The crypto Travel Rule in Spain after Royal Decree-law 25/2026

What information accompanies each transfer of crypto-assets

Each transfer of crypto-assets must carry the name of the originator and of the beneficiary, their distributed ledger addresses or account numbers and, for the originator, an address and an identification detail. This is required by Article 14 of Regulation (EU) 2023/1113. There is no threshold. The rule applies to any transfer, whatever its amount.

The information does not have to travel inside the transaction recorded on the blockchain. It must be submitted securely, in advance of or at the same time as the transfer, and in line with the GDPR (Article 14(4)). Before sending, the originator’s provider verifies the accuracy of its customer’s information against reliable and independent documents or sources (Article 14(6)). If it cannot comply with Article 14, it may not initiate or execute the transfer (Article 14(8)).

Transfers involving self-hosted addresses and the 1,000 euro threshold

A self-hosted address is a distributed ledger address not linked to any crypto-asset service provider or to a non-EU entity providing similar services. It is the wallet the user controls directly. Article 3(20) of Regulation 2023/1113 defines it, and Royal Decree-law 25/2026 has carried that definition into Article 1(7) of Law 10/2010.

When a transfer goes to or comes from a self-hosted address, there is no second provider to send or receive the information. The provider involved collects and keeps the originator and beneficiary information itself, and ensures that the transfer can be individually identified (Articles 14(5) and 16(2)). Above 1,000 euros, it must also take adequate measures to assess whether the self-hosted address is owned or controlled by its customer.

What the beneficiary’s provider and intermediaries do when information is missing

A provider that receives a transfer of crypto-assets without all the required information has two options, chosen on a risk-sensitive basis and without undue delay. It can reject the transfer or return the crypto-assets to the originator’s account. Or it can ask for the missing information before making the crypto-assets available to its customer (Article 17(1)).

To detect missing information, the beneficiary’s provider applies effective procedures, including monitoring during or after the transfer (Article 16(1)). Before crediting the crypto-assets, it verifies the accuracy of its own customer’s information (Article 16(3)). Missing information is also a factor in assessing whether the operation is suspicious and must be reported to the financial intelligence unit (Article 18). In Spain, that unit is Sepblac.

If another provider repeatedly fails to send the information, the beneficiary’s provider has to react. It can start with a warning and a deadline and, if the information still does not arrive, reject its transfers, restrict the relationship or end it. It can also reject all future transfers straight away. In both cases it reports the failure to the authority that supervises anti-money laundering compliance (Article 17(2)).

Intermediary providers, which pass a transfer between two others, have parallel obligations. They transmit all the information received with the transfer and keep records available to the authorities (Article 19). They apply procedures to detect missing information, especially when a self-hosted address is involved (Article 20). And they decide on a risk basis whether to execute, reject, return or suspend an incomplete transfer (Article 21).

What changes in Spain with Royal Decree-law 25/2026

Regulation 2023/1113 has applied directly in Spain since 30 December 2024. What was missing was the adaptation of Spanish law. The European Commission opened infringement procedure INFR(2025)2079 against Spain for that gap, which the preamble of the decree-law places at the reasoned opinion stage. The first final provision of Royal Decree-law 25/2026 amends Law 10/2010 on five points.

• Obliged entities. Article 2(1)(z) now reads «crypto-asset service providers». Since Royal Decree-law 7/2021 it only covered providers exchanging virtual currency for fiat currency and custodian wallet providers.
• Definitions. Article 1 defines crypto-asset, crypto-asset service provider and self-hosted address by reference to MiCA and to Regulation 2023/1113. Providers that only give advice on crypto-assets are left out.
• Correspondent relationships. New Article 13(2 bis) applies when a provider executes crypto-asset services with an entity outside the EU. It must check that the entity is authorised or registered, and update its due diligence periodically or when new risks arise.
• Authorisations. Sepblac, the Executive Service of Spain’s Commission for the Prevention of Money Laundering, reports on the adequacy of internal controls in authorisation procedures for crypto-asset service providers (Article 45(4)(l)).
• Serious infringement. Breaching Articles 4 to 24 and 26 of Regulation 2023/1113 is a serious infringement for crypto-asset service providers, as are the breaches listed in Article 29 (Article 52(5)).

A serious infringement carries a fine of at least 60,000 euros. The maximum is the highest of four figures, 10% of annual turnover, the economic value of the operation plus 50%, three times the profit obtained or 5,000,000 euros (Article 57(1)(a)). The fine always comes with a public or private reprimand or, for an authorised entity, the temporary suspension of its authorisation. Directors and managers responsible may also be fined between 3,000 and 5,000,000 euros (Article 57(2)).

The decree-law entered into force on 1 October 2026, the day after its publication in the Official State Gazette. The Standing Committee of the Congress of Deputies, which acts while the Cortes are dissolved, validated it on 16 October. The resolution was published on 20 October, which settles the amendments to Law 10/2010. For crypto ATM operators, which were already obliged entities, the October change that matters is a different one, mandatory identification at crypto ATMs under Royal Decree 813/2026 (in Spanish).

A fictitious example with a self-hosted wallet

Nebula Exchange is a Spanish platform authorised by the CNMV. Its customer Lucia sends it the equivalent of 2,500 euros in bitcoin from a wallet she controls herself. No other provider is involved, so nobody sends Nebula the originator information. Nebula collects it from Lucia, keeps it together with the beneficiary information, Lucia again, and identifies the transfer individually. As the amount exceeds 1,000 euros, it also assesses whether the source address belongs to Lucia, with a technical proof of control of that address. Lucia passes it and Nebula credits the balance. Her identity was already verified when she became a customer, so that check does not need repeating. Had Nebula credited the funds without collecting the information or making the assessment, it would have breached Article 16(2) of the Regulation. Since 1 October 2026, that is a serious infringement under Law 10/2010.

The EBA guidelines on the Travel Rule

The European Banking Authority published its Travel Rule guidelines, reference EBA/GL/2024/11, on 4 July 2024. They apply from 30 December 2024. They specify what information accompanies transfers of funds and crypto-assets, how to detect that it is missing or incomplete, and what to do in that case. They also set criteria and means to identify and verify the originator or beneficiary in transfers involving self-hosted addresses. They are the practical reference for designing the procedures required by Articles 16, 17, 20 and 21 of the Regulation.

Those procedures run on ICT systems that also fall under DORA for crypto-asset service providers, so it makes sense to design both together.