Crypto-as-a-Service

Set Up Travel Rule Compliance

Overview

Before your end users can withdraw crypto from a Go Account to an external address, you must whitelist the destination. Whitelisting runs travel rule compliance checks and exchanges counterparty information with the receiving Virtual Asset Service Provider (VASP) on your behalf.

For withdrawals to another BitGo wallet, whitelisting works differently. BitGo skips the travel rule checks and authorizes the destination through your wallet policy.

Note

Travel rule obligations vary by jurisdiction and transfer amount. BitGo applies the relevant threshold automatically based on your enterprise configuration. Contact your customer success manager (CSM) or support@bitgo.com for details.

Prerequisites

Cookbook

Need just the steps? Expand the cookbook below to get started:

Travel RuleOpen Cookbook

1. Get VASP

Get the verified VASP associated with a destination address.

Endpoint: Get VASP suggestions]

export ACCESS_TOKEN="<SERVICE_USER_ACCESS_TOKEN>"
export ENTERPRISE_ID="<CHILD_ENTERPRISE_ID>"
export WALLET_ADDRESS="<DESTINATION_WALLET_ADDRESS>"
export COIN="<ASSET_ID>"  # for example: btc, eth, sol

curl -X GET \
  "https://app.bitgo.com/api/travel-rule/v1/vasps/suggestions?walletAddress=$WALLET_ADDRESS&enterpriseId=$ENTERPRISE_ID&coin=$COIN" \
  -H "Authorization: Bearer $ACCESS_TOKEN"

Step Result

BitGo returns the suggested VASP for the destination address. If your VASP wasn't correctly identified, then see the following step.

{
  "vaspId": "BFXUS2NXXX",
  "name": "Bitfinex",
  "internalVasp": false,
  "proofQuality": "SIGNED",
  "source": "TRUST_BULLETIN_BOARD"
}

2. Search the VASP Registry (Optional)

If BitGo didn't successfully identify your VASP in the prior step, you can search for it manually.

Endpoint: List VASP

export ACCESS_TOKEN="<SERVICE_USER_ACCESS_TOKEN>"

curl -X GET \
  "https://app.bitgo.com/api/travel-rule/v1/vasps?status=VERIFIED&limit=50" \
  -H "Authorization: Bearer $ACCESS_TOKEN"

Step Result

You receive a list of all VASPs registered with BitGo. Identify the appropriate one and save the vaspId.

Note

If your VASP isn't listed here, you can submit it as a new VASP in the following step.

{
  "vasps": [
    {
      "id": "68c9f3ab12dd4a1b9e02f33c45a67890",
      "vaspId": "BFXUS2NXXX",
      "name": "Bitfinex",
      "domain": "bitfinex.com",
      "status": "VERIFIED",
      "source": "TRUST",
      "jurisdiction": "USA",
      "createdAt": "2024-01-15T10:30:00.000Z",
      "updatedAt": "2025-05-01T08:00:00.000Z"
    }
  ]
}

3. Whitelist Address

Submit the destination address for compliance review. This step covers whitelisting:

  • A BitGo address or Go Account.
  • An address with verified VASP.
  • An address that requires verifying a new VASP.

Endpoint: Whitelist address

Use this when the destination is another Go Account or another BitGo wallet.

export ACCESS_TOKEN="<SERVICE_USER_ACCESS_TOKEN>"
export ENTERPRISE_ID="<CHILD_ENTERPRISE_ID>"
export WALLET_ID="<GO_ACCOUNT_WALLET_ID>"
export DESTINATION_WALLET_ID="<BITGO_DESTINATION_WALLET_ID>"

curl -X POST \
  https://app.bitgo.com/api/travel-rule/v1/whitelist \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -d '{
    "enterpriseId": "'"$ENTERPRISE_ID"'",
    "walletId": "'"$WALLET_ID"'",
    "coin": "eth",
    "address": "'"$DESTINATION_WALLET_ID"'",
    "custodyType": "hosted",
    "label": "Internal Go Account"
  }'

Step Result

BitGo returns the wallet policy rule ID as the whitelistId, along with a status that reflects whether policy approval is still pending.

{
  "whitelistId": "5f8d0a2e1c9b4d7a3e6f8b2c1d4e7a9f",
  "status": "pending_policy_approval"
}

4. Track Whitelist Status

Whitelisting resolves asynchronously. You can Create Webhooks so BitGo notifies you when the status changes, or you can check the status manually by calling the API.

Endpoint: Get whitelist address status

export ACCESS_TOKEN="<SERVICE_USER_ACCESS_TOKEN>"
export ENTERPRISE_ID="<CHILD_ENTERPRISE_ID>"
export WALLET_ID="<GO_ACCOUNT_WALLET_ID>"
export ADDRESS="<DESTINATION_WALLET_ADDRESS>"

curl -X GET \
  "https://app.bitgo.com/api/travel-rule/v1/whitelist-address-status?address=$ADDRESS&walletId=$WALLET_ID&enterpriseId=$ENTERPRISE_ID" \
  -H "Authorization: Bearer $ACCESS_TOKEN"

Step Result

BitGo returns the current whitelist status for the address.

{
  "whitelistResponse": [
    {
      "status": "VERIFIED",
      "verifiedSource": "TRUST",
      "address": "0xAbCd1234...",
      "receiveAddress": "0xAbCd1234...",
      "label": "My Bitfinex account",
      "coin": "eth",
      "walletId": "59cd72485007a239fb00282ed480da1f",
      "updatedAt": "2025-06-01T12:00:00.000Z"
    }
  ]
}

Next

Once your users' withdrawal addresses are whitelisted, they can send crypto through their Go Accounts.

See Also