Unhosted Wallet Rules in 2026: What Self-Custody Means
Unhosted wallet rules explained: EU EUR 1,000 ownership checks, UK travel rule, the withdrawn US FinCEN proposal, Switzerland, and whether self-custody can be banned.
An unhosted wallet is a crypto wallet where you hold the private keys yourself, with no exchange or custodian in between, and owning and using one is legal in the EU, the UK, the US and Switzerland as of October 2026. The rules land on the regulated firms at either end of a transfer. When you withdraw from an exchange to your own wallet, or deposit from it, the exchange may have to record who owns the address and, above some thresholds, check that it is yours.
This guide explains what the rules say in each major jurisdiction, what an exchange will ask you, and whether a government could ban self-custody. For the wider picture, see our crypto regulation by country hub.
What is an unhosted wallet?
"Unhosted wallet" is the term the Financial Action Task Force (FATF) and UK law use. EU law says "self-hosted address". Wallet makers usually say "non-custodial" or "self-custody". All of them describe the same thing: software or a hardware device that holds keys you control, so nobody else can move or freeze the funds. MetaMask, Slush, the xPortal app and a Ledger device are common examples.
A hosted wallet is the opposite: an account at an exchange or custodian that holds the keys for you. If you are new to the difference, start with our guides to non-custodial wallets and seed phrases.
Why regulators watch unhosted wallets
Anti-money laundering law works through intermediaries. Banks and exchanges check customers, screen transfers and report suspicions. A transfer between two unhosted wallets has no intermediary, so none of those checks happen. The travel rule, which makes firms pass sender and recipient details along with a transfer, only works when a firm sits at each end.
FATF's targeted report of 3 March 2026 focused on this gap. It found stablecoins were the most used crypto asset in illicit transactions, mostly moving peer-to-peer through unhosted wallets. The report's good practices include limits on transfers to unhosted wallets, enhanced due diligence, blockchain analytics and controls when stablecoins are issued or redeemed. It does not ask countries to ban the wallets themselves.
Unhosted wallet rules by jurisdiction
| Jurisdiction | Main rule | What the firm must do | Status, Oct 2026 |
|---|---|---|---|
| EU | Transfer of Funds Regulation (EU) 2023/1113 | Record sender or recipient details for every transfer; above EUR 1,000, check the self-hosted address is owned or controlled by the customer | Applies since 30 Dec 2024 |
| EU | AML Regulation (EU) 2024/1624 | Assess risk of self-hosted transfers and apply mitigating measures; no anonymous accounts or privacy coins at CASPs | Applies from 10 Jul 2027 |
| UK | Money Laundering Regulations, Part 7A | Identify unhosted wallet transfers; collect originator and beneficiary details where the risk is higher | Applies since 1 Sep 2023 |
| UK | FCA Financial Crime Guide (CP26/38) | Proposed good practice: enhanced due diligence on transactions involving unhosted wallets | Consultation until 24 Dec 2026 |
| US | FinCEN 2020 proposed rule | Would have required reporting and recordkeeping for unhosted wallet transactions | Withdrawn 6 Oct 2026 |
| Switzerland | FINMA Guidance 02/2019 | Transfers only to and from external wallets of the institution's own verified customers, with control proven by technical means | Applies since 2019 |
European Union
The EU's Transfer of Funds Regulation has applied since 30 December 2024, alongside MiCA. A crypto-asset service provider (CASP) must collect information on transfers to and from self-hosted addresses whatever the amount. For a transfer above EUR 1,000 sent or received for its customer, it should verify that the self-hosted address is owned or controlled by that customer, according to the European Parliament's summary of the regulation. A transfer between two self-hosted wallets with no CASP involved is outside its scope.
The AML Regulation adds two things from 10 July 2027. Article 40 requires CASPs to assess the risk of transfers involving self-hosted addresses and apply measures such as identifying the person behind the address or asking for the origin of the funds. Article 79 bars CASPs from keeping anonymous accounts or accounts using anonymity-enhancing coins. Recital 160 says the ban does not apply to wallet hardware and software providers that do not control the wallets. Our AMLR privacy coin guide covers that article in detail, and the travel rule guide covers transfers between exchanges.
United Kingdom
The UK travel rule took effect on 1 September 2023. In its 2022 consultation response, HM Treasury said it did not agree that unhosted wallet transactions should automatically be treated as higher risk, because many people use them for legitimate purposes. UK firms must identify these transfers and collect originator and beneficiary details where the risk of illicit finance is higher, rather than on every transfer. If they ask and do not get the details, regulation 64G says they must not release the crypto to the beneficiary.
The FCA's CP26/38, published in October 2026, proposes adding "a firm applies EDD for transactions involving unhosted wallets" to its Financial Crime Guide as an example of good practice. That points to stricter checks at UK firms once the new crypto regime starts in October 2027. Our UK crypto regulation guide covers that regime.
United States
The US has no federal rule aimed at unhosted wallets. FinCEN proposed one in December 2020 that would have made banks and money services businesses report and keep records on transactions with unhosted wallets. It was never finalized, and on 5 October 2026 FinCEN announced it was withdrawing it, along with a 2023 proposal on crypto mixers. The withdrawal was published in the Federal Register on 6 October 2026. Existing Bank Secrecy Act duties for exchanges, such as customer checks and suspicious activity reports, still apply.
On the policy side, Executive Order 14178 of 23 January 2025 lists the right to maintain self-custody of digital assets among US policy goals. An executive order is policy, so it binds federal agencies and gives you no legal right you could enforce in court. Self-custody protections were written into the CLARITY Act, which passed the House 294 to 134 in July 2025, but the Senate failed to advance the bill in a 49 to 50 cloture vote on 15 September 2026. See CLARITY Act explained and our US crypto regulation guide.
Switzerland
Switzerland went further than FATF early on. Under FINMA Guidance 02/2019 of 26 August 2019, FINMA-supervised institutions may only send crypto to, or receive it from, external wallets belonging to their own customers whose identity they have verified. FINMA later said the customer's control of the external wallet must be checked by suitable technical means, and that this applies until a technical solution guarantees travel rule compliance.
What an exchange will ask when you withdraw
The exact process depends on the exchange and the country, but the questions follow the rules above. Expect some or all of these:
- Whether the address belongs to an exchange or is a private wallet, and which wallet app you use.
- Whether the wallet is yours or someone else's. For a third party, the exchange will want their name and sometimes their address.
- Proof that you control the wallet, for larger EU transfers or higher-risk UK ones. Common methods are signing a message with the wallet, sending a small test amount from it, or connecting the wallet to the exchange's verification page.
- The source of funds, for large or unusual deposits from an unhosted wallet.
If you cannot answer, the exchange can delay or refuse the transfer. Regulated firms run these checks through identity verification providers such as iDenfy and blockchain analytics firms. One caution: a real exchange asks inside its own app or website. A message asking you to "verify" your wallet through a link, or to enter your seed phrase, is a scam. Our wallet drainer guide shows how these work.
Can the government ban self-custody?
None of the jurisdictions above bans holding your own keys, and the rules they have written point the other way. The EU AML Regulation's recital 160 keeps wallet software and hardware providers outside the privacy coin ban as long as they do not control users' wallets. UK policy rejected treating unhosted wallets as high risk by default. US policy names self-custody as something to protect.
What governments can do, and do, is tighten the edges. They can cap or slow transfers between exchanges and private wallets, require ownership proofs, and push exchanges to refuse funds linked to mixers or sanctioned addresses. FATF's 2026 report lists those tools. Laws can also change, and a future rule could be stricter than today's, so the answer above is a snapshot as of October 2026.
What this means for DeFi users
DeFi runs on unhosted wallets. When you connect a self-custody wallet to a protocol, you interact with smart contracts directly, with no account, no sign-up and no firm holding your tokens. That is why DeFi stays available to many people who cannot or will not keep funds on an exchange: there is no account to freeze, markets run around the clock, and the contract rules are public on-chain.
Self-custody does not take you outside the law. The exchange checks above still apply each time you move money between a bank, an exchange and your wallet. Taxes apply to DeFi gains and income wherever you hold the tokens. Sanctions law applies to you personally, and some front-ends block sanctioned addresses or certain countries; our OFAC sanctions guide explains screening. There is no deposit insurance, no ombudsman and no password reset. If you lose your seed phrase, a contract is exploited, a stablecoin depegs or a loan is liquidated, the loss is yours.
JewelSwap is a non-custodial DeFi protocol on MultiversX, Sui and Radix. You connect your own wallet and keep your keys. It offers liquid staking tokens (JWLSUI and SJWLSUI, JWLEGLD and SJWLEGLD, JWLXRD and SJWLXRD), auto-compounded yield farms on Scallop for Sui and on AshSwap, xExchange, OneDex and Hatom for MultiversX, and NFT lending on MultiversX. Moving funds from an exchange to the wallet you use with JewelSwap is an unhosted wallet withdrawal, so expect the checks described above. Our self-custody guide and KYC in DeFi explainer cover the rest.
Frequently asked questions
Is it legal to use an unhosted wallet?
Yes, in the EU, the UK, the US and Switzerland as of October 2026. The rules apply to exchanges and other regulated firms that send funds to or receive funds from unhosted wallets, not to people holding their own keys.
What is the EU's EUR 1,000 rule for self-hosted wallets?
Under the Transfer of Funds Regulation, applying since 30 December 2024, an EU crypto-asset service provider must collect information on every transfer to or from a self-hosted address. For transfers above EUR 1,000, it should also verify that the address is owned or controlled by its customer, for example through a signed message or a test transfer.
Did the US ban unhosted wallets?
No. FinCEN's 2020 proposal to require reporting on unhosted wallet transactions was never finalized and was withdrawn in October 2026. Executive Order 14178 of January 2025 names self-custody as a policy goal.
Does the EU ban self-custody in 2027?
No. From 10 July 2027 the AML Regulation bars crypto-asset service providers from keeping anonymous accounts or accounts using privacy coins. Recital 160 says this does not apply to wallet hardware or software providers that do not control the wallets.
Why does my exchange ask me to prove I own my wallet?
Travel rule laws require it to know who is behind a self-hosted address for some transfers, such as EU transfers above EUR 1,000 or higher-risk transfers in the UK. Proving control with a signed message or test transfer usually answers it. Never share your seed phrase to do so.
Educational only, not legal or financial advice. Rules checked October 2026 and change often; check with your exchange or a qualified adviser for your situation.
