TL;DR: Stablecoin volumes reached close to $1 trillion per month last year, double 2024 levels, while regulators including FATF are pushing VASPs to operationalize the Travel Rule inside fragmented settlement and compliance workflows, according to SumSub. Compliance is shifting from a separate review step to an embedded identity and data-exchange control problem.
Editorial analysis by NHI Mgmt Group, based on content published by SumSub: “Sumsub Partners with Fireblocks to Power the Digital Asset Economy with Seamless Travel Rule Compliance”.
Key questions
Q: How should VASPs embed Travel Rule compliance into transaction workflows?
A: VASPs should place counterparty verification, encrypted data exchange, and policy enforcement directly into the transfer path.
Q: Why does stablecoin growth make Travel Rule compliance harder to manage?
A: Stablecoin growth increases transaction speed, counterparties, and protocol variation, which makes manual or out-of-band compliance steps less reliable.
A: Manual handling usually creates delays, inconsistent data quality, and more opportunities for transactions to stall.
Practitioner guidance
- Embed Travel Rule checks in the transaction path Design compliance so required counterparty data is exchanged during transaction processing, not in a separate after-the-fact review step.
- Align controls to counterparty risk profiles Use workflow logic that changes validation depth, routing, and approval requirements based on jurisdiction, counterparty type, and transaction context.
- Validate interoperability across Travel Rule protocols Test how your compliance workflow handles multiple networks and message formats, including protocol-specific data requirements and exceptions.
Bottom line: Travel Rule compliance is moving into the payment workflow, which changes it from a detached review activity into a runtime governance control.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
Travel Rule compliance is becoming a transaction identity problem, not a documentation problem. The important shift is that the identity and counterparty checks now sit inside the payment workflow itself. That changes governance because the control is only effective if it executes at transfer speed and across multiple protocols. Practitioners should treat this as a control-plane design issue, not a legal add-on.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases.
A question worth separating out:
Q: Who is accountable when Travel Rule compliance fails in a VASP workflow?
A: Accountability is shared, but it is not ambiguous. Compliance owns policy intent and regulatory interpretation, while platform and operations teams own execution reliability, protocol support, and evidence retention. If those responsibilities are not separated clearly, failures become hard to audit and harder to remediate.
👉 Read our full editorial: Travel Rule compliance moves into digital asset transaction workflows
Travel Rule compliance is becoming a transaction-control discipline, not a back-office compliance task. When compliance is embedded in the payment path, the relevant unit of governance is the transaction workflow itself. That changes how VASPs think about control ownership, approval timing, and evidence generation. Practitioners should treat workflow design as part of the compliance architecture, not as an implementation detail.
A question worth separating out:
Q: Should compliance teams prioritise protocol interoperability or custom risk workflows first?
A: They should prioritise whichever condition blocks safe execution in their environment. If counterparties use multiple Travel Rule networks, interoperability comes first; if regulatory exposure varies by corridor or client type, risk-based workflow tailoring comes first. In practice, most VASPs need both.
👉 Read our full editorial: Travel Rule compliance moves into digital asset transaction workflows