Travel Rule Weaponized? Arbiter Rulings Reshape CASP Duty of Care

Alejandro Martínez · 2026-06-11

Recent rulings by Malta's Arbiter for Financial Services are shaking up how Crypto-Asset Service Providers (CASPs) handle Travel Rule compliance. It used to be just another anti-money laundering (AML) checkbox. But now? The Arbiter is using the Travel Rule (Regulation (EU) 2023/1113) as a benchmark for a CASP's duty of care toward everyday customers. ### What Changed? The Crypto.com Case In cases involving Crypto.com, the Arbiter made it clear: relying on automated tick-box self-declarations for transfers over $1,100 to self-hosted wallets just won't cut it. Under the EBA Guidelines, firms must show "adequate measures" to verify wallet ownership. That means real technical checks—like test transactions or cryptographic proofs—not just trusting what customers type in. ### A New Layer of Liability Here's the tricky part. The Arbiter can't fine firms for AML violations—that's the FIAU's job. But he can decide if a CASP's failure to follow Travel Rule standards hurt a consumer. That opens up a whole new world of civil liability. Even if a CASP like Crypto.com doesn't get a regulatory fine, it might still have to pay clients if weak Travel Rule controls caused a loss. ### Why This Matters for CASPs Think about it. Contract disclaimers and in-app warnings won't protect you if your internal controls are shaky. The bar for "adequate measures" just got higher. You need to weave dynamic transaction monitoring into your Travel Rule setup. Compliance isn't just about ticking boxes anymore—it's about managing litigation risk. **Key takeaways for CASPs:** - Automated self-declarations are legally insufficient for transfers over $1,100 - You need technical verification methods like test transactions or cryptographic proofs - Weak Travel Rule controls can lead to financial liability, even without regulatory fines - Contractual disclaimers won't shield you from consumer claims ### The Bigger Picture This jurisprudential shift is a wake-up call. Compliance is now a critical part of risk management. Structural weaknesses in your architecture can cost you real money. So, if you're a CASP, it's time to look beyond the checkbox and build a system that truly protects your customers—and your bottom line.