The regulatory treatment of crypto wallets depends on a single question: who holds the keys? Custodial wallet providers - where the provider controls the private keys on behalf of the customer - are treated as financial institutions or VASPs in virtually every jurisdiction that has implemented FATF standards.
The regulatory treatment of crypto wallets depends on a single question: who holds the keys?
Custodial wallet providers - where the provider controls the private keys on behalf of the customer - are treated as financial institutions or VASPs in virtually every jurisdiction that has implemented FATF standards. They must conduct KYC, perform ongoing customer due diligence, implement transaction monitoring, report suspicious activity, and comply with the Travel Rule for transfers above the applicable threshold. Under the EU's MiCA framework, custodial providers must obtain formal authorisation and meet capital, governance, and operational resilience requirements.
Non-custodial wallets - where the user retains sole control of their private keys - sit on the other side of a widening regulatory divide. MiCA explicitly excludes hardware and software providers of non-custodial wallets from its scope. The FATF acknowledges that peer-to-peer transactions between non-custodial wallets fall outside most direct regulatory frameworks. In theory, this means the providers of non-custodial wallet software face no direct AML obligations.
In practice, the gap is closing.
The new EU Anti-Money Laundering Regulation, effective by July 2027, will require CASPs to perform enhanced customer due diligence for transactions involving non-custodial wallet addresses. Institutions must assess ML/TF risks associated with counterparties using non-custodial wallets, monitor transactions to and from unhosted addresses, and verify beneficial ownership to the extent technically feasible. Suspicious transactions involving unhosted wallets must be reported to Financial Intelligence Units.
Different jurisdictions already apply Travel Rule requirements to unhosted wallets differently. In the EU, VASPs must collect unhosted wallet information from their clients. Singapore and Germany require identity verification of the unhosted wallet owner. Switzerland requires both identity verification and proof of ownership. The patchwork creates compliance complexity for any business operating across borders.
The underlying concern is straightforward. Stablecoins accounted for 84% of illicit virtual asset transaction volume in 2025. Unhosted wallets feature prominently in laundering schemes. Complex multi-hop strategies - where funds are moved through repeated wallet-to-wallet transfers to obscure their origin - exploit the anonymity that non-custodial wallets provide.
For custodial wallet providers, the compliance path is clear if demanding: full AML/CFT programmes, Travel Rule compliance, enhanced monitoring for transactions involving non-custodial addresses, and regulatory licensing. For exchanges and CASPs, the incoming EU AML Regulation means that non-custodial wallet transactions will increasingly require enhanced due diligence, slowing processing and raising costs.
The regulatory direction is unmistakable. Non-custodial wallets will not remain unregulated indefinitely. Businesses that build their models on the assumption of permanent regulatory exemption are building on sand.
At Kybri Consulting Limited, we advise digital asset businesses on compliance frameworks that account for the custodial-non-custodial regulatory divide - from Travel Rule implementation and enhanced due diligence to VASP licensing and MiCA readiness.
A thirty-minute call, no obligation. If the answer is that you do not need us yet, you will hear that too.
