The Securities and Exchange Commission (SEC) has moved to tighten ‘travel rule’ requirements for digital asset businesses, requiring them to collect, verify and retain information on transfers in order to strengthen safeguards against money laundering and technology-related crime.
The rules are designed to give digital asset operators sufficient information to assess and manage money laundering risks, bringing Thailand’s framework closer to international standards set by the Financial Action Task Force (FATF).
The SEC said the requirements were developed in coordination with the Anti-Money Laundering Office (Amlo), as authorities step up cooperation between the public and private sectors to prevent and disrupt technology-related crime.
The Travel Rule is so named because it aims to to prevent illicit, anonymous or untraceable crypto transactions by allowing certain identifiable data to ‘travel’ with each transfer.
The new framework follows a resolution by a subcommittee responsible for linking financial information to improve the monitoring of suspicious transactions. The SEC and Amlo agreed to establish guidelines for digital asset operators, while Amlo prepares regulations under the anti-money laundering law.
Transfer checks
Under the new rules, digital asset businesses must establish policies and operating procedures for managing risks associated with the transfer and receipt of digital assets.
Operators also have to collect information on customers and their transaction counterparties before processing transfers. In addition, they must verify the identity and status of the counterparty virtual asset service provider, as well as any intermediary digital asset operator involved in the transfer route.
Additional checks apply when transactions involve self-hosted wallets, which are controlled directly by users rather than a third-party service provider. Operators must verify ownership or control of such wallets when sending or receiving digital assets.
For transfers involving two digital asset operators, the ordering operator must transmit information on both the sender and recipient together with the transfer instruction to the beneficiary operator receiving the order.
The requirements are intended to improve the traceability of digital asset transactions and give regulators and operators more tools to identify suspicious activity and prevent digital assets from being used as a channel for technology-related crime.
Five-year requirement
Digital asset businesses must retain transfer-related information for every transaction for at least five years. The records must be maintained in a format that allows regulators to access and inspect them immediately when required.
The new rules take effect on Feb 27, 2027, giving digital asset operators time to prepare their systems for data transmission, verification and transaction monitoring. The implementation period is intended to allow operators to upgrade internal processes and technology before the requirements become mandatory.
The SEC conducted public consultations on the principles for the rules in March and April, followed by consultation on the draft notification in June and July. The majority of stakeholders supported both the principles and the proposed notification.
SEC secretary-general Pornanong Budsaratragoon said the regulator was committed to preventing digital asset businesses from becoming conduits for money laundering and technology-related crime.
The updated Travel Rule would strengthen the ability to block technology-related crime, reduce the risk of digital asset services being used for money laundering and terrorist financing, and reinforce operators’ responsibility to monitor customer transactions in line with regulatory requirements, she noted.