Any institution dealing with digital assets faces a persistent compliance challenge: how to manage transactions involving unhosted wallets when regulators have yet to provide clear guidance on specific obligations? As customer demand for crypto services intensifies, the question of hosted versus unhosted wallets has moved from theoretical to operational urgency.
This article explains the distinction between hosted and unhosted wallets, examines the current regulatory landscape in major jurisdictions, and describes several approaches institutions can take to manage their risks while supporting hosted and unhosted wallet transactions.
What is a hosted wallet?
Hosted wallets, also called custodial wallets, involve a third party holding the private cryptographic keys on behalf of the user. This is usually an exchange like Coinbase or a specialist custodial service.
Hosted wallets operate analogously to traditional bank accounts, with a known and regulated entity responsible for custody of assets and maintaining beneficial ownership records.
What is an unhosted wallet?
Unhosted wallets, also known as self-hosted, non-custodial, or private wallets, place private key management directly in the hands of the user, without intervention from an intermediary.
The wallet owner maintains full control over their cryptographic keys and, by extension, their digital assets. No third party may restrict access, freeze funds, or provide transaction history to regulators or law enforcement without the cooperation of the owner.
The History of Hosted and Unhosted Wallets
From a historical perspective, unhosted wallets align with the fundamentals of cryptocurrency: peer-to-peer transactions without trust and without intermediaries. They remain an integral part of the ecosystem, particularly for users who prioritize financial sovereignty or hold significant stakes where counterparty risk outweighs self-preservation risk.
Nonetheless, as exchanges grew and institutional custody solutions emerged, hosted wallets became more prevalent for retail users seeking convenience and reduced self-custody risk. The distinction is operationally important because hosted wallets provide institutions with clear counterparties, established KYC/AML processes, and regulatory frameworks designed for intermediated relationships.
Unhosted wallets present a different paradigm: pseudonymous addresses on public blockchains, no intermediaries to facilitate information exchange or traditional identity verification. That being said, public blockchains provide full transaction transparency that allows compliance teams to assess portfolio risk, track fund flows, and identify illicit exposures.
The existing US regulatory landscape in 2025
The United States maintains no specific federal guidance on how institutions should handle customer transactions involving unhosted wallets, despite intensive regulatory activity throughout 2024 and 2025.
The only comprehensive federal attempt came in December 2020, when Treasury Secretary Steven Mnuchin proposed requiring banks and money services businesses (MSBs) to collect information on counterparties for unhosted wallet transactions exceeding $3,000. But after significant industry pushback questioning technical feasibility, Treasury officially withdrew the rule in August 2024 without replacing it.
Recent regulatory developments have focused on the possibility for banks to offer cryptocurrency custody services: OCC, FDICAnd Federal Reserve all clarified at the beginning of 2025 that banks can provide custody of cryptocurrencies without prior approval from supervisory authorities. However, these frameworks related to scenarios where banks control cryptographic keys, not situations where customers transact from their own non-custodial wallets.
The banking secrecy law Travel rule creates clear obligations between regulated institutions at the $3,000 threshold. FinCEN has never clarified how these requirements apply when a counterparty is an unhosted wallet, however FATF Guidance suggests minimum standards to which institutions can refer.
US banks apply standard AML frameworks to unhosted wallet transactions in the absence of crypto-specific guidelines. However, the FATF standards and detailed frameworks implemented in the EU and Singapore provide practical reference points for managing unhosted portfolio transactions. This provides compliance templates that U.S. institutions can adapt while awaiting domestic clarification.
Practical approaches for institutions
U.S. institutions can adopt several risk-based approaches while awaiting specific guidance:
1. Risk-Based Selection Using Blockchain Analysis
Whether a wallet is hosted or not, institutions can focus on assessing portfolio risk profiles using a blockchain analytics solution such as Elliptical Lens. This approach shifts the question of “who owns this portfolio?” “what risks does this portfolio present?” »
Blockchain analysis can reveal whether a wallet has transacted with sanctioned entities, whether it has connections to darknet markets or mixing services, or whether transaction patterns are consistent with money laundering typologies.
This enables risk-based decision-making: low-risk wallets with transparent transaction histories and no links to illicit activities receive standard treatment while high-risk wallets trigger enhanced due diligence, transaction restrictions or an outright ban.
This methodology leverages the unique transparency characteristics of public blockchains. Unlike traditional finance, where counterparty risk assessment without customer cooperation is impossible, blockchain technology enables behavior-based risk assessment independent of identity verification. The complete transaction history of a wallet is publicly available and analyzable.
2. Transaction Limits and Multi-Level Monitoring
Institutions can allow customer transactions with unhosted wallets below certain thresholds with standard oversight, while requiring additional documentation or applying increased scrutiny above those thresholds. This approach balances customer access with risk management, recognizing that smaller transactions pose a lower money laundering risk while larger transactions merit additional controls.
For example, an institution may allow unrestricted withdrawals to unhosted wallets of less than $10,000 per month (relying on blockchain analytics for risk control), require enhanced due diligence and source of funds documentation for withdrawals between $10,000 and $50,000, and require verification of wallet ownership using cryptographic proof for withdrawals greater than $50,000 per month. 000 $.
This multi-tiered approach provides clarity to customers, demonstrates risk-based thinking to regulators, and maintains operational feasibility.
3. Wallet whitelist and blacklist
Institutions can maintain lists of approved and blocked wallets based on blockchain analysis, streamlining repeat transactions while systematically excluding high-risk addresses.
Whitelisting allows institutions to pre-approve self-hosted wallets that have undergone verification, whether through cryptographic proof of client ownership, analysis of transaction history demonstrating low risk, or documented business relationships. Once whitelisted, transactions with these addresses benefit from expedited processing, reducing operational friction while maintaining risk controls.
The blacklist systematically blocks wallets with confirmed illicit exposure: addresses sanctioned by OFAC, wallets associated with ransomware operations, deposit addresses on the darknet market or wallets displaying money laundering typologies. Rather than verifying these addresses repeatedly, institutions can automatically prevent transactions, reducing the workload of the compliance team while ensuring consistent policy enforcement.
Both approaches require ongoing monitoring. Whitelisted wallets should be periodically re-examined for new illicit exposure and blacklists should be updated as new threat information emerges. However, this proactive list management creates operational efficiencies while maintaining risk controls that satisfy AML obligations.
How Elliptic helps you move toward compliance
In the absence of specific regulatory guidance, blockchain analytics offers institutions a practical compliance framework grounded in the anti-money laundering principles that regulators already expect.
With Elliptic’s filtering solutions, compliance teams can identify wallets associated with or exposed to sanctioned entities, darknet markets, ransomware operators, mixed services, and fraudulent schemes.
When a customer withdraws to or deposits from an unhosted wallet, you see the wallet’s full transaction history, illicit exposure levels, and risk categorization. This allows you to approve, escalate, or block based on an actual risk assessment rather than taking a blanket approach to all scenarios.
This is risk-based AML compliance applied to blockchain: you control counterparty wallets, assess money laundering risk and document your decisions. The difference is that blockchain transparency makes this possible without needing cooperation from the counterparty.
Banks using this approach can serve their trusted customers who transact with unhosted wallets while maintaining defensible compliance positions. In a market where regulatory clarity may still be years away, blockchain analytics is the operational solution available today.
Do you want to know how Elliptic’s blockchain analytics and compliance solutions help institutions manage unhosted wallet transactions with confidence and regulatory defense? Contact us today.
