Travel Rule Compliance from 1 July 2026: Data Fields MTOs Must Collect

The travel rule becomes mandatory for all Australian remittance operators and virtual asset service providers from 1 July 2026. From that date, you must collect, verify, and pass on a defined set of payer and payee information with every value transfer you send, and screen incoming transfers for complete data before releasing funds. Missing or incomplete fields are no longer a paperwork issue — they are a compliance breach that can trigger AUSTRAC enforcement action.

This guide lists every data field you must collect, which ones require verification, and how to handle transfers that arrive without complete information. If you run an MTO or VASP, this is the operational detail your systems and staff need before the deadline.

Key Takeaways

• The travel rule requires ordering institutions to pass payer and payee data along the value transfer chain with every transfer from 1 July 2026.
• You must collect payer name, address or unique identifier, and account/transaction reference, plus payee name and account reference — verified for the payer in most cases.
• A AUD 1,000 threshold historically applied, but the 2026 reforms tighten requirements and expand coverage to all value transfer providers, including crypto.
• Incoming transfers with missing data must be flagged, and you must have a risk-based policy for requesting, holding, or rejecting them.
• Non-compliance carries civil penalties under the AML/CTF Act 2006 — build travel rule logic into your transaction workflow now, not after go-live.

What the Travel Rule Actually Requires

The travel rule — formally the requirement to include originator and beneficiary information in value transfer messages — comes from FATF Recommendation 16. Australia implements it through the AML/CTF Act 2006 and the AML/CTF Rules, and the 2026 reforms rewrite how it applies across the newly defined value transfer chain.

In plain terms: when you send money on behalf of a customer, you must attach a required set of information about both the sender (payer) and the recipient (payee), and transmit it to the next institution in the chain. The receiving institution relies on that data to screen the transfer and complete its own checks.

The rule exists to stop criminals moving funds anonymously. Without payer and payee data travelling with the transfer, sanctions screening, suspicious matter reporting, and law enforcement tracing all break down. FATF has identified the travel rule as one of the most commonly under-implemented recommendations globally, and AUSTRAC has signalled it expects full compliance from 1 July 2026.

Who the rule applies to

The obligation sits with every institution in the value transfer chain:

• Ordering institution — the provider that accepts the transfer instruction from the payer (your customer sending money).
• Intermediary institution — any provider that passes the transfer along without direct contact with payer or payee.
• Beneficiary institution — the provider that makes funds available to the payee.

Most MTOs act as ordering and beneficiary institutions depending on the direction of the corridor. VASPs moving virtual assets are now squarely covered — the crypto travel rule mirrors the fiat rule, with the same data fields applied to wallet transfers.

The Data Fields You Must Collect

This is the operational core. From 1 July 2026, every value transfer you originate must carry the following information. The table separates payer fields from payee fields and flags verification requirements.

Field	Party	Required	Verification needed
Full name	Payer	Yes	Yes (verify identity)
Residential or business address	Payer	Yes (or alternative identifier)	Yes
Date of birth OR customer ID number	Payer	Alternative to address	Yes
Account number / unique transaction reference	Payer	Yes	N/A (system-generated)
Full name	Payee	Yes	No (collected, not verified)
Account number / wallet address / transaction reference	Payee	Yes	No

Payer information in detail

For the person or entity sending the money, you must collect and verify:

1. Full legal name — matching the identity you verified at onboarding under your KYC process.
2. One identifier from: residential/business address, date of birth, customer identification number, or a national identity number.
3. An account number or, where no account exists, a unique transaction reference that lets the transfer be traced back to the individual transaction.

For a business payer, collect the registered business name, a business identifier (such as an ABN or ACN), and the registered or principal place of business.

The verification standard matters: payer data must be verified, not simply self-declared. Because you already conduct customer due diligence on the sender, you draw on that verified identity data. This is why robust eKYC at onboarding directly feeds travel rule compliance — the two obligations connect.

Payee information in detail

For the recipient, the standard is lighter because the payee is usually not your customer:

1. Full name of the beneficiary.
2. Account number, wallet address, or a unique transaction reference that allows the beneficiary institution to identify the recipient.

You are not required to independently verify the payee's identity as the ordering institution. You collect this information from your payer and pass it on accurately. The beneficiary institution carries the verification burden on its side.

Thresholds and the AUD 1,000 Rule

Historically, a AUD 1,000 threshold determined how much data had to travel with a transfer. Below the threshold, a reduced set of fields applied; above it, the full set was required and payer verification was mandatory.

Under the 2026 framework, treat the full data set as your default. For cross-border transfers of AUD 1,000 or more, collect and verify all payer fields. For transfers below AUD 1,000, you must still include payer and payee names and account/reference numbers, but verification of payer identity may be relaxed unless a suspicion of money laundering or terrorism financing exists — in which case, verify regardless of amount.

A practical warning: structuring across the threshold is a well-known evasion tactic. If a customer breaks a AUD 3,000 remittance into four AUD 900 transfers over two days, your transaction monitoring should link them and treat the aggregate as above threshold. Do not let the threshold become a loophole in your own controls.

Transfer value	Payer name	Payer identifier	Payer verification	Payee name + reference
AUD 1,000+	Required	Required	Required	Required
Under AUD 1,000	Required	Required	Relaxed (unless suspicion)	Required
Any amount, suspicion present	Required	Required	Required	Required

Handling Incoming Transfers With Missing Data

As a beneficiary institution, you cannot control what the sending provider attaches. From 1 July 2026 you must have a documented, risk-based policy for transfers that arrive with missing or meaningless travel rule data.

Your policy should cover three responses:

1. Request the missing information from the ordering or intermediary institution before releasing funds. This is the preferred first step for established counterparty relationships.
2. Hold or delay the transfer while you assess risk — appropriate where data gaps are partial and the counterparty is responsive.
3. Reject or return the transfer where data is missing, false, or the counterparty repeatedly fails to supply it, and consider whether a suspicious matter report (SMR) is warranted.

AUSTRAC expects you to track counterparties that consistently send incomplete data. A pattern of missing fields from a particular sending institution is a risk indicator in its own right, and you should factor it into your ongoing due diligence of correspondent and agent relationships.

Document your decision logic

Whatever you decide for a given transfer, record the reasoning. If you release funds despite a missing payee address, your file should show why that was acceptable on a risk basis. AUSTRAC assessors will test this during a compliance assessment — undocumented releases of incomplete-data transfers are a common finding.

Implementation: Building the Travel Rule Into Your Workflow

Travel rule compliance is a systems problem as much as a policy one. Here is a practical sequence to get operational before the deadline.

Step 1 — Map your value transfer chains. List every corridor and every counterparty (banks, aggregators, payout partners, VASP counterparties). Identify where you sit as ordering, intermediary, or beneficiary institution for each.

Step 2 — Audit your data capture. Confirm your onboarding and transaction screens collect every required payer and payee field. Many legacy MTO systems capture sender data well but treat payee details as free-text — that will not survive the 2026 rule.

Step 3 — Confirm your messaging format carries the data. If you transmit over SWIFT, the migration to ISO 20022 gives you structured fields for originator and beneficiary data — use them. For crypto, adopt a travel rule protocol (such as IVMS 101 data standard) that your VASP counterparties also support.

Step 4 — Build validation rules. Reject outbound transfers that lack a mandatory field before they leave your system. Flag inbound transfers with missing data for manual review. Automating this prevents the single most common breach — sending incomplete data because a staff member skipped a field.

Step 5 — Train front-line staff. Tellers and agents must understand why a payee's full name and account reference are non-negotiable, and how to handle a customer who resists providing information.

Step 6 — Update your AML/CTF program. Your program must document travel rule procedures, thresholds, verification standards, and your missing-data response policy. Review it against the 2026 Rules.

The crypto travel rule: extra considerations

VASPs face a harder problem because wallet addresses are pseudonymous and not every counterparty VASP is identifiable or compliant. When sending virtual assets, you must still attach payer and payee data using an interoperable protocol. Where the receiving party is an unhosted wallet (no intermediary VASP), collect and retain the required originator and, where feasible, beneficiary information, and apply enhanced scrutiny. The sunrise problem — where some jurisdictions have not yet implemented the travel rule — means you will encounter counterparties who cannot receive your data; your policy must address how you handle those transfers on a risk basis.

Record-Keeping Obligations

Collecting and transmitting the data is only part of the obligation. You must retain travel rule records for seven years under the AML/CTF Act 2006, consistent with other transaction records.

Keep:

• The full payer and payee data set attached to each transfer.
• Evidence of verification performed on the payer.
• Records of any missing-data requests you made and the responses received.
• Your risk decisions on holding, releasing, or rejecting incomplete transfers.

These records must be retrievable and legible. During a compliance assessment or a law enforcement request through the Fintel Alliance, AUSTRAC may ask you to reconstruct the information attached to a specific past transfer.

Common Mistakes to Avoid

• Treating payee data as optional. The 2026 rule makes payee name and reference mandatory for every transfer. Free-text or blank payee fields will fail.
• Relying on threshold exemptions too heavily. The under-AUD 1,000 relaxation covers verification only, not the collection and transmission of core fields.
• Passing data downstream without checking it transmitted. Confirm your messaging rail actually carries the fields — truncation in older formats silently drops data.
• Ignoring inbound data quality. Accepting incomplete-data transfers without a policy is a breach even when you are the receiving party.
• Forgetting intermediary obligations. If you sit in the middle of a chain, you must pass received data onward unchanged and in full.

FAQ

What is the AUD threshold for the travel rule in Australia?

The historical threshold is AUD 1,000. At or above this amount, you must collect and verify full payer information and transmit full payer and payee data. Below AUD 1,000, you still collect and transmit payer and payee names and reference numbers, but verification of the payer's identity may be relaxed unless you suspect money laundering or terrorism financing — in which case you verify regardless of value.

Do I need to verify the payee's identity?

No. As the ordering institution you collect the payee's name and account or wallet reference from your customer and pass it on accurately, but you are not required to independently verify the payee. The beneficiary institution carries the verification responsibility on the receiving side.

What do I do if an incoming transfer is missing travel rule data?

Apply a documented, risk-based policy: request the missing information from the sending institution, hold or delay the transfer while you assess risk, or reject and return it where data is missing or false. Record your decision and reasoning, and consider filing a suspicious matter report where appropriate. Track counterparties that repeatedly send incomplete data.

Does the travel rule apply to cryptocurrency transfers?

Yes. From 1 July 2026 the travel rule applies to VASPs moving virtual assets, mirroring the fiat requirements. You must attach payer and payee data to virtual asset transfers using an interoperable travel rule protocol. Transfers to unhosted wallets require you to collect and retain originator information and apply enhanced scrutiny on a risk basis.

How long must I keep travel rule records?

Seven years, consistent with transaction record-keeping obligations under the AML/CTF Act 2006. Retain the full data set, evidence of payer verification, missing-data requests, and your risk decisions in a retrievable, legible format.

Prepare Before the Deadline

Travel rule compliance from 1 July 2026 is not a documentation exercise — it is a change to how every transfer flows through your systems. The operators who cope best will build field validation, verification logic, and missing-data policies into their workflow now and test them before go-live.

Review your AML/CTF program to confirm it documents travel rule procedures, and check your transaction system actually captures and transmits every required field. Use our AML/CTF program tool to align your documentation with the 2026 Rules, and explore our corridor guides to understand counterparty data practices in your key markets. Subscribe to our newsletter for ongoing coverage of the 2026 reform rollout.

This information is general in nature and does not constitute legal advice. Consult AUSTRAC or a qualified legal professional for advice specific to your situation.