A virtual asset service provider registered in Jersey and transferring stablecoins to a counterpart wallet in Singapore faces a question that is no longer theoretical: does its compliance program satisfy the Travel Rule (the obligation to pass originator and beneficiary data with every qualifying transfer) under both the Jersey regime and the recipient jurisdiction's rules simultaneously? The answer turns on how the program is built, not merely on whether the firm holds a registration. Jersey's Financial Services Commission (JFSC) has aligned its anti-money laundering and countering the financing of terrorism (AML/CFT) expectations with FATF Recommendation 15, which requires VASPs to collect, verify and transmit identifying information on the parties to a virtual asset transfer above the applicable threshold. For operators entering or already active in Jersey, building a compliant program means understanding that threshold, the data fields required, the technology options available and the cross-border gaps that arise when the counterpart VASP operates under a different regime.
This page sets out the regulatory basis for Travel Rule compliance in Jersey, the program components a JFSC-supervised entity must have in place, the practical steps to build or audit that program, and the cross-border banking and tax interactions that affect how the program is resourced. It is written for general counsel, compliance officers and founders who already understand crypto mechanics and need the legal and operational answer.
What is the regulatory basis for the Travel Rule in Jersey?
Jersey's Travel Rule obligation flows from the Money Laundering (Jersey) Order and related AML/CFT Codes issued by the Jersey Financial Services Commission, which incorporate FATF Recommendation 15 by reference and impose it directly on registered VASPs. The JFSC is the primary supervisory authority for virtual asset service providers on the island and enforces the same Travel Rule data obligations that apply in the major onshore hubs. Jersey is not an EU member state and therefore MiCA (the EU Markets in Crypto-Assets Regulation) does not apply directly – but a Jersey VASP serving EU-facing counterparts must accommodate MiCA's Transfer of Funds Regulation expectations on the EU side of the transaction, a practical cross-border tension we see frequently in our practice.
The JFSC's AML/CFT Handbook sets out the supervisory expectations in detail. It requires a VASP to identify and verify both the originating customer (the party sending virtual assets) and the beneficiary (the recipient) for any transfer that meets or exceeds the applicable threshold. Where the transfer falls below that threshold, a risk-based assessment of whether to collect the data still applies. The framework does not limit this obligation to fiat-on/off transfers. It extends to wallet-to-wallet transfers between two VASPs, and it imposes an obligation on the receiving VASP to obtain the originator data even when the sending VASP is located outside Jersey.
Importantly, the JFSC has made clear that supervisory visits and thematic reviews now routinely include Travel Rule readiness as a specific examination item. Operating a VASP in Jersey without a documented Travel Rule program – including policies, technical infrastructure and staff training – is treated as a material compliance gap. The consequences range from remediation requirements to registration suspension. For a business that relies on its Jersey registration as the gateway to correspondent banking and institutional counterparts, the risk of supervisory action is existential, not academic.
To map your Jersey compliance program against current JFSC expectations, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity structure, the transaction volumes and the counterpart jurisdictions – change the analysis materially.
What must a Travel Rule compliance program in Jersey actually contain?
A Travel Rule compliance program for a Jersey VASP has six core components, each of which the JFSC expects to find documented and operational at the time of any supervisory review. First, a KYC framework (know-your-customer procedures) that covers not only the direct customer but also the counterpart VASP and, where applicable, the ultimate beneficial owner of the sending or receiving wallet. Second, a transaction monitoring system capable of identifying transfers that meet or exceed the applicable threshold in real time and flagging those that require Travel Rule data exchange before settlement.
Third, a Travel Rule messaging protocol – typically implemented through one of the established inter-VASP messaging networks – that transmits the required originator and beneficiary fields securely to the counterpart institution. Fourth, a counterpart VASP due diligence process that assesses whether the receiving or sending VASP is itself regulated in a FATF-compliant jurisdiction, has equivalent AML/CFT controls and is not on a relevant sanctions list. Fifth, a sunrise issue policy: a documented approach to handling transfers where the counterpart VASP is not yet Travel Rule capable, setting out the risk-based steps the Jersey VASP will take before proceeding, holding or declining. Sixth, a record-keeping framework that retains all originator and beneficiary data for the period required by Jersey law, in a form accessible to the JFSC on request.
The MLRO – Money Laundering Reporting Officer (the designated individual responsible for the firm's AML program) – is personally accountable for each of these components under Jersey law. The MLRO must be a senior, qualified individual with direct access to the board and must report any identified deficiencies to senior management without delay. In our cross-border practice, we regularly advise firms that have a technically operational messaging protocol but a deficient counterpart due diligence process – the gap that most often triggers JFSC feedback during supervisory visits.
How do you build a compliant program from scratch in Jersey?
Building a Travel Rule compliance program in Jersey follows a structured sequence: gap assessment first, then policy drafting, then technology selection and integration, then staff training and finally a pre-launch dry run against live transaction flows. Each step has a distinct legal and operational input, and compressing the sequence is the most common mistake we see in inbound engagements.
The gap assessment compares the firm's current state against the JFSC's AML/CFT Handbook requirements and FATF Recommendation 15. It identifies which data fields the firm currently captures, which it does not and which of its technology systems are capable of handling Travel Rule messaging without a rebuild. For firms migrating from a lighter offshore regime, this step frequently reveals that the KYC framework covers direct customers but not VASP-to-VASP transfers – a structural gap that requires new onboarding procedures, not just a policy update.
Policy drafting covers the Travel Rule policy itself, the counterpart VASP due diligence standard, the sunrise issue procedure and the record-keeping schedule. These policies are not static documents: the JFSC expects them to be reviewed and updated as the regulatory environment changes and as the firm's transaction profile evolves. Technology selection involves evaluating the available inter-VASP messaging networks and aligning the firm's choice with the networks used by its primary counterparts. A Jersey VASP that routes most of its institutional volume to Singapore MAS-licensed counterparts will need a protocol compatible with both regimes.
Staff training must cover not only the mechanics of Travel Rule data exchange but also the decision rules for the sunrise issue – the real-world scenario where a transfer arrives from a VASP that cannot or will not provide Travel Rule data. The JFSC expects the MLRO to have reviewed and signed off the training materials. A pre-launch dry run tests the entire chain: from customer instruction through transaction monitoring, Travel Rule message dispatch, counterpart acknowledgment and record storage. Finding a gap at this stage is an asset; finding it during a supervisory visit is a liability.
How does the Travel Rule interact with cross-border banking and tax in Jersey?
Jersey's position as a cross-border financial center means that a VASP registered there will almost always have transaction flows that touch multiple regimes simultaneously, and the Travel Rule program must account for each of them. On the banking side, the correspondent banks that service Jersey VASPs increasingly require evidence of a fully operational Travel Rule program as a condition of opening or maintaining accounts. A firm that cannot demonstrate compliant Travel Rule messaging – with records of counterpart VASP due diligence – risks account closure, a consequence that effectively terminates operations regardless of regulatory standing.
On the tax side, the data collected under the Travel Rule – originator identity, transaction values and counterpart information – overlaps materially with the information required for Common Reporting Standard (CRS) and, for US-facing flows, FATCA reporting. In our cross-border practice, we have seen firms build their Travel Rule infrastructure in isolation from their tax reporting function, then face a costly data reconciliation exercise when the two sets of obligations diverge. Structuring the data architecture to serve both regulatory and tax reporting from a single record set is materially more efficient and is the approach we recommend at the design stage.
For firms serving EU-resident customers from Jersey, the Transfer of Funds Regulation expectations on the EU side mean that the receiving EU VASP will apply its own data requirements to the inbound transfer. The Jersey VASP must transmit data fields that satisfy both Jersey law and the EU counterpart's local rules. Where those fields diverge – and they sometimes do, particularly on the question of whether a self-hosted wallet address must be verified – the program needs a documented resolution policy rather than an ad-hoc judgment at the point of transfer.
A practical illustration: Travel Rule remediation for a payments-layer VASP
In a recent engagement, a payments company operating a Jersey-registered VASP came to us after its banking provider raised concerns about the firm's AML program during an annual review. The firm had a Travel Rule policy on paper but no operational messaging infrastructure and no counterpart VASP due diligence records. We conducted a gap assessment, drafted revised policies and guided the firm through the selection and integration of an inter-VASP messaging protocol compatible with its primary counterparts in the MAS-regulated Singapore market. We also restructured the firm's KYC onboarding to capture the VASP-to-VASP data fields required by the JFSC. Within a matter of weeks, the firm was able to demonstrate an operational program to its banking provider and avoid account termination. The remediation also surfaced a data architecture overlap with the firm's CRS reporting obligations, which we addressed as part of the same mandate.
Which compliance structure fits your Jersey operation?
The right program design depends on the operator's profile, transaction volume and counterpart mix. Three patterns emerge consistently in our practice.
A startup VASP entering Jersey with a single licence category and predominantly retail-to-exchange flows should build a minimum-viable program: a clearly documented Travel Rule policy, a single inter-VASP messaging protocol aligned to its primary counterparts and an MLRO with a clear escalation path. The timeline from gap assessment to operational readiness is typically a matter of weeks, not months, if the technology integration is straightforward. The key risk at this stage is underestimating the counterpart due diligence obligation.
A mid-market VASP with multiple licence categories, institutional counterparts across several FATF-equivalent jurisdictions and a meaningful fiat on-ramp should invest in a more comprehensive technology stack: a messaging protocol with broad interoperability, an automated transaction monitoring system and a formal counterpart VASP register. This profile also needs a more granular sunrise issue policy, because the volume of transfers from non-Travel-Rule-capable counterparts will be higher. The banking interaction is more complex, and the data architecture decision – Travel Rule records, KYC records and CRS/FATCA reporting drawn from a single source – is worth resolving at the design stage.
A group structure with a Jersey entity and operating subsidiaries in the EU, Singapore or the Gulf faces the most complex program design. Each subsidiary is supervised locally, with its own Travel Rule rules, but intra-group transfers and shared services mean that a group-level Travel Rule policy must be layered over the local programs without creating conflicts. We have seen group structures where the Jersey entity's Travel Rule messaging satisfies the JFSC but the EU subsidiary's transfer monitoring flags the same transactions under the Transfer of Funds Regulation because the data fields were transmitted in a different format. A unified data model, agreed at the group level, prevents this.
If a prior application stalled, an account was closed or a supervisory review raised Travel Rule concerns, contact OBOLUS at info@oboluslaw.com. A second read frequently surfaces the structural reason and the route back.
A common assumption: one registration covers all Travel Rule obligations
A common assumption among operators expanding from an offshore base is that a single VASP registration – in Jersey or elsewhere – satisfies the Travel Rule obligations for all jurisdictions in which the firm operates. This is not the case. The Travel Rule applies at the point of the transfer, and both the sending and receiving jurisdiction's rules apply simultaneously. A Jersey VASP sending to a Singapore MAS-licensed counterpart must satisfy the JFSC's requirements on dispatch and the MAS requirements on what the receiving firm expects to see. Where those regimes diverge – and the threshold, the mandatory data fields and the treatment of unhosted wallets are all areas of active divergence across FATF-equivalent jurisdictions – the program must accommodate both.
The same logic applies to the firm's MLRO designation. Jersey law requires the MLRO to be a natural person, named to the JFSC and based in a position of seniority within the firm. A nominal appointment – a director who holds the title but has no operational involvement in AML decisions – will not withstand supervisory scrutiny. The JFSC expects the MLRO to be the person who actually reviews and approves suspicious transaction reports, signs off on the counterpart due diligence register and attests to the board that the Travel Rule program is operational. We map this responsibility structure as part of every Jersey compliance engagement.
Self-assessment: is your Jersey Travel Rule program examination-ready?
Before a JFSC supervisory visit, a Jersey VASP's compliance officer should be able to answer yes to each of the following questions. Is there a written Travel Rule policy, dated and signed by the MLRO, that covers the data fields required for both originator and beneficiary? Is there an operational inter-VASP messaging protocol, tested against live transaction flows, with records of at least one full cycle from instruction to acknowledgment? Is there a counterpart VASP due diligence register, updated at least annually, that covers every VASP with which the firm has transacted in the past review period? Is there a sunrise issue policy that sets out the precise steps – hold, request, escalate or decline – to be followed when a counterpart cannot provide Travel Rule data? Is there a record-keeping schedule, implemented in the technology stack, that retains all Travel Rule data for the period required by Jersey law? Is the MLRO a named individual, known to the JFSC, with documented authority to halt a transaction pending Travel Rule compliance?
If any of these questions produces a no or a qualified answer, the gap represents a supervisory risk. The JFSC has increased the frequency and depth of thematic reviews of VASP AML programs. A gap identified in advance is a remediation task; a gap identified during review is a regulatory event.
Related at OBOLUS
- AML and Travel Rule compliance for digital asset businesses – the firm's full compliance and AML practice, including Travel Rule program design across multiple jurisdictions.
- Outsourcing and cloud rules for licensed crypto firms – how to structure technology outsourcing without triggering regulatory concerns at the JFSC or equivalent supervisors.
- Utility token legal opinion for early-stage founders – token classification analysis to determine whether your instrument triggers additional Jersey or cross-border regulatory obligations.
FAQ
What does the Travel Rule require from a VASP?
The Travel Rule requires a VASP (virtual asset service provider) to collect, verify and transmit identifying information about the originator and beneficiary of a virtual asset transfer at or above the applicable threshold. The JFSC applies this obligation in line with FATF Recommendation 15. The required fields typically include the originator's full name, account identifier and address or equivalent, together with the beneficiary's name and account identifier. The receiving VASP must obtain and screen the originator data before crediting the beneficiary. Both parties carry obligations; neither can discharge its duty by pointing to the other's inaction.
Who must act as MLRO for a crypto firm?
Under Jersey law, the MLRO (Money Laundering Reporting Officer) must be a natural person – not a corporate entity or a nominal title holder. The individual must be of sufficient seniority to make binding compliance decisions, have direct access to the board and be named to the JFSC. For a VASP, the MLRO is personally responsible for the Travel Rule program, suspicious activity reports and counterpart due diligence. In our practice, the most common gap we see is an MLRO appointment that satisfies the formal registration requirement but lacks the operational authority to hold or decline a non-compliant transfer.
How do regulators audit crypto AML programs?
The JFSC conducts both scheduled supervisory visits and thematic reviews of VASP AML programs. During a review, examiners typically request the firm's AML/CFT policy suite, transaction monitoring records, counterpart VASP due diligence files and Travel Rule messaging logs for a sample period. They will test whether the MLRO's documented authority matches operational practice and whether the sunrise issue policy was applied consistently to non-compliant inbound transfers. Findings range from informal remediation guidance to formal directions and, in serious cases, registration suspension. Preparation – a pre-visit internal audit against the JFSC's published expectations – is the most effective risk-reduction step available to any Jersey VASP.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the compliance, AML and Travel Rule programs that sit around them. Digital assets are the whole of our practice. We map the licence, banking and compliance stack across operating, custody and payment layers before you commit – and we structure licensing, banking and tax as one mandate rather than three disconnected workstreams. To discuss your situation, contact info@oboluslaw.com.
By Victor Olsen, Regulatory & Compliance Analyst – specialising in VASP AML program design, Travel Rule implementation and JFSC supervisory readiness for cross-border digital-asset businesses.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.