First ask what the platform does, not what the wallet is called
Merely publishing software is a different activity from exchanging, safekeeping or executing transfers on behalf of customers. Taking the United Kingdom's current anti-money laundering regulation as an example, crypto exchange and custodial wallet businesses that fall within scope are required to register and comply with the relevant requirements; describing oneself as decentralized and charging only technology fees cannot replace an analysis of actual functions. Genuine technology products that do not touch customer business should likewise not be subjected to financial institution rules without first verifying the regulatory boundary.
Self-hosted addresses do not mean exemption from knowing both parties to a transaction
The EU Regulation on Information accompanying transfers of funds and certain crypto-assets still imposes information requirements on transfers between service providers subject to it and self-hosted addresses. Verification of control over an address above a specified amount is an additional requirement and cannot be read backwards to mean that smaller amounts require no identification of the persons involved in the transaction at all. Rules vary across jurisdictions regarding occasional transactions, ongoing business relationships and suspicious circumstances, and marketing statements that "no information whatsoever is required below a certain amount" particularly require verification.
Hypothetical scenario: privacy-friendly does not mean the platform is also unaware of identity
Assume a product allows users to display an alias to merchants, while necessary identity information is accessible only to authorized compliance personnel. This differs from a platform that does not collect required information at all and cannot respond to lawful investigations. Exposure can be reduced through field minimization, tiered permissions and encrypted storage, without publishing identity documents or residential addresses on-chain; whether third-party verification results may be relied upon depends separately on local rules and the ability to retrieve the information.
Draw real boundaries around product promises
Account-opening disclosures should explain what is collected, why it is collected, when additional documents may be required and how long information is retained. For customers who cannot satisfy necessary verification, processes for not establishing a relationship, restricting functions or exiting in accordance with law should be designed in advance, rather than promising unlimited anonymity first and then imposing additional requirements at the time of withdrawal. If a business model only works when customers can never be identified at all, the model should be reassessed first, rather than packaging identity requirements as optional.
Products should also avoid using transaction splitting to maintain an appearance of low thresholds. For the same customer, the same purpose or interrelated activities, which should be assessed together must be configured according to the applicable regime, rather than letting customers choose for themselves whether to be identified. Privacy disclosures can clearly distinguish the three purposes of platform collection, provision to partners and reporting in accordance with law, so that users know information will not be disclosed arbitrarily and that using an alias does not exempt them from necessary verification. Such a commitment is more accurate than a blanket claim of complete anonymity.
Recommended actions
- Check item by item whether claims such as "anonymous, no KYC, no records" have a basis in local law.
- Distinguish information displayed to the public from information the platform retains in accordance with law, and design access permissions accordingly.
- Before the product goes live, determine the fund-handling procedures for verification failures and customer exit.
This content is for general information only and does not constitute legal advice. Please consult a qualified lawyer about specific matters.
References
- Cryptoassets: AML / CTF regime — UK FCA
- Regulation (EU) 2023/1113, Articles 14 and 16 — European Union
