FATF Recommendation 16 Updated: What’s Next for the Travel Rule?

This June, the Financial Action Task Force (FATF) published the final updates to its Recommendation 16, which has mandated the Travel Rule obligation for digital assets since 2019. 

After 2 public consultations, the text clarifies existing obligations but, most importantly, introduces new concepts and requirements that countries must adhere to when passing the related legislation. Only after these domestic laws become applicable will Virtual Asset Service Providers (VASPs) be bound to the new rules.

Recommendation 16 New Requirement: Beneficiary Address

The most relevant change that must be highlighted, due to its expected impact on user experience and added friction, is the new requirement of beneficiary addresses.

Unlike the originator address, this information does not need to be provided in full: only the country and town name are enough. Nevertheless, it is clear that this brings an additional burden for the originator of a digital asset transfer, who must inform their financial institution about yet another data point on the receiving person.

The current basic beneficiary-required information has already been met with unsatisfied crypto users, when the law pushed the reality of digital asset transfers from 1 data input (wallet address) to 2 (wallet address and full beneficiary name). 

In fact, depending on the VASP's choice of Travel Rule solution and its level of interoperability with the beneficiary's VASP, they may be required to enter 3 data points (wallet address, full beneficiary name and beneficiary's exchange). 

Now, with the updated Recommendation 16, they will be expected to include an additional piece of data (the beneficiary's country and town), which may not be known, ultimately bringing the experience closer to that of traditional finance transfers. 

It is also relevant to note that the required originator data has been consolidated and made clearer in this update.The FATF removed the optional fields for date and place of birth, national identity number, and customer identification number. In the revision, apart from the originator's full name, account number, and address, only the date of birth will be mandatory.

Recommendation 16 New Requirement: Verification of Beneficiary Data

Another significant change by the revised R.16 is the introduction of data verification requirements. The beneficiary financial institution should check whether the information received on the intended beneficiary aligns with the account information it already holds. This can be done before the transfer of data, after, or on an ongoing basis, to stop atypical or misdirected transfers.

This can be an important step to fight fraud, which has grown significantly recently, as set out in recent FATF reports. 

While the data verification obligation may introduce a new layer of delay, depending on how Travel Rule providers and VASPs implement it, it might also contribute to less friction brought by errors in digital asset transfers.

Recommendation 16 New Requirement: Legal Person Data

The revision also adds a required field for cases where the originator and/or beneficiary is a legal person. All transfers above the threshold will now be required to include either:

(i) a connected BIC 

(ii) a Legal Entity Identifier (ISO 17442), or 

(iii) a unique official identifier issued by the relevant jurisdiction.

This is already a reality in 21 Analytics’ Travel Rule solution. To enable complete, automated identification of the involved originator and/or beneficiary, the 21 Analytics team has introduced the required field of Legal ID for transfers involving legal persons. 

Most often, the Legal ID used is a Legal Entity Identifier (LEI) or domestic official identifiers. This was an effort to support our VASP customers in handling legal person transactions and their associated risks. Therefore, a smooth transition is expected regarding this topic.

Recommendation 16 New Concept: The Payment Chain

Finally, the global anti-money laundering watchdog, the FATF, also clarified the concept of the payment chain, defining that the obligations on payment transparency start with the financial institution which receives an instruction from the customer, and end with the financial institution that services the account of the beneficiary or provides cash to the beneficiary.

Future Steps

The FATF acknowledges that this revision requires updates across the private sector and market infrastructures and that such changes take time to implement. For this reason, the organisation, which usually makes updates effective immediately, has taken the unusual step of allowing a transition period. FATF members are expected to implement the new requirements by the end of 2030.

In the explanatory note for the revision of Recommendation 16, the FATF also lays the ground for upcoming guidance from the institution, which will address several points that need clarity or that the public requested more information on during the consultation process. 

Most importantly, while these updates will be applicable to VASPs, they can expect specific guidance in Recommendation 15, which provides the tailored framework for the crypto industry.