Break down the actions behind the exchange button item by item
A wallet may only display links to third-party tools, or it may automatically compare quotes, receive users' trading intentions, transmit orders to counterparties, or even execute trades with its own funds. The interface may look similar, but to whom the customer purchases what service may be entirely different. Article 3 of the EU's MiCA lists exchange, order execution, reception and transmission of orders, and transfer on behalf of clients as separate service categories; it is not enough to merely verify whether private keys are held.
For cross-chain, distinguish information tools from actual transfer arrangements
Cross-chain may include locking assets on the original chain, acquiring assets on another chain, and using liquidity providers for exchange. During review, it should be confirmed whether the platform can select the bridge or route, set the receiving address, control contract upgrades, and decide how assets are returned after a failure. Automatic code execution does not mean there is no operator involvement, nor does it prove that the wallet operator is necessarily subject to regulation; its actual role must still be examined.
The payment regulatory scope of Singapore's MAS expressly includes certain transmission and exchange-facilitation activities that do not hold funds or tokens. In the EU, ESMA Q&A also states that a transfer service meeting the definition will not avoid authorization requirements merely because it is embedded in other business. Therefore, "no custody" or "cross-chain is merely a back-end step" is not sufficient to end the analysis directly.
A third-party statement cannot cover two entirely different products
Assume Wallet A has users actively leave the application, independently choose and contract with a third party; Wallet B provides a final quote on its own exchange page, deducts fees, and promises arrival, and even if it calls an external protocol at the underlying level, B's service still needs to be re-analyzed. A is not necessarily exempt from regulation, and B does not necessarily fall within a particular license merely because it charges fees; this comparison shows that the user relationship, instructions, and commitments are more important than disclaimers on the page.
If the product retains a "best quote" or automatic routing function, it should also explain the scope of comparison, the source of fees, and failure handling. It cannot be assumed that the recommended route is the risk level the user wants, nor can the risks of bridge attacks, expanded slippage, or lack of support on the target chain all be hidden in technical terms.
Before expanding functions, review both access and risk disclosure
It is recommended to first map out the entities and asset paths for each route, identify licenses, customer authorization, and fault liability, and then decide whether to integrate. Testing should include timeouts, partial completion, duplicate requests, and refunds, not just successful exchanges. Re-review should also be conducted when adding new protocols or changing default routes, to avoid the initial pure-display model becoming a wallet that substantively provides complete trading services through continuous iteration.
Action recommendations
- Record quotes, orders, signatures, routing, and delivery responsibilities item by item.
- Verify asset control, upgrade and refund permissions across each chain and third-party protocol.
- Review exchange, order services and transfer on behalf of clients separately by target jurisdiction.
- Test cross-chain timeouts, partial completion and duplicate execution, and specify the user notification method.
This content is for general information only and does not constitute legal advice. Please consult a qualified lawyer about specific matters.
References
- MiCA Article 3: Definitions — EU regulations / ESMA official rulebook
- ESMA Q&A 2071 — ESMA / European Commission responses
- MAS expands the scope of regulated payment services — Monetary Authority of Singapore (MAS)
