Self-custody meets institutional control: where the legal line actually sits
No regulator accepts “non-custodial” as the answer: a wallet needs a custody licence where its provider can move or control client assets under that market’s test, and a self-custody wallet stays compliant by keeping every provider-held key short of control and meeting the AML rules that still reach transfers to and from self-hosted addresses. Holding one key of a multisig can make you a custodian under MiCA, whose definition covers controlling the means of access, even where the same key clears FinCEN’s test because you cannot move value alone.
A joint analysis by Infinilex and Reah on what “non-custodial” actually has to mean, jurisdiction by jurisdiction, to hold up under real regulatory scrutiny.
“Non-custodial” is not a self-certifying label anywhere. The US asks who can move funds unilaterally. The EU asks who controls the means of access. India and the UAE ask what function the platform performs in substance. Singapore regulates facilitation even without possession. Canada asks what the user legally received. One multi-sig architecture, six different tests, and the label decides none of them.
Overview
Platforms building on stablecoin rails increasingly lead with the same pitch: self-custody wallets, multi-sig protection, “institutional-grade” security. Reah’s own positioning, “self-custody meets institutional-grade security”, is a good example of how the industry frames this today. We wanted to pick up that thread from the legal side, because security and compliance are often talked about as though they’re the same conversation. They’re not. More broadly, a wallet can be perfectly secure and still fall within a licensing regime, depending on how regulators assess its underlying structure. Here’s where that line actually sits: the US asks who can move funds unilaterally; the EU asks who controls access; India and the UAE ask what function a platform actually performs; Singapore regulates even without possession; and Canada asks a different question entirely: what did the user legally receive? This piece walks through what “non-custodial” actually has to mean, jurisdiction by jurisdiction, to hold up under real regulatory scrutiny.
Platforms often describe their wallet infrastructure as “self-custody” or “non-custodial”, paired with multi-signature controls. That framing is common across the industry, and for good reason: it signals that the user, not the platform, retains meaningful control over their assets. But from a compliance standpoint, “non-custodial” is not a self-certifying label. Regulators don’t ask what a product calls itself. They ask a narrower, more mechanical question: who can actually move the funds, and under what conditions?
That question, and not the marketing term, is what determines whether custody-related licensing applies.
The US stance on custody
The clearest official articulation of this comes from the U.S. Financial Crimes Enforcement Network (FinCEN). In its 2019 interpretive guidance on convertible virtual currency business models, FinCEN drew a direct, mechanical line:
- Software / “unhosted” wallet providers. Platforms that give users tools to hold their own keys are not regulated as money transmitters under the Bank Secrecy Act, because they never accept or transmit funds on the user’s behalf.
- Multi-signature wallet providers. Just like software and unhosted wallet providers, multi-sig wallet providers are treated the same way, but only if they lack the unilateral ability to execute a transaction. If a platform holds one key in a multi-sig scheme but cannot move funds without the user’s separate signature, FinCEN’s guidance places that outside money-transmitter status.
Key takeaway. The operative fact isn’t the number of keys or the word “non-custodial” on a landing page. It’s whether any single party, including the platform itself, can move a client’s assets alone.
Non-custodial dApps, swaps and the CLARITY Act
Two further points from FIN-2019-G001 (9 May 2019) matter for builders who hold no keys at all. Section 4.4 says that when a decentralised application accepts and transmits value, the money-transmitter definition applies to the DApp, its owners or operators, or both, whether or not it operates for profit. Section 5.2.2 says the developer is not a money transmitter for the mere act of creating the application, but qualifies as one if the developer uses or deploys it to engage in money transmission. Section 4.2.2 closes with the line that governs this whole page: a provider that keeps total independent control of the value, or stands between the owner and the payment system, is a money transmitter “regardless of the label the person applies to itself or its activities”.
Congress has not changed this yet. The House-passed text of the Digital Asset Market Clarity Act of 2025 (H.R. 3633, engrossed in House) carries a section 109 under which a non-controlling blockchain developer or provider of a blockchain service, including one supplying hardware or software for a customer’s own custody, would not be treated as a money transmitter. The Senate cloture vote on the bill failed on 15 September 2026, so as at 6 October 2026 that safe harbour is not law and FinCEN’s 2019 guidance remains the operative federal text. State money-transmission licensing runs on its own definitions and is outside this article.
The EU draws the line differently, and more broadly
Under the EU’s Markets in Crypto-Assets Regulation (MiCA), the analysis doesn’t hinge on “custodial vs. non-custodial” as a binary at all. MiCA defines “providing custody and administration of crypto-assets on behalf of clients” as “the safekeeping or controlling, on behalf of clients, of crypto-assets or of the means of access to such crypto-assets, where applicable in the form of private cryptographic keys” and treats it as a licensable activity requiring authorization as a Crypto-Asset Service Provider (CASP).
Notice the phrase “or of the means of access.” This matters because, under MiCA, you don’t need to hold a client’s assets outright to be considered a custodian; simply controlling access to those assets can be enough. Holding even one key in a multi-sig setup is, on a plain reading, controlling a “means of access.” And once a platform is treated as offering custody, it takes on real obligations under Article 75 of the MiCA regulation: it must have a custody agreement with each client, keep client assets separate from its own, and report on asset status at least every three months. The wider authorisation decision is mapped in MiCA vs VARA, and the application mechanics in our MiCA CASP readiness checklist.
Key takeaway. A structure that clears FinCEN’s narrower “unilateral control” test in the US will not automatically clear MiCA’s broader “controlling means of access” test in the EU. These are two different legal tests, not two phrasings of the same one.
Self-hosted wallets, decentralised services and the end of the transitional period
Three further points from the Regulation sharpen the EU answer. First, recital 83 says that “hardware or software providers of non-custodial wallets should not fall within the scope of this Regulation”, so a wallet whose provider holds no key and no means of access is outside the custody service. Second, recital 22 brings in services where part of the activity is performed in a decentralised manner and keeps out only services “provided in a fully decentralised manner without any intermediary”; a swap or dApp with an identifiable operator is in scope for the services it provides. Third, Article 59(1) bars anyone from providing crypto-asset services in the Union without authorisation, and the transitional period in Article 143(3) for providers already operating before 30 December 2024 ended on 1 July 2026, earlier in Member States that shortened it. A platform that holds a means of access for EU clients today needs the CASP authorisation, not a grandfathering plan.
Self-custody also meets the perimeter from the other side. A crypto-asset service provider dealing with a self-hosted address has its own information and address-verification duties under Regulation (EU) 2023/1113, set out with the thresholds in our crypto travel rule guide for India, the UAE, the EU and the US. The wallet is not licensed, but every regulated counterparty it touches will ask who controls it.
India doesn’t ask what you call yourself, it asks what you do
India’s framework, administered by the Financial Intelligence Unit (FIU-IND) under the Prevention of Money Laundering Act, 2002, takes this a step further. The Ministry of Finance’s notification in March 2023 brought “safekeeping or administration of virtual digital assets or instruments enabling control over virtual digital assets” within the definition of a reporting entity, regardless of whether the entity is based in India, and regardless of how the platform describes its own custody model.
Legal commentary tracking FIU-IND’s enforcement pattern has been explicit about this: platforms that brand themselves “non-custodial” are not automatically outside scope. Regulators in India and elsewhere increasingly apply a functional test: who, in practice, controls the use of the assets, regardless of the technical architecture or the label the platform uses. Who the notification catches, and the registration sequence that follows, are covered in our FIU-IND registration guide and the step-by-step checklist.
Key takeaway. The single most important sentence for any founder building wallet infrastructure to internalize: the label is not the analysis, the control structure is the analysis.
What the January 2026 guidelines add on unhosted wallets and smart contracts
FIU-IND’s AML and CFT guidelines for VDA service providers, updated 8 January 2026, speak to both halves of the self-custody question. Paragraph 7.1.2 says that using an automated process such as a smart contract to carry out reporting-entity functions does not relieve the parties of their obligations under the PMLA and the Rules, and that the controlling parties responsible for executing the contracts must undertake documented risk assessments before launch. Paragraph 7.2 puts the compliance onus for a transfer between a hosted and an unhosted wallet on the reporting entity hosting the wallet; how India and the other markets treat self-hosted wallets is covered in our crypto travel rule guide. Paragraph 7.3 repeats that the obligations are activity-based and apply irrespective of physical presence in India. What the guidelines require of a registered provider’s AML programme and MLRO is on our crypto AML programme page.
The UAE: custody is its own licence, full stop
Dubai’s Virtual Assets Regulatory Authority (VARA) removes almost all ambiguity by treating custody as a separate, standalone licensable activity, not a feature bundled into a trading or wallet licence. VARA’s Virtual Assets and Related Activities Regulations 2023 define custody as “safekeeping Virtual Assets for or on behalf of another Entity and acting only on verified instructions from or on behalf of such Entity” (VARA defines “Entity” as any legal entity or individual), and its Custody Services Rulebook requires custody to be conducted through its own legal entity, segregated from any other virtual asset activity the group performs, subject to a limited exception for VA Transfer and Settlement Services.
Two details make VARA’s regime relevant to any “self-custody meets multi-sig” claim specifically:
- VARA requires VASPs providing custody to maintain control of each virtual asset at all times while segregating each client’s holdings into that client’s own wallet, a structural requirement that sits independently of how many signatures a transaction needs.
- VARA’s regime works, in substance, the way India’s does: what matters is not whether a firm considers itself a custodian, but whether it performs custodial functions. A firm that holds even one key in a client transaction flow, or that influences whether a transaction is verified and executed, risks being read as performing a custodial function under VARA’s activity-based rules, regardless of what the product page calls it.
How VARA sits against the UAE’s two other virtual-asset regimes is mapped in VARA vs ADGM vs DIFC; the UAE VASP licensing-readiness checklist is the pre-application gap analysis we run with clients.
Key takeaway. In Dubai, “we’re not a custodian” is not a determination a platform gets to make for itself. It’s a determination VARA makes, based on what the platform’s technical setup actually allows it to do.
Singapore: custody is regulated even without full possession
Singapore’s Monetary Authority of Singapore (MAS) offers a useful contrast because it shows the perimeter can extend even further than “who holds a key.” Following the Payment Services (Amendment) Act 2021, with the relevant provisions taking effect in April 2024, the Payment Services Act was expanded to bring custodial services for digital payment tokens (DPTs) within MAS’s licensing regime, alongside the facilitation of DPT transfers and exchanges.
Notably, MAS’s own guidance makes clear that transfer and exchange-facilitation services fall within scope “even where the service provider does not come into possession of the moneys or DPTs.” In other words, MAS will still regulate a platform simply for enabling a transfer or exchange, whether or not it ever actually holds the assets.
Licensed DPT service providers in Singapore are required to safeguard customer assets, including by depositing them into a trust account, separate from the platform’s own holdings.
Since 30 June 2025 Singapore also reaches providers that serve no Singapore customers at all. MAS’s media release of 6 June 2025 confirmed that digital token service providers with a place of business in Singapore that provide services solely to customers outside Singapore need a licence under Part 9 of the Financial Services and Markets Act 2022 from that date, and that MAS will generally not issue such a licence. Providers serving Singapore customers remain under the Payment Services Act.
Key takeaway. MAS doesn’t wait for a platform to hold assets before stepping in; simply enabling a transfer or exchange can be enough to fall under regulation. And once a platform is in scope, keeping customer assets in a separate trust account isn’t optional; it’s a baseline legal requirement, not a discretionary security feature.
Canada: a different question entirely, what did you actually sell the user?
Canada’s approach, developed by the Canadian Securities Administrators (CSA), is worth including precisely because it doesn’t ask “who holds the key” at all. It asks a different question: what is the legal nature of the user’s claim against the platform?
Under CSA Staff Notice 21-327, if a user pays for crypto but the platform doesn’t hand over that exact asset right away, even a short delay, the user hasn’t really bought the crypto itself. They’ve bought a promise that the platform will give it to them. Canadian regulators treat that promise as a security or derivative. So a platform can call itself “non-custodial”, but if there’s a payment-to-delivery gap, that label doesn’t matter; the user’s claim is what gets regulated.
Where a platform does perform a custody function, the CSA and IIROC’s joint guidance is explicit that the risk being regulated, loss, theft, or bankruptcy of custodied assets, exists regardless of which technical custody mechanism a platform uses, because “the mechanism for ‘custody’ in the crypto asset context may be different between business models, yet a risk of loss, theft or bankruptcy remains.”
Key takeaway. Canadian regulators may look past the custody architecture altogether and ask whether, functionally, the user has an immediate, unconditional claim to a specific on-chain asset or a contractual promise from the platform. If it’s the latter, “non-custodial” framing may not change the underlying securities-law analysis at all.
How a self-custody wallet becomes compliant
Pulling the six tests together, the path to a “non-custodial” claim a platform can defend runs through design and documentation, not labels. This section was added on 6 October 2026.
- Design every provider-held key short of control. If the provider keeps no key, no recovery power and no veto, it sits where FinCEN’s section 4.2.1 and MiCA’s recital 83 place wallet software: outside the custody perimeter. If it keeps one key, that key must not be able to move value alone (FinCEN section 4.2.2) and must still be read against MiCA’s “means of access”, VARA’s “verified instructions” and FIU-IND’s “instruments enabling control” tests.
- Write the signing structure down. Who holds each key, who can rotate or recover it, and what any relayer, guardian or policy engine can do without the client. This is the document every regulator in this article asks for first, and the one a custody agreement under MiCA Article 75 has to describe.
- Decide the operator question separately for any swap or dApp. An identifiable team that controls the front end, fees, upgrades or matching is the person FinCEN section 4.4, MiCA recital 22 and FIU-IND paragraph 7.1.2 look at, whatever the keys do.
- Where a test is met, apply rather than relabel. MiCA’s transitional period ended on 1 July 2026, VARA treats custody as its own licence, and FIU-IND registration is activity-based and applies irrespective of location. The MiCA CASP readiness checklist and the UAE VASP licensing-readiness checklist set out the files.
- Build for the counterparties’ AML rules. Even a wallet that is outside licensing is treated as a self-hosted address by every CASP, VASP and reporting entity it transacts with, and each will ask for travel-rule data and evidence of who controls the address. The thresholds by market are in our crypto travel rule guide. Wallets that can supply that information cleanly keep their users’ on-ramps open. The self-custody compliance controls checklist lists the controls.
Conclusion
This isn’t an academic distinction. It determines which licence, if any, a platform needs (money-transmission registration in the US, CASP authorization in the EU, FIU-IND reporting-entity registration in India, and their equivalents in the UAE, Singapore, and Canada, each triggered by a different, specific test), where a platform can operate without a local partner or licence, and what it can legally promise its users. “Your keys, your crypto” is only a meaningful claim if it’s technically true under the applicable test, not just true in spirit. That determination must be made separately in each jurisdiction where the relevant service is offered, because the frameworks above do not apply the same standard. Canada, in particular, stands apart, asking less about who holds the keys and more about the legal nature of the user’s claim to the asset.
For any builder evaluating a multi-sig or “non-custodial” product, including relying on someone else’s marketing claim about theirs, three questions cut through the noise: Can any single party, including the platform, move funds without the client’s separate signature? Does the platform control any credential that acts as a “means of access” or “verified instruction” checkpoint, even without holding the asset itself? And has the structure been tested against the specific legal standard in every jurisdiction the platform operates in, not just where it was formed? Get those answers right, and “non-custodial” is a claim a platform can defend to a regulator, not just to a user. Get them wrong, and it’s a marketing line that creates a licensing problem nobody saw coming.
Frequently asked questions
Is calling a wallet "non-custodial" or "self-custody" enough to stay outside custody licensing?
No. Regulators do not treat "non-custodial" as a self-certifying label. They apply a functional test: who can actually move the funds, and under what conditions. The control structure, not the marketing term, is what determines whether custody-related licensing applies.
Does holding one key in a multi-signature wallet make a platform a custodian?
It depends on the jurisdiction's test. Under FinCEN guidance in the US, a multi-signature provider may stay outside money-transmitter status where its role is limited to providing additional authorization for an unhosted wallet and it does not accept or transmit value. Under the EU's MiCA, holding a key may amount to controlling a "means of access" if the authority it provides within the full signing structure gives the platform control over client assets. The same architecture may therefore be treated differently across jurisdictions.
How does the US decide whether a wallet provider needs a licence?
FinCEN's 2019 guidance applies a facts-and-circumstances analysis. Relevant factors include who owns the value, where it is stored, whether the owner interacts directly with the payment system, whether the provider accepts or transmits value, and whether the provider has independent control over the assets. A software provider or a multi-signature provider whose role is limited to supplying additional authorization for an unhosted wallet may fall outside money-transmitter status. A different conclusion may apply where the provider operates a hosted wallet, maintains account-based balances, accepts and transmits value, or exercises independent control.
Does the EU's MiCA treat controlling a key as custody?
Potentially, yes. MiCA defines custody as safekeeping or controlling, on behalf of clients, crypto-assets or the means of access to them. Holding a key is relevant where the authority it provides within the full signing structure gives the platform control over client assets or their means of access. If the arrangement constitutes custody and administration under MiCA, authorization and related obligations may apply.
How do India and the UAE decide whether a platform performs custody?
Both apply a functional, activity-based test rather than accepting a label. India's FIU-IND framework covers the safekeeping or administration of virtual digital assets, or instruments enabling control over them, regardless of how the platform describes itself. Dubai's VARA treats custody as its own standalone licence and asks whether a firm performs custodial functions in substance, including whether it holds a key or influences whether a transaction is verified and executed.
Can a platform be regulated in Singapore or Canada without holding customer assets?
Yes. In Singapore, MAS regulates certain digital-payment-token services even where the service provider does not take possession of customer assets. Where a provider safeguards customer assets, segregation and trust-account requirements may apply. In Canada, the CSA examines the nature of a user's claim in the context of crypto-asset trading platforms. Where the user does not receive immediate delivery and control of the asset and instead holds a contractual claim against the platform, that claim may be regulated as a security or derivative.
Do non-custodial wallets need a custody licence?
Not for the label, and not automatically. A licence attaches where the provider can move or control client assets under the test of the market it serves. FinCEN asks whether the provider accepts and transmits value or has total independent control (FIN-2019-G001, 9 May 2019, sections 4.2.1 and 4.2.2); MiCA asks whether it safekeeps or controls the means of access (Article 3(1)(17)); FIU-IND asks whether it safekeeps or administers virtual digital assets or instruments enabling control over them; and VARA asks whether it performs custodial functions in substance. A wallet whose provider holds no key and cannot move funds sits outside custody licensing in each of these regimes. A wallet whose provider holds a key that can complete a transaction, or that counts as a means of access, does not.
Are self-custody wallets regulated, and how does a self-custody wallet become compliant?
The wallet software itself is largely outside the licensing perimeter: MiCA's recital 83 says hardware or software providers of non-custodial wallets should not fall within the Regulation, and FinCEN's 2019 guidance treats the owner of an unhosted, single-signature wallet as not a money transmitter. The perimeter reaches the wallet at two points. First, any key, co-signing right or recovery power the provider keeps is tested as custody. Second, every regulated counterparty the wallet transacts with must treat it as a self-hosted address and apply its own travel-rule and address-verification duties; the thresholds by market are in the Infinilex guide to the crypto travel rule in India, the UAE, the EU and the US. Compliance therefore means keeping provider-held keys short of control, documenting the signing structure, and building the address-verification and travel-rule data flows those counterparties will ask for.
Do we need KYC and AML as a non-custodial dApp or swap?
Often yes, and the answer turns on who operates the service rather than on where the keys sit. FinCEN's 2019 guidance says at section 4.4 that when a decentralised application performs money transmission the definition applies to the DApp, its owners or operators, or both, and at section 5.2.2 that a developer who deploys the application to engage in money transmission qualifies as a money transmitter. MiCA's recital 22 keeps services provided in a fully decentralised manner without any intermediary outside the Regulation, but brings in services where only part of the activity is decentralised and an identifiable operator remains. FIU-IND's guidelines updated 8 January 2026 state at paragraph 7.1.2 that using a smart contract to carry out reporting-entity functions does not relieve the controlling parties of their PMLA obligations. A swap or dApp whose team controls the front end, the fee switch, upgrade keys or the matching logic should assume it is in scope for KYC and AML in each of these markets until counsel confirms otherwise on its facts.
Does holding one key of a multisig wallet make me a custodian under MiCA?
It can. MiCA Article 3(1)(17) defines custody and administration as the safekeeping or controlling, on behalf of clients, of crypto-assets or of the means of access to such crypto-assets, where applicable in the form of private cryptographic keys. A multisig co-signer who holds one key for clients holds a means of access, so the question is whether that key gives it control within the signing structure, for example because its signature is needed to move funds or to recover them. Where it does, the co-signer is a crypto-asset service provider providing custody, needs authorisation under Article 59(1), and takes on the Article 75 duties: a written custody agreement, a register of positions, a custody policy, a statement to clients at least every three months and segregation of client assets. The transitional period under Article 143(3) ended on 1 July 2026, so there is no grandfathering left to rely on. The same key may clear FinCEN's test in the US if the co-signer cannot move value alone (FIN-2019-G001, section 4.2.2).
What does Infinilex do on a custody classification, and who signs?
Infinilex maps the signing structure of a wallet, custody or multisig product against the custody test of each market it serves, writes up the classification and the licensing path that follows, and prepares the licence or registration file where one is needed. Infinilex counsel qualified in India, the UAE and the US sign opinions for those jurisdictions; for the EU and any other jurisdiction Infinilex scopes and coordinates the local counsel who sign. For MiCA, Infinilex quarterbacks and EU local counsel files. The team includes in-house chartered accountant and company secretary capacity for the entity and filing work around a licence. Email is answered within one working day.
Building wallet, custody or multi-sig infrastructure across borders?
Tell us where your users, your keys and your entities sit, and we will map which custody test each market applies to your architecture, and what licensing follows, before a regulator maps it for you.
Thirty minutes with Prashant Sharma, the founder, who does the work himself. You leave with next steps either way. Email is read by the founder and answered within one working day.
Further reading
From Infinilex: The Web3 legal-readiness checklist · MiCA vs VARA · VARA vs ADGM vs DIFC · FIU-IND registration for crypto businesses in India · The UAE VASP licensing-readiness checklist · The self-custody compliance controls checklist · Crypto licence requirements by country · MPC and smart-contract wallets: which key arrangements are custody?
Primary texts read on 6 October 2026: FinCEN FIN-2019-G001 (9 May 2019); Regulation (EU) 2023/1114 (MiCA, 31 May 2023), Articles 3(1)(17), 59(1), 75 and 143(3) and recitals 22 and 83; Regulation (EU) 2023/1113 (31 May 2023), Articles 3(20), 14(5) and 16(2); FIU-IND AML and CFT guidelines for VDA service providers (updated 8 January 2026), paragraphs 1.2.2, 7.1.2, 7.2 and 7.3; H.R. 3633 as engrossed in the House, section 109; MAS media release of 6 June 2025.
From Reah: reah.com
Contributor note
Reah contributed the product and platform perspective on multi-signature wallet architecture, treasury workflows and institutional controls. Infinilex contributed the legal and regulatory analysis across the six jurisdictions covered in this article.
About Reah
Reah is a financial operating system for global businesses managing both fiat and digital assets. It brings banking, finance-grade non-custodial wallets, corporate cards, treasury workflows, and AI-native execution into one platform. Its wallet architecture preserves self-custody, while team permissions, approval policies, and a unified ledger provide the governance and auditability finance teams need. Reah is a financial technology company, not a bank, broker-dealer, or investment adviser. Product availability is subject to eligibility, geography, and partner availability.
About Infinilex
Infinilex is a legal and regulatory advisory practice for Web3 and digital-asset projects, helping founders structure operations, tokens, and platform-level compliance across India, the UAE, and the US. Rather than coordinating three disconnected local counsel across three jurisdictions, Infinilex handles the work itself across all three, which is the corridor most Web3 businesses building out of the US, India or the UAE actually run on. Rather than treating jurisdiction selection as an afterthought, Infinilex works with teams at the design stage, mapping which regulator actually governs the given product, and building the entity, licensing, and compliance structure around that answer before the product ships.
This article is general information for founders, not legal, tax or investment advice for your specific company or product. It does not assess any specific platform’s custody architecture, including Reah’s. Regulatory positions across the US, the EU, India, the UAE, Singapore and Canada change. Confirm every point against current law for your facts, and have your structure reviewed before you rely on a custody classification.