Envoy FAQ for Compliance & Product Teams

1.What is Envoy?

Envoy is an open-source, end-to-end encrypted, peer-to-peer messaging service that lets virtual asset service providers (VASPs) exchange Travel Rule data directly with their counterparties.

Think of it as a dedicated, encrypted phone line between your VASP and each counterparty. Envoy supports both the TRISA and TRP protocols.

• Simplicity: one interface for multiple protocols (TRISA, TRP and Sunrise email)
• Security: end-to-end encryption protects your customers’ personal data (PII)
• Reach: Sunrise email messaging lets you exchange data with VASPs outside the TRISA and TRP networks
• Cost: free to self-host under the MIT license, or available as a managed service

2.What is the Travel Rule?

The Travel Rule is the Financial Action Task Force (FATF) requirement, set out in Recommendation 16, that obliges VASPs to share originator and beneficiary information when they transfer virtual assets, to combat money laundering and terrorist financing.

The required data and the thresholds at which it applies vary by jurisdiction.

3.Who should use Envoy?

Any VASP that must comply with the Travel Rule, including cryptocurrency exchanges, wallet providers, money service businesses and payment service providers.

Envoy suits compliance teams that need a robust Travel Rule solution with minimal technical overhead, and technical teams that want an open-source system they can inspect, deploy and integrate.

4.Who owns and operates Envoy?

The OpenVASP Association owns and stewards the MIT-licensed Envoy codebase, the TRISA Global Directory Service (GDS) and the TRISA Working Group. Rotational Labs operates the TRISA infrastructure on OpenVASP’s behalf and provides the Envoy managed service.

Any VASP can self-host Envoy and contribute to its open-source development. Rotational Labs is a TRISA Service Provider and core contributor that builds, hosts and maintains Envoy for VASPs that want a hosted solution. Read the OpenVASP announcement →

5.What is TRISA's Global Directory Service (GDS)?

The GDS is a directory of verified VASPs, backed by the TRISA Verified Certificate Authority (TVCA). Every Envoy user must register with it.

After verifying a VASP, the GDS issues x.509 identity certificates. These certificates enable end-to-end encryption and prevent misdelivery: only the intended recipient can read the data. Registration is free and verification takes about 1 business day. Start GDS registration →

6.How does an Envoy transfer work?

The originating VASP sends the beneficiary VASP an encrypted message (a secure envelope) with the originator’s details. The beneficiary accepts, rejects or asks for a repair, and the originator can then confirm the transfer with the blockchain transaction hash.

1. Send: the originator selects a counterparty and protocol and sends originator data.
2. Respond: the beneficiary accepts and adds beneficiary data, rejects with a reason, or requests a repair.
3. Confirm: the originator can attach the on-chain transaction hash to complete the record. This is optional.

Every step is stored as a cryptographically signed secure envelope, which gives both parties a tamper-evident audit trail. Jurisdictions differ on timing: some require the Travel Rule exchange before the asset transfer, others don’t.

7.How do I send a Travel Rule message?

Click Send New Transfer in Envoy, or use the API, and choose one of three methods depending on the counterparty.

The managed service includes Daybreak, a curated database of email contacts at more than 1,500 VASPs, to simplify Sunrise messaging. Daybreak is not included in the self-hosted version.

8.What can I do with incoming messages?

Incoming messages appear in Envoy’s transfer inbox, where you can accept, reject or request a repair.

• Accept: add the required beneficiary information and return the message.
• Reject: decline the message and give a reason.
• Request repair: ask the sender to correct or complete the data. The sender returns an amended secure envelope.

9.How does Envoy manage customers and counterparties?

Envoy keeps IVMS101 records for your customers and an automatically synchronized list of counterparty VASPs.

• Customers: maintain IVMS101 records, automatically generate unique travel addresses and QR codes, link multiple wallet addresses to each customer, and keep transaction history.
• Counterparties: view country of registration, supported protocol and travel address. The list syncs daily with the GDS, so new TRISA members appear automatically.

All of these features are also available through Envoy’s REST/JSON API.

10.Which protocols does Envoy support?

Envoy supports the TRISA and TRP open protocols, plus Sunrise email for counterparties on neither network.

• TRISA: uses a certificate authority to verify VASPs, with public-key encryption and mTLS for private, peer-to-peer messaging.
• TRP (Travel Rule Protocol): uses travel addresses for decentralized exchange between counterparties.
• Sunrise email: starts a Travel Rule exchange with any counterparty that has a valid email address.

TRISA and TRP have been interoperable since 2023. TRISA has also opened interoperability discussions with closed networks such as Binance GTR, Coinbase TRUST and VerifyVASP; the outcome depends on their willingness to integrate. Until then, Sunrise email reaches any out-of-network counterparty.

11.What is Sunrise email messaging?

Sunrise lets Envoy users exchange Travel Rule data with any counterparty, even one that uses neither TRISA nor TRP, by starting the exchange over email.

The recipient receives an email that directs them to a secure data portal to view and respond. Sunrise also covers counterparties in jurisdictions that do not yet have Travel Rule requirements.

12.What is a travel address?

A travel address is a unique identifier used by TRP, sometimes described as the IBAN of crypto transfers. It encodes the VASP and account or wallet details.

Example:

taMgkZxSMgvtkp2PFR861UnJTDdM3wR5TwBb49iN6JSkZ3gpqgbGy1rZ9jRD2GQpYVgyw5QGi48XSVH6ufyT4HTGGKHLwmDPZAJoKJmtg4k7iFFPVo

Travel addresses work like URLs: the host part stays the same for a VASP, but the account or wallet part can change. The same counterparty may therefore have different travel addresses for different transactions.

Because TRP is decentralized and has no central directory, the originator must collect the travel address from the beneficiary when initiating each transaction. If a counterparty uses TRP but is not in the TRISA directory, use Envoy’s prepare transaction API endpoint to send messages to its travel address.

13.Does Envoy generate travel addresses?

Yes. Your Envoy node generates travel addresses for your customers automatically.

Travel addresses work across both the TRISA and TRP networks, and Envoy’s travel address utility can decode them to identify counterparties.

14.Which Travel Rule regulations does Envoy support?

Envoy is designed to support Travel Rule requirements at any threshold under FATF Recommendation 16, the EU Transfer of Funds Regulation (TFR) and MiCA, the US (FinCEN Travel Rule), the UK, Singapore and Switzerland.

Envoy uses the IVMS101 data standard and adapts to jurisdiction-specific data requirements. Your local compliance obligations remain with your VASP, so confirm specific requirements with counsel in each jurisdiction.

15.What data is exchanged for Travel Rule compliance?

Envoy exchanges originator and beneficiary identity data and transaction details, structured with the IVMS101 standard and sealed in secure envelopes.

• Originator PII: for example name, account number, date of birth and physical address
• Beneficiary PII: for example name and account number
• Transaction details: for example asset type, amount and network
• VASP details: information about the originating and beneficiary VASPs

The exact fields depend on the jurisdiction. Some require date of birth, others don’t, and Envoy accommodates both.

16.How do we prove compliance during a regulatory audit?

Present the final secure envelope for the transaction. It is cryptographically signed and identical for both counterparties.

Envoy keeps an off-chain record of every secure envelope in both deployment options.

• Self-hosted: your organization stores the encrypted envelopes and manages the keys, and must provide access to the relevant envelopes for an audit or legal enforcement action.
• Managed service: Rotational stores your encrypted messages, backed up in triplicate, and a dedicated compliance contact helps retrieve the envelopes you need.

17.How long is transaction and customer data retained?

As long as your retention policy requires. Retention is configurable because requirements differ by jurisdiction.

If you self-host, you configure retention in your own storage system. If you use the managed service, Rotational configures retention to match your policies.

18.Can customers request data deletion under GDPR?

Yes, Envoy can delete data, but AML and CFT record-keeping obligations often take precedence over the GDPR right to be forgotten.

Consult legal counsel before acting on a deletion request.

19.How are counterparty VASPs verified?

Every VASP is verified by TRISA before it can join the network.

When a VASP submits the GDS registration form, TRISA carries out domain checks, sanctions checks and a phone verification call. Verified VASPs receive x.509 identity certificates for both TestNet and MainNet. Certificates are valid for one year and are reissued while the VASP remains in good standing.

20.What if a counterparty doesn't respond or doesn't support the Travel Rule?

Use Sunrise email to reach counterparties that don’t support the Travel Rule. If a TRISA-certified VASP repeatedly fails to respond, report it and TRISA can take corrective action.

Compliance officers typically review pending transfers in batches once or twice a week, and direct outreach also helps. In the EU, VASPs are required to report repeatedly non-responsive counterparties.

21.Does Envoy screen transactions or block high-risk jurisdictions?

No. Envoy is an encrypted messaging solution, not a sanctions-screening, AML or KYC tool.

Your VASP remains responsible for risk analysis, screening and any blocking within its compliance processes. Third-party plugins with blockchain analytics vendors are planned, as are policies to automatically reject messages (not transactions) from selected counterparties.

22.Does Envoy work with DeFi or self-hosted wallets?

Envoy focuses on VASP-to-VASP transfers.

For self-hosted wallets, VASPs generally require proof of ownership, for example a small test transfer. Envoy does not provide KYC services directly but can integrate with partners such as iComply, Ospree and Chainalysis.

23.How does Envoy keep data secure?

Envoy seals Travel Rule data in secure envelopes, multi-layer encrypted messages that only the intended recipient can open, and sends them over mutually authenticated channels.

• End-to-end encryption
• Public key infrastructure (PKI)
• Mutual TLS (mTLS) to open secure channels between counterparties
• HMAC validation for authenticity and tamper evidence
• Counterparty verification through TRISA’s certificate authority

24.What encryption standards does Envoy use?

Data in transit is protected by mTLS. Data at rest is stored in secure envelopes encrypted with AES-256-GCM, signed with HMAC-SHA256, with keys sealed using RSA-OAEP-256.

• In transit: mTLS on the TRISA network, and on TRP when available. All TRP exchanges require valid TLS certificates.
• At rest: all Travel Rule PII is stored as secure envelopes with its original cryptography, even when the transfer happened over TRP.
• Envelope encryption: data is encrypted symmetrically with AES-256-GCM using a new key for every transfer, signed with HMAC-SHA256, and the encryption key and HMAC secret are encrypted with the recipient’s public key using RSA-OAEP-256.
• Integrity: Envoy checks every envelope’s HMAC automatically and rejects any message whose HMAC is invalid.

Secure envelope specification on trisa.dev →

25.How many secure envelopes are in a typical transfer?

Six. Each message creates two identical secure envelopes, one for each counterparty, which proves both received the same data with no tampering.

If the beneficiary requests a repair, each repair adds another pair of envelopes.

26.Is any Travel Rule data written to the blockchain?

No. Customer PII and Travel Rule checks never go on-chain, where they could be exposed.

All data is encrypted in secure envelopes and stored off-chain in a database, like a filing cabinet of sealed envelopes. For an audit or legal enforcement action, you unlock and show the regulator the final envelope for the transaction.

27.How is Travel Rule data linked to the on-chain transaction?

The originator adds the blockchain transaction hash to the final message once the on-chain transfer is complete.

• Proof of transfer: the hash is the on-chain receipt showing the funds actually moved.
• Reconciliation: both parties can match the transaction to the Travel Rule details they exchanged, such as amounts and addresses.
• Record-keeping: regulators often require evidence of the on-chain transaction, and storing the hash in Envoy keeps the audit trail complete.

28.Can Envoy work with other Travel Rule services?

Yes, where those services adopt compatible approaches or APIs.

Envoy’s API is designed as a multiplexer that supports any protocol willing to interoperate with TRISA, open or closed.

29.Does Envoy have an API and webhooks?

Yes. Every Envoy feature is available through its REST/JSON API, and Envoy can call your internal API (a webhook) when a new message arrives.

Webhooks let your compliance team know immediately when a transfer needs approval or rejection. API reference →

30.How do we integrate Envoy with our own app?

Your app collects the transfer details from the user and calls the Envoy API, which packages the data and sends it to the counterparty over the best available channel.

1. The user indicates whether the transfer is going to another VASP, which determines whether the Travel Rule applies.
2. The user enters the beneficiary’s name, wallet address and counterparty VASP, and optionally the beneficiary’s travel address.
3. Your app calls Envoy, which fetches the originator’s IVMS101 record and your VASP’s record and packages them with the transaction details.
4. Envoy sends the secure envelope via TRISA if the counterparty is a TRISA member, via TRP if a travel address was entered, or otherwise by Sunrise email to the Daybreak contact (managed service, where contact details exist).
5. You decide when to release funds, for example after sending or after receiving a response. Once released, your app adds the transaction hash.

Beneficiary details are usually a one-time setup per wallet and can be saved for future transfers. You can also do all of this manually in the Envoy interface. Ask a compliance expert in your jurisdiction exactly which information and sanctions checks you need; name, wallet address and counterparty may not be enough.

31.Can we customize Envoy?

Yes. Self-hosted users have full control of the code; managed-service users customize through the API.

32.Does the dashboard show which protocol a transfer used?

Not currently. The interface does not label TRISA and TRP transfers separately, but the API data shows the protocol for each transfer.

33.How much does Envoy cost?

Self-hosting is free under the MIT license; you provide your own infrastructure and staff time. The managed service costs $375 per month per node (one node per entity), with a 6-month minimum commitment.

Compare the two options →

34.How long does it take to deploy Envoy?

About 1–2 days with the managed service, or 4–6 weeks self-hosted. Both include GDS registration, which takes about 1 business day.

• Managed service: turnkey. Rotational sets up and manages Envoy for you, and existing TRISA members can be onboarded almost immediately.
• Self-hosted: download and configure the code, register with the GDS, integrate with your back end, then test and deploy. Plan for developer and compliance time on your side, plus your own compute, key management and data storage.

35.What are we responsible for under each option?

Self-hosted, you run everything. With the managed service, Rotational runs the infrastructure and you focus on compliance decisions.

36.What technical support is available?

Technical support is included with the managed service, along with a dedicated compliance contact. Self-hosted users can rely on documentation and community channels, or buy optional technical support separately.

The compliance contact helps retrieve data for audits or legal enforcement actions, but is not a legal advisor.

37.How long does it take a counterparty to accept a transfer?

It depends on the counterparty’s review process.

Manual review introduces a delay that depends on each VASP’s internal procedures; many compliance teams review in batches once or twice a week. Envoy is developing auto-accept and auto-reject policies, including allow and block lists for repeat counterparties and known wallets, to speed up routine transfers.