The 2027 break: What changes with the Travel Rule, section 11a FM-GwG, AMLR and AMLA?

Editorially reviewed: 22 October 2026 · Legal status checked up to: 31 August 2026 (manuscript); FMA guidance on the Travel Rule and financial sanctions re-checked on 22 October 2026. Time-bound statements are dated; legal acts that are announced but not yet published are marked as such. Negative findings (“no draft”, “not published”) refer to this search status. Austrian legal sources are available in German.

For whom: Banks (SI) Banks (LSI) Crypto-asset service providers Insurers The Travel Rule and the CASP-MV concern crypto-asset service providers and financial entities with a crypto offering; the AMLR and financial sanctions apply to all obliged entities, including insurers.

The widespread statement that verification of third-party self-hosted addresses begins in 2027 is not correct. Art. 40(1) of the Anti-Money Laundering Regulation is almost identical to Art. 19a of the Fourth AML Directive, which Austria has applied since 30 December 2024 in section 11a FM-GwG. What changes in 2027 is the legal act, not the content of the obligation – a directive provision requiring transposition becomes a directly applicable regulation provision.

What applies today under the Transfer of Funds Regulation?

Regulation (EU) 2023/1113 has applied since 30 December 2024 and requires information on both sides of a crypto-asset transfer to be transmitted – not to the supervisor but to the counterparty's service provider. Unlike for transfers of funds there is no de-minimis threshold: a transfer of five euros triggers the same obligations as one of five million (recital 30). Exempt are only transfers between two service providers acting on their own behalf and person-to-person transfers without the involvement of a service provider.

The data set is asymmetric. Under Art. 14(1), for the originator the name, distributed-ledger address, the crypto-asset account number where applicable, address including country, number of an official document and customer number – alternatively date and place of birth – and the legal entity identifier must be transmitted, the latter only where it exists and where the message format provides a field for it. For the beneficiary, para 2 requires only name, distributed-ledger address (no postal address), account number where applicable and legal entity identifier. The country indication is therefore not even mandatory for the originator. The information is retained for five years; a further five years require a specific Member State provision.

Self-hosted addresses: Where is the verification gap?

For transfers to a self-hosted address above EUR 1,000, Art. 14(5) requires “appropriate measures to assess whether that address is owned or controlled by the originator”; Art. 16(2) mirrors this for the beneficiary. In both directions the verification duty relates exclusively to the provider's own customer. It answers the question “does this address belong to my customer?” – not the question “whom does this address belong to?”. If it belongs to a third party, the duty ends, and the beneficiary information supplied by the customer remains unverified under the Transfer of Funds Regulation.

Alongside stands a second, risk-based obligation that does not know this limitation: section 11a FM-GwG, inserted by the FM-GwG Amendment Act (Federal Law Gazette I No 151/2024), in force since 30 December 2024. It obliges providers to identify and assess the risk of transfers to and from self-hosted addresses and to take at least one of four mitigating measures – including risk-based measures to identify the originator or beneficiary. The difference is the actual finding: Art. 14(5) is a rule with a fixed threshold and a documentable result; section 11a is a standard without threshold and without prescribed method. Its result is an internal risk assessment, not a data record – and no reporting stream has a field for it.

Which report does the TFR provide for?

Only in the event of failure does a report to an authority arise. Under Art. 17(2) the beneficiary's provider must report repeated failures of a counterpart – missing information despite a request within three working days inside the Union, five from outside (para 56 of the EBA Guidelines) – together with the measures taken to the competent authority; Art. 21(2) applies verbatim to intermediary providers. In Austria the competent authority is the FMA. It provides a spreadsheet form that, completed, is to be sent as a PDF by e-mail with a prescribed subject line. The reporting channel for repeated Travel Rule failures to the Austrian supervisor is thus an e-mail with a PDF attachment – without a published structured format and without published case numbers; the procedure matches the current FMA guidance (checked 22 October 2026). A technically failed transfer is not a suspicion of money laundering – the suspicion assessment runs separately. Breaches of Art. 14, 15, 17, 19, 21 and 26 of the Regulation are sanctioned under section 34(2) FM-GwG with up to EUR 5 million or twice the benefit derived.

What applies from 10 July 2027 under the Anti-Money Laundering Regulation?

Above all Art. 19(3), Art. 37, Art. 40 and Art. 79 AMLR: due diligence from EUR 1,000, correspondent relationships, self-hosted addresses and the ban on anonymous accounts.

The overhaul shifts the weights but does not close the gap. Art. 40 opens identity determination through third parties – in practice blockchain analytics providers – and thus external assessment instead of verification. An obligation whose depth the obliged entity determines by its own risk assessment produces no comparable data item. Notable, too, is that by August 2026 AMLA had conducted ten consultations, none devoted to the crypto-specific mandates; the future European supervision has so far become crypto-specific only in the draft on Art. 19(9) (three transactions within twelve months indicate a business relationship – an effective mechanism against splitting below EUR 1,000).

2028: What does AMLA take over?

The Anti-Money Laundering Authority, based in Frankfurt am Main, took up its activities on 1 July 2025. Crypto-asset service providers are a separate category of risk classification under Art. 12(4)(j) AMLAR. Under Art. 13 AMLA launches the first selection procedure by 1 July 2027, completes it within six months and begins direct supervision six months after publication of the list – that is, in the course of 2028. National supervisors had to transmit eligibility data by 15 August 2026 under the implementing standard.

Sanctions law: What else is the same data needed for?

Since the fifth sanctions package of 2022 a second order has lain over the AML strand. The 19th package (23 October 2025) extended the service ban to all crypto-asset services and prohibited transactions in listed crypto-assets, the 20th package (23 April 2026) prohibits from 24 May 2026 any transaction with providers established in Russia, the 21st package (23 July 2026) creates a listing mechanism for third countries. Two obligations must be distinguished. Event-driven: under Art. 8 of Regulation (EU) No 269/2014, information on frozen funds and sanctions hits must be reported to the competent authority immediately – the FMA states expressly that crypto-asset service providers, as legal persons, are subject to this obligation, as are insurance undertakings. Periodic: under the Sanctions Act 2024, frozen funds have additionally been reportable to the FMA (instead of the OeNB) since 1 January 2026, quarterly via the Incoming Platform. The quarterly report does not replace the immediate notification. For frozen holdings the state thus requires an immediate notification and four times a year a named list by individual crypto-asset; for transfer activity twice a year a sum without country, counterparty and token.

How far has the Travel Rule been implemented internationally?

According to the FATF's seventh targeted update of 16 July 2026, 91 of 109 surveyed jurisdictions (83 %) have enacted Travel Rule legislation – after 73 % the year before and 39 % in 2023 – but almost half of them have not yet taken any supervisory or enforcement action. For Austria, an IMF-led country assessment has been available since 30 April 2026: Recommendations 15 (new technologies) and 16 (wire transfers) were rated “largely compliant”; clear criticism concerns the resources and operational independence of the Financial Intelligence Unit. The capture question thus arises not only on the collection side but on the processing side.

What needs to be done by 10 July 2027?

1. Section 11a FM-GwG today: document the risk assessment and the chosen mitigating measures for self-hosted addresses – the obligation has existed since 30 December 2024, not only from 2027.
2. Define verification methods under paras 83–86 of the EBA Guidelines, operate whitelisting with change controls, embed the request deadlines (three or five working days) in the process.
3. Set up the reporting process under Art. 17(2) and 21(2) TFR to the FMA and count the cases internally – there are no published figures; your own statistics are the only benchmark.
4. Prepare the transition to the AMLR: EUR 1,000 threshold (Art. 19(3)), correspondent relationships (Art. 37), ban on anonymous accounts (Art. 79); incorporate the AMLA guidelines on Art. 37 and 40 as soon as published.
5. Test sanctions screening against the data gap: neither the Transfer of Funds Regulation nor sanctions law provides an evidence rule for the counterparty's nationality and residence. Anchor both sanctions reports in the process: the immediate information of the FMA under Art. 8 Regulation (EU) No 269/2014 for every hit, and the quarterly submission of frozen funds – do not wait for the end of the quarter.
6. Reconcile the data base with the supervisory strand: the split in section 10 of the CASP-MV into self-hosted addresses and crypto-asset accounts comes from the same Travel Rule data.

Frequently asked questions

Does verification of self-hosted addresses only begin in 2027?

No. The verification duty for the provider's own customer above EUR 1,000 has applied since 30 December 2024 under Art. 14(5) of the Transfer of Funds Regulation; the risk-based duty also towards third-party addresses has applied since the same day under section 11a FM-GwG. Art. 40 AMLR transfers it into a directly applicable regulation from 10 July 2027.

Is there a de-minimis threshold for crypto-asset transfers?

No. The Transfer of Funds Regulation requires the accompanying information regardless of amount; only the verification duty for self-hosted addresses attaches to EUR 1,000. From 2027, Art. 19(3) AMLR also sets the threshold for full due diligence on occasional transactions at EUR 1,000.

How do I report repeatedly missing Travel Rule information to the FMA?

With the FMA form for CASPs and intermediary providers (Art. 17(2) and 21(2) TFR), completed as a PDF by e-mail with the prescribed subject line. No structured format or interface is published.

When does AMLA supervise directly?

The selection procedure starts by 1 July 2027 and takes six months; direct supervision starts six months after publication of the list, that is, in the course of 2028. Crypto-asset service providers are a separate category of the risk classification.