinct instruments.

First, BIS maintains the Entity List and the Denied Persons List: dealings with parties on either list require a licence or are prohibited outright. A virtual-asset service provider that routes transactions through software, exchanges technology, or operates infrastructure that has been supplied to an Entity List party is squarely within scope. The question is not whether the underlying asset is a good; it is whether the transaction involves the provision of controlled technology or software, or whether it amounts to a facilitation of activity that would require a licence if conducted directly by a US person.

Second, BIS administers military end-use and end-user (MEU) restrictions for specified destinations, as currently in force. These controls apply to items that are not otherwise licensable but are known or suspected to be destined for a military end-user in a listed country. A virtual-asset service provider that operates in or through a jurisdiction subject to MEU controls, and that provides software or technology services to counterparties whose end-use has not been verified, faces a real exposure under this head.

The Foreign Direct Product rules extend the reach of the EAR beyond the United States. Foreign-produced items that are the direct product of controlled US technology or software can be brought within US jurisdiction. In our experience, this is the dimension of BIS / EAR that virtual-asset firms most frequently underestimate: a platform built partly on US-origin software, operated by a non-US entity, and used to transfer value to a counterparty in a restricted destination may bring all three points of contact within scope of the EAR.

What does this mean operationally? A virtual-asset service provider must maintain an accurate classification for every component of its technology stack. It must screen customers and counterparties not only against OFAC's SDN List but against BIS lists. And it must trace the technology it exports or releases – including through remote access – to confirm the end-user. Name screening alone does not satisfy this obligation. Have you mapped the technology components in your platform against the Commerce Control List?

What does the EU zero-threshold travel rule require in practice?

The EU travel rule, applied under the zero-threshold standard for transfers between crypto-asset service providers, requires that originator and beneficiary information accompanies every transfer – a standard materially more demanding than the US financial-institution travel rule, which applies a monetary threshold.

The data elements required – identity of the originator, the originator's account or wallet address, identity of the beneficiary, and the relevant account or address – must be transmitted with the transfer and must be verified before the transfer is processed by the receiving service provider. A service provider that cannot obtain complete information must either obtain it before transfer or reject the transaction. The rule does not permit a risk-based exception from the data requirement itself: completeness is mandatory.

This creates an operational asymmetry for cross-border firms. A US-regulated virtual-asset business dealing with an EU-regulated counterpart must satisfy the EU data requirements on the EU side of the transaction, even if its own domestic obligations do not impose the same standard. In our cross-border practice, we regularly advise firms that have discovered this gap only after a transfer is queried: the EU counterpart's compliance team has requested data that the US-side firm's system never collected.

Alongside the data obligation, the EU asset-freeze rules apply in full. A transfer to a wallet held by or for the benefit of an EU-designated person is prohibited, regardless of whether the data was complete. Blockchain analytics is increasingly integrated into EU compliance practice for exactly this reason: name screening against a static list does not catch a wallet that has not yet been formally linked to a designated person in the public database, but whose transaction history maps to a known cluster. The EU approach expects service providers to use available tools, not merely to run a name check.

The interaction between the data obligation and the asset-freeze prohibition is a point of real compliance tension. A service provider may receive a transfer with complete data, screen the named beneficiary, find no match, and process the transaction – only to discover later that the receiving wallet was associated with a designated person through blockchain analysis. The data rule and the asset-freeze rule address different risks; satisfying one does not satisfy the other.

Where do the BIS / EAR and EU positions diverge most sharply?

The deepest divergence between the BIS / EAR and EU positions on virtual-asset transfer screening lies in the level at which each regime engages with the transaction.

BIS / EAR engages at the level of the technology: it asks what is being exported, to whom, and for what purpose. The EU travel rule engages at the level of the transfer record: it asks whether the data accompanying the transaction is complete and whether the named parties are free of designation. These are genuinely different analytical frames. A business that satisfies one may not satisfy the other, and vice versa.

Consider the following comparison by criterion:

Scope of the obligation. Under BIS / EAR, the obligation attaches to controlled technology and software and to parties on BIS watch lists. Under the EU travel rule, the obligation attaches to every transfer between crypto-asset service providers, without a value threshold. A transaction involving EAR99 technology (US-origin but uncontrolled) and a counterparty not on any BIS list may carry no BIS / EAR licence requirement – but it will still carry the EU data obligation if it moves between two EU-regulated service providers.

The screening target. BIS / EAR requires screening against the Entity List and Denied Persons List; OFAC requirements add the SDN List and the 50 percent rule. The EU travel rule's data obligation does not replace screening; it adds to it. The EU asset-freeze rules require screening against the EU Consolidated List. The UN Security Council Consolidated List underlies both regimes. A cross-border service provider operating under both must maintain screening against at least three distinct list sources, with different update cycles and different matching standards.

Extraterritorial reach. The Foreign Direct Product rules give BIS / EAR a significant extraterritorial dimension for items that are the direct product of controlled US technology. The EU travel rule applies to transfers between EU-regulated service providers and to transfers received by or sent to non-EU service providers where the receiving or sending entity is within EU jurisdiction. Neither regime is fully territorial; each can reach across a border to catch a transaction that the other does not.

Consequence of a gap. A BIS / EAR violation may result in denial of export privileges, civil penalties, and – where knowledge is present – criminal liability. An EU travel-rule breach may result in supervisory action, fines, and, if an underlying asset-freeze violation is also present, the full range of EU sanctions enforcement. The two penalty regimes are independent: a single transfer that breaches both can attract consequences under both.

In our experience, the firms most exposed to dual-regime consequences are those that have structured their compliance programme around one regime and assumed the other is covered. It is not. The correct approach is to treat BIS / EAR compliance and EU travel-rule compliance as separate workstreams that share data sources but address different legal questions.

How do secondary-sanctions risk and blockchain analytics change the analysis?

Secondary-sanctions risk and the use of blockchain analytics by regulators add a third layer of complexity that neither the BIS / EAR framework nor the EU travel rule addresses directly – but which both regimes can reach through their facilitation and asset-freeze provisions.

US secondary-sanctions risk for foreign financial institutions is a well-developed concept. US authority allows measures against foreign financial institutions that conduct or facilitate significant transactions for designated persons or specified sectors, as currently in force. For these purposes the definition of a financial institution can extend beyond banks to insurers and card-network operators. In the virtual-asset context, the same logic applies: a non-US crypto-asset service provider that processes a material volume of transactions for parties subject to US sanctions may find its access to the US financial system restricted, even if it is not itself designated and even if no individual transaction crossed a US-jurisdictional wire.

This secondary-sanctions dimension does not appear in the EU travel rule at all. The EU regime operates through direct prohibitions – asset freezes, making funds available – rather than through correspondent-account-style pressure on intermediaries. A non-EU service provider faces EU exposure only where it has some connection to EU jurisdiction: an EU-regulated counterpart, an EU customer, or an establishment within the EU. The US secondary-sanctions reach is structurally broader.

Blockchain analytics changes the practical operation of both regimes. Wallet clusters can be mapped to designated persons even before a formal designation is published. Regulators have used blockchain tracing to establish that a service provider processed transactions for a designated entity's wallet cluster, regardless of whether the named account holder appeared on a list at the time of the transaction. The implication for compliance is significant: a programme that screens only against current published lists, run at the moment of onboarding, will not detect a wallet that is retrospectively linked to a designated person. Dynamic, ongoing monitoring of transaction patterns – not merely point-in-time name screening – is the operational standard that regulators are moving toward.

The EU dual-use export-control regime, governed by the recast Dual-Use Regulation as currently in force, adds yet another overlay for virtual-asset service providers that develop or export cryptographic technology. Where the technology involved in a virtual-asset platform is dual-use in nature, the export of that technology outside the EU may require an authorisation separate from the asset-freeze compliance and the travel-rule data obligation. The interaction between dual-use controls, US EAR classification, and EU travel-rule requirements is one of the more technically demanding aspects of this sector's compliance posture.

What are the highest-risk gaps in practice, and when should counsel be involved?

The highest-risk gaps in virtual-asset transfer screening and the travel rule arise not from individual failures but from structural blind spots – points where the compliance programme was designed for one regime and applied to a multi-regime reality.

The first gap is technology classification. Many virtual-asset firms have never formally classified their software stack under the Commerce Control List. If the platform uses encryption above a specified strength, employs algorithmic trading, or incorporates intrusion-detection or monitoring capabilities, it may have a non-EAR99 classification that requires a licence for export or for release to foreign persons. A deemed export – the release of controlled technology to a foreign national within the United States, including through remote access – can occur without any cross-border transfer. We have acted for technology businesses that discovered a deemed-export exposure only during regulatory due diligence on an acquisition. The cost of that discovery is materially higher than the cost of a classification exercise before the matter arises.

The second gap is list coverage. Screening against a single consolidated list – even the SDN List – is not sufficient for a business operating under BIS / EAR. The Entity List and the Denied Persons List must be screened separately and on a current basis. The EU Consolidated List, updated independently of the UN and the SDN List, must also be screened where EU jurisdiction attaches. Sanctions records must be kept for five years under OFAC requirements. The multi-list, multi-regime obligation is a programme-design question, not a technology question.

The third gap is transfer data completeness. Firms that process transfers from non-EU counterparts frequently receive incomplete originator data. The EU travel rule's zero-threshold standard means there is no de minimis exception: a transfer with incomplete data is a non-compliant transfer. The operational response – whether to pend, query, or reject such transfers – must be documented in policy and applied consistently.

The fourth gap is the 50 percent rule in a virtual-asset context. A wallet held by an entity that is 50 percent or more owned by a blocked person is itself blocked property, even if the entity is not named on the SDN List. Blockchain analytics can help identify cluster associations, but the legal question – whether the entity behind the wallet meets the ownership test – is a corporate-ownership analysis, not a list-screening question. In our experience, firms that assume blockchain analytics substitutes for the ownership analysis are exposed on both counts.

Counsel should be involved at three stages: first, when designing the technology-classification framework and the multi-list screening architecture; second, when a transfer is flagged or a regulator inquiry arrives; and third, when the business is expanding into a new jurisdiction or adding a new product line that involves controlled technology. The voluntary self-disclosure mechanism, recognised as a mitigating factor in OFAC's Enforcement Guidelines, is most effective when used early and with the full picture in view. Blocked property and rejected transaction reports are due to OFAC within 10 business days of the blocking or rejection. That window is short; waiting for a comprehensive internal review before deciding whether to report is a risk in itself.

A cross-border virtual-asset business with operations touching the US, the EU, and one or more of the Gulf or Asia-Pacific regimes faces the full stack of obligations. Singapore implements UN Security Council measures through regulations administered in coordination with the Monetary Authority of Singapore; Japan implements sanctions principally through the Foreign Exchange and Foreign Trade Act; the UAE maintains a national framework with an Executive Office for control lists. Each of these adds a layer. Where two regimes both apply, the stricter prohibition governs. That principle does not reduce the compliance burden; it means the burden is determined by the most demanding regime in play at each point in the transaction.

The position above covers the structural analysis. Your specific facts – the technology in your stack, the jurisdictions of your customers, the route of your transfers, the ownership structure of your counterparties – change the analysis. If a transfer has already been flagged, or a regulatory inquiry has arrived, an early review can preserve options that narrow with time. Contact Calder & Vance at info@caldervance.com to discuss the position.

Does the myth that name screening alone is sufficient still persist?

Yes – and it persists at exactly the level where it causes the most damage. The belief that a single name-screening pass against one consolidated list satisfies the obligations under virtual-asset transfer screening and the travel rule bis / ear vs eu is the most common structural error we encounter in practice.

It is not difficult to see why the myth takes hold. Screening tools have become technically sophisticated, easy to deploy, and visibly active. When a compliance team sees no hits, it is natural to conclude that the obligation is met. But the obligation is not a list-matching exercise. It is a programme.

Under BIS / EAR, the programme must include technology classification, end-use and end-user verification, Foreign Direct Product analysis, and multi-list screening – including Entity List and Denied Persons List coverage in addition to the SDN List. Under the EU travel rule, the programme must ensure that complete originator and beneficiary data accompanies every transfer, that the data is verified before processing, and that incomplete transfers are handled according to a documented policy. Under the EU asset-freeze regime, screening must be current, multi-list, and connected to blockchain-analytics monitoring for wallet clusters. Under the UN Consolidated List obligations that underlie both regimes, the Security Council's listings must be reflected in screening regardless of which autonomous regime applies.

None of these requirements is satisfied by a single name-screening pass. The controls are complementary; the gap between them is where enforcement actions originate.

What does a complete programme look like? It covers: accurate ECCN classification or EAR99 confirmation for every technology component; screening against the SDN List, Entity List, Denied Persons List, EU Consolidated List, and UN Consolidated List on a current basis; transfer-data collection and verification that satisfies the EU zero-threshold standard for transfers involving EU-regulated parties; a documented procedure for handling incomplete or flagged transfers; blockchain-analytics monitoring integrated into ongoing transaction review; a corporate-ownership analysis procedure for the 50 percent rule and its EU equivalent; and a reporting calendar that accounts for the 10-business-day blocked-property reporting window. That is the architecture of compliance counsel. It is not a technology purchase.

For a confidential review of your screening programme's coverage under both the BIS / EAR and EU regimes, contact Calder & Vance at info@caldervance.com. We act for multinationals, financial institutions, and exporters on sanctions and export-control matters across the major regimes.

Related practices

• BIS / EAR affiliate-level restrictions service – end-user controls, Entity List exposure, and licence compliance for affiliated entities.
• OFSI vs Australia virtual-asset travel rule analysis – a comparative assessment of the UK and Australian travel-rule positions.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.