BLOCKCHAIN LAB BRIEFING · KYB AND IDENTITY
The Travel Rule Is a Message Between Institutions. It Is Not a Field on a Block.
FATF’s wire-transfer logic, carried into crypto by Recommendation 16 and the EU’s transfer-of-funds rules, obliges firms to send originator and beneficiary information. The ledger does not do that job.
2 October 2026
01
What happened
The Financial Action Task Force expects virtual-asset service providers to obtain, hold, and transmit originator and beneficiary information on transfers above the relevant threshold, and to have a way to identify transfers involving unhosted wallets. The EU’s Regulation (EU) 2023/1113 extends transfer-of-funds information duties to crypto-asset transfers.
None of that text says the personal data should be written into a public transaction. A public chain is a poor place for a name, an account number, or an address of a natural person.
02
Why it matters
TrustOps exists because evidence and identity do not belong on a ledger that anyone can index. A team that encodes the travel-rule payload in calldata will create a record it cannot delete, in tension with data-protection duties and with the minimisation the rest of this site argues for.
The operational object is a secure channel between two supervised firms, plus a policy for when the other side is a self-hosted wallet.
03
The operating layer
Keep the payload off-chain. Store a reference, a hash, or a message id if a public audit trail is genuinely required. Screen before you broadcast, not after. Log the decision. Do not log the passport.
A protocol that moves tokens between two of your own wallets is not the same fact pattern as a transfer between two service providers. Do not bolt one control onto the other.
04
What is verified
FATF has published updated guidance and targeted updates on virtual assets. Regulation (EU) 2023/1113 is the Union’s transfer rule and is published on EUR-Lex. Implementation details and thresholds sit in those texts and in national rules.
05
What remains unclear
Which travel-rule protocol two specific firms have actually interoperated. Whether a self-hosted wallet flow in your product collects more data than the rule requires.
06
The catch
Compliance theatre writes the name on-chain and calls the transaction compliant. That design fails privacy, and it still fails the travel rule if the receiving institution never got a message it can read.
This is not a sanctions-screening product and not legal advice.
WATCH
What builders should watch
- 01The channel used between institutions, and what it stores.
- 02The unhosted-wallet branch, written as a procedure.
- 03A deletion and retention rule for the off-chain payload.
BOTTOM LINE
Send the information to the institution that must have it. Do not publish it to the network.
Sources
Blockchain Lab uses public social posts as reporting leads, not as proof. Every published briefing is assessed against primary sources, available documentation and relevant technical context. Social engagement is not used as evidence of the underlying claim.
Continue
Crypto Pulse
Pi Network Says It Will Explore an Open USD Partnership. It Does Not Issue the Coin.
Crypto Pulse
A World Bank Working Paper Estimates a Bitcoin Leak in Aid. The Range Is Not a Seizure.
Crypto Pulse
The SEC Proposes a Custody Path for Crypto Held by Advisers and Funds
Crypto Pulse
A Senate Crypto Tax Bill Is Real. Its Sponsor Did Not Promise a Flood of Capital.
Crypto Pulse
Coinbase and Citi Connect Stablecoin Acceptance to Bank Infrastructure
Regulation
MiCA Splits E-Money Tokens from Asset-Referenced Tokens. The Split Is the Product.
Stablecoins
A Stablecoin Integration Is a Redemption Desk. The Token Is the Receipt.
Regulation
A Crypto-Asset White Paper Is Disclosure. It Is Not a Licence to Sell.
Regulation
Basel’s Crypto Groups Are a Capital Question for Banks. They Are Not a Token Rating.
Tokenisation
The UK Digital Securities Sandbox Is a Place to Test Market Infrastructure. It Is Not a Shortcut to a Listing.
Stablecoins
Singapore’s Stablecoin Framework Is for Single-Currency Tokens Issued in Singapore. Read the Boundary.
Regulation
A Dubai VARA Licence Is a Dubai Licence. It Does Not Travel in the Token.
Regulation
DORA Regulates the Firm’s ICT Risk. It Does Not Certify a Chain.
Privacy
A Public Ledger Is a Poor System of Record for Personal Data. GDPR Makes That Operational.
Stablecoins
The USDC Break in March 2023 Was a Bank Exposure. The Chain Did Not Depeg Itself.
Stablecoins
A Reserve Attestation Is a Snapshot. It Is Not an Audit of Solvency.
Stablecoins
PYUSD Is a Paxos Dollar Token Distributed Through PayPal. The Brand Is Not the Issuer.
Stablecoins
A Tokenised Deposit Is a Bank Liability. A Stablecoin Is Someone Else’s.
Tokenisation
BUIDL Is a Tokenised Fund Share. It Is Not a Dollar, and It Is Not a Bond You Hold at Home.
Tokenisation
A Token Does Not Create Title. The Instrument Does.
Tokenisation
In Most Tokenised Deals the Asset Sits in a Vehicle. The Token Is a Claim on the Vehicle.
Settlement
Atomic Settlement on a Ledger Is Not Legal Finality.
Custody
Proof of Reserves Shows Assets on a List. It Does Not Show What the Firm Owes.
Stablecoins
TerraUSD Was a Design for Defending a Peg. It Was Not a Reserve of Dollars.
Stablecoins
A Basis Trade Can Fund a Synthetic Dollar. It Can Also Unwind.
Stablecoins
DAI Is as Sound as Its Collateral and Its Oracles. The Peg Is the Output.
Staking
A Dominant Liquid Staking Protocol Is an Operator Fact, Not Just a Convenience.
Staking
Restaking Reuses a Stake as Collateral for Other Services. The Slash Is Shared Too.
Ethereum
EIP-4844 Blobs Are Temporary Data. They Are Not a Storage Layer.
Ethereum
Account Abstraction Changes the Wallet. It Does Not Remove the Key.
Ethereum
A Rollup Sequencer Is an Operator. Liveness and Order Are Its Job.
Security
The Bridge Is the Risk. The Exit Window Is the Design.
Security
A Price Oracle Is a Committee with a Timestamp. It Is Not the Market.
Bitcoin
Lightning Is a Liquidity Network. Capacity on a Chart Is Not a Path.
Bitcoin
A Spot Bitcoin ETF Is a Fund Share. It Does Not Hand You a Key.
Identity
A Verifiable Credential Stays with the Holder. The Ledger Stores a Reference, If Anything.
Tokenisation
A Permissioned Token Is an Allowlist with a Hook. The Standard Is Not the Law.
Stablecoins
A Freeze Function Is an Administrator. Put It in the Risk Register.
Payments
ISO 20022 Is a Message Standard. It Does Not Make a Token a Payment System.
Payments
FedNow and a Stablecoin Finalise on Different Ledgers. Do Not Merge the Clocks.
Treasury
Chains Move on Saturday. Many Banks Do Not. The Gap Is a Position.
Operations
A Ledger Does Not Replace Reconciliation. It Adds a Feed.
Security
A Pause Key Is a Control. It Is Also a Single Point of Failure.
Security
An Upgradeable Proxy Means the Rules Can Change. Read the Admin, Not Only the ABI.
Governance
Token Voting Is Not a Board. Delegation Often Is Not Either.
Ventures
Points Are a Marketing Balance. They Are Not a Right to a Token or to Revenue.
Credit
An Invoice Token Can Be Pledged Twice. The Ledger Will Not Notice.
Assets
A Carbon Token Can Sell the Same Tonne Twice. Retirement Is the Event That Matters.
Agents
An Agent Needs a Budget and a Stop Before It Gets a Wallet.
Canon
What changed: ten papers, read against what happened next.
Forge
Forge is the bridge from a paper to a working demo.
Studio
The route is paper, pattern, prototype, proof, venture.