Counterparty due diligence
The travel rule only works if the firm knows which institution stands behind the beneficiary address. The FATF's 2021 guidance therefore expects VASPs to conduct counterparty due diligence before transmitting personal data. The VASP must identify the counterparty, confirm that it is licensed or registered, assess the quality of its AML/CFT controls and decide whether to deal with it at all.1 MAS has adopted the same expectation. The Guidelines ask licensees to assess whether a counterparty is subject to and supervised for AML/CFT requirements consistent with the FATF standard before transmitting information to it. They also ask licensees to consider the risks of sending personal data to an entity that is unregulated or located in a jurisdiction with weak data protection.2
In practice this produces a tiered counterparty list. Tier one comprises licensed VASPs in FATF-member jurisdictions with which the firm has an established travel-rule channel. Tier two comprises licensed VASPs with which no channel exists, for which the firm transmits information by a secure fallback and monitors more closely. Tier three comprises unlicensed or unknown counterparties, which the firm treats like unhosted wallets or declines. The tiering should be documented, reviewed at least annually, and fed by a source of licensing data such as the public registers of MAS, FINMA's register of SRO members and the equivalent registers in other jurisdictions.
Notes
- FATF, Updated Guidance for a Risk-Based Approach to Virtual Assets and VASPs, October 2021, paras 198–210 (counterparty VASP due diligence). ↩
- Guidelines to Notice PSN02, section on counterparty due diligence and on the protection of personal data transmitted in connection with value transfers. ↩
For general information only. This article does not constitute legal or tax advice, does not replace advice on an individual case and creates no lawyer-client relationship. It reflects the legal position as of October 2026.