Self-Custody Wallet Compliance Checklist for Financial Institutions (2026)

Self-custodied crypto has become a practical compliance issue for banks, lenders, wealth managers, accountants, auditors and digital asset platforms. Customers increasingly hold material value outside exchanges and custodians, yet still expect those assets to be recognised in credit, mortgage, onboarding, audit and treasury workflows.

Existing compliance processes often assume an identifiable intermediary: a bank, broker, custodian, administrator or exchange that can issue statements, confirm account ownership and respond to due-diligence requests. Self-custody changes that control environment. There may be no named account statement, no regulated intermediary able to confirm ownership and no provider that can validate a balance. The assets are controlled through cryptographic keys and recorded on public blockchains.

A crypto-backed lender may need to verify borrower wallet control before accepting assets as collateral. A mortgage provider may need to understand whether a deposit originated from a wallet controlled by the applicant. A wealth manager may need to include self-custodied assets in a client balance sheet without taking custody. An auditor may need evidence that a company controlled certain wallets at a reporting date. A fintech may need to onboard a customer who moves funds between exchanges and private wallets.

In each case, the institution needs a documented assessment that separates identity, wallet control, asset evidence, source-of-funds analysis and risk. The answer is not to reject self-custody by default or ask customers to surrender private keys. The answer is a layered, proportionate and auditable review process.

This guide explains how institutions can operationalise self-custody wallet compliance in 2026. It is not legal advice, and requirements vary by jurisdiction, product and customer type. It is a framework for a defensible review process.

Quick Answer

Financial institutions should assess self-custodied crypto by separating identity, wallet control, asset evidence, source-of-funds analysis, AML risk and audit documentation. No single artefact answers every compliance question. A wallet signature may prove control of an address, but it does not prove legal ownership, identity, source of funds or acceptable risk.

The starting point is ordinary customer due diligence. The institution should know who the customer is, whether it is dealing with an individual or entity, who the beneficial owners or controllers are where relevant, and what purpose the crypto evidence serves in the file.

The next step is wallet verification. For self-custodied assets, this usually means asking the customer to sign a unique challenge message from the relevant wallet. The signature can be verified cryptographically against the public address, without moving assets or exposing private keys.

The institution should then verify relevant assets and review source of funds to the extent required by the use case. A proof-of-funds review for lending differs from a source-of-funds review for a property purchase or an audit procedure for a corporate treasury.

Finally, the institution should record what was requested, what was verified, what was out of scope, who reviewed it, what risk decision was made and how another reviewer could reconstruct the file later.

Executive Summary

Self-custody wallet compliance is best handled as a layered evidence model:

Define the purpose, scope, ownership context and approval pathway.
Verify identity through appropriate KYC, KYB and beneficial ownership checks.
Verify wallet control through a wallet signature or equivalent cryptographic proof.
Verify relevant assets through balance evidence tied to a timestamp or block height.
Assess source of funds where the transaction, customer or regulatory context requires it.
Apply AML, sanctions and blockchain analytics controls proportionately.
Record the scope, result, exceptions, limitations and decision in an audit trail.
Reverify or monitor where the relationship or exposure continues.

The institution should avoid two extremes: accepting weak evidence such as screenshots, and collecting excessive wallet history when a narrower verification would answer the question.

Core principle: Self-custody does not remove compliance responsibilities. It changes how evidence is collected, verified and retained.

Self-custody compliance evidence model

Terminology Used in This Guide

Different organisations use different terms for similar wallet arrangements. Regulators may refer to self-hosted wallets or unhosted wallets. Financial institutions may say private wallets. Technology providers often say self-custody wallets or self-custodied wallets.

Definition: self-custody
Self-custody means a person, entity or appointed controller controls the cryptographic keys or signing authority for crypto assets, rather than relying on a third-party custodian or exchange to control those assets.

These terms are not always legally identical in every jurisdiction. This article uses "self-custody" unless a specific regulatory term is being discussed.

Core Compliance Framework

The institutional self-custody framework: identity -> wallet control -> proof of funds -> source of funds -> AML and sanctions -> risk assessment -> audit trail.

Each layer answers a different compliance question. Identity evidence does not prove wallet control. Wallet control does not prove balances. Proof of funds does not prove source of funds. Blockchain analytics does not prove ownership.

What Makes Self-Custody Different?

Self-custody wallets may be hardware, mobile, browser-based, desktop, multisig, smart-contract based or part of an institutional key-management arrangement.

The assets are recorded on a blockchain. The wallet controls the keys needed to authorise transactions or produce signatures.

Private keys

The private key is the secret material used to sign transactions or messages. In ordinary self-custody, there is no bank, broker or platform that can reset it. A compliance process should never require private keys or recovery phrases.

Wallet control

Control is demonstrated by the ability to sign. A valid wallet signature for a unique challenge shows technical control of the relevant address or signing authority. That is not the same as legal ownership.

No intermediary

Traditional reviews often rely on intermediary records: bank statements, custodian confirmations, brokerage reports or exchange statements. Self-custody may not have those records, so the institution should build evidence from identity records, wallet signatures, blockchain data and customer-supplied context.

Public blockchains

Many crypto assets are visible on public blockchains. Anyone can inspect an address and see balances or transactions. Visibility is useful, but it is not attribution. A public address does not show who controls it.

Direct operational control

Self-custody gives the holder direct operational control. Compliance workflows should respect that control model. A customer can prove wallet control without transferring assets into custody or disclosing secret material.

Traditional account review	Self-custody wallet review
Account statement identifies the account holder	Blockchain address is public but usually pseudonymous
Institution can contact bank or custodian	No intermediary may exist
Balance comes from account statement	Balance should be verified on-chain and scoped
Account access is controlled by the provider	Wallet control is proven through signatures or transactions
Source of funds often relies on banking trail	Review may combine exchange records, wallet history and analytics

Regulatory Landscape

Crypto regulation is not uniform. Obligations differ across the UK, EU, United States and other jurisdictions. The same institution may face different duties depending on its activity, permissions and customer type.

The following overview is not a legal conclusion. It explains how major frameworks shape operational evidence and the design of a control environment.

AML and KYC

AML and KYC frameworks are concerned with identifying customers, understanding risk, preventing money laundering and terrorist financing, detecting suspicious activity and keeping adequate records. The precise requirements depend on jurisdiction, regulated activity and customer type.

For self-custody, the practical issue is attribution. The institution may know the customer, but not whether the customer controls the wallet. Or it may see wallet activity, but not whether that activity belongs to the customer. Wallet verification connects the identity file to the wallet evidence.

FATF Guidance

The Financial Action Task Force (FATF) sets international AML/CFT standards and has issued guidance for virtual assets and virtual asset service providers. FATF's work is risk-based and focused on VASPs and financial institutions, while recognising risks associated with peer-to-peer and self-custodied activity.

The operational lesson is not that every self-custody user becomes a regulated intermediary. It is that regulated firms should consider the risks of virtual asset activity, understand counterparties and transfers where relevant, and apply proportionate controls.

Travel Rule

The Travel Rule concerns information accompanying transfers. In crypto, it generally applies to regulated crypto-asset service providers or VASPs, not to every private wallet holder. However, transfers to or from self-hosted or self-custodied wallets can create additional due-diligence questions for regulated firms.

Wallet verification complements Travel Rule controls by helping a firm determine whether its customer controls an origin or destination wallet. It does not by itself satisfy all Travel Rule obligations, and it should not be treated as a substitute for required originator or beneficiary information where those rules apply.

MiCA

The EU Markets in Crypto-Assets Regulation (MiCA) creates a harmonised framework for crypto-asset issuers and crypto-asset service providers in the EU. MiCA is primarily about issuers, service providers, authorisation, governance, disclosures, market conduct and supervision. It does not turn every private self-custody wallet into a regulated firm.

MiCA does not prescribe a universal wallet-verification process for private self-custody. Its practical relevance is that crypto-asset activity in the EU is increasingly subject to formal authorisation, governance and conduct expectations. When crypto assets enter formal financial workflows, weak evidence becomes harder to defend. Wallet verification can support the evidence layer without implying that a private wallet is itself regulated under MiCA.

EU Transfer of Funds Regulation

Regulation (EU) 2023/1113 extends transfer information requirements to certain crypto-asset transfers. The European Banking Authority has published guidelines on information requirements in relation to transfers of funds and certain crypto-assets, including guidance relevant to transfers involving self-hosted addresses.

For self-custody reviews, the relevance is operational. Firms should understand when transfer information rules apply, how they interact with self-hosted wallets, and what evidence they need to support risk decisions. Wallet verification can help establish wallet control, but it does not replace transfer information requirements where those rules apply.

DAC8

DAC8 extends EU administrative cooperation and tax reporting rules to crypto-assets handled by reporting crypto-asset service providers. It is relevant to tax transparency and intermediary reporting. It does not mean that every private self-custody balance is automatically reported by virtue of existing on a blockchain.

For institutions, DAC8 is part of the broader movement towards more structured crypto records, particularly where activity passes through reporting intermediaries. It increases the practical value of clean, attributable and timestamped evidence.

FCA and UK Context

In the UK, the FCA supervises certain cryptoasset businesses for AML/CTF under the Money Laundering Regulations. The FCA's scope includes, among other activities, cryptoasset exchange providers and custodian wallet providers carrying on in-scope business in the UK. UK crypto regulation continues to evolve, and firms should assess their own permissions and obligations.

For firms that encounter self-custodied crypto in non-custodial workflows, the practical question is usually not "is the wallet regulated?" but "what evidence do we need?"

Compliance Checklist

The following checklist is the centrepiece of a self-custody compliance workflow. It is designed for institutions that need to assess self-custodied crypto without taking custody.

Area	Objective	Suggested evidence
Governance and scope	Define the review purpose, policy owner and decision pathway	Policy, risk appetite, use-case scope, roles, approval matrix
Customer identity	Know who the institution is dealing with	KYC/KYB file, identity documents, screening results, relationship purpose
Wallet control verification	Connect the customer to the wallet	Signed challenge message, address, chain, timestamp, verification result
Proof of funds	Verify relevant assets exist at a point in time	On-chain balances, token balances, valuation method, block height or timestamp
Source of funds	Understand how assets entered the transaction or wallet	Exchange records, bank transfer evidence, transaction history, sale records
Blockchain analytics	Assess financial-crime exposure	Risk scores, sanctions exposure, typology flags, analyst notes
Sanctions screening	Avoid dealings with sanctioned persons or addresses	Name screening, address screening, match resolution records
Transaction history	Review relevant activity over the required period	Scoped transaction export, chain data, categorisation, exceptions
Beneficial ownership	Identify who benefits from or controls entity-held assets	Ownership chart, registers, trust or corporate documents, authorised signers
Corporate authority	Confirm the person signing can act for the entity	Board approval, mandate, signatory list, treasury policy
Segregation of duties	Separate evidence collection, review and approval where appropriate	Reviewer assignment, access logs, approval records, conflict checks
Audit trail	Make the file reviewable later	Request ID, evidence bundle, reviewer decision, timestamps, limitations
Ongoing monitoring	Track changes where exposure continues	Refresh schedule, alerts, balance updates, trigger events
Exception handling	Manage incomplete, conflicting or elevated-risk evidence	Exception log, escalation record, additional evidence, senior approval
Risk assessment	Make a proportionate decision	Risk rating, rationale, escalations, approvals, conditions

1. Governance and Scope

Why it matters: Self-custody reviews become inconsistent if teams do not define the use case, evidence threshold and decision owner before evidence is collected.

Practical implementation: Establish a policy or playbook for lending, mortgage deposits, wealth reporting, treasury review, onboarding and audit support. Define who may request wallet evidence, who reviews it, when escalation is required and what evidence is sufficient.

Common pitfalls: Allowing each reviewer to invent their own process, or collecting broad wallet data before deciding what question the institution is trying to answer.

2. Customer Identity

Why it matters: Wallet evidence is not useful unless the institution knows whose wallet is being assessed. KYC and KYB establish the person or entity behind the relationship.

Practical implementation: Use existing customer due diligence processes. For entities, identify directors, beneficial owners, authorised signers and relevant controllers. Record the review purpose.

Common pitfalls: Treating a wallet signature as identity proof. A signature proves wallet control, not the signer's legal identity.

3. Wallet Control Verification

Why it matters: A customer can copy any public wallet address. The institution needs evidence that the customer controls the wallet being presented.

Practical implementation: Issue a unique challenge message. The message should name the verifier, state the purpose, include a request ID or nonce, identify the wallet address and chain, include an expiry time, and state that the signature does not authorise a transaction. Verify the returned signature cryptographically.

Common pitfalls: Accepting screenshots, old signatures or generic messages such as "I own this wallet." These are easier to reuse and harder to defend.

4. Proof of Funds

Why it matters: Wallet control does not prove assets. The wallet may be empty, assets may have moved, or the relevant token may not be included in the review.

Practical implementation: Capture balances for the verified wallet at a defined timestamp or block height. Define in-scope assets. Where valuation matters, record pricing source, time and methodology.

Common pitfalls: Treating a signature as proof of funds, relying on a balance screenshot, or failing to specify the review time.

5. Source of Funds

Why it matters: Proof that assets exist is not proof that the assets are acceptable for the transaction. Source-of-funds review asks how the assets were acquired or moved into the relevant wallet.

Practical implementation: Request evidence proportionate to the use case. This may include exchange statements, bank transfers, trading records, mining or staking records, sale agreements, inheritance documentation or transaction history over a scoped period.

Common pitfalls: Requesting a full lifetime wallet history when only a specific deposit path is relevant, or confusing source of funds with source of wealth. Source of funds concerns the funds used for a transaction; source of wealth concerns how overall wealth was accumulated.

6. Blockchain Analytics

Why it matters: Public blockchain activity can expose sanctions, fraud, ransomware, scam, mixer or high-risk service interactions. Analytics can support financial-crime risk assessment.

Practical implementation: Screen relevant addresses and transaction paths using appropriate tools. Record the provider, date, result, risk flags and analyst interpretation. Escalate unresolved high-risk exposure according to policy.

Common pitfalls: Assuming analytics proves ownership. It does not. Analytics evaluates transaction exposure; wallet verification proves control.

7. Sanctions Screening

Why it matters: Institutions should avoid dealing with sanctioned persons, entities and addresses. Sanctions risk can arise at the customer level and the wallet-address level.

Practical implementation: Screen the customer and relevant parties through normal sanctions controls. Screen wallet addresses against available sanctions and high-risk address data. Investigate possible matches and retain the resolution.

Common pitfalls: Treating a no-hit result as a complete AML approval. Sanctions screening is one control, not the whole process.

8. Transaction History

Why it matters: Transaction history can explain asset movements, support source-of-funds analysis, identify inconsistent claims and reveal activity relevant to risk.

Practical implementation: Define the review period and assets. For a mortgage deposit, the period may follow the deposit path. For an audit, it may align with the reporting period. For lending, it may focus on collateral wallets and recent movements.

Common pitfalls: Reviewing only one address where the customer uses several addresses, or collecting excessive unrelated history.

9. Beneficial Ownership

Why it matters: Entity-held wallets may be controlled by employees, directors, trustees, fund managers or service providers. The signer may not be the beneficial owner.

Practical implementation: Map the entity structure and beneficial owners. Record who is authorised to operate the wallet and who benefits from the assets. For trusts, funds and family offices, document the relevant capacity in which the signer acts.

Common pitfalls: Assuming the device holder owns the assets. Technical control and beneficial ownership can differ.

10. Corporate Authority

Why it matters: A company wallet may be owned by the company but operated by a treasury team or individual officer. The institution needs to know whether the signer is authorised.

Practical implementation: Request board resolutions, mandates, treasury policies, signatory lists or internal approvals where appropriate. For multisig wallets, record the policy and signing threshold.

Common pitfalls: Accepting one employee's wallet signature as evidence of corporate authority without checking the mandate.

11. Segregation of Duties

Why it matters: In higher-risk reviews, the person collecting evidence should not always make the final decision. Segregation improves control quality and reduces conflicts.

Practical implementation: Assign roles for evidence collection, technical verification, compliance review and approval. Use a second-line or senior review for high-value transactions, unresolved analytics alerts, politically exposed persons, sanctions-adjacent exposure or unusual source-of-funds narratives.

Common pitfalls: Treating the process as a purely technical check and allowing a single operator to request evidence, verify it, resolve exceptions and approve the relationship.

12. Audit Trail

Why it matters: Compliance evidence must survive handoff. Another reviewer should understand what was requested, what was verified, what was excluded and why the decision was made.

Practical implementation: Retain the challenge, signature, address, chain, timestamps, balance evidence, analytics output, source documents, reviewer notes, escalations and final decision. Record limitations explicitly.

Common pitfalls: Keeping screenshots or informal emails without the underlying data needed to reproduce the conclusion.

13. Ongoing Monitoring

Why it matters: Self-custodied assets can move quickly. A wallet verified today may have a different balance or risk profile tomorrow.

Practical implementation: Decide whether the relationship requires repeat verification, event-based alerts, periodic balance checks or renewed source-of-funds review. Lending and ongoing platform relationships may need more monitoring than one-off evidence reviews.

Common pitfalls: Treating a point-in-time proof as permanent evidence.

14. Exception Handling

Why it matters: Self-custody reviews can produce partial, ambiguous or conflicting evidence. The control environment should define how exceptions are escalated and resolved.

Practical implementation: Maintain an exception log for stale signatures, mismatched addresses, unsupported wallet types, incomplete source-of-funds evidence, unresolved analytics alerts and conflicting explanations. Record whether the exception was remediated, escalated, accepted with conditions or rejected.

Common pitfalls: Approving files because "most" evidence is present without documenting what was missing or why the residual risk was accepted.

15. Risk Assessment

Why it matters: Compliance is not just document collection. The institution must decide whether the evidence supports the product, transaction or relationship.

Practical implementation: Apply a risk-based approach. Consider customer type, jurisdiction, asset type, wallet type, transaction size, source-of-funds clarity, analytics results, sanctions exposure and product risk. Record approvals and conditions.

Common pitfalls: Reducing the review to a checklist without a final risk judgement.

Compliance Workflow

A practical self-custody workflow usually looks like this:

Self-custody compliance workflow

Customer

The customer presents self-custodied crypto as relevant evidence. The institution identifies whether the assets are collateral, deposit funds, proof of wealth, treasury assets, audit evidence or onboarding context.

KYC / KYB

The institution verifies the individual or entity using ordinary customer due diligence. For entities, it identifies beneficial owners and authorised representatives.

Wallet Verification

The customer signs a unique challenge message from the wallet. The institution verifies the signature and records the address, chain, timestamp and request purpose.

Balance Verification

The institution captures relevant balances at a specific time and records the asset scope, timestamp or block height and valuation basis.

Source-of-Funds Review

The institution reviews how the assets entered the wallet or transaction path. This may require exchange records, bank records, transaction history or commercial documents.

Blockchain Analytics

The institution screens addresses and transaction paths for risk indicators and documents any escalations or dismissals.

Risk Assessment

The institution combines evidence and applies policy. The outcome may be approval, rejection, escalation, request for further information or approval with conditions.

Decision and Audit Trail

The institution records the evidence, decision and limitations so the file remains reviewable.

Wallet Verification Within Compliance

Wallet verification is a compliance input, not a complete compliance process.

It proves that the wallet's signing authority produced a valid signature for a specific challenge. In many workflows, that is the cleanest way to link a customer to a self-custodied address. For a deeper distinction, see wallet ownership vs identity verification.

It does not prove identity. KYC does that. It does not prove balance. Balance verification does that. It does not prove source of funds. Transaction and document review do that. It does not prove that the wallet is low risk. AML controls and risk assessment do that.

Message signing is useful because it is non-custodial. The customer does not transfer assets. The institution does not receive private keys. The signature can be independently verified and recorded.

Definition: wallet verification
Wallet verification is the process of proving that a person, entity or system controls a crypto wallet, usually by signing a unique message and verifying the signature against the public address.

Definition: wallet control
Wallet control is the practical ability to authorise transactions or produce valid signatures from a wallet address or wallet policy. It is technical evidence, not a complete legal ownership determination.

Definition: proof of funds
Proof of funds is evidence that relevant assets existed or were controlled at a defined point in time. For self-custody, it normally combines wallet control verification with balance evidence.

Definition: source of funds
Source of funds is evidence explaining where the funds used for a transaction came from. It is not the same as proof of wallet control.

Definition: source of wealth
Source of wealth is evidence explaining how a person or entity accumulated overall wealth over time. It is broader than source of funds, which focuses on funds used for a specific transaction.

Common Mistakes

Accepting screenshots

Screenshots are easy to manipulate and hard to reproduce. They may show a balance, but they do not prove wallet control or source of funds.

Confusing ownership with balances

A wallet signature can prove control of an address with no assets. A block explorer can show assets at an address controlled by someone else. Ownership and balances are separate questions.

Treating KYC as sufficient

KYC proves identity. It does not prove the customer controls the wallet they have supplied.

Ignoring ongoing monitoring

Point-in-time evidence may be enough for a one-off review, but it may be inadequate for lending, collateral monitoring or ongoing customer relationships.

Collecting excessive data

More data is not always better. Overcollection creates privacy, retention and review burdens. Institutions should collect evidence proportionate to the decision.

Assuming blockchain analytics proves ownership

Analytics can identify risk exposure, but it cannot prove that the customer controls the wallet. It should be paired with wallet verification.

Ignoring multisig and corporate wallets

One signature may not be enough where a wallet is controlled by a multisig policy, DAO, trust, fund or corporate treasury process.

Operational Considerations

Evidence Retention

Retention should follow the institution's legal, regulatory and policy requirements. For self-custody evidence, retain the challenge, signature, verification result, wallet address, chain, timestamps, source documents, analytics output and decision record.

Auditability

Evidence should be reviewable by someone who was not involved in the original file. The reviewer should be able to answer what was requested, what was proven, what was not proven and why the decision was reasonable.

Privacy

Wallets can reveal sensitive financial history. Institutions should avoid broad wallet surveillance unless it is justified by the relationship and disclosed appropriately. Scoped evidence is often better than open-ended access.

Least-Privilege Data Collection

Collect the narrowest evidence that answers the compliance question. A mortgage deposit review may not require every transaction in a long-term wallet. A collateral review may not require source-of-wealth evidence if policy only requires current collateral proof and AML screening.

Repeat Verification

Set refresh rules. Repeat verification may be appropriate when a signature expires, a balance changes materially, collateral is revalued, a new wallet is added, a transaction occurs, or a periodic review is due.

Record Keeping

Record the scope of the wallet review. If only one address was verified, say so. If only Bitcoin was reviewed, do not imply all crypto assets were reviewed. If source-of-funds review was limited to a transaction path, document that limitation.

Institutional Edge Cases

Some reviews need additional context. Corporate treasury wallets may require board authority and treasury policy evidence. Trusts, estates, pension schemes, charities and family offices may require documentation showing capacity, beneficial ownership or fiduciary authority. Insolvency, escrow and inheritance matters may require evidence of control that is separate from beneficial entitlement.

Future Trends

Several trends are likely to make self-custody compliance more common: greater institutional use of hardware wallets and multisig, more formal crypto-backed lending, wealth reporting for digital assets, tokenised assets, clearer regulatory expectations and automated wallet verification. The common thread is operational: manual screenshots and ad hoc explorer checks are not a scalable compliance model.

Frequently Asked Questions

1. What is self-custody wallet compliance?

Self-custody wallet compliance is the process an institution uses to assess customers, assets, wallet control, source of funds and risk when crypto is held outside an exchange or custodian.

2. Does self-custody make crypto non-compliant?

No. Self-custody is a method of holding assets. Compliance depends on the institution's obligations, the customer, the transaction, the evidence and the risk assessment.

3. How should financial institutions handle self-custodied crypto?

They should use a layered process: KYC or KYB, wallet verification, balance verification, source-of-funds review where needed, AML controls, risk assessment and audit documentation.

4. Does MiCA require wallet verification?

MiCA does not create a universal requirement for every private wallet holder to verify wallets. Institutions should assess MiCA's relevance to their activities and may use wallet verification as supporting evidence.

5. Does the Travel Rule apply to self-custody wallets?

Travel Rule obligations generally apply to regulated transfer participants such as VASPs or crypto-asset service providers, not to every private wallet holder. Transfers involving self-custodied wallets can still require risk-based due diligence.

6. Does KYC prove wallet control?

No. KYC verifies identity. Wallet control verification requires evidence that the customer controls the wallet, usually through a signature.

7. Are screenshots acceptable evidence?

Screenshots may support context, but they are weak primary evidence. They do not prove control and can quickly become stale.

8. What evidence should lenders collect?

Lenders should consider identity evidence, wallet-control proof, balance evidence, valuation data, eligibility checks, AML screening, collateral monitoring rules and an audit trail.

9. What evidence should mortgage providers collect?

Mortgage providers should consider identity evidence, wallet verification, proof of funds, transaction path evidence, source-of-funds documents, exchange records and risk-review notes.

10. Should institutions verify balances?

Yes, where the asset value affects the decision. Wallet control alone does not prove funds.

11. How often should wallets be reverified?

Frequency depends on the use case. One-off reviews may need a single point-in-time verification. Lending, collateral or ongoing customer relationships may require periodic or event-based reverification.

12. What is wallet control verification?

It is evidence that links a customer or authorised representative to a wallet by proving control of the wallet's signing authority.

13. What does a wallet signature prove?

It proves that the relevant wallet signing authority signed a specific message. It does not prove identity, legal ownership, balance or source of funds.

14. Should institutions ask customers for private keys?

No. A legitimate compliance workflow should not require seed phrases, private keys or recovery words.

15. What is proof of funds in self-custody?

It is evidence that relevant assets existed in a wallet at a defined time, ideally tied to a verified wallet and retained with the review record.

16. What is source of funds in crypto?

Source of funds explains where the funds used for a transaction came from. It may require exchange records, bank records, transaction history or other documents.

17. Is source of funds the same as source of wealth?

No. Source of funds concerns the funds used in a specific transaction. Source of wealth concerns how overall wealth was accumulated.

18. Can blockchain analytics replace wallet verification?

No. Analytics assesses transaction risk. Wallet verification proves control.

19. What should auditors look for?

Auditors should consider wallet-control evidence, reporting-date balances, valuation, rights and obligations, completeness, management representations and audit trail quality.

20. How should institutions handle multisig wallets?

They should document the wallet policy, signing threshold, authorised signers and whether the verification proves one signer, several signers or wallet-level control.

21. What about corporate treasury wallets?

Institutions should verify wallet control and corporate authority. A signature from an employee may not be enough without mandate evidence.

22. Should institutions collect full wallet histories?

Only where justified. A scoped transaction history is often more proportionate than a full lifetime wallet review.

23. Can customers keep custody during compliance review?

Yes. Cryptographic wallet verification allows customers to prove control without transferring assets or exposing private keys.

24. What should be included in an audit trail?

The audit trail should include request details, challenge message, signature, address, chain, verification result, balance evidence, source documents, analytics, reviewer notes and decision rationale.

25. How do AML controls apply to self-custody wallets?

AML controls may include customer due diligence, sanctions screening, transaction monitoring, blockchain analytics, source-of-funds review and suspicious activity escalation.

26. Should institutions treat all self-custody as high risk?

Not automatically. Institutions should apply a risk-based approach. Risk depends on customer profile, jurisdiction, transaction size, asset type, wallet history and available evidence.

27. What is least-privilege crypto evidence?

It means collecting only the wallet data needed to answer the review question, rather than demanding open-ended access or excessive history.

28. What does a compliant self-custody review look like?

It is scoped, documented and risk-based. It links identity to wallet control, verifies relevant assets, assesses source of funds and AML risk where needed, and leaves a clear audit trail.

Conclusion

Self-custody does not remove compliance responsibilities. It changes the evidence model.

Institutions should adopt a layered approach that connects identity verification, wallet verification, proof of funds, source-of-funds review, risk assessment and audit evidence.

This model allows institutions to assess self-custodied crypto without asking customers to give up control of their assets. It also avoids the false comfort of screenshots, generic declarations or unstructured document collection.

Accredifi provides cryptographic wallet verification infrastructure that helps financial institutions verify self-custodied wallets while allowing customers to retain full control of their assets. It is designed to complement existing KYC, AML and compliance workflows rather than replace them.

Technical & Regulatory References

Disclaimer: This article is for informational purposes only and does not constitute legal, regulatory, financial, tax, investment, audit, mortgage or compliance advice. Institutions should obtain jurisdiction-specific advice before relying on any compliance process.