Travel Rule Is Coming to Thailand: A Closer Look at How Crypto Transfers Will Change

The Travel Rule is set to reshape digital asset transfers through SEC-regulated operators, including exchanges, brokers, and dealers, by requiring information identifying senders and recipients. Taking effect on 27 February 2027, how will these requirements affect operators, exchange users, and those holding assets in self-hosted wallets and what is the trade-off against this greater transparency bring?

A Wallet Address Alone May Not Be Transparent Enough

In General, transactions on a blockchain can be traced. The publicly visible information shows assets moving from one wallet address to another. this is a feature widely praised as making blockchain transactions “transparent and verifiable.” Yet seeing assets move between wallets does not necessarily reveal who is behind a transaction. Therefore, the Travel Rule addresses this gap by requiring information about the sender and recipient to support efforts to prevent money laundering. How does it work? Pulse Legal takes you through it step by step.

What Is the Travel Rule in the International Context?

The Travel Rule forms part of the Financial Action Task Force’s (FATF) standards on anti-money laundering and countering the financing of terrorism. It applies the payment transparency principles under Recommendation 16 to virtual assets. At its core, the rule requires Virtual Asset Service Providers (VASPs) to obtain, retain, and transmit specified information about the sender and recipient to the counterparty service provider promptly and securely. This supports transaction monitoring and the tracing of assets linked to criminal activity. In Thailand, these obligations fall on digital asset business operators under the Emergency Decree on Digital Asset Businesses B.E. 2561.

The word “travel” refers to information accompanying a transaction. However, FATF does not require personal information to be recorded directly on a public blockchain. The information may be transmitted through a separate channel linked to the transaction.

FATF standards generally serve as guidelines for domestic legislation and regulation. Thailand’s Travel Rule requirements are set out in SEC Notification No. Sor Thor. 9/2569, which digital asset business operators in Thailand must use as the basis for designing their Travel Rule systems.

What Does Thailand’s Travel Rule Require?

According to the SEC’s news release and Q&A, the obligations apply to digital asset business operators under SEC supervision, such as exchanges, brokers, and dealers. Operators must establish risk management policies and procedures, collect information about customers and transaction counterparties, conduct checks on counterparty service providers and relevant intermediaries, and transmit the required information together with the transfer instruction to the recipient’s service provider.

Operators must also retain supporting information for every transfer for at least 5 years, in a form that allows regulators to retrieve or inspect it immediately. The Travel Rule therefore affects transfer procedures, information systems, and internal governance. Pulse Legal has prepared accompanying flowcharts to illustrate the requirements below.

Outgoing Digital Asset Transfers

When a customer (the “Sender”) instructs a digital asset business operator (the “DA Operator”) to transfer digital assets, the operator has the following obligations.

1. Collect the required Travel Rule data. The information required depends on the value of the transfer, with THB 30,000 as the threshold.

For transfers valued at less than THB 30,000, the required Travel Rule data comprises:

The names of the sender and recipient.
The account numbers of the sender and recipient.
The wallet addresses of the sender and recipient.

For transfers valued at THB 30,000 or more, the required Travel Rule data comprises:

The names of the sender and recipient.
The account numbers of the sender and recipient.
The wallet addresses of the sender and recipient.
The sender’s address.
The recipient’s country and province or city.
The sender’s date of birth, where the sender is an individual.
The legal entity registration number or government-issued identification number, where the sender or recipient is a legal entity.

**The Travel Rule data is shown in the green boxes in the flowchart.

2. Verify the Travel Rule data. Once all required information has been collected, the operator must carry out the following checks in relation to the sender and recipient.

(1) Sanctions screening: Check whether the recipient’s name and wallet address appear on a sanctions list. If there is a match, the operator must not execute the transfer.

(2)Wallet classification: Use tools to determine whether the recipient’s wallet is a hosted wallet (a digital asset wallet held and controlled by a service provider, such as a wallet opened with a DA Operator) or a self-hosted wallet (a wallet which user holds and controls independently, whether through a hardware wallet or another arrangement).

For a hosted wallet: The operator must ensure that the transfer is to a wallet of another DA Operator, or an overseas operator that is not located in a jurisdiction on the “High-Risk Jurisdictions subject to a Call for Action” list and operates lawfully in that country.

(3) Sender verification: Verify the sender’s information. Most operators are likely to already hold their customers’ know-your-customer (KYC) information. However, other types of operators that are not exchanges and do not hold the sender’s KYC information may need to request additional information.

For a self-hosted wallet: If the digital assets are valued at THB 30,000 or more, the operator must verify that the recipient actually holds and controls the wallet (self-hosted wallet ownership verification).

3. Execute the transfer, transmit the information, and retain records

Once the information under Step 1 has been collected and the checks under Step 2 have been passed, the operator may execute the transfer instruction. For a transfer to a hosted wallet, it must also transmit the information collected under Step 1 to the recipient’s service provider together with the transfer instruction.

The operator must retain the information collected under Step 1 and the records of checks under Step 2 for at least 5 years from the date of the transfer, in a form readily available for inspection.

Incoming Digital Asset Transfers

When an operator receives digital assets, it has the following obligations.

1. Identify the originating wallet type

The operator must use tools to determine whether the originating wallet is a hosted wallet or a self-hosted wallet.

If it is a hosted wallet, the operator must ensure that the assets have been transferred from a wallet of another DA Operator, or an overseas operator that is not located in a jurisdiction on the “High-Risk Jurisdictions subject to a Call for Action” list and operates lawfully in that country. If these conditions are not met, the operator must not allow the recipient to access the digital assets.

2. Collect the required Travel Rule data.The information required depends on the value of the digital assets received, with THB 30,000 as the threshold.

For incoming transfers valued at less than THB 30,000, the required Travel Rule data comprises:

The names of the sender and recipient.
The account numbers of the sender and recipient.
The wallet addresses of the sender and recipient.

For incoming transfers valued at THB 30,000 or more, the required Travel Rule data comprises:

The names of the sender and recipient.
The account numbers of the sender and recipient.
The wallet addresses of the sender and recipient.
The sender’s address.
The recipient’s country and province or city.
The sender’s date of birth, where the sender is an individual.
The legal entity registration number or government-issued identification number, where the sender or recipient is a legal entity.

**The Travel Rule data is shown in the green boxes in the flowchart.

For transfers from hosted wallets, the information is expected to have already been provided by the sending operator. If any information required under Step 2 is missing, the receiving operator must follow up to obtain it. If the missing information cannot be obtained and the transfer is from a self-hosted wallet, the operator must not allow the recipient to access the digital assets.

3. Verify the Travel Rule data.Once all required information has been collected, the operator must carry out the following checks.

(1) Sanctions screening: Check whether the sender’s name and wallet address appear on a sanctions list. If there is a match, the operator must not allow the recipient to access the digital assets.

(2) Self-hosted wallet ownership verification: Where the Travel Rule data is complete and the transfer originates from a self-hosted wallet, the operator must consider the transaction value. For transfers valued at THB 30,000 or more, it must verify that the sender actually holds and controls the wallet.

4. Make the assets available and retain records

Once the information under Step 2 has been collected and the checks under Step 3 have been passed, the operator may allow the recipient to access the digital assets. It must retain the information collected under Step 2 and the records of checks under Step 3 for at least five years from the date of the transfer, in a form readily available for inspection.

Implications for Digital Asset Users in Thailand

Many users in Thailand are likely to use centralized exchanges (CEXs). The most visible effects will be on digital asset deposits and withdrawals. Users may need to prepare recipient information, provide details about the transaction counterparty, or verify control of a wallet, depending on the circumstances.

The THB 30,000 threshold captures a substantial number of everyday transactions. This raises privacy concerns, particularly regarding the collection of senders’ addresses. A data breach, a possibility whenever information is collected in one place, could expose users to harm. Incidents overseas have included home invasions and violence intended to steal digital assets or force victims to transfer them. The 2020 Ledger customer data breach, for example, exposed names, addresses, and phone numbers, followed by reports of threats to invade customers’ homes. In the United States, there have also been criminal cases involving perpetrators breaking into homes and forcing victims to open their accounts to steal cryptocurrency. These incidents do not establish that the Travel Rule caused such harm. They do, however, illustrate how linking identity and residential information to digital asset holdings can put both assets and personal safety at risk if the information falls into the wrong hands.

The Travel Rule does not prohibit the use of self-hosted wallets. However, users seeking to convert digital assets held in self-hosted wallets into fiat currency will face additional steps as Travel Rule information is requested. They may also need to complete self-hosted wallet ownership verification, although the methods to be used and their practical feasibility remain uncertain. This raises a further question: will additional data collection and verification slow down transactions through operators such as CEXs?

The SEC has clarified that the Travel Rule does not affect trading on an exchange’s order book, nor does the rule itself affect Thai baht transfers or withdrawals, as it concerns information relating to digital asset transfers. As for processing times, most transfers should proceed through the normal process if the required information is complete and the systems are ready. Some transactions, however, may require additional review.

Completing KYC does not therefore mean that no further information will be requested. KYC focuses on identifying the customer who opens an account, while the Travel Rule adds information about the other party when digital assets are sent or received. In practice, users working to a transfer deadline should allow time for platform checks and verify counterparty details before initiating a transfer, particularly when transferring between platforms or to or from a self-hosted wallet.

Implications for Digital Asset Business Operators in Thailand

A key challenge is ensuring that Travel Rule information and digital asset transfers move in a coordinated manner. Operators must design data collection interfaces, verification systems, and procedures for communicating with counterparty service providers. This is particularly important when information is incomplete, names do not match, or counterparties use systems that cannot communicate with one another. Costs may therefore include system development, technology vendors, security, data storage, and staff to review exceptions.

Customer communication is another important consideration. If an operator does not explain why additional information is required or why received assets cannot yet be withdrawn, verification delays may lead to complaints and undermine trust. Preparation should therefore include status messages, channels for submitting additional information, and a review process for customers who believe their transactions have been restricted inappropriately.

Benefits and Drawbacks

Benefits: Better Information for Monitoring and Greater Confidence

The principal benefit of the Travel Rule is that it gives operators and relevant authorities identifying information to accompany transaction trails. This can support the analysis of suspicious transactions and asset tracing. It also forms part of efforts to bring Thailand’s market into alignment with international standards.

From a business perspective, Pulse Legal considers that verifiable processes may help counterparties and financial service providers assess an operator’s risk more clearly. However, the outcome depends on data quality and how the systems are implemented in practice. Collecting more information alone does not guarantee that every scam can be prevented or that assets can always be recovered for victims.

Drawbacks and Trade-offs: Cost, Convenience, and Privacy

Pulse Legal sees at least three areas of trade-off.

First, the cost of providing services. Compliance involves ongoing costs, which may affect competitiveness or be reflected in future service terms. It would nevertheless be premature to conclude that every operator will raise its fees.

Second, user convenience. Even lawful transfers may be delayed when information does not match or systems are not fully interoperable. If platforms impose broad transaction restrictions to avoid risk, legitimate users may face unnecessarily limited options. This could push them towards platforms outside regulatory supervision, contrary to the SEC’s objective of encouraging investors to use regulated platforms.

Third, privacy and data security.Linking individuals’ names with wallet addresses and transaction histories can increase the harm caused by a data breach. Operators should therefore consider what information they collect, whom they send it to, who can access it, and how they prevent it from being used for purposes other than those intended.

Travel Rule implementation should incorporate a personal data protection review from the outset, including arrangements for sending information to overseas counterparties. The applicable legal bases and obligations under Thailand’s Personal Data Protection Act (PDPA) must be assessed against each business’s actual processing activities.

What to Watch Next

The next question is how these requirements will translate into the user experience. What ownership verification methods will each platform support? How will it handle incomplete information? How will false information be detected or addressed? And how effectively will platforms be able to connect with overseas operators?

The SEC has also stated that it has coordinated with the Anti-Money Laundering Office (AMLO) as AMLO prepares rules under anti-money laundering legislation. Operators should therefore monitor developments from both agencies and should not treat the implementation of systems under this notification as the end of their compliance work.

For Pulse Legal, the quality of Travel Rule implementation should be measured by how effectively information is used to manage risk, while keeping data secure and allowing legitimate users to transact appropriately. The period before 27 February 2027 is therefore an important window for operators to prepare their systems and for users to understand the changes ahead.

References

Securities and Exchange Commission, Thailand, News Release No. 179/2569, dated 2 September 2026: SEC news release.

Securities and Exchange Commission, Thailand, Q&A on the Travel Rule Requirements for Digital Assets: Travel Rule Q&A.

FATF, Best Practices in Travel Rule Supervision (2025), particularly Sections 1.1–1.2: FATF report.