“Being able to sign” does not mean “the money comes from a lawful business”
A signature challenge or a small-value verification transaction can help determine whether a person can operate an address, but it cannot on its own prove who ultimately owns the assets, still less explain the prior source of funds. A corporate wallet may also be controlled by employees, trustees or multiple persons jointly. Wallet whitelisting therefore needs to be combined with corporate authorization, personnel changes and the purpose of the transaction; it cannot be that once a verification is completed, the wallet is cleared forever.
Verification methods must match the applicable rules and wallet technology
The EU Transfer of Funds Regulation requires regulated service providers, for relevant transfers to self-hosted addresses exceeding EUR 1,000, to assess whether the address is owned or controlled by the corresponding customer; the EBA guidelines list signature, verification transaction and other optional methods. This is an EU-specific rule, not a globally uniform requirement. Addresses of multisignature, smart contract wallets or custodial platforms may not be verifiable by the same method, and appropriate alternatives and manual review should be available, rather than inducing customers to hand over private keys or seed phrases.
Hypothetical scenario: new risks may also arise for whitelisted wallets
Assume a customer has previously paid only from a verified wallet, and one day that wallet receives a large amount of assets inconsistent with its business, followed by an immediate request to exchange and remit them. The wallet's own rules are still satisfied, but the transaction background has changed. The platform should assess the matter in light of the fund path, the customer's explanation and the order materials; on-chain risk labels may serve as leads, but the customer should not be characterized as unlawful without verification.
Risk analysis should also take into account that a customer may receive unsolicited small-value transfers. A remote association involving only a very small amount should not be indiscriminately equated with directly receiving clearly high-risk funds. As an internal assessment method, the platform may record the association path, the proportion of the amount, the timing and whether the customer can explain it, and where necessary check the source of the label with the tool provider. The platform should not assure customers that all coins are absolutely clean, nor should it treat an automated label lacking context as the sole reason for permanently refusing service.
Product rules should cover exceptions and misjudgments
First decide whether to accept withdrawals from exchanges, payments by group companies and operations by authorized employees, and then list the acceptable evidence for each scenario. Otherwise, a normal customer withdrawing funds from an exchange custodial account may be wrongly rejected because no “personal dedicated on-chain address” can be seen. Sources that cannot be explained should be handled under the risk process with a record retained; for assets received in error, a return path should also be designed within the lawful scope, and they must not be automatically sent back to a suspicious source address without assessment.
Recommended actions
- List the supported wallet types and the corresponding verification methods, and do not request private keys or seed phrases.
- Keep records of address whitelisting separate from account authorization and source-of-funds review.
- Establish exception approval and review procedures for exchange withdrawals, corporate multisignature arrangements, and anomalous incoming credits.
This content is for general information only and does not constitute legal advice. Please consult a qualified lawyer about specific matters.
References
- Regulation (EU) 2023/1113, Articles 14 and 16 — European Union
- Travel Rule Guidelines（EBA/GL/2024/11） — European Banking Authority (EBA)
