本專業實務報告以匿名化之國際 VASP 為深度個案研究對象，結合 FATF（2025）Targeted Update 與 Sumsub（2025）《The Travel Rule Buyer's Guide》所列八大旅行規則建置挑戰及三階（Baseline／Intermediate／Advanced）擇商能力模型，就 FATF（2019）第 16 項建議旅行規則（Travel Rule）之遵循要求進行比較分析，探討 VASP 兩項合規維運之核心問題：旅行規則如何施行以滿足合規需求，以及機構層級反洗錢工具鏈之整合治理。

實務研究調查發現：（一）依 FATF（2025）Targeted Update，117 個受訪轄區中 85 個（73%）已通過旅行規則立法，惟實質涵蓋率約僅 42%（本研究依 FATF 2025 年 6 月 Targeted Update 資料衍生計算，85/205 個 FATF 全球網路轄區），當前立法通過與實質落實之間落差顯著，歸因於多重挑戰；（二）《虛擬資產服務法》已於 2026 年 6 月 30 日經立法院三讀通過，惟尚未見主管機關於子法層級指定旅行規則技術標準，本法過渡條款施行前有必要透過相關機制補實，台灣 VASP 業者於公開資訊上目前僅有 2 家有可查證之旅行規則相關實作；（三）個案平台反洗錢工具鏈宜採 Advanced 模組化整合統籌架構，以案件管理平台為調度中樞串接 KYC（客戶身分識別）、KYT（區塊鏈交易分析）、旅行規則與制裁名單篩選等模組，降低重複盡職調查成本並消弭資料孤島。本報告依「參照制度、遵循密度、基礎設施、服務商監理」四個層次提出政策建議：參考日本模式建立等值法域清單並以風險為基礎之內控因應日出法域對手方、依業者規模與風險輪廓分級適用遵循密度、指定資料格式標準（IVMS 101）並建立公共驗證基礎設施，以及參考歐盟 DORA 對關鍵服務商課予適度資安與個資保護要求。

In an in-depth case study of an anonymized international VASP, this report draws on the FATF (2025) Targeted Update and the eight implementation challenges and three-tier (Baseline / Intermediate / Advanced) vendor-selection capability model in Sumsub's (2025) Travel Rule Buyer's Guide for a comparative analysis of two core compliance-operations issues under FATF (2019) Recommendation 16: (i) how the Travel Rule should be implemented to satisfy compliance requirements, and (ii) institution-level governance and integration of the AML tool-chain.

Three findings emerge. First, 85 of 117 surveyed jurisdictions (73%) have enacted Travel Rule legislation, yet effective coverage is only about 42% (85/205 FATF Global Network jurisdictions; derived by this study from the June 2025 Targeted Update), a marked enactment-implementation gap rooted in multiple challenges. Second, the Virtual Asset Service Act passed its third reading in the Legislative Yuan on June 30, 2026, but the competent authority has yet to designate Travel Rule technical standards in secondary legislation, a gap warranting complementary mechanisms before the Act's transitional provisions take effect; public information shows only two Taiwanese VASPs with verifiable Travel Rule implementations. Third, the case platform's AML tool-chain should adopt an Advanced-tier modular, orchestrated architecture with the case-management platform as hub connecting KYC, blockchain analytics (KYT), Travel Rule, and sanctions-screening modules, reducing duplicate due-diligence costs and dismantling data silos. It advances four tiers of policy recommendations: (i) a Japan-style Taiwan equivalent-jurisdictions list and risk-based internal controls for sunrise-jurisdiction counterparties; (ii) compliance intensity tiered to operator scale and risk profile; (iii) data-format standardization (IVMS 101) with public verification infrastructure; and (iv) proportionate security and data-protection requirements for critical service providers, informed by the EU's Digital Operational Resilience Act (DORA).

1. 中央銀行（2022 年 12 月 15 日）。虛擬資產交易所 FTX 破產事件的原因及啟示（央行理監事會後記者會參考資料）。取自 https://www.cbc.gov.tw/dl-193810-c151303de7404c5781e11c49aeba2b5b.html（最後瀏覽日期：2026/7/7）
2. 行政院（民國 110 年 4 月 7 日）。院臺法字第 1100167722 號令——指定洗錢防制法第 5 條第 2 項所稱虛擬通貨平台及交易業務事業之範圍。
3. 行政院（2026年4月2日）。政院通過「虛擬資產服務法」草案。https://www.ey.gov.tw/Page/9277F759E41CCD91/bfd446a7-ce23-4308-9347-9ce6e6c44196
4. 金融科技發展與創新實驗條例（民國 107 年 4 月 30 日施行）
5. 金融監督管理委員會（2023年9月26日）。VASP 指導原則發布新聞稿。https://www.fsc.gov.tw/ch/home.jsp?id=96&parentpath=0,2&mcustomize=news_view.jsp&dataserno=202309260005&dtable=News
6. 金融監督管理委員會（2024年10月1日）。預告「提供虛擬資產服務之事業或人員洗錢防制登記辦法」草案暨「虛擬通貨平台及交易業務事業防制洗錢及打擊資恐辦法」修正草案。https://www.fsc.gov.tw/ch/home.jsp?id=96&parentpath=0,2&mcustomize=news_view.jsp&dataserno=202410010002&dtable=News
7. 金融監督管理委員會（2024年11月26日）。提供虛擬資產服務之事業或人員洗錢防制登記辦法。https://law.fsc.gov.tw/LawContent.aspx?id=GL004000
8. 金融監督管理委員會證券期貨局（無日期）。提供虛擬資產服務之事業或人員〔洗防登記名單〕。2026 年 5 月 9 日，取自 https://www.sfb.gov.tw/ch/home.jsp?id=1053&parentpath=0,8
9. 提供虛擬資產服務之事業或人員防制洗錢及打擊資恐辦法（民國 113 年 11 月 26 日發布）。
10. 虛擬通貨平台及交易業務事業防制洗錢及打擊資恐辦法（民國 110 年）。
11. 虛擬資產服務法（民國 115 年 6 月 30 日立法院三讀通過）。
12. 21 Analytics. (n.d.). Crypto-asset service provider (CASP). Retrieved May 6, 2026, from https://www.21analytics.co/glossary/crypto-asset-service-provider-casp/
13. 21 Analytics. (n.d.). Virtual asset service provider (VASP). Retrieved May 6, 2026, from https://www.21analytics.co/glossary/virtual-asset-service-provider-vasp/
14. Australian Transaction Reports and Analysis Centre (AUSTRAC). (n.d.). Additional travel rule obligations when transferring virtual assets. Retrieved July 7, 2026, from https://www.austrac.gov.au/industry-and-business/obligations-and-guidance/additional-guidance/travel-rule/additional-travel-rule-obligations-when-transferring-virtual-assets
15. Bank Secrecy Act, 31 U.S.C. § 5311 et seq. (1970).
16. Financial Action Task Force. (2019). Guidance for a risk-based approach to virtual assets and virtual asset service providers. FATF. https://www.fatf-gafi.org/content/dam/fatf-gafi/guidance/RBA-VA-VASPs.pdf
17. Financial Action Task Force. (2024). Targeted update on implementation of the FATF Standards on virtual assets and virtual asset service providers. FATF.
18. Financial Action Task Force. (2025, June). Best practices on Travel Rule supervision. FATF. https://www.fatf-gafi.org/content/dam/fatf-gafi/recommendations/Best-Practices-Travel-Rule-Supervision.pdf
19. Financial Action Task Force. (2025). Explanatory note for revised Recommendation 16. FATF/OECD.
20. Financial Action Task Force. (2025, June). Targeted update on implementation of the FATF Standards on virtual assets and virtual asset service providers. FATF/OECD.
21. MtGox Co., Ltd. (2014). Announcement of the commencement of bankruptcy proceedings (Tokyo District Court 2014 (fu) No. 3830). Retrieved July 7, 2026, from https://www.mtgox.com/img/pdf/20140723_report_en.pdf
22. Nakamoto, S. (2008). Bitcoin: A peer-to-peer electronic cash system. https://bitcoin.org/bitcoin.pdf
23. Payment Services Act 2019, Act 2 of 2019 (Singapore). Singapore Statutes Online. https://sso.agc.gov.sg/act/psa2019
24. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (General Data Protection Regulation, GDPR). Official Journal of the European Union, L 119, 1–88.
25. Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector (Digital Operational Resilience Act, DORA). Official Journal of the European Union, L 333, 27 December 2022.
26. Regulation (EU) 2023/1113 of the European Parliament and of the Council of 31 May 2023 on information accompanying transfers of funds and certain crypto-assets (Transfer of Funds Regulation, TFR). Official Journal of the European Union, L 150.
27. Regulation (EU) 2023/1114 of the European Parliament and of the Council of 31 May 2023 on markets in crypto-assets (Markets in Crypto-Assets Regulation, MiCA). Official Journal of the European Union, L 150, 9 June 2023.
28. Sumsub. (2025). The Travel Rule buyer's guide. Sumsub Inc. https://sumsub.com/travel-rule/
29. Sumsub. (2025). Travel Rule course modules 1–3. Sumsub Inc.
30. U.S. Department of Justice, Southern District of New York. (2013). Manhattan U.S. Attorney announces seizure of additional $28 million worth of Bitcoins belonging to Ross William Ulbricht, alleged owner and operator of “Silk Road” website. Retrieved July 7, 2026, from https://www.justice.gov/archive/usao/nys/pressreleases/October13/SilkRoadSeizurePR.php