Self-custody and the Travel Rule

Self-custody means you hold the keys. The Travel Rule, in the Union, is Regulation (EU) 2023/1113 on information accompanying transfers of funds and certain crypto-assets. The concept — why it exists, which data move between providers — is in the blog article. This page does not rebuild it. It says what happens, in practice, when one end of the transfer is an address that is not a CASP’s.

When the regulation applies

The regulation applies to crypto-asset transfers where the originator’s provider or the beneficiary’s has its registered office in the Union. Recital 38 says the requirements also reach transfers to or from a self-hosted address, as long as a provider is involved. The express exclusion is a person-to-person transfer carried out with no CASP. Two wallets you control, with no exchange in between, are not the case in these articles. As soon as the transfer leaves an exchange, or arrives at one, the provider on that side is inside the regulation.

The definition, Article 3(20), calls a self-hosted address a distributed-ledger address not linked to a CASP or to an entity not established in the Union that provides similar services. It does not matter whether the device is a phone or a piece of metal. What matters is that the address is not a provider’s.

What the exchange can ask you for

Article 14 requires the originator’s CASP to ensure the transfer is accompanied by information on the originator and the beneficiary: name, the distributed-ledger address where the transfer is registered on a network, the crypto-asset account number where one exists, and the address including the country, a document number, a customer number or, instead, date and place of birth. Where the originator provides it and the message format allows, the LEI as well. Paragraph 5 says that if the destination is a self-hosted address, the provider obtains and holds that information and ensures the transfer can be individually identified.

The same paragraph adds the threshold. Without prejudice to measures under Directive (EU) 2015/849, where the amount exceeds €1,000 to a self-hosted address, the originator’s CASP takes adequate measures to assess whether that address is owned or controlled by the originator. Article 16(2) mirrors the rule in the other direction: if the transfer arrives from a self-hosted address, the beneficiary’s CASP obtains and holds the information, identifies the transfer and, above €1,000, assesses whether the address is owned or controlled by the beneficiary. Recital 39 summarises both directions of the threshold and says that, in principle, the provider is not required to verify information on the user of the self-hosted address, except in that case above €1,000, where it does assess control.

In practice that becomes screens asking for the wallet type, a signature from the address or a small test transfer. The regulation does not prescribe the brand of the method. It prescribes the duty to assess control above the threshold and to hold the information in every case. If information is missing or incomplete, Article 16 allows the beneficiary’s provider, on a risk-sensitive basis and without undue delay, to decide what happens to the transfer. That is not a commercial whim the text ignores: it is the consequence the article writes.

What a wallet of your own does not fix

Moving crypto-assets to an address you control does not turn the sending platform into a CASP, and it does not repair a missing row. ESMA’s statement of 17 April 2026 gives a self-hosted wallet as one example of an orderly exit, alongside a transfer to an authorised CASP. It is a way out, not an authorisation. The context is in if the platform is not authorised.

It also does not replace custody under Article 75 of MiCA. While the assets are at the exchange, segregation and liability are the subject of that guide: custody and client funds. Once the keys are only yours, those CASP duties in respect of that balance end because the balance is no longer in its custody. The risk of losing the key, or of signing the wrong transaction, is not covered by Article 75. The transfer regulation, recital 45, also asks the provider to assess the risk of transactions with self-hosted addresses and, if it sees unusual patterns, to take that into account for a possible report to the financial intelligence unit.

Article 37 of the transfer regulation asks the Commission for a report, by 1 July 2026 at the latest, on the risks of transfers to or from self-hosted addresses and on whether specific measures are needed. This page does not guess at that report. As of November 2026 the text in force is still the regulation linked above, with the €1,000 threshold.

One transfer, in order

1. Confirm that the exchange is the legal person on the row, with letter j if the service is the transfer. The letters are in the services guide.
2. Have ready the name the provider has already verified. Article 14 requires the originator’s data to be accurate, not an alias in the app.
3. If the amount exceeds €1,000, expect a check that you control the address. It is not a fee: it is paragraph 5 or Article 16(2).
4. Keep the transfer identifier. The provider has to be able to identify the transfer individually.
5. If the destination is another exchange, the data move between providers. That leg, not the wallet you control, is what the blog article develops.

Common questions