Travel Rule Protocols: Explained and Discussed

While working in the background, a Travel Rule protocol is an integral part of Travel Rule compliance. Without a protocol, compliance is impossible. 

Below, we explain what a Travel Rule protocol is and discuss some of the most well-known options, along with guidance on choosing the ideal one. 

What is a Travel Rule Protocol? 

A protocol is a set of rules for transmitting data between entities; it is neither software nor hardware but can be implemented by either. Simply explained, a protocol is the language that 2 pieces of software use to communicate with each other. 

In the context of the Travel Rule, VASPs are obligated to exchange wallet owner information to finalise transactions. Since this exchange occurs between different solutions (software), a protocol is essential to communicate this information. 

Travel Rule Protocols Discussed 

The Travel Rule Protocol (TRP) 

TRP is the leading decentralised protocol, building on and leveraging other open industry standards from the digital asset industry. It is a royalty-free specification and does not depend on any centralised third-party services. 

TRP encourages data sharing before a transaction occurs to ensure the data is complete and the transaction does not pose any AML/CFT risks. This reduces the burden of having to return funds to the sender if the data is not compliant. 

Sumsub Protocol 

Sumsub has developed its own Travel Rule protocol: the Sumsub protocol, which uses an API to facilitate data delivery. During data exchange between two Sumsub clients, the Travel Rule transaction details show that information is transmitted directly through the Sumsub protocol. The counterparty only gains access to the complete Travel Rule data after verifying ownership of the wallet address.

The Sumsub protocol supports both types of Travel Rule data exchange: pre-on-chain (before the blockchain transaction) and post-on-chain (after the blockchain transaction).

Binance’s Protocol: the Global Travel Rule Protocol (GTR) 

Binance, the world’s leading cryptocurrency exchange by trading volume, established the Global Travel Rule (GTR) to support compliance with the FATF’s Travel Rule requirements.

All Binance entities worldwide are integrated into GTR. This means that any VASP conducting counterparty due diligence can transact with any Binance entity via GTR.

VerifyVASP

VerifyVASP is based in South Korea. It is a closed, centralised Travel Rule messaging protocol developed by Upbit in partnership with Chainalysis. 

VerifyVASP is designed to enable secure and immediate data sharing between verified VASPs. As a messaging protocol, VerifyVASP allows its members to exchange transaction data instantly in a secure, controlled environment.

TRISA

TRISA is a decentralised protocol governed by a centralised authority. It allows any VASP to connect freely, without hidden servers or restricted API endpoints. 

TRISA uses a peer-to-peer messaging system combined with a central Certificate Authority (CA) to identify and verify VASPs. The CA also functions as a directory of public key certificates, enabling secure communication between VASPs

How to Choose a Travel Rule Protocol

Several factors should be considered when choosing a Travel Rule protocol. 

For starters, it is important to check how widely the protocol has been adopted across the industry. Relying on a protocol that operates in isolation could limit your ability to transact with counterparties who use different protocols. It is important to note that decentralised protocol providers cannot cite exact numbers due to the protocol being available without any limitation. Therefore, the numbers for these protocols are more of a guideline. 

Privacy and security must also be carefully assessed. Consider how the protocol transmits personally identifiable information (PII). Is it decentralised? Is there a third party controlling it and, therefore, able to access the data exchanged via the protocol? 

Also, if the data is controlled by a third party, consider your options should this party shut down or be offline. How will data be transmitted if the protocol is unavailable? 

Another key element is the protocol’s discovery mechanism, how it identifies recipient VASPs. Does it use a central registry or a peer-to-peer discovery model? A weak or unreliable discovery method could increase the risk of failed or delayed transactions.

Read Determine Who Your Beneficiary Is Without Invading Privacy

Integration and implementation requirements should also be evaluated. How easily can the protocol be integrated with your current systems? It’s worth checking whether the vendor provides technical support or onboarding assistance, as some protocols offer more robust resources than others.

Did you know TRP is easy and free to implement? Access its specifications here. 

Cost is another factor that shouldn’t be overlooked. Different protocols operate under varying business models, such as subscription fees, per-transaction charges, or licensing arrangements. It’s important to identify any hidden costs, including fees for upgrades, maintenance, or interoperability bridges, to avoid surprises down the line. The price should be weighed against the protocol’s capabilities and adoption in the market.

Finally, consider the governance and stability of the protocol provider. Who governs the protocol? Is it based on an open standard, or controlled by the provider or third-party? Assess the financial stability, transparency, and long-term viability of the organisation behind the protocol to ensure you’re not locked into a system without a sustainable future.

Common pitfalls include selecting a protocol solely because it works with current counterparties, underestimating data protection responsibilities, and choosing a vendor without clear service-level agreements or governance transparency.

Find out more about TRP, 21 Travel Rule’s native protocol.