Travel Rule vs KYT: Do Crypto Compliance Teams Need Both?

A licensed crypto exchange needs both: the Travel Rule shares who sent the funds, and KYT screens whether that wallet is actually safe to receive them from.

In 2025 the Central Bank of Ireland fined Coinbase Europe 21.46 million euro after three coding errors in its transaction-monitoring software let 30,442,437 transactions worth more than 176 billion euro pass through unscreened between April 2021 and March 2025. That gap sits squarely in KYT territory, not the Travel Rule's job description. The two controls get confused constantly, because they operate at different moments in the same transfer, and mixing them up is exactly how a compliance program ends up with a hole this size.

The Travel Rule and KYT Solve Different Problems

The Travel Rule is a data-sharing rule. When a transfer crosses a jurisdiction's threshold, the sending VASP has to hand the receiving VASP a packet of information: the originator's name, wallet address, and enough identifying detail to satisfy a counterparty check. It runs once, at the moment of transfer, between two regulated entities that already know who they claim to be.

KYT is a screening process, not a handoff. It looks at the wallet address itself, its transaction history, and its exposure to OFAC-sanctioned addresses, mixer contracts, and stolen-funds clusters, and it keeps checking as new transactions arrive. It doesn't care what name the sender put on a form. It cares what the wallet has actually touched on-chain.

Picture a transfer where the sending VASP files a perfect Travel Rule packet: real name, verified address, every field the rule asks for. The wallet on the receiving end can still sit three hops from a Lazarus Group cluster, and nothing in that packet would show it. The rule was never built to catch that. Call it a blind spot, not a loophole.

Different question, different tool.

What Does Each Control Actually Check?

The Travel Rule checks identity data attached to a transfer. KYT checks the wallet's on-chain behavior, independent of who claims to own it, and it doesn't stop checking once the transfer clears.

Plastron's own screening corpus holds 3,901 labeled addresses spread across scam, sanctions, and hack-exploit clusters, and 780 of those sit on the OFAC SDN list by itself. None of that data comes from a Travel Rule message. It comes from watching what addresses actually did on-chain, which is exactly the gap KYT is built to close and an identity form was never designed to catch.

Head-to-head

Side by side, the differences come down to what data each control has access to, and when it runs.

A compliance officer can trace a counterparty's public wallet history by hand on a block explorer like Etherscan, one hop at a time. Screen the wallet with Plastron instead, and the sanctions, mixer, and stolen-funds exposure across Ethereum and six other chains comes back in one pass rather than a manual crawl through transaction history.

When Is the Travel Rule Enough on Its Own?

If the only obligation you're solving is proving you disclosed originator and beneficiary information to a counterparty VASP, the Travel Rule packet is enough by itself. That's literally what it's for, and a clean disclosure record satisfies that specific requirement whether or not anyone ever screens the wallet behind it.

It stops being enough the moment the question changes to whether the funds are safe to accept. FATF's June 2025 targeted update found 85 of 117 assessed jurisdictions, 73 percent, had passed Travel Rule legislation, up from 65 jurisdictions the year before. Fifty-nine percent of those jurisdictions had still taken zero enforcement action to check whether firms were actually screening anything behind the paperwork, a gap the Travel Rule's sunrise issue has been dragging on for years.

A VASP can have a perfect Travel Rule record and still accept funds from a sanctioned address, because nothing in the rule requires anyone to check.

Verdict

A VASP that only sends Travel Rule packets and never screens the wallet behind them is complying with the letter of one rule while missing the entire reason AML controls exist. Read the other way, a firm that runs KYT on every address but skips the Travel Rule handoff is screening wallets it has no legal identity data for, which creates its own reporting gap. Neither control substitutes for the other, and for a licensed exchange the choice was never really optional.

Run both, in that order: disclose first, screen continuously after. An individual sending crypto peer-to-peer below any reporting threshold does not need a Travel Rule program at all, but the wallet on the other end can still carry the kind of exposure only a screening check would catch. Budget for both line items too. A disclosure program without a screening budget behind it is a paper trail pointing at a problem nobody looked for.

FAQ

Does KYT replace the need for the Travel Rule?

No. KYT tells you whether a wallet's on-chain history is risky. It says nothing about who legally controls that wallet, which is the specific gap the Travel Rule's identity data is built to close.

Do individuals sending crypto peer-to-peer need to worry about the Travel Rule?

Usually not directly. The Travel Rule applies to VASPs moving funds above a jurisdiction's threshold, not to a person sending crypto from a self-hosted wallet to a friend. The wallet you're sending to can still carry sanctions or scam exposure worth checking first.

What counts as the Travel Rule threshold?

It varies by jurisdiction. The EU enforces it at a 1,000-euro threshold for self-hosted wallets, while the US applies a 3,000 dollar threshold for cross-border transfers, and FATF's 2025 survey found most assessed jurisdictions had passed some version of the rule.

Can a wallet fail KYT screening even if its Travel Rule paperwork checks out?

Yes. The Travel Rule packet only reflects what the counterparty VASP submitted. A wallet address can carry mixer exposure or sit a few hops from a sanctioned address regardless of what the identity form says.

What happens if an exchange only implements one of the two controls?

It fails an audit eventually. Regulators including FinCEN and the bodies enforcing FATF's standards expect both disclosure and ongoing screening, and the Coinbase Europe case shows what a monitoring-only gap costs even when the identity side of the program is intact.