When money moves between two regulated providers, each side knows who it is dealing with and can exchange the information regulators require. When a customer deposits stablecoins or crypto from their own wallet, there is no provider on the other end. An address is not a person: it has no name attached, no directory to check it against, and no way to tell you that the customer who gave it to you actually controls it.
That gap is why regulators have put self-hosted wallets at the centre of Travel Rule compliance, and why exchanges, brokers and other stablecoin and crypto providers are being asked to prove their customers control the wallets they deposit from.
This guide explains what self-hosted wallet verification requirements look like today, with a focus on the EU, what is coming next, how the accepted verification methods compare, and how to meet the rules without slowing down deposits.
This article is for general information and is not legal advice. Requirements vary by jurisdiction and change over time, so confirm your obligations with your legal and compliance team.
What is a self-hosted wallet?
A self-hosted wallet is a wallet where the customer holds the private keys, rather than a regulated provider. You will also see them called unhosted, self-custodial, non-custodial or external wallets.
For a stablecoin and crypto provider, every deposit a customer makes from their own wallet is a transfer from a self-hosted address, and every withdrawal back to it is a transfer to one. That means self-hosted wallet rules apply to the core of how customers fund and use their accounts.
Why regulators focus on self-hosted wallets
The Travel Rule requires providers to collect and share information about the sender and recipient of a transfer. Between two regulated providers, that information travels with the transfer. A self-hosted wallet has no provider to send it, so when a customer deposits from one, the obligation falls entirely on the provider receiving the funds.
Regulators have responded in two ways. First, by requiring providers to collect information about self-hosted transfers from their own customers. Second, by asking providers to establish that the customer actually controls the self-hosted address, so funds cannot be routed in through a wallet that belongs to someone else.
The EU: Transfer of Funds Regulation (TFR)
The EU's Transfer of Funds Regulation, Regulation (EU) 2023/1113, has applied since 30 December 2024. It extends the Travel Rule to crypto-asset transfers, including stablecoins, and covers transfers between crypto-asset service providers (CASPs) and self-hosted wallets.
For transfers to or from a self-hosted address, CASPs must collect the relevant originator and beneficiary information and ensure the transfer can be individually identified.
What changes above EUR 1,000
For a transfer exceeding EUR 1,000 to or from a self-hosted address, Articles 14(5) and 16(2) of the TFR require the CASP to take adequate measures to assess whether that address is owned or controlled by its customer.
In practice, that means a provider receiving a deposit of more than EUR 1,000 in stablecoins or crypto from a customer's own wallet needs a reliable way to establish that the customer controls that wallet, and a record to show it did. The same applies when paying a withdrawal of that size out to one.
Transfers directly between two self-hosted wallets, with no CASP involved, fall outside the TFR.
The EBA Travel Rule guidelines: accepted verification methods
The European Banking Authority published its final Travel Rule guidelines in July 2024. They set out how CASPs should meet their TFR obligations, including for self-hosted addresses.
The guidelines give a non-exhaustive list of methods for verifying ownership or control of a self-hosted address and expect CASPs to use at least one. Examples include:
- Signing a specific message with the wallet, which proves the customer holds the private keys.
- Sending a predefined amount from the wallet to the CASP, often called a Satoshi Test.
Where a single method is not reliable enough to reasonably establish ownership or control, CASPs should combine methods. An earlier draft required two methods in every case; the final guidelines dropped that requirement.
The guidelines also expect CASPs to use technical means to tell whether a transfer involves another provider or a self-hosted wallet, and to assess and mitigate the risks of self-hosted transfers.
What is coming next in the EU
The EU's Anti-Money Laundering Regulation, Regulation (EU) 2024/1624, applies from 10 July 2027. Article 40 requires CASPs to assess the risks of transfers to or from self-hosted addresses and apply mitigating measures to match. The new EU AML authority, AMLA, is due to issue guidelines by the same date, including on how to determine whether a self-hosted address is owned or controlled by a customer.
The direction is clear: providers will be expected to understand and manage the risk of every self-hosted deposit, not only those above a threshold. Building a verification step into your deposit flow now is simpler than retrofitting one later.
Beyond the EU
Travel Rule regimes outside the EU are built on FATF Recommendation 16, which applies to businesses that exchange, transfer or safeguard digital assets for customers, including when those customers use self-hosted wallets.
Comparable self-hosted wallet requirements exist in jurisdictions including the UK, UAE, Hong Kong, Switzerland, Jersey, Liechtenstein, Singapore and the Philippines, though thresholds and accepted methods vary. Across them, self-declaration alone is generally not considered sufficient, and regulators expect technical proof such as a cryptographic signature or a Satoshi Test.
If you accept stablecoin and crypto deposits from customers in several regions, the practical answer is to verify control by default, so one deposit flow covers every market.
What this means for stablecoin and crypto providers accepting deposits
For most providers, self-hosted wallet requirements translate into five practical needs at the deposit step:
- Know when a deposit comes from a self-hosted wallet. Your flow should identify whether funds are arriving from a self-hosted address or from another provider.
- Collect the right information. Capture the originator and beneficiary details the Travel Rule requires in your jurisdiction.
- Establish control. Above EUR 1,000 in the EU, and often below it as a matter of policy, establish that the customer controls the sending wallet using an accepted method.
- Screen before money moves. Check wallets and users against sanctions lists and restricted regions before you accept funds.
- Keep an audit trail. Store a record of each verification you can retrieve when an examiner or partner asks.
Choosing a verification method for deposits
The method you choose decides how much friction your customers feel when they fund their account, and how strong your evidence is.
Message signing. The customer connects the wallet they are depositing from and signs a message. It takes seconds, costs no gas, moves no funds and produces cryptographic proof that only the keyholder could create. It is listed by the EBA as an accepted method.
Satoshi Test. The customer sends a small, specific amount from their wallet before the real deposit. It proves control, but it means two transfers, two network fees and a wait for confirmation, and deposits can sit uncredited until the test clears.
Self-declaration. A checkbox where the customer states the wallet is theirs. It is quick, but it records a claim rather than evidence, and on its own it is unlikely to satisfy a requirement to establish control.
For most stablecoin and crypto providers, message signing gives the best balance of strong evidence and low friction at deposit. Our guide to the Satoshi Test compares the two in more depth, and Wallet Verification: Replacing the Manual Check looks at what manual review costs a team.
How WalletConnect helps you meet self-hosted wallet requirements at deposit
WalletConnect builds compliance into the deposit itself. Wallet Verification proves control and captures the evidence, and Account Top-ups & Deposits lets the customer fund their account with stablecoins or crypto from the wallet they just verified, through the same integration.
- One-click verification by message signing. Your backend starts a verification with a single API call, and the customer connects their wallet on a verification page and signs once. It works across 700+ wallets compatible with the WalletConnect protocol, starting with EVM and Solana wallets.
- Address confirmed automatically, captured from the connected wallet with no manual entry, before funds move.
- Sanctions and IP screening against OFAC, EU, UK and UN lists and restricted regions, run inside the funding flow before money moves, with the outcome enforced automatically
- Travel Rule capture as an optional add-on in the same flow, with required fields configurable to your jurisdictions. Information is collected once, stored in line with GDPR and reused, so returning customers go straight to confirmation.
- An audit-ready, reusable record captured at signing and returned to your systems in real time: proof of control, timestamp, chain, domain, URI, nonce, session ID and connected-wallet metadata, with an export-ready copy in the WalletConnect dashboard. Retention stays under your control.
- Deposits credited automatically. Chain, token and amount are fixed before anyone signs, and every deposit comes with clear payment data, so you credit customers with no manual reconciliation.
WalletConnect provides the verification infrastructure, the capture inside the flow, the screening and the audit record. You keep control of your compliance program: your KYC and customer due diligence policy, risk thresholds, screening configuration, case management, reporting and record retention.
All of it runs on the WalletConnect Network, which has connected wallets, apps and institutions since 2018 and is SOC 2 Type II certified and independently audited on a recurring basis. The same verified wallet carries through to withdrawals with Payouts, so you pay out to wallets you know your customers control.
Frequently asked questions
Is the EUR 1,000 threshold per deposit?
The TFR threshold applies to the value of the transfer. Many providers verify control for every self-hosted wallet regardless of amount, which keeps the deposit experience consistent and avoids splitting flows by value.
Does the Travel Rule apply to transfers between two self-hosted wallets?
No. The TFR applies where a CASP is involved. Transfers directly between two self-hosted wallets fall outside it.
Do I need to verify wallets for deposits below EUR 1,000?
The specific requirement to assess ownership or control applies above EUR 1,000, but providers are still expected to assess and mitigate the risks of self-hosted transfers, and the AMLR builds on that from 2027. Verifying by default is the simplest way to meet both.
Is a self-declaration checkbox enough?
Generally not. A checkbox records what the customer says rather than proving control. Accepted methods such as message signing provide evidence you can show an examiner.
What record should I keep?
Keep evidence of the verification itself, such as the signature, the address, the chain and a timestamp, alongside the Travel Rule information for the deposit. Wallet Verification captures and returns this record automatically, and it can be reused for later deposits from the same address in line with your risk policy.
Is wallet verification the same as KYC?
No. It proves control of a wallet. It is not KYC or customer due diligence, and it does not replace either.
Meet self-hosted wallet requirements without slowing deposits
Self-hosted wallet verification is now part of accepting stablecoin and crypto deposits. WalletConnect lets you verify control in one click, screen before money moves, keep an audit-ready record and take the deposit in the same flow, through one integration on your existing stack.
Talk to our team to see how Wallet Verification fits your deposit flow.
WalletConnect is a technical service provider, not a regulated financial services firm and not a law firm. Nothing here is a warranty that use of these features achieves compliance. You remain solely responsible for your own regulatory obligations and for determining what applies to you, including your licence scope and jurisdiction. These features do not replace your AML or CFT programme. Not legal advice.