In a custodial wallet, a third party controls the private keys and can move the funds; in a non-custodial (self-custody) wallet, only the owner controls them. For a business the difference is also legal: in the European Union, safekeeping or controlling crypto-assets, or the means of access to them, on behalf of clients is a crypto-asset service that requires authorization (MiCA, arts. 3(1)(17) and 59(1)). This guide explains how to tell them apart, what each model means under MiCA, the Travel Rule and US rules, and when each one makes sense.
What custodial and non-custodial wallets are
A wallet does not store crypto-assets: it stores the private keys that move them. Whoever controls those keys controls the funds (as the SEC staff puts it in its investor bulletin on custody, which has no legal force). In a non-custodial wallet, the user backs up the keys with a seed phrase, a device or a key share, and practices self-custody. Cold wallets, which keep keys offline, are used both for self-custody and by professional custodians.
| Aspect | Custodial | Non-custodial |
|---|---|---|
| Who controls the keys | A provider: an exchange, a custodian or the business itself | The user |
| Who can move the funds | The provider, on the user’s instructions | Only the user |
| If access is lost | The provider can restore it, under the contract | It depends on the user’s own backup |
| In the EU, for the provider | Custody and administration of crypto-assets: authorization required (MiCA, art. 59(1)) | Providers of hardware or software for non-custodial wallets are outside MiCA (recital 83) |
| In the US, per FinCEN | A hosted wallet provider is a money transmitter | A person using an unhosted wallet to buy goods or services on their own behalf is not |
Who controls the key: the question that decides the rules
MiCA does not regulate wallets but a service: “custody and administration of crypto-assets on behalf of clients”, defined as the safekeeping or controlling, on behalf of clients, of crypto-assets or of the means of access to them, where applicable in the form of private cryptographic keys (art. 3(1)(17)). That is why the commercial label matters little and the key architecture matters a lot:
- A single key on the user’s device. Nobody else can sign for the user.
- Multisig. Several signatures from a set are needed, for example two of three. If the business holds one signature but cannot complete a transaction alone, it cannot move the funds on its own; if it holds enough signatures, it can.
- MPC (multi-party computation). The key is split into shares that are never put together. The question is the same: can the business, or its provider, sign without the user?
Recital 83 of MiCA adds two points: the custody agreement may provide that the client keeps control of the crypto-assets held in custody, and providers of hardware or software for non-custodial wallets fall outside the Regulation. How a specific design is classified is worth reviewing with legal counsel before it is built.
What MiCA requires from a custodian acting for clients
Only authorized crypto-asset service providers (CASPs) and the financial entities that art. 60 allows to do so may provide the service: credit institutions, central securities depositories, investment firms and, only for the e-money tokens they issue, electronic money institutions (arts. 59(1) and 60). The transitional period for firms already operating ended on July 1, 2026 at the latest (art. 143(3)). Article 75 sets the custodian’s duties:
- An agreement with the client with minimum content: parties, service, custody policy, communication and authentication, security systems, fees and applicable law (75(1)).
- A register of each client’s positions (75(2)).
- A custody policy that minimizes the risk of loss through fraud, cyber threats or negligence (75(3)).
- A statement of position at least every three months (75(5)) and procedures to return the crypto-assets or the means of access as soon as possible (75(6)).
- Segregation of clients’ crypto-assets, including on the distributed ledger, and legal separation from the custodian’s estate so that its creditors have no claim on them, in particular in insolvency (75(7)).
- Liability for losses attributable to the custodian, capped at the market value of the crypto-asset at the time of the loss (75(8)).
- If it uses another custodian, only authorized CASPs, and the client must be told (75(9)).
In addition, a CASP holding clients’ crypto-assets must prevent their use for its own account (art. 70(1)). How authorization is obtained in Spain is explained in our guide to the CASP license. If the tokens are financial instruments, such as tokenized securities, their custody falls under MiFID II rather than MiCA: safekeeping and administration of financial instruments for clients is an ancillary service (Directive 2014/65/EU, Annex I, Section B, point 1).
The Travel Rule: transfers to and from non-custodial wallets
Since December 30, 2024, Regulation (EU) 2023/1113 requires CASPs to accompany each crypto-asset transfer with information on the originator and the beneficiary (arts. 14 and 40), and sets specific rules when one end is a “self-hosted address”: an address not linked to a CASP or to a non-EU entity providing similar services (art. 3(20)).
- When a CASP sends crypto-assets to a self-hosted address, it obtains and keeps the originator and beneficiary information and, if the amount exceeds €1,000, takes adequate measures to assess whether that address is owned or controlled by its customer (art. 14(5)).
- The same applies, the other way round, to a CASP receiving from a self-hosted address (art. 16(2)).
For a business offering non-custodial wallets, the practical consequence is that its users may have to show their exchange or custodian that they control their address when they move amounts above that threshold. More in our Travel Rule entry.
Embedded wallets and wallet-as-a-service: custodial or not?
An embedded wallet is a wallet created inside an application, often with a wallet-as-a-service provider, so that the user does not have to manage a seed phrase. It can be custodial or non-custodial: it depends on who can sign. These are the questions to answer before choosing a provider:
- Can the business, or the provider, sign a transaction without the user taking part?
- How is access recovered? If recovery lets the business or the provider rebuild the key without the user, that control exists even if it is never used.
- What happens if the provider shuts down? Can the user export the key or move the funds without it?
- Who is liable to the user for a loss, and what does the contract say?
If the answers show that the business controls the means of access, the product moves toward custody on behalf of clients under art. 3(1)(17) of MiCA, with the authorization and the duties of art. 75, or needs an authorized custodian behind it.
And in the United States
In the US, the line between hosted and unhosted wallets runs through FinCEN’s guidance, the GENIUS Act and some state rules.
- FinCEN. Its interpretive guidance FIN-2019-G001, of May 9, 2019, treats hosted wallet providers as money transmitters subject to the Bank Secrecy Act; a person who uses an unhosted wallet to buy goods or services on their own behalf is not one. Nor is a multisig provider that only adds a second key without total independent control over the funds, unless it combines that service with a hosted wallet (Sections 4.2.1 and 4.2.2).
- GENIUS Act (Public Law 119-27, July 18, 2025). Its definition of “digital asset service provider” includes acting as a digital asset custodian but excludes developing self-custodial software interfaces (Sec. 2(7)). Section 3 does not apply to transactions by means of a software or hardware wallet that facilitates an individual’s own custody (Sec. 3(h)(1)(C)). The Act is not yet in effect (Sec. 20): the Treasury expects it to take effect on January 18, 2027.
- New York. Storing, holding or maintaining custody or control of virtual currency on behalf of others requires a BitLicense (23 NYCRR 200.2(q) and 200.3(a)). According to the regulator, writing software that lets customers self-custody does not in itself require a license, but a wallet service that keeps custody of other people’s funds likely would.
When each one makes sense: four business cases
| Case | Usual model | What to watch |
|---|---|---|
| The company’s own treasury | Self-custody with multisig or MPC, or an external custodian for most of the funds | Holding your own assets is not custody “on behalf of clients”; what matters is approvals, limits and recovery |
| An app where each user holds their own assets | Non-custodial, or an embedded wallet under the user’s control | That neither the business nor its provider can sign or rebuild the key without the user; a recovery process users understand |
| A product where the business holds or moves clients’ assets (exchange, payments, neobank) | Custodial | Authorization (MiCA, art. 59(1)) and the duties of art. 75, or an authorized custodian behind it |
| Tokenized securities | Depends on the design of the issue | Custody of financial instruments is a MiFID II service, not a MiCA one; in Spain, the register of the securities is kept by the ERIR |
If you choose an external custodian, compare models and criteria in our guide to crypto custody providers.
Frequently asked questions
What is a non-custodial wallet?
A wallet in which only the user controls the private keys, usually backed up with a seed phrase or a device. Nobody else can move the funds or recover access on the user’s behalf.
Does a business offering non-custodial wallets need a MiCA license?
Not for providing the software: providers of hardware or software for non-custodial wallets are outside MiCA (recital 83). If the business also safekeeps or controls the means of access on behalf of its clients, it provides the custody service of art. 3(1)(17) and needs authorization (art. 59(1)).
Is an embedded wallet custodial?
It depends on who can sign. If the business or its provider can move the funds or rebuild the key without the user, it works as a custodial wallet; if only the user can, it is non-custodial.
What happens if the seed phrase of a non-custodial wallet is lost?
Without another backup, access to the funds is lost and nobody can restore it. That is why businesses design recovery before launch, with schemes such as multisig or MPC, and check that recovery does not give them control over the funds.
Does the Travel Rule apply to non-custodial wallets?
Not to their user, but to the CASP sending to that address or receiving from it: it must obtain and keep the originator and beneficiary information and, above €1,000, assess whether the address belongs to its customer (Regulation (EU) 2023/1113, arts. 14(5) and 16(2)).
How we work
Unknown Gravity is a Spanish tokenization technology and blockchain infrastructure company. We develop wallets and custody solutions for businesses: multisig, MPC, embedded wallets, approvals by amount and recovery procedures. We do not hold third parties’ assets and we are not a CASP: when the model requires custody, we integrate it with an authorized custodian.
Official sources
- Regulation (EU) 2023/1114 (MiCA), arts. 3, 59, 70, 75 and 143 (EUR-Lex)
- Regulation (EU) 2023/1113 on information accompanying transfers of funds and crypto-assets (EUR-Lex)
- Directive 2014/65/EU (MiFID II), Annex I (EUR-Lex)
- FinCEN: guidance FIN-2019-G001 on business models involving convertible virtual currencies
- GENIUS Act, Public Law 119-27 (govinfo)
- New York State Department of Financial Services: virtual currency businesses
- SEC: Crypto Asset Custody Basics for Retail Investors (investor bulletin)
Framework verified as of October 13, 2026. Deciding which wallet model your product needs? Talk to us.