If you take custody of customer keys or can move customer funds on their behalf, you will very likely be treated as a money transmitter under U.S. law and must meet Bank Secrecy Act and state licensing obligations. Depending on the product’s features, the SEC, CFTC, and OFAC may also apply. The first moves for any team in this position are to begin FinCEN registration and build out an AML program, assess state money transmitter licensing needs, and lock down key custody while evaluating Travel Rule readiness.
TL;DR:
- Custody is determined by control over private keys and whether customer balances are tracked on an internal ledger rather than on-chain control.
- U.S. regulators like FinCEN, SEC, CFTC, and OFAC impose registration, licensing, and compliance obligations based on custody and the specific product features.
- Building a compliant AML program requires documented controls, independent testing, dedicated personnel, and detailed recordkeeping of all transaction and compliance activities.
- Custodial providers must carefully manage key security practices and documentation to influence legal custody classification and regulatory scrutiny.
- Early legal counsel and thorough documentation are crucial to navigating licensing, enforcement risks, and demonstrating compliance during regulatory examinations.
Table of Contents
- What counts as custody and why it triggers regulation
- Which U.S. regulators have jurisdiction and what they expect
- Building the core AML program custodial operators need
- The security controls that shape your legal exposure
- The realistic roadmap: sequence, timeline, staffing, and cost
- Choosing screening and Travel Rule vendors that hold up in production
- When custody crosses into securities or derivatives territory
- Where examiners and enforcement actions find trouble
- Reporting and recordkeeping beyond the SAR
- Data privacy duties that come with holding customer information
- Money transmitter licensing differences across states
- DeFi features and what they do to a custodial compliance program
- Why documentation and early counsel matter most
- How Murphy’s Law helps custodial operators stay ahead of regulators
- Sources
- FAQ
What counts as custody and why it triggers regulation
Custody is a factual question, not a marketing label. Regulators look at who actually controls the private keys, who can move or freeze funds, and whether customer balances are tracked on an internal ledger rather than reflected directly on-chain under the user’s own control. According to FinCEN’s guidance on virtual currency businesses, a person or company engaged as a business in accepting and transmitting convertible virtual currency on behalf of others is a money transmitter, while a person acting purely on their own behalf is not.
The FinCEN CVC interpretive guidance sharpens this further by distinguishing hosted wallets, where a provider holds the keys, from unhosted wallets, where the user retains full control. The FinCEN CVC guidance applies a four-factor test: who owns the value, where it is stored, how the arrangement interacts with the payment system, and who actually controls the funds. Hosted wallet providers typically qualify as money services businesses under this test.
Several structures create custody exposure even when the product markets itself as non-custodial:
- Multi-sig setups where the provider holds one of the required keys, since that key can block or authorize withdrawals even without full unilateral control.
- Non-custodial front-ends layered over a custodial backend, a pattern that does not change the underlying custody analysis.
- Admin keys with freeze, pause, or upgrade authority, which can convert a technically non-custodial contract into a custodial relationship in practice.
A short self-audit question works for most teams: could your company, acting alone, move or block a customer’s funds without that customer’s separate signature? If yes, plan for custodial treatment.
Which U.S. regulators have jurisdiction and what they expect
Custodial wallet operators sit at the intersection of several regulatory regimes, and the obligations stack rather than substitute for one another.
- FinCEN and the Bank Secrecy Act: money transmitters must register as an MSB and build a BSA-compliant AML program, per FinCEN’s regulatory guidance.
- State money transmitter licensing: most states require a separate license for businesses that transmit value on behalf of customers, and a national custodial product often means dozens of parallel applications with different documentation, bonding, and net worth requirements.
- The SEC: when the tokens held in custody function as securities, custody itself can implicate broker-dealer or qualified custodian rules, an area the SEC’s Crypto Task Force has flagged as an enforcement priority.
- The CFTC: operators offering derivatives, margin, or leveraged products on top of custodial wallets may need futures commission merchant registration regardless of how the custody itself is structured.
- OFAC: sanctions screening is a freestanding obligation layered on top of AML duties, requiring custodial operators to screen counterparties and wallet addresses against sanctions lists before and during transactions.
None of these regimes are optional add-ons. A custodial wallet that skips state licensing because it has FinCEN registration, or skips sanctions screening because it has a KYC program, is building a compliance gap that examiners find quickly.
Building the core AML program custodial operators need
A defensible AML program rests on five pillars, and each needs a crypto-specific implementation rather than a template borrowed from traditional banking.
- Internal controls: written policies that map directly to how your wallet actually moves funds, including thresholds for manual review.
- Independent testing: a periodic, arms-length review of the program’s effectiveness, not just its paperwork.
- A designated compliance officer: someone with real authority to halt transactions and escalate concerns.
- Ongoing training: role-specific, covering engineers who build transaction logic as well as staff who review alerts.
- Customer identification and due diligence: Customer Identification Program checks at onboarding, with Customer Due Diligence and Enhanced Due Diligence for higher-risk accounts such as those with high transaction velocity or exposure to sanctioned jurisdictions.
Suspicious Activity Reports and Currency Transaction Reports remain the backbone of ongoing monitoring, and both require accurate, timestamped recordkeeping that ties back to specific wallet addresses and customer identities. Governance documents, including a written AML policy, sanctions policy, and incident response plan, should be version-controlled and reviewed at least annually.
Pro Tip: Keep a single change log that ties every policy update to the regulatory driver behind it. Examiners read program maturity through documentation history, not just current policy text.
The security controls that shape your legal exposure
Legal custody characterization and technical architecture are more connected than most teams assume. The choices you make about key management do not just affect security, they affect how a regulator or a court reads your custody relationship with customers.
- Hardware security modules versus threshold signature schemes: HSMs isolate keys in tamper-resistant hardware, while TSS distributes signing authority across multiple parties so no single party holds a complete key. Applied research on crypto key custody architecture treats both as baseline components of a defensible custody setup.
- Quorum policies and offline backups: requiring multiple approvers for high-value withdrawals, paired with air-gapped backup storage, reduces both theft risk and the odds that a single compromised employee can move funds unilaterally.
- Key rotation and separation of duties: no individual should hold both the ability to initiate and approve a withdrawal.
- Privileged access management and forensic logging: every key-related action needs an audit trail detailed enough to reconstruct an incident after the fact.
A custodial wallet’s admin key that can freeze or redirect user funds strengthens the case that the provider, not the user, controls the asset, which is precisely the control test FinCEN applies when deciding MSB status, according to the FinCEN CVC interpretive guidance. SOC 2 attestations, independent penetration testing, and dedicated key custody audits round out the picture examiners and counterparties expect to see before they will trust a wallet’s controls.
The realistic roadmap: sequence, timeline, staffing, and cost
Most operators get the order wrong by trying to license before the program exists to support the license application.
- Register with FinCEN as an MSB as soon as the custody trigger is confirmed, since this is a prerequisite for most state applications.
- Build the AML program, including written policies, a named compliance officer, and initial staff training, before submitting state paperwork.
- Integrate screening and Travel Rule vendors so the technical infrastructure matches what the written policies describe.
- File state money transmitter license applications, sequenced by where the largest customer bases sit, since multi-state approval timelines rarely align.
- Commission independent testing once the program has been live long enough to generate a real transaction history to test.
Staffing typically includes a dedicated compliance officer, one or more AML analysts to work alerts, security engineers responsible for key management, and outside legal counsel for licensing filings and regulatory interpretation. Many early-stage operators outsource parts of this to specialized consultants rather than building every function in-house from day one.
Budgets vary sharply by scale. A money transmitter license filing in a single state carries its own fees and bonding requirements, and a multi-state footprint multiplies both the cost and the timeline. Vendor fees for screening and Travel Rule tools, independent audits, and compliance insurance add further recurring cost on top of licensing.
Choosing screening and Travel Rule vendors that hold up in production
Blockchain analytics providers assign risk scores to wallet addresses and counterparties, which feed directly into whitelisting, blacklisting, and escalation decisions. Elliptic’s analysis of hosted versus unhosted wallets recommends threshold-driven risk scoring as a practical framework where explicit U.S. guidance is thin, particularly for transactions touching unhosted wallets.
Travel Rule compliance runs on a parallel track. FATF Recommendation 16 requires virtual asset service providers to exchange originator and beneficiary information above set thresholds, and the FATF virtual assets guidance is the basis for the IVMS-101 data standard most vendors now use. Ripple’s Travel Rule documentation shows a working integration pattern with Notabene, running screening and Travel Rule checks in parallel and routing outcomes to auto-approve, flag, or reject.
- Data coverage: does the provider track the specific chains and assets your wallet actually supports?
- Latency: can risk scoring complete inside your transaction execution window without stalling users?
- Encryption and PII handling: does the vendor support both plaintext submission with vendor-side encryption and pre-encrypted submission?
- Integration effort and cost: how much engineering time does onboarding actually require, and what does the vendor charge at your expected transaction volume?
Pro Tip: Log every screening and Travel Rule decision, including the automated outcome and any manual override, so you can reconstruct the reasoning behind any single transaction months later.
When custody crosses into securities or derivatives territory
Custody obligations escalate sharply the moment the assets held look like securities or the product looks like a derivative, regardless of how careful the wallet’s technical custody design already is.
- Howey factors and token design: tokens sold with an expectation of profit tied to a common enterprise can implicate securities law, and custody of those tokens raises the question of whether the operator needs broker-dealer or qualified custodian treatment, an area the SEC’s Crypto Task Force is actively watching.
- Leveraged and derivative products: offering margin, futures, or other leveraged exposure on top of a custodial wallet can trigger CFTC registration requirements as a futures commission merchant, independent of the custody model underneath.
Operators facing either scenario should narrow product scope where possible, give customers clear disclosures about what they actually hold, and bring in counsel before launch rather than after a regulator asks questions. Partnering with an already-registered broker-dealer or FCM for the securities- or derivatives-adjacent piece of a product is often faster than building that registration internally.
Where examiners and enforcement actions find trouble
Enforcement patterns in this space tend to repeat, which makes remediation priorities fairly predictable.
- Program-level gaps: an AML program that exists on paper but lacks independent testing, or a KYC process too thin to catch obvious red flags.
- Missing reports: SARs that should have been filed based on transaction patterns but were not, often because alert thresholds were never tuned.
- Operational red flags: admin keys concentrated with one person, incomplete transaction logs, or sanctions screening that runs inconsistently across products.
- Registration missteps: operating as a money transmitter without FinCEN registration or the required state licenses, or mischaracterizing a custodial product as non-custodial to avoid the obligation entirely.
Pro Tip: Treat every examiner request for documentation as a preview of litigation discovery. If a document looked bad produced under subpoena, fix the underlying practice now rather than the document later.
Remediation usually starts with a documented gap analysis against BSA and state requirements, followed by evidence that the fix was implemented and tested, not just written down.
Reporting and recordkeeping beyond the SAR
SARs and CTRs get the most attention, but custodial wallet operators carry recordkeeping duties that extend well past those two report types. Transaction records, customer identification documents, and the underlying due diligence files that supported each account opening decision need to be retained in a format that can be searched and produced quickly if an examiner or a court asks.
Retention periods for BSA-related records are commonly measured in years rather than months, and state money transmitter regulators frequently layer their own retention rules on top of federal requirements, so the safer practice is to retain the longer period rather than the shorter one when the two frameworks diverge. Records should be stored in a format that survives a platform migration or vendor change, since a compliance file that only exists inside a discontinued tool is effectively no record at all.
Beyond the transaction ledger itself, operators should retain screening decisions, Travel Rule message logs, and any manual override of an automated flag, tied to the specific transaction and reviewer. This is where the reporting obligation and the security logging discussed earlier overlap directly: a well-designed audit trail satisfies both purposes at once. Teams building this out from scratch often find it easier to work from an existing compliance recordkeeping checklist than to reconstruct requirements section by section.
Data privacy duties that come with holding customer information
Taking custody of customer funds means taking custody of a substantial amount of customer data as well, and that data carries its own separate compliance obligations under U.S. law. The Gramm-Leach-Bliley Act imposes privacy notice and safeguarding requirements on financial institutions, and custodial wallet operators handling nonpublic personal information often fall within its scope depending on how their services are structured and which regulator has jurisdiction over them.
State privacy laws add another layer, and they are not uniform. Several states now require specific breach notification timelines, data minimization practices, or opt-out rights for certain categories of personal information, and a custodial operator serving customers nationally needs to track which state’s rules apply to which customer rather than assuming one policy fits every jurisdiction.
Practically, this means the same KYC and CIP records that satisfy BSA obligations become sensitive data holdings that need their own access controls, encryption standards, and breach response plan. A data privacy policy should be written and reviewed alongside the AML policy, not treated as a separate compliance track handled by a different team with no visibility into what the compliance program actually collects.
Money transmitter licensing differences across states
State money transmitter licensing is where a national custodial wallet product runs into the most friction, because there is no single federal license that substitutes for state-level approval. Requirements for net worth, surety bonding, permissible investments, and reporting cadence differ from state to state, and a company operating nationally can end up managing dozens of separate regulatory relationships simultaneously.
Some states also enforce more aggressively than others, and examination priorities shift depending on which state regulator is reviewing the file. A custodial operator that treats licensing as a one-time filing exercise rather than an ongoing relationship tends to fall behind on renewal deadlines, bonding updates, and periodic reporting that many states require after the initial license is granted.
The practical answer is sequencing: prioritize the states where the largest share of customers actually reside, build a compliance calendar that tracks every state’s renewal and reporting dates separately, and treat any multi-state expansion as a project with its own timeline rather than an afterthought bolted onto the AML program. Teams weighing which states to prioritize first often benefit from a detailed breakdown of state and federal licensing issues before committing engineering and legal resources to a specific rollout order.
DeFi features and what they do to a custodial compliance program
Custodial wallet operators increasingly bolt on DeFi features such as staking, lending, or swap integrations, and each of these can quietly reintroduce custody risk even when the underlying protocol markets itself as decentralized. If your wallet routes customer funds into a DeFi protocol on the customer’s behalf, or holds the keys that interact with that protocol, the custody analysis discussed earlier still applies to your side of the transaction regardless of how the protocol itself is structured.
The compliance challenge is that DeFi protocols rarely offer the same KYC, screening, or Travel Rule infrastructure that centralized counterparties do, which means a custodial wallet integrating with DeFi has to build its own compliance layer around a protocol that was not designed with one. Screening tools like those described earlier still apply to the wallet addresses involved, but the operator carries more of the compliance burden than it would in a wallet-to-wallet transfer between two regulated VASPs.
Operators exploring DeFi integrations should treat every new protocol connection as its own risk assessment: what does the protocol actually do with customer funds, does the operator retain any control once funds enter the protocol, and does the integration change the custody characterization discussed in the first section. A practical roadmap for DeFi compliance is worth reviewing before any DeFi feature reaches production, since retrofitting compliance controls after launch is considerably harder than designing them in from the start.
Why documentation and early counsel matter most
Litigating crypto enforcement and fraud recovery cases teaches a consistent lesson: the operators who fare best are the ones who can produce a clear, contemporaneous record of every compliance decision they made and why. Regulators and courts reward documented judgment, not perfect hindsight.
The practical recommendation is simple. Document every material compliance decision as it happens, retain vendor integration records including screening and Travel Rule logs, and keep independent testing current rather than treating it as a box to check once a year. That discipline is what separates a defensible program from one that only looks defensible until someone asks hard questions.
— Mark
How Murphy’s Law helps custodial operators stay ahead of regulators
Building a defensible custodial compliance program, or defending one under regulatory scrutiny, is faster with counsel who has litigated the cases that shape how these rules get enforced. Some law firms work with crypto businesses on compliance program design, licensing strategy, and regulatory defense, drawing on courtroom experience in matters involving Celsius, Terraform Labs, and BitMEX.
The right time to engage counsel is before a license window closes, before an enforcement notice arrives, or before a complex vendor integration goes live, not after. If your team is weighing custody design decisions or preparing for a licensing push, Murphy’s Law’s crypto compliance consulting services are built for exactly that stage.
This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.
Sources
- Application of FinCEN’s Regulations to Persons Administering, Exchanging, or Using Virtual Currencies (FinCEN)
- FATF — Virtual Assets and VASP Guidance
- Hosted vs unhosted wallets: Compliance risks and practical solutions — Elliptic
FAQ
Can the IRS know about a self-custody crypto wallet?
The IRS can identify self-custody wallet activity through blockchain analysis and information exchanges with exchanges that report customer transactions. Wallets themselves are pseudonymous, not anonymous, and transactions that touch a regulated exchange or custodial service typically become traceable to an identity.
Can you lose crypto held in a non-custodial wallet?
Yes. A non-custodial wallet puts full responsibility for key security on the holder, so a lost seed phrase, a compromised device, or a phishing attack can result in permanent loss with no custodian to recover the funds on your behalf.
Can the FBI track a Bitcoin wallet?
Federal investigators, including the FBI, use blockchain analytics tools similar to those described in this guide to trace Bitcoin transactions across public ledgers and link wallet addresses to real-world identities through exchange records and other data sources.
Can the government seize cryptocurrency from a wallet?
Yes, when law enforcement obtains a court order tied to a criminal investigation or civil forfeiture action, and the practical ability to execute that seizure typically depends on whether the funds sit with a custodial service that can comply or in a wallet the target still controls.
What is the difference between custodial and non-custodial wallet compliance?
Custodial wallet providers generally carry money transmitter, AML, and licensing obligations because they hold customer keys and control fund movement, while non-custodial wallet software that never takes control of customer keys generally falls outside that same regulatory framework.