Bitcoin was once money without a sender. For everything that runs through a regulated provider, that ended on 30 December 2024. Since that day a rule has applied across the whole EU that has long been routine in banking: the name travels with the money.
Anyone who sends cryptoassets through an exchange, a broker or a custodian sends their identity along with them. Name, wallet address, account number with the provider, and in addition address or ID number or date and place of birth. The recipient's provider receives this data, checks it and keeps it.
This is no detail for compliance departments. It reshapes the question of whom you show your wealth to. What surveillance means in concrete terms in everyday digital life today, from the phone to the payment, is gathered under digital privacy and asset protection.
Two regulations, one date
On 30 December 2024 two EU regulations took full effect at the same time.
The first is the Markets in Crypto-Assets Regulation, MiCA for short. It governs who may offer crypto services in the EU. Parts of it applied from June 2024. Since 30 December 2024 it has applied in full. Exchanges, brokers and custodians need authorisation and are under supervision.
The second is the recast Transfer of Funds Regulation. It extends the duties that have applied to bank transfers for years to cryptoassets. This is known as the travel rule. It too applies from 30 December 2024.
On top of this come guidelines from the European Banking Authority. They set out how providers detect missing or incomplete information and what they then have to do. These guidelines also apply from 30 December 2024. The authority names the aim itself: transfers should be fully traceable where this is necessary.
What exactly travels with your transfer
On this point the regulation is very specific. The sender's provider must transmit the following information:
- the sender's name,
- the sender's wallet address and, where one exists, the number of the sender's crypto-asset account with the provider,
- the sender's address including country, the number of an official identity document and the customer number, or alternatively date and place of birth,
- the recipient's name and wallet address or account number.
The data must be transmitted before the transfer, at the same time or in parallel with it. It does not have to sit in the blockchain transaction itself. It runs through a separate channel between the providers.
There is no minimum amount. The regulation gives its reason expressly. Because crypto transfers know no borders, the standard of the international Financial Action Task Force requires that all crypto transfers are treated as cross-border transfers. Small domestic amounts are not exempt either. Anyone who sends €50 in bitcoin to a friend sends their name along with it.
What happens when information is missing
The duty does not fall only on the sender. The provider on the recipient's side must check as well. If the required information is missing or incomplete, it must act without undue delay. It rejects the transfer or returns the cryptoassets to the sender. Or it requests the information before crediting the cryptoassets to you.
For you this means: a transfer without complete data may not arrive. Or it gets stuck until the information has been supplied. If another provider repeatedly fails to supply information, your provider can restrict or end its business relationship with it. The data is therefore no longer a formality. It is the precondition for your money moving at all.
And the data stays. Providers must keep the information on sender and recipient for five years. National law may set longer periods. Five years of transfer history with name, address and ID number, at every provider you have ever used.
Your own wallet is no longer invisible
The most sensitive part concerns the self-custody wallet. That is, the hardware wallet in your drawer or the app whose keys only you know. The regulation calls it a self-hosted address.
The travel rule applies to every transfer in which a provider is involved. Even when your own wallet sits at the other end. If you send bitcoin from your exchange to your hardware wallet, the provider must collect and keep the information on sender and recipient. The transfer must be individually identifiable.
Above €1,000 it becomes more specific. For a transfer to a self-hosted address above that amount, the provider must take adequate measures to assess whether that address is owned or controlled by its customer. The same applies in the other direction, when you transfer from your own wallet to an exchange.
In practice this means: you have to prove to your provider that the wallet belongs to you. From then on the address is linked to your name, in the database of a regulated company under state supervision.
This is the core. A blockchain is public. Every movement is visible to everyone, only without names. Once an address has been matched to a name, its entire history becomes readable, backwards and forwards. The travel rule ensures that exactly this match is made at the interface between provider and wallet.
What the regulation already provides for later
Anyone who wants to know where a rule leads reads not only the duties. They read the review clauses. The regulation contains two.
By 1 July 2026 the Commission must present a report on the risks of transfers involving self-hosted addresses. It is to assess whether specific measures are needed and, where appropriate, propose amendments.
A second report follows by 30 June 2027. It is expressly to examine how necessary, effective and enforceable additional measures would be. As examples, the regulation names specific duties for providers of hardware and software wallets, and the restriction, control or prohibition of transfers involving self-hosted addresses.
The word prohibition is thus in the Official Journal. Not as a decision, but as an option for review with a date. That is a mechanism familiar from other areas. First comes recording. Then review. Then adjustment. The same pattern shows in the Great Reset.
The next step is already in law: the tax authority
The travel rule serves the fight against money laundering. The data sits with the providers. They must answer requests from the competent authorities fully and without delay. For the tax authority, a separate channel has already been adopted.
On 17 October 2023 the Council adopted the directive on administrative cooperation for cryptoassets, known among specialists as DAC8. It obliges providers of crypto services to report data on their customers and their transactions to the tax authorities. Member states apply the rules from 1 January 2026. The information is exchanged for the first time for the calendar year 2026, within nine months of the year end.
That closes the circle. In 2025 the providers know whose address is whose. From 2026 they report it to the state in which you are tax resident.
The UK, Ireland, the Nordics, Benelux and Switzerland compared
The United Kingdom. MiCA and the EU regulation do not apply in the UK, which left the EU before they were adopted. But the UK was earlier. Its own travel rule has been in force since 1 September 2023, in Part 7A of the Money Laundering Regulations 2017. A transfer between crypto businesses must carry the names of sender and recipient and the account number or a unique transaction identifier. Where a business in the chain sits outside the UK, transfers above a set value must carry fuller details on the sender: address, customer number, ID document or date and place of birth. Within the UK, the recipient's business can request these details and must receive them within three working days. If information is missing, the recipient's business must ask for it and consider delaying the transfer or returning it. For transfers to and from unhosted wallets, a business may ask its own customer for the information; if it does not receive it, it must not make the cryptoasset available to the recipient. The records are kept for five years.
Ireland, the Nordic member states and Benelux. In Ireland, Denmark, Sweden, Finland, the Netherlands, Belgium and Luxembourg, both regulations apply directly, as they do in every member state. Each national supervisor authorises and oversees the providers under MiCA.
Switzerland. Switzerland is not in the EU, but it was earlier and stricter. As far back as August 2019, FINMA determined that supervised institutions may only allow payments to and from external wallets if these belong to their own customer and that customer's power of disposal has been technically verified. Transfers to a third party's wallet go ahead only after the institution has identified that third party like one of its own customers. This practice knows no €1,000 threshold.
Switching to a provider in a neighbouring country therefore changes little about the data trail. Within the EU the same regulation applies. The UK has had its own rule since 2023. In Switzerland the rules have applied for years.
What this means for your wealth
Add up the parts. Every transfer through a provider carries your name. Every self-custody wallet you connect to a provider is matched to your name. The blockchain stores the movements permanently. From 2026 the tax authorities receive reports of their own. And the regulation itself provides for examining whether transfers involving self-custody wallets should be restricted or prohibited.
This is a structural risk, not a mood. For many investors, cryptoassets were the part of their wealth that lay outside the banking system. At the interface with the provider, that separation has been removed. What you pay in and out there is documented just like a bank transfer.
Then there is a risk that appears in no regulation. Where name, address and crypto holdings come together in one place, a data set is created that interests more than the authorities. Every provider holds these data sets for five years. The more providers you have used over the years, the more copies of your transfer history exist. Discretion begins with the number of providers, not only with the wallet.
Three conclusions suggest themselves.
First: take stock. Which of your addresses are already linked to your name because you once verified them with a provider? Everything that has run through those addresses can be traced. Assume that every address that has ever been in contact with a provider is known.
Second: documentation. In the UK, selling, exchanging or spending cryptoassets is a disposal that can give rise to Capital Gains Tax. Gains above the tax-free allowance of £3,000 are taxed at 18 or 24 per cent, and there is no holding period after which a gain becomes tax free. HMRC states plainly that exchange reports do not replace your own records: you must keep your own records of each transaction, including the date, the number of tokens and the value in pounds sterling. If the data sits with the provider anyway and will soon sit with the tax authority, your own records should be at least as complete.
Third: residence and structure. The question of which state receives this data depends on your tax residence. Anyone seriously considering a move abroad should include their crypto holdings in that planning from the outset. For people who actually move away, a holding structure such as the Family Investment Company also comes into question. For someone who remains tax resident in their home country, it is not the right route.
Freedom now lies in planning, not in technology
The technology behind bitcoin did not change on 30 December 2024. The blockchain works as before. What has changed is the environment. The points at which cryptoassets meet euros, pounds, francs and bank accounts are now fully regulated and identified.
That holds in both directions. Anyone who buys cryptoassets almost always buys them through a provider. Anyone who sells them to pay for a property, a business or an invoice with the proceeds almost always sells them through a provider. Entry and exit are the points where the name sticks. In between, the wallet may be private. The ends are not.
Anyone holding cryptoassets as part of their asset protection has to price this in. Protection no longer lies in anonymity. It lies in which legal order can reach your holdings, and in your having answered that question before someone else asks it.
Postscript (as of 23 September 2026)
Since the post, MiCA's transitional phase has run out completely. According to ESMA's overview, the longest permitted transitional period for providers already active under national law before 30 December 2024 ended on 1 July 2026. Since 1 July 2026, nobody anywhere in the EU may provide crypto services without MiCA authorisation. Every provider you trade through in the EU is thus under full supervision and applies the travel rule. In the UK, the value above which a transfer leaving the UK chain must carry the sender's full details has been £800 since 30 June 2026 (S.I. 2026/621). Which surveillance data arises where today is described on the page on digital privacy.