Virtual-asset transfer screening and the travel rule under OFSI: explained

A payment firm operating between the United Kingdom and Australia processes a virtual-asset transfer for a client whose wallet address connects to a counterparty on a designated-persons list. The compliance team ran a name screen. The name was clean. The wallet was not. Is the firm in breach? Has it met its travel-rule obligation? These questions sit at the intersection of two distinct regulatory regimes – and the answer is different depending on which side of the transfer you are standing on.

Virtual-asset transfer screening and the travel rule under OFSI require a virtual-asset service provider (VASP – a business that exchanges, transfers, or safeguards crypto-assets on behalf of clients) to screen both originator and beneficiary information against designated-persons lists, and to transmit that information with every qualifying transfer. The governing instrument in the UK is the Sanctions and Anti-Money Laundering Act ("SAMLA") and the relevant thematic financial-sanctions regulations; the travel-rule obligation is imposed separately under financial-crime rules, but the two interlock. Under the Australian autonomous-sanctions and UNSC-implementing regime administered by DFAT, the same dual obligation exists but is calibrated differently – and the EU transfer-of-funds regime, which applies a zero threshold regardless of transfer value, represents a third reference point that any business moving assets between these jurisdictions must hold in view. As of January 2026, divergences between these regimes in scope, threshold design, and enforcement posture are material enough to create structural screening gaps for cross-border VASPs.

This analysis examines the thesis that name-level screening alone no longer satisfies the OFSI financial-sanctions obligation for virtual-asset transfers, traces the evidence across the UK, Australian, and EU regimes, compares the travel-rule architectures, and identifies the practical steps that reduce exposure at each divergence point.

The central thesis: why name screening alone fails the OFSI test

The proposition that a clean name screen discharges OFSI's financial-sanctions obligations rests on a misunderstanding of how the UK asset-freeze prohibition is framed. Under the relevant thematic regulations made under SAMLA, the prohibition extends to making funds or economic resources available, directly or indirectly, to or for the benefit of a designated person – not merely to transacting with someone whose name appears on a list. That indirect-benefit limb is where virtual-asset compliance most frequently falls short.

In our experience, the majority of VASP compliance gaps we review involve a programme that was built for name screening and never extended to wallet-address clustering, beneficial-ownership look-through, or travel-rule data verification. The programme appeared effective because it had never been tested against an indirect-exposure fact pattern. OFSI can impose a monetary penalty on a strict-liability basis – the firm does not need to have known of the designation to be in breach. That combination of broad prohibition scope and strict liability makes the gap costly.

What does the evidence show? Three structural features of virtual-asset markets make name screening structurally insufficient: (1) wallet addresses are pseudonymous and a single designated person can control dozens, (2) the 50 percent rule (OFAC's rule treating entities owned 50 percent or more by blocked persons as themselves blocked, with a broadly analogous ownership-and-control test under UK and EU rules) can render an entity subject to restrictions without any entry on a published list, and (3) transfer-routing through intermediary wallets can separate the originator from the final beneficiary across multiple hops. A name screen addresses only the first layer of the first of these three problems.

The secondary-keywords question – what is the difference between OFSI and Australia on virtual-asset transfer screening and the travel rule – turns partly on enforcement posture and partly on how the ownership-and-control test is applied to entities that hold or manage virtual assets. That difference is explored in the regime-comparison sections below. The cross-border comparison also has a third dimension: the EU transfer-of-funds regulation applies to VASPs established or operating in the EU with no de minimis threshold, meaning that any chain involving an EU-connected counterpart imports that obligation into the analysis.

How the UK financial-sanctions obligation bites on virtual-asset transfers

OFSI's financial-sanctions obligations apply to all persons and entities in the United Kingdom, and to UK persons wherever they are, in relation to virtual assets exactly as they do to fiat transfers. The thematic regulations impose an asset-freeze on funds and economic resources owned or held by, or on behalf of, a designated person. Virtual assets are economic resources for this purpose.

Three specific obligations converge for a UK VASP. First, the prohibition on making funds available – even intermediary routing through a wallet associated with a designated person may satisfy the availability test. Second, the ownership-and-control test (the UK and EU test for whether a non-listed entity is caught through a listed person) can capture a VASP's counterparty where that counterparty is controlled by a designated person, even without a direct listing. Third, relevant firms in the UK carry a legal duty to report knowledge or suspicion of a designated person's involvement in a transaction to OFSI. That reporting obligation is triggered by suspicion, not by certainty – and a VASP that screened only on name, found nothing, and never considered the wallet-address dimension has arguably not formed a reasonable suspicion view at all.

OFSI's strict-liability enforcement regime – in force since 2022, as currently in force verify before reliance – means that the question is not whether the firm intended to deal with a designated person. The question is whether the prohibited act occurred. This places the entire burden of prevention on the quality of the compliance programme. A maximum monetary penalty of the greater of £1,000,000 or 50 percent of the breach value applies at present, as currently in force verify before reliance. Pending legislative change, guidance issued in early 2026 has signalled that these parameters may rise materially.

Consider what this means in practice. A UK VASP processes a transfer from a retail client whose name does not appear on any designated-persons list. The receiving wallet is associated with an entity that is not itself listed but is owned more than 50 percent by a listed person. The transaction clears the name screen. The travel-rule data transmitted with the transfer shows only the originator's name. OFSI's prohibition is engaged by the indirect-benefit route. The firm is potentially in breach, without ever having had a reason to pause if its screening stopped at names.

The travel rule: OFSI's position versus Australia's FATF-aligned framework

The travel rule (the obligation to transmit originator and beneficiary information with each qualifying virtual-asset transfer) was developed by FATF as Recommendation 16 and extended to virtual assets. Both the UK and Australia have transposed it, but the calibration differs in ways that matter for cross-border compliance.

In the UK, the travel-rule obligation for virtual-asset transfers sits within the broader financial-crime regime rather than within SAMLA directly, but OFSI expects VASPs subject to its jurisdiction to maintain compliance programmes that cover both the sanctions and the travel-rule limbs in an integrated way. The practical consequence is that a VASP which collects and transmits travel-rule data for anti-money-laundering purposes is generating information that is also directly relevant to its OFSI screening obligation: the originator and beneficiary details can and should feed back into the sanctions screen. We regularly advise clients that treating travel-rule data as a financial-crime-only input, quarantined from sanctions workflows, is itself a structural gap.

Australia's DFAT-administered autonomous-sanctions regime applies to virtual assets on the same basis as to other financial transactions. The FATF-aligned travel-rule obligation in Australia sits within the AML/CTF framework. On the divergence question – the difference between OFSI and Australia on virtual-asset transfer screening and the travel rule – three features stand out. First, the Australian regime does not yet carry a strict-liability civil-penalty provision for financial sanctions of the same architecture as OFSI's 2022 amendment, which means that the mental-element analysis differs in an enforcement scenario. Second, the ownership-and-control test applied by DFAT to entities captured through a listed person follows the UN Consolidated List conventions and its own legislative instruments, and the line between "ownership" and "effective control" is drawn in a manner that requires independent analysis for each designated person rather than a mechanical threshold application. Third, Australian enforcement posture has historically proceeded by prohibition and revocation rather than monetary-penalty notice, though this is a qualitative observation and the position should be verified for current facts.

The EU's transfer-of-funds regime is the relevant reference point for any VASP with EU connections. The zero-threshold rule – requiring originator and beneficiary information regardless of transfer value – means that an EU-connected leg of a multi-hop transfer imposes travel-rule obligations that are broader in scope than both the UK and Australian equivalents for smaller transfers. Where two regimes both apply, the stricter prohibition governs the conduct of a person subject to both; a VASP cannot net out the obligations or apply the less demanding standard to the EU leg.

Where do the two regimes diverge most sharply?

The OFSI-versus-Australia divergence on virtual-asset transfer screening and the travel rule crystallises across four dimensions, each carrying a distinct compliance implication for cross-border businesses.

Strict liability versus intent-based enforcement. OFSI's monetary-penalty power operates on a strict-liability basis. A breach is established by the act; the firm's knowledge or intent goes only to the aggravating or mitigating assessment. The Australian financial-sanctions enforcement model requires a different analytical sequence. For a business subject to both regimes, this means that the same transaction can produce different enforcement trajectories in each jurisdiction – but that is not a basis for a lower standard in either. The stricter prohibition governs.

Reporting obligations. The UK places a mandatory reporting obligation on relevant firms with knowledge or suspicion of a designated person. The Australian framework carries analogous reporting obligations, but the trigger definitions and the receiving authority differ. A cross-border VASP must maintain separate procedures for each jurisdiction's reporting pathway. Conflating them – or assuming that a report filed in one jurisdiction satisfies the obligation in the other – is a compliance error we see regularly.

Ownership and control analysis for virtual-asset entities. UK case law has engaged with the ownership-and-control question for corporate entities; the direction of travel is that actual, not theoretical, control is required, and that existing influence over a company's commercial conduct can suffice to establish control even without a majority shareholding. Applied to virtual-asset entities – DAOs, multi-signature wallets, protocol governance tokens – this analysis becomes considerably more complex. The Australian regime's ownership test follows a similar logic but without the same body of domestic authority, meaning the outer boundary is less precisely drawn.

Blockchain analytics integration. Regulators in both jurisdictions treat blockchain analytics as a component of a reasonable screening programme. A designation can, as currently in force verify before reliance, extend to wallet addresses associated with a designated person. A VASP that does not integrate blockchain analytics into its screening workflow cannot claim to have taken all reasonable precautions under either regime.

Risk flags: when does a virtual-asset compliance programme fall below the threshold?

There is a persistent myth in the market – and this is the objection worth addressing directly – that name screening alone is sufficient to meet the OFSI obligation for virtual-asset transfers. It is not. The prohibition is broader than the list; the control test can catch unlisted entities; and the indirect-benefit limb of the asset-freeze is not addressed by a name check at all. A VASP that believes its programme is adequate because it screens against the OFSI Consolidated List and has never received a penalty notice has likely not been exposed to the type of transaction that would test the programme's outer limits.

The risk flags that, in our practice, most reliably indicate a programme operating below the required threshold are these. First, the absence of wallet-address screening alongside name screening. Second, a travel-rule workflow that feeds data to the AML team but does not loop back into the sanctions team's beneficiary-review process. Third, no documented ownership-and-control analysis for counterparties that are legal entities, particularly where those entities are incorporated in a jurisdiction with restricted transparency. Fourth, de-risking (a financial institution exiting a relationship to avoid sanctions exposure) used as the primary response to a screening alert, without a structured investigation to determine whether the alert represents a genuine OFSI concern or a false positive. De-risking can terminate legitimate relationships and generate its own regulatory scrutiny if done in a pattern-led way without documented rationale.

Fifth, and most acutely for cross-border VASPs: no documented analysis of which regime's travel-rule and sanctions obligations apply to each leg of a multi-jurisdiction transfer. A transfer originating in Australia, passing through a UK VASP, and settling with an EU-connected counterpart triggers three sets of obligations. A programme designed for one regime will underserve the others. Have you mapped your cross-border transfer routing against each regime's obligation set? If the answer is "we assumed our UK compliance covers the others," the programme has a structural gap.

The cross-border compliance architecture: building a programme that works across OFSI, Australia, and the EU

Building a programme that satisfies OFSI, DFAT's sanctions requirements, and the EU transfer-of-funds regime simultaneously is achievable, but it requires deliberate design rather than extension of a single-jurisdiction model. The position above covers the standard UK case. Your facts – the counterparty, the wallet structure, the transfer routing, the regimes in play – change the analysis and the control design.

The starting point is a regime map. For each jurisdiction in which the VASP has a presence or through which it routes transfers, the applicable sanctions prohibitions, the travel-rule threshold and data requirements, the reporting obligation and trigger standard, and the enforcement posture must be set out and compared. Where two regimes impose obligations on the same transaction, the stricter standard is the compliance floor.

The second element is integrated screening architecture. Name screening and wallet-address screening must run in parallel and feed a single alert-management workflow. Travel-rule data received from the sending institution is not merely a financial-crime input; it is a sanctions data source and must be treated as such. The originator's name, the originator's wallet address, and the stated purpose of the transfer each contain information that is relevant to both AML and sanctions analysis.

The third element is documented ownership-and-control analysis for any counterparty that is a legal entity. For VASPs, this is particularly important where the counterparty operates in a sector or jurisdiction that is subject to heightened sanctions scrutiny. The analysis does not need to be repeated for every transaction, but it must be current – an ownership structure that was clean six months ago may have changed.

The fourth element is a reporting-readiness procedure. Records of every sanctions screen, every travel-rule data transmission, every ownership-and-control analysis, and every alert and disposition must be retained. The UK requires records to be kept for five years, as currently in force verify before reliance. Equivalent retention requirements apply under the other regimes. In an OFSI investigation or an enforcement review under any comparable regime, the firm's ability to demonstrate what it did, when, and why is the difference between a mitigated and an aggravated finding.

The fifth element is voluntary self-disclosure readiness. Voluntary self-disclosure (VSD – a voluntary report to the regulator of a suspected breach before the regulator identifies it) is a recognised mitigating factor in OFSI's enforcement process, as it is in OFAC's Enforcement Guidelines. A VASP that discovers a possible breach and takes no action, waiting to see whether the regulator identifies it, foregoes a material mitigation argument. A programme that builds VSD assessment into its incident-response workflow is in a materially better position than one that does not.

A cross-border VASP that has assessed its obligations under OFSI, considered the Australian and EU comparators, and designed its screening, travel-rule, and reporting architecture against that map is in a qualitatively different position from one that has simply deployed an off-the-shelf screening tool. We have acted for institutions on each side of that line, and the difference in outcome in a regulatory engagement is significant.

If a transaction has already been flagged, or a travel-rule obligation has potentially been missed, an early review can preserve options that narrow with time. For a confidential review of a potential breach or a programme-design assessment, contact Calder & Vance at info@caldervance.com.

Related practices

• Affiliate-level restrictions under BIS/EAR – understanding how entity-level controls cascade through corporate groups
• Aggregating holdings under OFAC – applying the 50 percent rule across layered ownership structures

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.