Custodial vs Non-Custodial Wallets, Explained

A custodial wallet is one where a company holds the private keys and you hold an account with that company. A non-custodial wallet (also called self-custody) is one where you alone hold the keys. The practical gap is who can move the coins, who can be blamed or compelled when something goes wrong, and who can help you get back in.

Key takeaways

An SEC staff investor bulletin defines the split by who manages and controls access to the private keys: a third-party custodian, or you.
With a custodian, the contract you accepted determines whether you own specific coins or only hold a claim on the company; a court read one such contract as transferring title to the company.
With self-custody, no company can freeze or lose your keys, and no company can restore them either.
Under FinCEN's 2019 guidance, hosted-wallet providers are money transmitters with registration, anti-money-laundering and identity-check duties, while a person using an unhosted wallet for their own purchases is a user, not a money transmitter.
Hybrid designs split control among several keys or parties. They add recovery options only if the key arrangement lets you act when one party is unavailable.

What you actually hold in each case

A wallet does not contain coins. As the SEC staff's crypto custody bulletin (December 2025; staff guidance, not a rule) puts it, wallets store the private keys that authorize transactions. The bulletin treats the choice as self-custody, where you control the keys and carry sole responsibility for them, or third-party custody, where an exchange or dedicated custody provider manages and controls access to the keys. Both can be built on hot (internet-connected) or cold (offline) wallets.

Custodial: an account and a contract

When a provider holds the keys, what you own depends on its terms and on the type of service. On January 4, 2023 the US Bankruptcy Court for the Southern District of New York held in the Celsius case that, under that company's terms of use, coins deposited in its Earn accounts became Celsius's property, and those still there when it filed became property of the bankruptcy estate. The court said its decision did not determine ownership of assets in Celsius's separate Custody program and reserved individual customers' contract defenses, so it is an example of the risk, not a rule for every custodian.

Some custodians are bound by stricter rules. New York's financial regulator, in guidance issued September 30, 2025, tells custodians licensed under its virtual currency rules (23 NYCRR Part 200) and New York limited purpose trust companies to keep customer assets separate from their own, both on-chain and in internal ledgers, and to state in the customer agreement that the relationship is custodial rather than debtor-creditor. That letter replaced a January 2023 version, applies only to New York-licensed or chartered custodians, and does not bind a court. Outside that group, the account terms decide.

Non-custodial: control, with no one to appeal to

With self-custody the keys, and therefore the ability to move the coins, are yours alone. There is no counterparty whose insolvency can turn your coins into a claim. The same fact removes any helpdesk: according to the SEC bulletin, if a wallet is lost, stolen, damaged or hacked you may permanently lose access.

Failure modes and recovery

The two models fail in different places, and each failure has a different remedy.

Event	Custodial	Non-custodial
Provider is hacked, shuts down or goes bankrupt	You may lose access to your assets, per the SEC bulletin; if the provider fails, recovery runs through its insolvency process	Not applicable: no provider holds the keys
You forget a password	Usually a reset after identity verification, under the provider's procedures	Depends on the wallet; many wallets can be restored from their seed phrase backup
You lose the device or private key	Not applicable: the provider holds the keys	A seed phrase backup can restore the wallet; without one, access may be permanently lost
Credentials stolen (login or private key)	Provider support and its terms decide what happens	Whoever holds the private key can move the funds; no company can reverse that
Account frozen or restricted	Possible under the provider's terms or a legal order	The provider cannot freeze keys it does not hold

Deposit insurance does not fill the custodial gap. The FDIC's fact sheet on crypto companies states that FDIC insurance does not cover crypto assets and does not protect against the default, insolvency or bankruptcy of non-bank entities, including crypto custodians, exchanges, brokers and wallet providers. The SEC bulletin suggests asking each custodian whether it insures against loss or theft and reading the terms of any such cover.

Questions the SEC bulletin says to put to a custodian

How is it regulated, and what happens if it fails?
Does it use deposited assets as collateral for its own purposes (rehypothecation), and does it commingle customer assets instead of holding them individually? If so, is your consent required?
Does it keep assets itself or subcontract storage, and does it use hot wallets, cold wallets or both?

Rules, KYC and who is regulated

FinCEN's May 2019 guidance on convertible virtual currency business models separates hosted wallets, where a third party controls the keys, from unhosted wallets, where the user does. It calls hosted-wallet providers account-based money transmitters, which makes them money services businesses, and says the host must identify, verify and monitor the wallet owner under its anti-money-laundering program. The guidance says a person using an unhosted, single-signature wallet to buy goods or services on their own behalf is a user, not a money transmitter.

Non-exempt money transmitters must register with FinCEN on Form 107 within 180 days of being established and renew every two years. Unlike some other money services business types, no dollar activity threshold applies to the money transmitter definition, and a business that is a money services business only because it acts as an agent of another one does not register separately. The FinCEN guidance describes the anti-money-laundering program, recordkeeping and reporting duties that follow.

States can add their own licensing; New York's virtual currency license under 23 NYCRR Part 200 is one example. That is why custodial platforms ask for identity documents and can restrict accounts. Wallet software that only lets you control your own keys typically has no account to verify, although a registered exchange where you buy or cash out will verify your identity.

Two limits apply. The 2019 guidance says its interpretations extend only to business models with the same key facts, and that a developer exempt for creating software can still be a money transmitter if it also uses the software to accept and transmit value. So it is not a blanket exemption for every self-custody product. And the rules keep changing, so the primary documents linked here are worth rechecking for newer versions.

Fees and day-to-day convenience

The SEC bulletin notes that cold-wallet hardware typically costs money to buy, hot wallets may initially be free, and sending crypto usually involves transaction fees in either case. For custodians, the bulletin suggests asking about annual asset-based fees, transaction fees, fees to transfer assets out, and fees to open or close the account; these vary by provider and are set out in its fee disclosures.

Convenience points the other way. A custodian offers password resets, support, fiat deposits and integrated trading. Self-custody offers none of that but works without permission from any company. The SEC bulletin lists questions for self-custody too: whether you are comfortable setting up and maintaining a wallet, and whether you want sole responsibility for it.

Middle options between the two

Several designs split control instead of giving it wholly to a company or to one person. Whether they count as custodial depends on who can move funds alone.

Multisig with a co-signer service. A transaction needs more than one key. FinCEN's guidance says a provider that only creates unhosted wallets which require a second authorization key, in addition to the owner's, to complete transactions is not a money transmitter, because it does not accept and transmit value. The same section says a provider becomes a money transmitter if it also acts as a hosted-wallet provider, records the value as an entry in its own accounts, leaves the owner without direct interaction with the payment system, or keeps total independent control of the value, whatever label it uses. Recovery depends on the key count: if the service holds one of two keys and both are needed, its outage blocks you; a setup such as two-of-three in which you hold two keys lets you act without it.
MPC (multi-party computation) wallets. The signing key is designed never to be assembled in one place. NIST describes threshold cryptography as computing a cryptographic operation in a distributed manner while the private key is secret-shared across various parties. Which parties hold shares (you, a provider, or both) determines whether the arrangement is custodial.
Smart-contract wallets with social recovery. ethereum.org's account abstraction page says ERC-4337, whose core contract was deployed to Ethereum mainnet on March 1, 2023 without changing the core protocol, supports smart-contract wallets with custom security rules, recovery of lost access and batched transactions. Backup keys can be added and distributed among trusted people. The page also states that users still use private keys to control access, and that smart-contract wallets have been difficult to program, which account abstraction aims to simplify.

Weighing the choice

The table lists considerations, not recommendations. Many holders use both models for different purposes.

Consideration	Points toward custodial	Points toward non-custodial
Comfort with technical setup	Low: login-based access and support	High: able to maintain keys and backups
Counterparty exposure	Accepted for convenience, with the provider's terms read	Unwanted: you prefer no company between you and the coins
Need for recovery help	High: a reset process matters	Low, or covered by a hybrid design
Fiat on-ramp and frequent trading	Integrated bank links and order books	Typically requires moving coins to a venue first
Privacy from the provider	Identity verification is standard	No account relationship with the wallet software
Who bears the risk of loss	You accept the provider's security, terms and solvency	You accept responsibility for your own keys, device and backup

Frequently asked questions

Did the SEC's SAB 122 make custodial holdings safer for customers?

Staff Accounting Bulletin 122, issued January 23, 2025, rescinded the earlier guidance (SAB 121) on how entities record obligations to safeguard crypto assets for platform users. Such entities now decide whether to recognize a liability for risk of loss, using standard loss-contingency accounting. It changes how companies report; the bulletin does not address customers' legal rights in a bankruptcy.

Is a wallet app non-custodial just because it says so?

The test is who controls the private keys, not the label. The SEC's investor alert on crypto asset securities (March 2023) warns that people who deposit crypto with a platform might cease to have legal ownership of it, and to be wary of claims such as that you always retain ownership of your crypto assets or can withdraw them whenever you like. Account terms and the custodian's disclosures are the place to check who holds the keys.

Does a custodian have to keep my coins separate from its own?

Not everywhere. The SEC bulletin notes that some custodians commingle assets to reduce costs, and some use deposits as collateral, and suggests finding out whether consent is required. New York-licensed or chartered custodians fall under the state regulator's separation requirement described above.

Can I move coins from a custodian to my own wallet?

Whether and how a platform allows withdrawals to an outside address is set by its own terms, including supported assets and fees. The SEC's 2023 alert notes that some crypto entities have suspended customers' ability to withdraw, which is why the terms are worth reading before depositing. A small test transfer is a common way to confirm that an address and a withdrawal route work.

Can a smart-contract wallet recover access without a seed phrase?

That is one of the designs' stated purposes: ethereum.org lists recovery of lost access among the features account abstraction enables. The recovery rules are set when the wallet is created, for example which backup keys or trusted parties may act, so the setup deserves the same care as a seed phrase backup.

Checklist before choosing

Write down who can move the coins alone: you, a company, or several parties together.
For a custodian, read the account terms on ownership, commingling and collateral use, and note whether it is state-licensed or chartered and what disclosures it publishes.
For self-custody, test the backup by restoring a small amount before moving a larger one.
Decide in advance what happens if you are unavailable or locked out, and whether a hybrid design covers that.
Keep the amount held in each place proportionate to how much loss of access you could tolerate there.