--- title: Travel Rule Infrastructure & Counterparty Coordination entity: SwissChain Holding SA jurisdiction: Switzerland doc_type: infrastructure status: in_progress last_reviewed: 2026-03-09 owner: TBD evidence_level: public source_urls: [] related_docs: [] --- # NOTABENE Travel Rule Compliance & Counterparty Risk Infrastructure (Regulatory & Technical Memorandum) ## I. Systemic Role within SwissChain Control Architecture Within SwissChain's control architecture, Notabene functions as the specialized Travel Rule compliance and counterparty risk management layer for virtual asset transfers. While Sumsub provides comprehensive identity verification, KYC/KYB and broad AML screening, Notabene is purposebuilt to address the specific technical, legal and operational challenges of FATF Recommendation 16 implementation across multiple jurisdictions and messaging protocols. In systemic terms, Notabene sits between SwissChain's internal compliance decisioning (powered by Sumsub) and the actual execution of cryptoasset transfers (secured by DFNS custody infrastructure), ensuring that originator and beneficiary information is collected, validated, transmitted and stored in accordance with Travel Rule obligations before any onchain transaction is authorized. This separation is structurally important because Travel Rule compliance is not merely a datatransmission exercise but a counterparty due diligence and pretransaction riskassessment function. Notabene enables SwissChain to verify the regulatory status, jurisdiction and risk profile of counterparty VASPs; screen beneficiary wallets for sanctions, fraud and illicitfinance exposure; identify whether a destination address is controlled by a regulated VASP, an unhosted wallet or a highrisk entity; and enforce jurisdiction-specific thresholds and data requirements automatically. For SwissChain, the implication is that Notabene operates as a critical control gate: no qualifying virtual asset transfer should reach the DFNS signing layer without passing Notabene's pretransaction checks and Travel Rule dataexchange workflows, which is central to demonstrating compliance with FATF standards, domestic Travel Rule regulations, and banking partners' expectations around counterparty transparency and AML/CFT controls in crypto flows. ## II. Legal Nature, Regulatory Perimeter and Market Positioning Notabene is a RegTech softwareasaservice provider offering Travel Rule compliance, counterparty due diligence and crypto transaction risk management tools to virtual asset service providers, financial institutions, banks and crypto-native businesses. It does not operate as an exchange, custodian, payment processor or VASP itself; instead, it provides the infrastructure and data services that allow regulated entities to comply with Travel Rule obligations imposed by domestic regulators pursuant to FATF Recommendation 16. This legal positioning means that SwissChain does not outsource its regulatory accountability for Travel Rule compliance to Notabene but outsources the technical implementation of counterparty identification, VASP network connectivity, encrypted PII transmission, and related datamanagement functions, while retaining responsibility for policy definition, riskappetite calibration and supervisory accountability. From a market standpoint, Notabene has established itself as a leading Travel Rule solution provider within the virtual asset sector. According to publicly available materials, Notabene's network comprises over 1,900 VASPs across more than 100 jurisdictions, serves more than 240 customers, and has facilitated over USD 1 trillion in transaction volume through its platform. Public reports indicate that Notabene is trusted by major crypto exchanges and financial institutions including Luno, Bitso, Crypto.com, Coinbase, Anchorage Digital, Galaxy Digital, Fireblocks, Bitso and others, and maintains strategic partnerships with blockchain analytics providers such as Chainalysis, Elliptic, Scorechain and regulatory data providers such as VASPnet to enrich its counterparty intelligence and transaction screening capabilities. Notabene's 2025 State of Crypto Travel Rule report, based on survey data from 91 VASPs and 10 regulatory bodies, indicates that 100% of surveyed firms plan to be Travel Rule compliant by the end of 2025, with nearly 90% expecting to meet requirements in the first half of the year, and documents a 431% yearoveryear increase in VASPs blocking withdrawals until beneficiary information is confirmed. This market position and data point to Notabene operating as mature, productionscale infrastructure for Travel Rule compliance rather than as a niche or experimental service, which is material for SwissChain's institutional positioning. ## III. Certification and Assurance Framework Notabene publicly discloses SOC 2 Type II certification, confirming that its controls over security, availability, processing integrity, confidentiality and privacy have been independently audited and found to operate effectively over a sustained period. The SOC 2 Type II report was issued following a threemonth audit by AICPArecognized auditors and concluded with a clean opinion, indicating that Notabene achieved its service commitments and system requirements based on the trust services criteria relevant to security and privacy as outlined in TSP section 100, 2017 Trust Services Criteria. For SwissChain, this provides external assurance that Notabene's handling of sensitive customer personally identifiable information (PII), Travel Rule data and counterparty due diligence workflows is subject to independent oversight and meets institutional control standards, which supports reliance on Notabene under SwissChain's vendorrisk governance and allows auditors and regulators to reference Notabene's SOC 2 attestation when evaluating SwissChain's Travel Rule control environment. Data protection and privacy controls are explicitly aligned with EU GDPR and Singapore PDPA requirements, with Notabene offering what it describes as "SafePII"—an escrowed, encrypted exchange of PII that Notabene positions as the industry's strongest protection for customer data in Travel Rule contexts. Notabene's public materials indicate that all sensitive data is encrypted both at rest and in transit using established encryption schemas, and that multiple regions for data storage are available, with full physical data segregation available for enterprise customers to support data residency and sovereignty requirements. Notabene further provides a plugandplay Travel Rule enduser data consent component, which is relevant for demonstrating that Travel Rule datasharing has been conducted with appropriate customer notice and consent under applicable privacy regimes. Notabene publicly commits to 24/7 uptime and offers configurable enterprise SLAs, which supports operationalresilience expectations for a critical compliance function. While Notabene does not publicly enumerate ISO certifications, penetrationtesting cadence or detailed incidentresponse metrics, SwissChain can rely on the SOC 2 Type II, GDPR and PDPA alignment, and enterprise SLA framework as a baseline assurance package, subject to contractual augmentation and periodic auditreport review under NDA. ## IV. Core Technical Architecture and Control Surface Notabene's platform is architected as an end-to-end, protocolagnostic Travel Rule compliance solution that integrates counterparty identification, VASP network connectivity, wallettype detection, blockchain analytics, sanctions and risk screening, encrypted PII transmission, audittrail generation and regulatory reporting within a unified orchestration environment. According to public materials, Notabene connects to over 1,900 VASPs across more than 100 jurisdictions and supports all major Travel Rule messaging protocols, enabling interoperability regardless of the counterparty's chosen technical standard. Notabene publicly describes itself as the only end-to-end Travel Rule solution offering a true multiprotocol approach, which is structurally important for SwissChain because it eliminates the risk that counterparty VASPs using different protocols become unreachable or require manual workarounds, thereby reducing operational friction and compliance gaps. The Notabene workflow comprises four integrated steps executed in real time for each qualifying transaction. First, the platform identifies and screens all counterparties by determining whether a destination address is controlled by a regulated VASP, an unhosted wallet, or an unidentified entity, using walletattribution data and blockchain intelligence. Second, it performs VASP due diligence by accessing regulatory status, jurisdiction, licensing information and risk indicators for counterparty VASPs, with Notabene maintaining a proprietary VASP directory enriched by partnership with VASPnet, which provides real-time, verified regulatory data on licensed VASPs globally. Third, Notabene facilitates the exchange of Travel Rule information by securely transmitting encrypted originator and beneficiary PII via the appropriate messaging protocol, using SafePII technology designed to protect customer data during transfer and storage. Fourth, the platform automates transactionflow decisions and generates analytics and insights, allowing SwissChain to set riskbased rules that automatically approve, flag or block transactions based on counterparty risk profiles, jurisdictional rules and internal policies. Notabene's public materials indicate that the platform supports infinite assets and blockchains, offers over 10 ready-to-use jurisdiction-specific compliance rule bundles covering more than 35 jurisdictions, and enables automated compliance workflows calibrated to varying thresholds and data requirements across regions. Strategic partnerships with Chainalysis, Elliptic and Scorechain provide integrated blockchain analytics and transaction monitoring, allowing Notabene customers to layer walletrisk scoring, sanctions screening and fraud detection directly into Travel Rule decisioning. For SwissChain, this means that Travel Rule compliance, counterparty due diligence and transactionlevel risk screening are unified in a single system, reducing the risk of process gaps or manual reconciliation errors between disparate tools. ## V. Risk Mitigation Mechanics and Residual Risk Notabene's riskmitigation value for SwissChain derives from three primary functions: pretransaction counterparty visibility, automated Travel Rule dataexchange across protocols, and unified audit trails that satisfy both FATF Recommendation 16 and domestic regulatory expectations. On the counterpartyvisibility side, Notabene's network of over 1,900 VASPs and integration with VASPnet's verified regulatory database enables SwissChain to perform real-time due diligence on counterparty VASPs, assessing their regulatory status, jurisdiction and compliance posture before authorizing transfers. This directly addresses one of the most significant Travel Rule implementation challenges: that manual due diligence on hundreds or thousands of counterparty VASPs is operationally infeasible and creates either business friction (blocking transfers pending manual review) or compliance risk (allowing transfers without adequate counterparty assurance). Notabene's automated VASP due diligence and rules engine allows SwissChain to scale trusted flows to regulated counterparties while blocking or escalating highrisk or unverified entities. On the dataexchange side, Notabene's multiprotocol architecture and SafePII encryption reduce the operational and legal risks associated with transmitting sensitive customer PII across borders and between institutions. Notabene's approach to encrypted, escrowed PII exchange is designed to satisfy both Travel Rule datasharing obligations and GDPR/PDPA privacy protections, which is particularly important for SwissChain given its Swiss and EU regulatory perimeter. The platform's ability to handle the "sunrise challenge"—where a counterparty VASP has not yet implemented a Travel Rule solution—by enabling unilateral data transmission and storage reduces the risk that SwissChain is forced to either reject legitimate customer transactions or proceed without adequate Travel Rule compliance documentation. However, reliance on Notabene introduces concentrated vendor risk and networkeffect dependencies. SwissChain's ability to execute compliant virtual asset transfers becomes dependent on Notabene's uptime, network coverage and data accuracy; if Notabene experiences service disruptions, delays in VASP directory updates or gaps in protocol connectivity, SwissChain's transaction flows may be blocked or processed with incomplete due diligence. Additionally, while Notabene's VASP network is large, coverage is not universal, and counterparties outside the Notabene ecosystem may require manual handling or secondary solutions. Residual risk therefore includes: potential delays or failures in Travel Rule data exchange if counterparty systems are unavailable; reliance on thirdparty data sources (VASPnet, blockchain analytics partners) whose quality and completeness are not fully transparent; and the risk that regulatory interpretations or technical standards evolve faster than Notabene's platform can adapt. These risks must be mitigated through contractual SLAs, periodic testing of Travel Rule workflows with key counterparties, independent validation of VASP directory data accuracy, and fallback procedures for manual Travel Rule processing where automated solutions fail. ## VI. Integration with SwissChain Stack and Control Flows Technically, Notabene integrates into SwissChain's transactioninitiation and approval workflows via APIs, sitting between the upstream AML/sanctions layer (Sumsub) and the downstream custody/signing layer (DFNS). When a client initiates a virtual asset withdrawal or transfer, SwissChain's internal systems first validate the customer's identity, perform KYC/KYB checks and screen for sanctions and adverse media via Sumsub. If the transaction passes these controls, it is routed to Notabene for Travel Rule processing before being submitted to DFNS for cryptographic signing. Within Notabene, the workflow identifies the counterparty wallet type, performs VASP due diligence if the destination is a regulated entity, exchanges encrypted PII with the counterparty, applies SwissChain's configured risk rules, and returns a compliance decision (approve, escalate, block) along with an audit record. Only transactions that receive approval from Notabene and satisfy all Travel Rule dataexchange requirements are forwarded to DFNS for signing and onchain broadcast. This integration enforces a sequential control architecture where Travel Rule compliance is a mandatory gate rather than a parallel advisory function. SwissChain can configure Notabene's rules engine to implement jurisdiction-specific thresholds (e.g., USD 1,000 for FATFaligned jurisdictions, lower thresholds for EU/UK/Singapore), automatically block transfers to highrisk jurisdictions or unverified VASPs, and escalate transactions involving unhosted wallets for enhanced due diligence. The linkage between Notabene and DFNS ensures that cryptographic signing cannot proceed unless Travel Rule obligations have been satisfied and documented, which is central to demonstrating to auditors and regulators that SwissChain's Travel Rule controls are technically enforced rather than procedurally suggested. ## VII. Auditability, Supervisory Defensibility and Strategic Implications Notabene's unified audit trail, covering counterparty identification, VASP due diligence, PII transmission and transaction decisions, provides SwissChain with structured, exportable evidence of Travel Rule compliance for every qualifying transfer. The platform's public materials emphasize the ability to store encrypted customer PII for up to five years and generate reports for local regulators, which directly satisfies FATF Recommendation 16's recordkeeping and dataavailability requirements. For SwissChain, this means that external auditors and regulators can trace each virtual asset transfer from initiation through to completion, review the counterparty VASP's regulatory profile, verify that required originator and beneficiary information was collected and transmitted, and confirm that riskbased escalation or blocking decisions were applied consistently with documented policies. Strategically, integrating Notabene as the dedicated Travel Rule infrastructure provider allows SwissChain to present a coherent institutional narrative: that its virtual asset transfer flows are subject to pretransaction counterparty due diligence, automated Travel Rule data exchange across protocols, and unified compliance controls that align with FATF standards and domestic regulations across more than 100 jurisdictions. The reported metrics—over 1,900 VASPs in network, 240+ customers, more than USD 1 trillion in transaction volume, SOC 2 Type II certification, and GDPR/PDPA alignment—support the argument that Notabene is not an experimental or fragmented solution but a mature, productionscale Travel Rule platform used by major exchanges and financial institutions. At the same time, SwissChain must document in its vendorrisk framework that Notabene is classified as a critical outsourced function, with documented SLAs, periodic validation of VASP directory accuracy, scenario testing of Travel Rule workflows with representative counterparties, and contingency procedures for manual Travel Rule processing in the event of Notabene service disruptions. Managed in this way, Notabene can be positioned to bank boards, listing committees and regulators as a deliberate, riskreducing infrastructure choice that materially strengthens SwissChain's Travel Rule compliance posture and counterparty transparency, supporting both regulatory defensibility and institutional acceptance in a rapidly evolving regulatory landscape.