Seven Travel Rule Blind Spots Putting VASPs in the Danger Zone

The digital asset industry is expanding rapidly. According to a 2025 report by Mordor Intelligence, the global cryptocurrency market—valued at about USD 2.96 trillion in 2025—could reach nearly USD 7.98 trillion by 2030, implying a compound annual growth rate (CAGR) of ~ 30.1%. 

As the sector surges, the adoption of lower-risk assets like stablecoins and new regulatory frameworks—such as Hong Kong’s Stablecoin Ordinance and the GENIUS Act—are driving momentum. At the same time, regulators worldwide are tightening expectations for digital-asset providers.

A key part of these requirements is the Travel Rule. This is the FATF’s standard recommending VASPs collect, verify, and transmit originator and beneficiary information before or during virtual asset transfers.

More than 85 jurisdictions have already implemented the Travel Rule, and over 100 are expected to follow in 2026 and beyond. However, implementation is uneven, and many VASPs inadvertently expose themselves to unnecessary risk. 

Suggested read: Explore Travel Rule Implementation

Blind spot 1: Uneven global enforcement: Where the sun rises in one place and sets in another

As countries are adopting the Travel Rule at different speeds, VASPs compliant in one jurisdiction end up interacting with VASPs that are only partially compliant, or perhaps not compliant at all. This is the so-called “Sunrise issue,” with the Travel Rule “sun” rising much faster in some jurisdictions than others.  

This slows down transfers, leads to inconsistent expectations, and limits the ability of firms to meet their obligations. The Sunrise issue is difficult to solve because it relies on both government decisions and the cooperation of VASPs. It’s too big for individual firms alone to solve.

💡To help solve this, Sumsub has created a free account for VASPs that are not yet required to fully comply with the Travel Rule but want to get ahead of the requirements and currently lack their own compliance tools—while also making it easier for other VASPs to meet their obligations. This solution is accessible to all VASPs, simple to set up, effective at flagging suspicious transactions, and helps strengthen the safety and transparency of the crypto ecosystem. It is also flexible and scalable, making it suitable for both small providers and large, high-volume VASPs.

Blind spot 2: National data protection compliance does not mean global compliance

VASPs need to send personal data to each other to comply with the Travel Rule, which has serious repercussions for privacy obligations. In addition to encrypting data, firms may also need to comply with privacy frameworks such as EU GDPR, UK GDPR, and California’s CCPA, and demonstrate strong internal controls. 

While sharing personal data under the Travel Rule can be compliant if handled properly, differences in privacy laws across jurisdictions mean that a VASP’s national compliance does not automatically ensure global compliance, and careful controls are needed to avoid violations.

💡Sumsub's independent audits and internationally recognized certifications help shine a light on this common blind spot. Our Information Security Management System supports compliance with privacy laws around the world, while our Local Data Processing infrastructure helps with regional storage and processing wherever needed.

Blind spot 3: Fragmented Travel Rule regulations make it easy to fall through the cracks

Travel Rule requirements vary significantly across jurisdictions. While the FATF provides clear recommendations, individual countries decide how strictly to implement them based on their own risk assessments, regulatory priorities, and industry maturity. As a result, some regulators mandate counterparty due diligence, while others do not. Some require verification of unhosted wallets, while others choose a lighter-touch approach. This fragmentation creates a major blind spot for VASPs handling high-volume cross-border virtual asset transfers.

The consequences of non-compliance vary by jurisdiction and can be severe, ranging from fines and license revocations to personal liability and even imprisonment. 

💡Sumsub’s jurisdictional rule bundles cover more than 11 jurisdictions and 35 markets, making it easy to help resolve fragmentation. Whenever a counterparty's VASP's location is unclear, the system automatically applies the strictest possible rules by default to minimize compliance risk.

Blind spot 4: Interoperability gaps can be significant

At present, there is no universal solution for transmitting Travel Rule data; networks operated by different providers also often use incompatible protocols. When originating and beneficiary VASPs use different systems, messages can fail to send, leading to delays, errors, and extra costs.

However, regulators increasingly view interoperability as an essential component of Travel Rule compliance. 

💡Sumsub helps close these gaps by connecting with the broadest range of protocol providers on the market, including Code, GTR, Sygna, and TRP. This coverage allows for reliable message transmission across systems that would otherwise be unable to communicate.

Suggested read: Ask Sumsubers: What is the difference between the Sunrise problem and the Interoperability problem? Which should you be more concerned about?

Blind spot 5: Disjointed systems make Travel Rule integrations unnecessarily costly

Travel Rule integrations often turn out to be far more resource-intensive than VASPs anticipate. As regulations evolve, firms may need to repeatedly update their systems, logic, and workflows—especially when it comes to unhosted wallet verification. This constant rebuilding drives up operational costs, puts added pressure on compliance teams, and increases the risk of expensive mistakes.

💡Sumsub reduces this burden by bringing KYC, AML screening, transaction monitoring, unhosted wallet verification, and VASP-to-VASP communication into a single, unified platform.

Blind spot 6: Verifying wallet ownership is highly complex

Whether a wallet is hosted or unhosted can determine which requirements apply. However, proving control of unhosted wallets can be difficult. Nevertheless, VASPs still need to be able to prove ownership, depending on the jurisdiction. Verification depends on wallet type and local regulations, and VASPs can easily underestimate how often wallet verification becomes a roadblock.

💡Sumsub helps make this process simpler by supporting multiple verification methods, including digital signatures and Address Ownership Proof Protocol, to help firms meet evolving regulatory expectations without harming the user experience.

Blind spot 7: Do you know who is really behind a blockchain address?

The masked nature of blockchain addresses makes determining who is really behind them an ongoing challenge. Without knowing who the address-holder is, VASPs cannot apply a risk-based approach. Fragmented protocols can further complicate this process, slowing transfers down and leading to more manual reviews.

💡Sumsub makes life easier by using multiple blockchain analytics tools and a growing blockchain address book based on client data. It also prevents accidental data disclosure by confirming wallet addresses with beneficiary VASPs without them needing to share personal information.

Shining a light on the Travel Rule blind spots

VASPs cannot afford blind spots in their Travel Rule workflows, as failing to comply with regulations can have serious consequences, ranging from fines and license suspensions to criminal penalties. Hopefully, by shining a light on the Travel Rule blind spots that put VASPs at risk, VASPs can turn compliance into a competitive advantage.