The Isle of Man's Travel Rule framework is being refined. The FSA has announced proposed amendments to the Travel Rule (Transfer of Virtual Assets) Code 2024, with the amending legislation being laid before the March sitting of Tynwald.
The Isle of Man's Travel Rule framework is being refined. The Isle of Man Financial Services Authority has announced proposed amendments to the Travel Rule (Transfer of Virtual Assets) Code 2024, with the amending legislation — the Travel Rule (Transfer of Virtual Assets) (Amendment) Code 2026 — being laid before the March sitting of Tynwald.
The Travel Rule Code 2024 came into effect on 28 October 2024, implementing FATF Recommendation 16 for the island's VASP sector. It was a significant step — the first time the Isle of Man had codified specific data transmission obligations for virtual asset transfers, requiring originating VASPs to collect and pass specified customer information to beneficiary VASPs alongside each transfer. The regime has been operational for less than eighteen months, and the FSA's willingness to revisit it reflects something worth noting: a regulator that is engaged with industry experience and prepared to refine its framework where the evidence supports it.
The centrepiece of the 2026 amendment is a revision to paragraph 7 of the Code, which addresses unhosted wallet transfers. Under the current Code, where a VASP facilitates a transfer involving an unhosted wallet — a self-custody wallet controlled directly by the end user, with no intermediary — the VASP is required to obtain specified Travel Rule information from its customer. The existing wording has created practical difficulties in application. Unhosted wallets by their nature do not sit within the VASP-to-VASP data transfer infrastructure that the Travel Rule was primarily designed for, and the obligations as currently drafted have been experienced by some VASPs as disproportionate relative to the actual risk profile of many such transfers.
The amendment seeks to address this by revising the wording in paragraph 7 to make the application of the unhosted wallet provision more proportionate and to explicitly permit VASPs to apply a risk-based approach. This is consistent with the direction of FATF's own guidance on unhosted wallets, which acknowledges the elevated risk profile of self-custody wallet transfers but does not mandate a one-size-fits-all treatment. A risk-based approach allows VASPs to calibrate their controls to the actual characteristics of the transaction — taking into account factors such as transaction value, customer risk profile, source of funds, and blockchain analytics outputs — rather than applying blanket requirements regardless of context.
The second strand of the 2026 changes is procedural but equally significant. The FSA is working with the Treasury to bring the Travel Rule Code 2024 within the scope of the AML/CFT (Civil Penalties) Regulations 2019. If approved by Tynwald, this will be achieved through the AML/CFT (Civil Penalties) (Travel Rule) (Amendment) Regulations 2026. Until now, non-compliance with the Travel Rule Code has carried criminal sanctions — the Code made failure to comply a criminal offence. The introduction of civil penalties alongside the existing criminal penalties creates a more graduated enforcement toolkit, allowing the FSA to respond to compliance failures proportionately without reaching for criminal prosecution in every instance.
For VASPs registered in the Isle of Man, the practical implications are twofold. First, the revision to paragraph 7 creates an opportunity — and an obligation — to revisit existing unhosted wallet policies and procedures. A risk-based approach only functions if the underlying risk assessment is substantive. VASPs should ensure their business risk assessments address unhosted wallet exposure specifically, that their policies articulate a clear risk-tiering methodology, and that their controls are documented and defensible. Second, the introduction of civil penalties raises the stakes of compliance gaps that might previously have seemed unlikely to attract enforcement attention. A graduated penalties regime tends to lower the practical enforcement threshold, and VASPs should treat this as a signal to ensure their Travel Rule compliance is genuinely operational rather than policy-on-paper.
The FSA has noted that the proposed revisions have followed extensive consultation and collaboration with the island's VASP sector. That collaborative approach to legislative development is a feature of the Isle of Man regulatory environment worth acknowledging — and it is also a reason why VASPs operating here should engage actively with consultation processes when they arise.
At Kybri Consulting Limited, we support Isle of Man VASPs in building and maintaining Travel Rule compliance frameworks — from policy design and risk assessment through to unhosted wallet procedures and regulatory engagement. If the 2026 amendments raise questions about your current compliance position, we are happy to assist.
A thirty-minute call, no obligation. If the answer is that you do not need us yet, you will hear that too.
