Unhosted wallet

Nothing about the software is unusual; the label exists to describe what supervisors cannot see. European rules have obliged providers to verify who controls a self-hosted address for transfers above 1,000 euros since December 30, 2024, while the American attempt at comparable rules was withdrawn in August 2024. Holding your own keys remains lawful in almost every country covered here.

How it works

An unhosted wallet is defined by an absence rather than a feature. No company holds the private keys, so there is no account, no login, no support desk, and crucially no supervised institution for a regulator to send instructions to. A phone app, a hardware device and a paper backup are all unhosted wallets; the category is defined by who controls the keys, not by the form factor.

Because of that absence, rules aim at the last regulated party in the chain, which is the exchange you are withdrawing from. Under the European transfer of funds regulation, in force since December 30, 2024, a provider must gather sender and recipient details for crypto transfers, and where the other end is a self-hosted address and the amount exceeds 1,000 euros it must establish whether its own customer owns or controls that address. Supervisory guidance is explicit that simply asking the customer and believing the answer does not satisfy this, which is why withdrawal screens now request a signed message, a small test payment, or a screen recording of the wallet.

Note what the rule does not do. It does not forbid transfers to wallets you control, does not require the recipient to be identified when the recipient is a stranger, and does not apply to a transfer between two unhosted wallets, which no regulated firm touches. The separate European anti-money-laundering regulation goes further from July 10, 2027 by banning anonymous accounts at licensed providers, but that is a rule about accounts at firms, not about the keys on your desk.

The United States looked at going further and stopped. FinCEN proposed in December 2020 that institutions keep records of counterparty details for transactions above 3,000 dollars involving unhosted wallets and report those above 10,000 dollars. More than 7,500 comments arrived, the technical objections were severe, and the proposal was formally withdrawn in August 2024 without a replacement.

Where you see it

The unhosted wallet label surfaces at exactly one moment: the withdrawal screen.

An exchange asking whether the destination belongs to you, offering options such as "my own wallet" or "a third party", and requesting a name for the recipient, is running the transfer rule. Answer honestly. The follow-up may be a proof of control step, and platforms serving European customers are now routinely equipped for it. Address whitelisting, which many venues offer alongside a 24 to 48 hour cooling period on new entries, uses the same plumbing and is worth turning on for its own sake.

You also see the concept in product design. Relai, one of the platforms reviewed here, is built so that purchases settle by default into a wallet on your own phone rather than into a house account, which makes the unhosted destination the normal path instead of an exception. Whatever venue you use, verify the first few characters and the last few characters of the address on the device screen itself, and send a small test amount before the real one.

Unhosted wallet vs custodial wallet

Unhosted and custodial wallets are opposite answers to one question: who can sign. In a custodial arrangement the company signs, so your balance is a claim on that company and its compliance team can hold, reverse or refuse a payment. In an unhosted wallet you sign, so nobody can stop a transaction and nobody can rescue you from a mistake. Regulators care about the difference because it marks the edge of what they can supervise. You should care because it marks the edge of who can lose your coins for you.