Bitcoin & the Travel Rule
From 1 July 2026, Australian virtual asset service providers (VASPs) must meet strengthened Travel Rule obligations when they move cryptocurrency on behalf of customers. Those rules are now in operation. This page explains what that means in plain language: who must comply, what exchange users and self-custody holders need to know in practice, and what it does not change about Bitcoin itself.
Quick read
- The Travel Rule applies to regulated intermediaries (exchanges and other VASPs), not to ordinary self-custody between wallets you control.
- Moving Bitcoin from an exchange to your own wallet still creates obligations at the exchange boundary. The “self-hosted exemption” means they do not pass data to another VASP, not that no checks apply.
- What AUSTRAC requires is not necessarily the same as how an individual exchange chooses to comply. There is no universal nationwide requirement for message signing, xpub disclosure or a Satoshi test.
- A TBA-supported collaborative security vault remains self-custody. Once Bitcoin is in your vault, moving it to other wallets you control is unchanged by the Travel Rule.
- Protect wallet information: never disclose seed phrases or private keys, and do not casually provide xpubs or other wallet-wide metadata simply to satisfy an exchange workflow.
- Pay from your own wallet: Australian exchanges increasingly restrict direct withdrawals to third-party wallets. For TBA clients, withdraw Bitcoin to your own collaborative security vault first, then pay TBA fees from your vault.
- The Bitcoin Adviser is not a VASP, exchange or custodian; we do not transmit Travel Rule data.
What is the Travel Rule?
The Travel Rule is an anti-money laundering and counter-terrorism financing (AML/CTF) standard. When a reporting entity transfers money, virtual assets, or certain other value on behalf of a customer, it must collect specific information about the payer and payee and pass that information to the next institution in the chain where the rules require it.
The standard comes from the Financial Action Task Force (FATF) Recommendation 16, which was extended to virtual assets and virtual asset service providers. Countries implement it in national law. In Australia, the framework sits under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 and the AML/CTF Rules 2025, supervised by AUSTRAC.
The practical purpose is transparency: so businesses in the chain can manage money laundering, terrorism financing, and proliferation financing risk, and so law enforcement can obtain transfer information when legally required. It is not a ban on self-custody Bitcoin; it regulates intermediaries that move value for others.
What changed on 1 July 2026?
Australia’s broader AML/CTF reforms have been rolling out in stages. For virtual asset transfers, AUSTRAC’s transitional rules deferred full Travel Rule obligations until 1 July 2026 for both existing digital currency exchange providers (now treated as VASPs) and newly regulated virtual asset services. That date has passed: those obligations are now in operation. The timeline below remains useful historical context.
| Milestone | Date | What it means (summary) |
|---|---|---|
| Travel Rule for virtual asset transfers | 1 July 2026 | VASPs must meet Travel Rule obligations for covered virtual asset transfers (no small-amount exemption in Australia). |
| VASP enrolment and registration | By 29 July 2026 | Providers of registrable virtual asset services must enrol and apply to register with AUSTRAC (existing registered DCEs roll over; new services have transitional arrangements if they apply in time). |
| Broader reform activity | From March 2026 | Transaction monitoring and other AML/CTF steps are already live or ramping for many entities; Travel Rule is one major July milestone, not the only reform. |
| ASIC digital assets framework | From 9 April 2027 | Separate timeline from AUSTRAC’s Travel Rule. Consumer licensing and disclosure rules under ASIC are not the same as AML Travel Rule compliance. |
For VASPs, AUSTRAC states that all non-incidental transfers of virtual assets are subject to the Travel Rule, whether domestic or international. That is stricter than some legacy wire-transfer carve-outs for low-value domestic payments.
Who must comply?
In scope: businesses that act as an ordering institution (accepting the instruction to send value), intermediary institution (passing transfer messages along the chain), or beneficiary institution (making value available to the payee). This includes Australian crypto exchanges, custodial wallet providers, and other virtual asset service providers that transfer assets on behalf of customers.
Generally not in scope as Travel Rule reporters:
- Individual Bitcoin holders sending from wallets they control (you are not a VASP because you hold your own keys).
- Transfers that involve only physical currency or tangible property (not virtual assets on-chain).
- Peer-to-peer on-chain transfers between two self-hosted wallets where no obliged entity sits in the middle of the transfer chain.
- The Bitcoin Adviser: we provide education and collaborative security support; we are not a custodian, exchange, or VASP and do not collect or transmit Travel Rule transfer messages. See our scope and risks page.
What information moves?
Exact fields depend on the type of transfer and your role in the chain. AUSTRAC describes transfer messages as typically including:
- Payer information (identity details the ordering institution must collect and, where required, verify).
- The payee’s full name.
- Tracing information that lets institutions link the transfer to accounts or wallets in the chain.
For transfers between two regulated institutions (for example, exchange to exchange), the ordering VASP passes this data to the next business in the chain before the transfer is completed. Institutions must monitor for missing or inaccurate information and follow risk-based policies when data is incomplete.
Australia has no de minimis threshold for virtual asset Travel Rule transfers: obligations apply regardless of transaction size. FATF’s global transition to updated messaging standards may take years for some banking rails; VASPs may use more contained payment ecosystems in the meantime.
This page does not reproduce every field in the Rules. For authoritative detail, use AUSTRAC’s guidance linked in Further reading below.
Self-hosted vs exchange (custodial) wallets
A self-hosted (self-custody) wallet is controlled by the payer or payee, not by an exchange or custodian. AUSTRAC treats these differently from custodial wallets held at a VASP.
The important nuance: there is an exemption when the transfer is to a self-hosted wallet. The ordering institution does not need to send Travel Rule information to another business in the chain because there is no next VASP. That is not a full exemption from compliance:
- Ordering institutions sending to a self-hosted wallet must still collect and verify payer information and collect payee information and tracing information under AUSTRAC’s virtual asset guidance.
- Beneficiary institutions receiving from a self-hosted wallet must obtain payer information and tracing information, and the payee’s full name if not already held, before making assets available.
VASPs must also maintain AML/CTF policies that describe how they determine whether a destination is custodial or self-hosted, how they assess counterparty licensing in FATF-aligned jurisdictions, and what steps they take to identify or verify the person controlling a wallet under a risk-based approach. Practices vary by exchange: wallet-type questions in an address book, ownership checks, or enhanced review for higher-risk transfers are common themes. AUSTRAC does not prescribe a single universal technical method, such as message signing, xpub disclosure or a Satoshi test, for proving control of every self-hosted wallet. Individual exchanges may nevertheless require additional verification under their own AML/CTF policies.
Verified vs unverified self-hosted wallets
The regulatory framework recognises that self-hosted wallets may be verified or unverified. AUSTRAC reform guidance describes a dedicated reporting requirement for transfers involving unverified self-hosted wallets that begins later (guidance summaries reference 31 March 2029 for certain reporting by ordering and beneficiary institutions), with further guidance to come. That is separate from the 1 July 2026 Travel Rule operational start for virtual asset transfers.
Recognition of unverified wallets does not mean an exchange must process every withdrawal to an unverified wallet. An exchange may impose stricter requirements under its own AML/CTF program, including declining transfers that do not meet those policies.
The law vs your exchange’s policy
One distinction matters more than almost any other detail on this page: what AUSTRAC requires is not necessarily the same as how an individual exchange chooses to comply.
What the rules require
When an exchange sends Bitcoin to the customer’s self-hosted wallet, it still has AML/CTF obligations. It must undertake due diligence so it has reasonable grounds for determining what type of wallet is receiving the Bitcoin, collect the required payer and payee information, verify required payer information, and follow its AML/CTF policies. Separately, the VASP must maintain risk-based policies covering how it determines wallet type and any steps it takes to verify the person controlling the wallet. See AUSTRAC’s additional travel rule obligations when transferring virtual assets.
What the rules do not prescribe
AUSTRAC does not prescribe one universal technical method by which every Australian Bitcoin holder must prove control of a self-hosted wallet. Message signing, xpub disclosure and Satoshi tests are not interchangeable with “the Travel Rule requires this.”
What an exchange may additionally require
Individual exchanges may impose their own verification mechanisms under their risk-based AML/CTF program, including:
- customer attestation;
- cryptographic message signing;
- a small proof-of-control transaction (sometimes called a Satoshi test);
- extended public-key (xpub) verification;
- other proprietary verification processes.
These are implementation choices made by individual providers. An exchange that adopts stricter controls is applying its own risk program; that does not mean every other exchange must use the same method, and it does not mean the provider is acting outside the law by requiring more than the minimum technical prescription in the Rules. Exchanges may decline transactions that do not satisfy their policies.
One exchange may accept an attestation or address classification. Another may require cryptographic proof. Another may use a different compliance provider. These differences arise from exchange implementation and risk policy, not because Bitcoin self-custody itself has changed.
Why multisig can be different
Collaborative multisignature custody deliberately distributes control across multiple keys. No single key, device or service provider represents ownership of the wallet. Verification methods designed around a conventional single-signature wallet may therefore be technically unsuitable, unnecessarily intrusive or unsupported by a particular multisig architecture.
Three methods now appear in real exchange workflows:
- Message signing: May not be straightforward or supported for a particular multisig script, coordinator or hardware configuration. Inability to complete a simplistic signing challenge does not mean the customer does not control the vault.
- Small transaction / Satoshi test: May create a circular problem for a newly created, unfunded vault. The customer is trying to withdraw Bitcoin to fund the vault, but is being asked to first send Bitcoin from that vault to prove control.
- Xpub disclosure: An extended public key can expose substantially more wallet information than the single receiving address required for one withdrawal. It should not be treated casually as equivalent to confirming one address.
Protect your wallet information
- Never disclose a seed phrase or private key to verify a withdrawal. Those are secrets that control funds.
- Be cautious about providing xpubs, wallet descriptors or other wallet-wide metadata when the purpose is simply to verify a single destination address. These are primarily a privacy and data-exposure issue: they can reveal more information about your wallet and transaction history than is necessary for the immediate transfer. They are not the same class of secret as a seed phrase or private key, but they are still sensitive.
- If an exchange’s verification method is incompatible with your collaborative multisig architecture, ask whether an alternative method is available before changing your custody setup or disclosing additional wallet information.
Common scenarios
Exchange → exchange
Both sides are VASPs. The sending exchange must pass originator and beneficiary data through the value transfer chain. You may need to label the destination as an exchange, select the counterparty platform, and use verified withdrawal addresses. Missing data can cause delays or refusal to process the transfer under the exchange’s AML program.
Exchange → self-custody
Typical path when moving Bitcoin off an exchange into your own wallet or a collaborative security vault (self-custody, not an exchange account). The exchange remains the ordering institution. Expect wallet-type questions, payee identification, and possible verification steps. The exchange does not pass Travel Rule messages to another VASP, but still applies its self-hosted wallet policies. This is different from sending from your exchange balance to another company’s wallet as a fee or payment; some Australian exchanges restrict that pattern under their AML/CTF and service policies.
Self-custody → exchange
You send from a wallet you control to an exchange deposit address. The exchange acts as beneficiary institution and must obtain required payer and tracing information before crediting you. Deposits may be held or reviewed while checks complete.
Self-custody → self-custody
A standard on-chain transfer between two wallets you control, including from a Theya collaborative security vault to a hardware wallet, cold storage, or another self-hosted address. With no obliged entity in the chain, Travel Rule standards do not apply to the transfer itself. This activity is unchanged by the July 2026 rules: ordinary Bitcoin network usage, not a regulated value transfer service.
Exchange examples (not legal guidance): Australian exchanges have implemented these requirements differently. Independent Reserve uses address-book classifications and verification for personal and custodial wallets. HardBlock requires customers withdrawing to their own self-custody to confirm that they control the keys and has chosen not to support direct withdrawals to custodial wallets. Other providers use additional technical checks such as message signing, xpub verification or proof-of-control transactions. These are different implementation choices under each provider’s AML/CTF program, not different versions of the law.
If you work with The Bitcoin Adviser
Many clients buy Bitcoin on an Australian exchange, then move it into client-controlled collaborative security (for example, a Theya multisig vault). A TBA-supported vault is self-custody: you retain beneficial ownership and control; we are not a custodian and do not hold your Bitcoin. That journey crosses the regulated boundary at the exchange withdrawal, not when you later move coins between wallets you control.
This distinction is increasingly important in practice. Australian exchanges are generally structuring withdrawals around destinations you own or control, rather than allowing your exchange account to be used to pay Bitcoin directly to an unrelated third party. For TBA clients, the simplest workflow is therefore to withdraw Bitcoin to your own collaborative security vault first, then make any payments, including TBA advisory fees, from your own wallet: exchange → your vault → TBA.
- We do not hold customer Bitcoin, operate an exchange, or send Travel Rule transfer messages.
- Your exchange will apply its Travel Rule and AML policies when you withdraw to a self-hosted or vault address.
- Vault to vault, or vault to any other self-custody wallet you control, is an on-chain transfer with no VASP in the middle. The Travel Rule does not apply to that movement itself; it is unchanged by July 2026 reform for ordinary client-initiated sends.
- Collaborative security distributes keys and documents continuity; it does not turn your vault into an exchange account. See Collaborative Security.
- Onboarding: if you fund a new vault from an exchange, complete KYC and address-book steps on the exchange side before large transfers. Our onboarding guide covers exchange funding in parallel with vault setup.
- SMSF and audit context: keep your own records (dates, amounts, TXIDs, exchange statements) for substantiation. See the SMSF Bitcoin Audit Guide if applicable.
We can help you think through custody architecture and documentation; we cannot override or expedite an exchange’s compliance decisions.
Choose an exchange workflow compatible with your custody architecture
A properly designed custody architecture should not be weakened merely to accommodate an exchange workflow designed around a different type of wallet. When choosing or reviewing an exchange, consider whether its withdrawal verification is compatible with collaborative multisig.
If one exchange cannot reasonably verify a collaborative multisig vault without inappropriate disclosure or technical workarounds, you can:
- ask for an alternative verification method;
- ask your adviser for assistance understanding what information is safe and appropriate to provide;
- where appropriate, use another regulated exchange whose withdrawal process is compatible with the custody architecture.
Switching exchanges is not the automatic first response. Start by asking whether an alternative method is available.
Paying TBA fees: withdraw to your wallet first
Australian exchanges are increasingly restricting direct Bitcoin withdrawals to third-party wallets under their broader AML/CTF and service policies. In practice, you should not rely on being able to pay a TBA invoice directly from your exchange account.
The preferred process is simple: exchange → your self-custody vault → TBA.
- Buy Bitcoin on your exchange (the exchange is the regulated VASP).
- Withdraw to the collaborative security vault you own and control.
- Pay your TBA invoice from your vault as a normal client-authorised Bitcoin transaction (see pricing and onboarding: invoice payments).
This keeps the roles clear. The exchange is the regulated VASP. Your collaborative security vault is your self-custody. TBA is your adviser, not an exchange, custodian or VASP.
If you previously paid TBA directly from an exchange, allow time to withdraw to your vault first before an invoice is due. Your adviser can help you rehearse the flow.
Withdrawing Bitcoin to self-custody after 1 July 2026
No single checklist fits every holder, but these steps reduce friction now that the rules are in operation:
- Correctly classify the destination as your own self-hosted wallet where that applies (not another exchange or a third-party business wallet).
- Confirm that the payee information and wallet classification match the actual arrangement.
- Review the exchange’s requested verification method before providing additional wallet information.
- Never provide seed phrases or private keys to verify a withdrawal.
- Treat xpub and descriptor requests as sensitive privacy disclosures and seek advice if you are unsure. See Why multisig can be different.
- If the requested method does not work with multisig, ask for an alternative before changing your custody setup.
- Test with a small withdrawal where operationally appropriate before moving a large balance.
- Keep TXIDs, exchange statements and relevant verification records for tax, SMSF or estate planning files.
- Plan fee payments from your vault; do not assume you can pay advisory invoices straight from an exchange balance. Prefer exchange → your vault → TBA.
- Secure your perimeter (email 2FA, hardware keys, password manager) so compliance workflows are not undermined by account takeover. Start at the Security Centre.
- Separate concerns: AUSTRAC Travel Rule (from July 2026) vs ASIC’s later digital assets framework (April 2027). Follow the regulator relevant to each question.
What the Travel Rule does not do
- It does not ban holding Bitcoin in self-custody or collaborative multisig, including TBA-supported vaults.
- It does not change ordinary transfers between self-custody wallets you control (vault to hardware wallet, vault to vault you own, and similar).
- It does not require individuals to register with AUSTRAC as VASPs.
- It does not change Bitcoin’s protocol, consensus rules, or how keys sign transactions on-chain.
- It does not mean every wallet-to-wallet transfer is reported to government; reporting obligations attach to regulated businesses in the chain.
- It does not make The Bitcoin Adviser a custodian or transfer agent for Travel Rule purposes.
- It is not the same as banning withdrawals; exchanges may delay or refuse transfers that do not meet their AML policies, but the rule’s aim is information flow between obliged entities, not ending self-custody.
- It does not prescribe one universal technical method (message signing, xpub disclosure or a Satoshi test) for proving control of every self-hosted wallet.
Compliance friction at exchanges is real. It is also different from losing the right to hold keys yourself once coins are off-platform. Collaborative multisig should not be weakened, nor unnecessary wallet-wide information disclosed, simply because a compliance workflow was designed around single-signature wallets.
Frequently asked questions
When did the Travel Rule start for crypto in Australia?
For virtual asset transfers, key Travel Rule obligations took effect on 1 July 2026 under AUSTRAC’s transitional rules.
Broader AML/CTF reform timelines also apply from March 2026 onward. See Australia timeline above.
Does the Travel Rule apply to my personal self-custody Bitcoin?
Not while Bitcoin stays in wallets you control without a regulated intermediary moving it for you, including a collaborative security vault.
When you interact with an exchange (deposit or withdrawal), the exchange’s Travel Rule obligations apply at that boundary. Vault-to-vault or vault-to-other-wallet moves you initiate are otherwise ordinary self-custody. See Self-hosted vs exchange wallets.
Do I need to register with AUSTRAC as an individual?
No. Registration applies to businesses providing designated virtual asset services, not to individuals holding Bitcoin for themselves.
VASPs must enrol and register by 29 July 2026 if they provide registrable services. That is an operator obligation, not a holder obligation.
What happens when I withdraw from an exchange to my own wallet?
The exchange acts as ordering institution. It must meet self-hosted wallet policies: collect and verify payer information and collect payee and tracing information, without passing data to another VASP.
You may be asked to classify the address and complete verification steps in the exchange’s address book. Those steps reflect the exchange’s AML/CTF program as well as AUSTRAC’s information requirements. See The law vs your exchange’s policy.
Do I have to sign a message, provide an xpub or send a small transaction to withdraw Bitcoin to my own wallet?
Not as a universal AUSTRAC requirement. An exchange may impose one of these methods under its own AML/CTF policies.
AUSTRAC requires exchanges to meet specified information, due-diligence and risk-management obligations but does not prescribe one universal technical proof-of-control method. See The law vs your exchange’s policy.
What if my exchange’s wallet verification does not work with collaborative multisig?
Do not weaken the vault architecture or disclose sensitive wallet information simply to work around the process.
Ask whether the exchange supports an alternative verification method. If necessary, speak with your adviser about the architecture and consider whether another regulated exchange offers a more compatible withdrawal workflow. See Why multisig can be different and If you work with The Bitcoin Adviser.
Will peer-to-peer transfers between two private wallets be reported under the Travel Rule?
Generally no, because no VASP is in the value transfer chain.
FATF notes P2P self-hosted activity can still pose ML/TF risk at a policy level; countries may pursue other measures. The Travel Rule targets obliged entities, not direct on-chain transfers between individuals’ wallets.
Is there a minimum transaction amount?
For virtual asset transfers in Australia, industry and AUSTRAC-aligned summaries describe no threshold: obligations apply regardless of amount.
Some other countries retain thresholds for certain transfer types; Australia’s virtual asset rules are broad.
How is this different from ASIC’s 2027 digital assets rules?
AUSTRAC’s Travel Rule is AML/CTF transparency between institutions. ASIC’s framework (commencing April 2027 with transition) addresses different consumer and markets regulation.
Hold both timelines in mind when reading news about “crypto regulation” in Australia.
Can I pay The Bitcoin Adviser fees directly from my exchange account?
You should not rely on that. Prefer exchange → your vault → TBA.
Australian exchanges are increasingly restricting direct withdrawals to third-party wallets under their AML/CTF and service policies. Withdraw to a collaborative security vault you control first, then pay the invoice from your vault. See Paying TBA fees above.
Does the Travel Rule change transfers from my vault to another wallet I control?
No. A collaborative security vault is self-custody. Moving Bitcoin from your vault to another self-hosted wallet you control is not a VASP transfer.
Travel Rule obligations apply when a regulated exchange or custodian moves value on your behalf. Once coins are in your vault, ordinary client-initiated sends between wallets you control are unchanged. See common scenarios.
Does The Bitcoin Adviser transmit Travel Rule data?
No. We are not a VASP, exchange, or custodian.
We provide education and collaborative security support. Travel Rule compliance sits with regulated institutions in your funding and withdrawal path. See scope and risks.
What should I do when withdrawing to self-custody after 1 July 2026?
Classify the destination correctly, review any verification request before disclosing wallet information, and keep good records.
See the post-1 July checklist above and your exchange’s own Travel Rule communications.
Can exchanges refuse or delay my withdrawal?
Under their AML/CTF programs, exchanges may delay, request more information, or refuse transfers that do not meet legal or policy requirements.
Preparing accurate wallet classifications and reviewing verification requests carefully reduces avoidable friction. This page does not guarantee any exchange outcome.
Further reading (official and context)
Primary (AUSTRAC):
- Travel rule overview
- Additional travel rule obligations when transferring virtual assets
- AML/CTF transitional rules 2026
International context:
Exchange operational examples (not law):
- Independent Reserve: Crypto Travel Rule updates
- HardBlock: The Travel Rule and self-custody
- Bitaroo: Sharing isn’t always caring (one provider’s description of self-hosted wallet verification choices)
Educational only. This page is general information about how the Travel Rule may affect Australian Bitcoin holders and clients who use exchanges. It is not legal, tax, financial, or investment advice. Laws and exchange processes change; rely on qualified professionals and official regulators for decisions. See scope, risks & important information.
Questions about custody after the exchange step?
We help families and holders design collaborative security and continuity plans once Bitcoin is in client-controlled custody. For exchange-specific Travel Rule steps, follow your platform’s guidance and review verification requests carefully before disclosing wallet information.