Unhosted Wallet

An unhosted wallet is a cryptocurrency wallet in which the private keys are held by the user, so that no financial institution or other service provider is in a position to move the funds. The term is used mainly by regulators and compliance teams. In their usage, it describes the far end of a transfer: a counterparty that is an individual with software or a device, rather than a regulated firm that can collect and pass on information. Industry participants more often call the same thing a self-hosted or non-custodial wallet.

The opposite is a hosted wallet, also called a custodial wallet, maintained by an exchange or other virtual asset service provider (VASP) that controls the keys on the customer's behalf.

A crypto wallet is software or hardware that stores a private key and uses it to sign transactions. The matching public key generates the address that others send funds to. Whoever holds the private key can spend the assets, so in an unhosted wallet the user alone has that power. Examples include mobile and desktop wallet apps, browser extensions and hardware wallets. Some setups split control using a multi-sig wallet or an MPC wallet; whether those count as unhosted depends on whether a service provider holds enough of the key material to move funds alone.

Because there is no intermediary, no one can reverse a mistaken transfer, freeze the balance in response to a court order, or recover the funds if the user loses the key.

Regulators generally do not license the software behind unhosted wallets, and individuals holding their own keys are not themselves regulated. Their concern is the point at which value moves between an unhosted wallet and a regulated firm, since that is where controls can be applied.

FATF guidance

The FATF extended its standards to virtual assets in 2019. Its Recommendation 16, applied through the Travel Rule, requires VASPs to obtain and share originator and beneficiary information on transfers. When one side of the transfer is an unhosted wallet, there is no counterparty VASP to exchange data with, so the FATF expects the regulated firm to collect the relevant information from its own customer and to apply a risk-based approach to these transfers.

European Union

The EU's recast Transfer of Funds Regulation, Regulation (EU) 2023/1113, which applies from 30 December 2024 alongside MiCA, covers transfers involving self-hosted addresses. For transfers above EUR 1,000 to or from a self-hosted address belonging to the firm's own customer, a crypto-asset service provider must take adequate measures to assess whether the address is owned or controlled by that customer.

United States

In December 2020, FinCEN proposed a rule that would have required banks and money services businesses to keep records and file reports on certain transactions with unhosted wallets. The proposal drew extensive comment and had not been finalized as of 2024. Existing obligations under the Bank Secrecy Act, such as suspicious activity reporting and sanctions screening, still apply to the regulated side of these transfers.

Exchanges and other VASPs handle unhosted wallet transfers in several ways. They may ask customers to declare whether a withdrawal address is their own, verify ownership through a signed message or a small test transaction, and run the address through blockchain analytics to check for links to sanctioned entities, mixers or known fraud. Transfers involving addresses listed by OFAC must be blocked or rejected under US sanctions law.

Supporters of self-custody argue that unhosted wallets protect users from exchange failures and give individuals control over their own property, a point reinforced by several high-profile exchange collapses. Law enforcement agencies point out that funds in unhosted wallets are harder to freeze and that criminals use them alongside mixers and peer-to-peer trading to move proceeds. Much of the policy debate turns on how far obligations can be placed on regulated firms without effectively restricting individuals' ability to hold their own assets.