No regulator decides this on the word "non-custodial". Two written tests do. FinCEN asks whether you have total independent control over the value. MiCA asks whether you are safekeeping or controlling the crypto-assets or the means of access to them, private keys included. The second is wider, so one architecture can pass in Washington and fail in Brussels.
Three written tests, and what each one asks
Wallet vendors write about key shares, hot and cold storage and recovery UX. Regulators write about who can move the coins.
Key takeaways
- FinCEN's 2019 guidance turns on four criteria, the last being "whether the person acting as intermediary has total independent control over the value".
- MiCA Article 3(1)(17) defines custody as "the safekeeping or controlling, on behalf of clients, of crypto-assets or of the means of access to such crypto-assets, where applicable in the form of private cryptographic keys".
- FinCEN says a provider with total independent control over the value is a money transmitter "regardless of the label the person applies to itself or its activities".
- In Switzerland, holding several clients' payment tokens in your own wallets — collective custody — is what reaches banking law rather than stopping at an SRO.
What does a regulator mean by custody?
Control, not possession. MiCA Article 3(1)(17) defines providing custody and administration of crypto-assets on behalf of clients as "the safekeeping or controlling, on behalf of clients, of crypto-assets or of the means of access to such crypto-assets, where applicable in the form of private cryptographic keys". Two words do the work: controlling, which sits beside safekeeping rather than under it, and means of access, which is not the asset itself.
Recital 83 removes the obvious escape route: the service "could include the holding of crypto-assets belonging to clients or the means of access to such crypto-assets, in which case the client might keep control of the crypto-assets in custody". A client still holding a key does not, by itself, put the arrangement outside the definition. Defined terms are in the glossary.
Does calling a wallet non-custodial keep it out of scope?
Not on its own. The label is not the test; the access you hold is. A promise to act only on the owner's instruction is not a reduction in control, and MiCA reaches the means of access whatever the product is called. FinCEN's 2019 guidance on convertible virtual currency business models ends its multiple-signature discussion with a sentence aimed at product labels:
"the provider will also qualify as a money transmitter, regardless of the label the person applies to itself or its activities" — FinCEN, FIN-2019-G001, section 4.2.2
It is equally blunt about contracts. In a hosted wallet, it says, "the host has total independent control over the value" — and the same sentence adds that this holds although the host is contractually obligated to access the value only on the owner's instructions.
Singapore wrote the no-possession case into scope rather than out of it. From 4 April 2024, facilitating the transmission or exchange of digital payment tokens is regulated "even where the service provider does not come into possession of the moneys or DPTs". The same logic governs trading venues, mapped in which licence a crypto exchange needs.
Multisig co-signing: who has total independent control?
FinCEN gives four criteria: "(a) who owns the value; (b) where the value is stored; (c) whether the owner interacts directly with the payment system where the CVC runs; and, (d) whether the person acting as intermediary has total independent control over the value". Criterion (d) is the line, and MiCA's sits further out.
Four builds, and how FinCEN and MiCA each read them
| Build | What the firm holds | FinCEN (2019 guidance) | MiCA Art 3(1)(17) |
|---|---|---|---|
| Hosted wallet, firm holds the keys | Full access | Money transmitter: the host "has total independent control over the value" | In scope |
| 2-of-2 multisig, user one key, firm co-signs | One authorisation key | Not a money transmitter, "because it does not accept and transmit value" | Arguable case by case: the text reaches controlling the means of access |
| Co-signing key plus a hosted account | Key and balance | Combining the two "will then qualify as a money transmitter" | In scope |
| Software wallet, keys only on the user's device | Nothing | Not an intermediary: the firm holds no key, and the owner interacts with the payment system holding total independent control | Out of scope, absent recovery or override paths |
Row two is the one no wallet vendor writes about. A co-signing service FinCEN expressly excludes is not automatically excluded by MiCA, which never qualified the word controlling with total or independent. Firms that read a US conclusion into a European filing tend to discover this after the application has gone in.
Switzerland: when does holding client keys reach banking law?
When several clients' tokens sit in wallets you control. The anti-money-laundering layer is what an SRO answers: FINMA's cryptoassets fact sheet states that "offering custody, exchange, trading and payment services with payment tokens falls under the Anti-Money Laundering Act", which is what the Swiss SRO application process addresses.
The same fact sheet goes past that layer: "providers of custody or trading activities with payment tokens may need to be licensed as a bank", and it names the trigger — "The same applies to providers who hold payment tokens from several clients in their own wallets (collective custody)." Omnibus versus per-client is not an operations preference here; it selects the licence.
The same fact sheet leaves a lighter door open: "since the FinTech licence was introduced, a banking licence is no longer mandatory for such activities". The FinTech licence "allows institutions to accept public deposits of up to CHF 100 million or cryptobased assets, provided that these are not invested and no interest is paid on them" — and it carries a disclosure founders miss: in bankruptcy, "client assets are neither privileged nor protected by deposit protection, which future clients must be informed about". What the proposed crypto-institution licence would change is covered in the Swiss crypto-institution draft.
Singapore: in scope even without possession
Singapore closed this question on 4 April 2024, bringing the "Provision of custodial services for DPTs" inside the Payment Services Act, together with facilitation of DPT transmission and exchange with no possession, and of cross-border transfers where no money is received in Singapore.
The transition was time-boxed. Firms already carrying on the newly regulated activities "must notify MAS within 30 days, and submit a licence application within six months from 4 April 2024" to continue on a temporary basis, with an external auditor's attestation report due within nine months. MAS was explicit about the alternative: "Entities that do not fulfil the requirements above are required to cease the activities when the amendments come into effect."
What a custody permission then obliges you to do
Segregation, records, statements, and a responsibility you cannot subcontract. MiCA Article 75(7) requires a provider to "segregate holdings of crypto-assets on behalf of their clients from their own holdings and ensure that the means of access to crypto-assets of their clients is clearly identified as such".
The same paragraph puts those holdings beyond the firm's own creditors, "so that creditors of the crypto-asset service provider have no recourse to crypto-assets held in custody by the crypto-asset service provider, in particular in the event of insolvency".
Three duties get underestimated. Article 75(5) requires a statement of position "at least once every three months and at the request of the client concerned". Singapore's safeguarding rules require "segregating customers' assets" into a trust account. And delegating custody abroad does not delegate the question — FINMA's Guidance 01/2026 extends the Swiss treatment to a foreign custodian only "provided that equivalent conditions are met, i.e. if the foreign third-party custodian is also subject to prudential supervision and the foreign law guarantees bankruptcy protection for the cryptobased assets held in custody". What that means on the ground is in local substance requirements.
Frequently asked questions
Is a self-custody wallet app a regulated activity?
On the wording of MiCA Article 3(1)(17), a firm that neither safekeeps client crypto-assets nor controls the means of access to them is outside the custody definition, and in FinCEN's analysis the owner interacts with the payment system directly and holds total independent control. Recovery features, admin overrides and sponsored transactions can change that answer, because the test is the access you actually hold.
Does holding one MPC share make us a custodian?
It depends on what that share can do alone. FinCEN states that a provider adding only a second authorisation key to an unhosted wallet "is not a money transmitter because it does not accept and transmit value", but that combining this with a hosted wallet "will then qualify as a money transmitter". FinCEN wrote that about multiple-signature wallets, where the provider holds a second key; it does not address MPC threshold signing, so the question is whether the shares you hold can produce a signature without the client. MiCA reaches controlling the means of access without the words total or independent, so the European answer is argued case by case.
Can we outsource custody to a licensed third party and avoid the question?
You move the operation, not the question. FINMA Guidance 01/2026 applies the Swiss treatment to a foreign custodian only where "the foreign third-party custodian is also subject to prudential supervision and the foreign law guarantees bankruptcy protection for the cryptobased assets held in custody". Under MiCA, the segregation and creditor-remoteness duties in Article 75(7) stay with the authorised provider.
Before you file
This page reports the wording of published regulatory documents; it is not legal advice and does not replace a review of your own architecture. Before choosing a jurisdiction, write down whether any key, share or permission you hold can move funds without the client, whether balances are per-client or omnibus, and every recovery or override path in the product. CryptoLicense is the licensing advisory brand of CL GLOBAL SDN BHD (1421939-T), in business since 2020, 100+ companies served across 10+ jurisdictions — see entity proof and our jurisdictions page. Fiat balances and card products run on a different rulebook, in stablecoin payments and card issuing. No application can be guaranteed; every regulator keeps its own discretion.
Part of a series: the full guide is at licence selection.