How to screen virtual-asset transfers across regimes

A payments firm processes a transfer between two virtual-asset service providers. The originator passes automated name screening. Settlement proceeds. Three weeks later, a compliance review surfaces a beneficial-owner link to a designated entity. The transfer was prohibited. The name check returned nothing because the designated person sat two layers up in the ownership chain. This is the gap that costs firms the most – not the obvious hit, but the one screening alone never reached.

Screening virtual-asset transfers across a cross-border footprint requires more than matching names to lists. As of January 2026, the travel rule (the obligation to pass originator and beneficiary information along the payment chain) operates under different thresholds, different scope rules, and different enforcement regimes in the United States, the United Kingdom, and the European Union. Where two regimes both apply, the stricter prohibition governs. A firm operating across all three must design its programme to the highest common standard, not to the minimum of any single one.

This guide walks through the core questions practitioners and compliance officers face: which rules apply, what the travel rule requires at each step, where the major regimes diverge, what the risk flags look like in practice, and when to involve sanctions counsel.

What is the travel rule and which regimes impose it on virtual-asset businesses?

The travel rule is the obligation, derived from the Financial Action Task Force recommendations and implemented differently in each jurisdiction, to collect, verify, and transmit originator and beneficiary information when a virtual-asset transfer moves between one virtual-asset service provider (VASP – any business that exchanges, transfers, or custodies virtual assets for clients) and another. It is not solely a sanctions rule; it is an anti-money-laundering control that intersects with sanctions screening at the point where transmitted information triggers a list hit or a red flag.

In the United States, VASPs operating as money-services businesses fall within the Bank Secrecy Act and OFAC's compliance expectations. OFAC does not administer the travel rule directly, but its sanctions obligations sit alongside it: a VASP that receives or transmits value involving a blocked person commits a potential violation regardless of whether travel-rule data was exchanged. BIS export-control obligations can also engage where digital assets are used to acquire controlled items.

In the European Union, the recast Transfer of Funds Regulation – extended to crypto-asset transfers – imposes a zero-threshold rule: originator and beneficiary information is required for every transfer between crypto-asset service providers, irrespective of value. There is no minimum-value floor. This is more demanding than the US position, and it reflects deliberate policy. Council Regulations impose the asset-freeze and making-available prohibitions on EU operators directly; a CASP processing a transfer for a listed person may face dual exposure.

In the United Kingdom, the Financial Conduct Authority applies travel-rule requirements aligned with the FATF standard. OFSI administers financial-sanctions obligations under SAMLA and the relevant thematic regulations on a strict-liability basis: knowledge is not required for a breach to be established. A UK VASP therefore carries sanctions exposure independently of whether its travel-rule messaging system functioned correctly.

In our experience, firms that treat travel-rule compliance and sanctions compliance as separate workstreams are the ones that discover the gap after a breach rather than before it. The two programmes must share data, not run in parallel silos.

What does cross-border step-by-step screening look like for a virtual-asset transfer?

Virtual-asset transfer screening and the travel rule cross-border, step by step, begins before any transaction is executed and continues through settlement. The following sequence applies across the major regimes; where a regime imposes a higher standard, that step is marked accordingly.

Step 1 – Counterparty identification. Before accepting or transmitting a transfer, the VASP must identify both the originator and the beneficiary to the degree required by the applicable country regime. For retail clients this typically involves identity verification; for institutional counterparties it involves legal entity identification and ultimate beneficial ownership analysis to at least the first natural-person level. The 50 percent rule (OFAC's rule treating entities owned 50 percent or more in the aggregate by blocked persons as themselves blocked) means ownership chains must be traced, not assumed.

Step 2 – Travel-rule data collection. The originator VASP collects the required data fields: at minimum, originator name, account/wallet identifier, and beneficiary name. The EU regime requires this for every transfer with no value threshold. Other regimes apply their own thresholds; verify the current position before relying on any specific figure.

Step 3 – Sanctions screening of the data collected. Screen the originator name, beneficiary name, and – critically – the underlying beneficial owners against all relevant lists: the OFAC SDN List, the UK Consolidated List, and the EU Consolidated List, as well as any sector-specific lists such as BIS's Entity List where the transfer has a goods or technology dimension. Name screening alone is insufficient at this step; the beneficial-ownership data collected must also be screened.

Step 4 – Blockchain analytics. Regulators use blockchain analytics to trace wallet clusters. A wallet associated with a designated person carries exposure for any VASP that receives or sends from it. A compliant programme should run analytics checks against known high-risk wallet clusters and flag unusual transaction patterns. This is not optional decoration; it is the control that catches what name screening misses.

Step 5 – Travel-rule data transmission. Before or simultaneously with the transfer, the originator VASP transmits the required data to the beneficiary VASP. The EU zero-threshold requirement means that even micro-transfers between CASPs require full data transmission. The beneficiary VASP must screen the received data before crediting the beneficiary.

Step 6 – Hold, reject, or block decision. Where screening produces a match or a material red flag, the transfer must be held pending enhanced review. A confirmed match with a listed person triggers an asset-freeze obligation under the EU and UK regimes and a blocking obligation under OFAC. Under OFAC, blocked property must be reported within 10 business days and records must be kept for five years. Rejected transactions carry their own shorter reporting window; verify the current deadline before relying on it.

Step 7 – Escalation and record-keeping. All screening decisions, including negative screening decisions, must be documented. Where a transfer is blocked or rejected, the file must record the basis, the list references, and the steps taken. Voluntary self-disclosure is a recognised mitigating factor in OFAC enforcement if an apparent violation is discovered after settlement; early escalation to compliance counsel preserves that option.

How does the EU zero-threshold rule diverge from the US and UK positions?

The most operationally significant divergence between the three major regimes is threshold. The EU Transfer of Funds Regulation, as extended to crypto-asset transfers under the EU's crypto-asset rules, imposes no minimum value: every CASP-to-CASP transfer requires full originator and beneficiary data, regardless of the amount transferred. This is a deliberate departure from the FATF baseline threshold.

The US position differs. OFAC's sanctions obligations attach to any transfer involving a blocked person, but the US travel-rule implementation under the Bank Secrecy Act historically applied a value threshold that the EU rule does not recognise. A VASP subject to both regimes – for example, one registered in the EU but also serving US-connected clients – cannot adopt the US threshold as its operational standard. It must apply the EU zero-threshold rule to all transfers within scope of that regime, and the OFAC obligations on top.

The UK position is aligned broadly with the FATF standard but sits alongside OFSI's strict-liability sanctions regime. Under OFSI's enforcement and monetary penalty guidance, a VASP can face a penalty based on the value of the breach: the maximum penalty is the greater of £1,000,000 or 50 percent of the estimated value of the breach, as currently in force, verify before reliance. This makes the financial consequence of a screening failure directly proportional to the size of the transfer – a significant exposure for high-value institutional flows.

Does your compliance programme have a single documented standard for which threshold applies to each transfer type, or does it default to the most permissive? That default is a gap.

What are the risk flags that warrant enhanced due diligence or a hold?

Enhanced due diligence is triggered not only by a direct list hit but by a pattern of indicators that individually may seem minor. A single flag rarely resolves the question; the combination is what matters.

• Ownership opacity: the beneficial owner cannot be identified beyond the first corporate layer, or the entity was recently incorporated in a jurisdiction with no apparent operational purpose.
• Wallet cluster association: blockchain analytics flag the originating or destination wallet as part of a cluster previously linked to a designated person or a sanctioned exchange.
• Incomplete travel-rule data: the originator VASP has transmitted a transfer without full required data. Under the EU regime, this is itself a compliance failure; it also removes a key screening input.
• Jurisdiction mismatch: the registered address of the counterparty, the IP address of the login, and the wallet geography do not correspond. This is not conclusive, but it is a red flag for further inquiry.
• A sharp change in transaction volume: a significant and unexplained increase in transfers through a corridor that has historically been low-volume. Regulators treat unusual volume shifts as a diversion indicator.
• Nested VASP exposure: the direct counterparty is itself a VASP that processes transfers on behalf of its own clients. Exposure to those underlying clients runs through the nested relationship.

In our practice we regularly advise VASPs that have identified a red flag but are uncertain whether it rises to the level requiring a hold. The standard is not certainty; it is whether a reasonable compliance officer, having seen the flag, would have required enhanced review before proceeding. If the answer is yes and no review was conducted, the position is weaker in any subsequent enforcement inquiry.

What is the virtual-asset transfer screening compliance checklist that a cross-border VASP should maintain?

A virtual-asset transfer screening and the travel rule compliance checklist for a cross-border VASP addresses seven operational areas. The purpose is not to tick boxes but to ensure that every element required by the strictest applicable regime is present and documented before a transfer settles.

1. Regulatory mapping: identify every jurisdiction in which the VASP has clients, holds assets, or operates infrastructure. For each, confirm which travel-rule implementation and which sanctions regime applies. Where regimes overlap, the stricter obligation governs.

2. Counterparty onboarding standard: document the ownership-chain analysis standard for institutional counterparties. For retail clients, document the identity-verification threshold. Both must reach natural-person beneficial owners; corporate-layer-only identification is insufficient.

3. Screening list coverage: confirm that the automated screening system covers the OFAC SDN List, the UK Consolidated List, the EU Consolidated List, and – where relevant – sector-specific lists including the BIS Entity List. List updates must be ingested promptly; a stale list is a live gap.

4. Beneficial-owner screening: confirm that the system screens beneficial owners, not only the directly named party. The 50 percent rule means that a non-listed entity owned by a listed person is itself treated as blocked; screening the entity name alone does not catch this.

5. Blockchain analytics integration: confirm that analytics checks run on wallet identifiers before and, where possible, after settlement. Documented results must be retained as part of the screening record.

6. Travel-rule data controls: confirm that the data fields required by the strictest applicable regime are collected for every transfer. For EU-regulated flows, this means every CASP-to-CASP transfer, no minimum value. Document the transmission process and retention of data sent and received.

7. Escalation and reporting protocol: document the escalation path from a screening flag through to a compliance officer, and from there to legal counsel and – where required – the regulator. OFAC's 10-business-day reporting obligation for blocked property and OFSI's reporting obligations for relevant firms are not optional; they run from the moment a firm identifies blocked property or has knowledge or suspicion of a designated person. A documented escalation path is the only reliable way to meet those windows.

When should a VASP involve sanctions counsel, and what does early involvement accomplish?

Sanctions counsel should be involved at three points: when designing the screening programme, when a material red flag or a potential match surfaces, and when an apparent violation is identified. Waiting until after a breach has been confirmed removes the most valuable option a firm has – voluntary self-disclosure, which is a recognised mitigating factor under OFAC's Enforcement Guidelines and carries practical weight in the UK and EU enforcement postures as well.

Early involvement at the programme-design stage means that the firm's screening logic, its ownership-analysis standard, its travel-rule data controls, and its escalation protocol are tested against the live requirements of all applicable regimes before a transaction goes wrong. In our experience, this is where the largest risk reduction occurs. A gap in the programme design will be exploited, sooner or later, by the complexity of the underlying transaction flow.

When a red flag surfaces, counsel can assess whether the flag requires a hold, a rejection, or enhanced due diligence, and can advise on the applicable reporting window. Where the window is short – as it is under OFAC for blocked-property reports – the time between identifying the issue and briefing counsel directly affects whether the firm's response is timely or late. A late report in a matter that would otherwise have been non-egregious can shift the enforcement analysis materially.

Where an apparent violation has already occurred, the options are narrower but they remain. Voluntary self-disclosure before a regulator independently identifies the violation is recognised as a mitigating factor. Preparing a well-structured disclosure, with an accurate account of the apparent violation, the controls in place at the time, and the remediation steps taken, requires technical sanctions expertise that is different from the general compliance function. We have acted in matters of this type across the major regimes, and the quality of the disclosure document is rarely irrelevant to the outcome.

Cross-regime exposure adds further complexity. A VASP subject to OFAC, OFSI, and EU Council Regulation simultaneously may need to disclose to multiple regulators, on different timelines, with different standards of what a disclosure must contain. Coordinating those disclosures without inadvertently prejudicing one filing through another requires counsel who operates across all three regimes.

Related practices

• Affiliate-level restrictions under BIS and the EAR – assessing when export-control obligations follow ownership chains into affiliated entities.
• EU travel-rule guide for virtual assets – detailed analysis of the EU zero-threshold requirement and CASP obligations under the recast Transfer of Funds Regulation.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.