Free tools Windows power users keep installed
One-click scans. No signup required.
Don’t rely on an app’s “non-custodial” label. Find out where each asset is held, who controls the account or private keys, and exactly what the service can do—including whether it can withdraw or transfer assets without your separate approval. A service may not hold your assets itself yet still have broad authority over them or connect to a separate custodian, exchange, wallet, or smart contract.
Start by identifying what “non-custodial” means for your assets
The answer can differ by asset type and account arrangement. An automation service might trade conventional securities through a brokerage account, connect to an exchange using an API, or interact with a crypto wallet or smart contract. If it handles more than one kind of asset, verify each arrangement separately.
As an Amazon Associate I earn from qualifying purchases.
For a securities account, the key questions are who holds the account, whose name is on it, and what authority the service has. The SEC describes investment-adviser custody as holding client funds or securities directly or indirectly, or having authority to obtain possession of them. Its guidance treats withdrawal authority as a significant indicator and distinguishes authorized trading from broader powers to dispose of assets. Read the SEC’s custody guidance.
For crypto, focus on private-key access and transaction signing. With self-custody, you control access to the keys and are responsible for securing them; a third-party custodian manages that access. A public address lets others send assets to you or verify transactions, but it does not authorize transactions. The SEC’s crypto custody bulletin explains the distinction and the risks of each approach.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Can the service withdraw or move your money?
Read the permission itself, not just the name the provider gives it. “Read only,” “trade only,” and “non-custodial” are not enough to establish what an authorization allows.
For a brokerage account
Request the account-opening documents, advisory agreement, power of attorney, and any standing authorization. Check the custodian’s legal name, whose name appears on the account, and whether the custodian sends statements directly to you. The SEC says advisers with custody generally must use a qualified custodian, subject to limited exceptions, and should tell clients which custodian holds the assets and how they are held. The SEC bulletin lists investor checks.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Then determine whether the service can only submit trades in your account or can also withdraw cash or securities, change destination instructions, write checks, or dispose of assets beyond authorized trading. If the written agreement is vague, ask the provider and custodian to explain the specific permissions in writing.
For an exchange API or crypto wallet
Inspect the actual scopes in the exchange account and the permissions shown by the wallet or smart contract. Find out whether the service can transfer assets to an address it chooses, whether you must separately approve each transfer, and whether you can revoke access yourself. For wallets, check contract approvals, delegated operators, transaction-signing steps, and any administrator or upgrade powers. The exact controls differ by product, so verify them in that platform’s own documentation and interface.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Who controls the crypto keys and transaction signing?
Ask who generated the private keys, where they are stored, who can access encrypted or decrypted key material, and who can sign or co-sign transactions. If a provider or associated service can access key material or authorize transactions, establish precisely what that access permits; a wallet interface alone does not prove that the arrangement is self-custodial.
In an April 13, 2026 staff statement, SEC Trading and Markets describes a self-custodial wallet, for the specified activity covered by that statement, as one where neither the wallet provider nor its associated covered interface has custody of or access to the user’s encrypted or decrypted private key. The statement concerns certain interfaces preparing user-initiated transactions involving crypto asset securities; it is not a blanket legal finding about every investment automation service or every crypto asset. Read the staff statement and its scope.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Self-custody also means taking responsibility for key security and recovery. The SEC notes that losing a key can mean permanently losing access. A hardware wallet is one optional physical cold-wallet form that can reduce exposure to internet-based cyberthreats, but it can itself be lost, damaged, or stolen; owning one does not verify an automation service’s custody claims. See the SEC’s explanation of crypto custody choices.
What happens if the service, custodian, or exchange fails?
Ask how client assets are separated from the provider’s own property and what process would return them if the service or asset-holding firm shut down or became insolvent. Also ask whether assets may be lent, pledged as collateral, rehypothecated, or commingled, and whether your consent is required. Request the terms for any claimed insurance: what it covers, what it excludes, who pays for it, and whether it applies to your specific assets and account. Check transfer, closure, and custody fees as well.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
For crypto custody services within MiCA’s scope in the EU, Article 75 requires a client-position register and custody policy, procedures for returning client assets, and segregation of client holdings from the provider’s holdings; it also addresses liability for certain losses attributable to the provider. These are jurisdiction-specific obligations, not a global standard for every service. Read MiCA Article 75.
Check whether the permissions match the service’s claims
Identify the legal entity behind the product, the named custodian or exchange, and the regulatory status relevant to the activity it performs in your jurisdiction. Compare the service’s disclosures with the authorizations visible in your brokerage account, exchange settings, or wallet. Look for clear information about fees, conflicts, venue relationships, and how trading information is used. The SEC’s April 2026 staff statement discusses role, fee, conflict, cybersecurity, and venue disclosures for interfaces within its limited scope; it does not cover every product. Consult the statement for the covered interfaces.
Regulatory materials have different force. The SEC’s crypto custody bulletin is investor education, not a rule, regulation, or Commission statement creating new obligations. Its October 1, 2026 custody-rule fact sheet describes proposed amendments, not final rules. The proposal would allow adviser self-custody of crypto under specified conditions, including safeguarding expertise, systems for private-key management, joint authorization by at least two people, and separate client crypto addresses; those terms should not be treated as requirements already in force. Read the SEC’s proposal fact sheet.
Quick Recap
Use this checklist to compare services
| What to verify | Evidence to look for |
|---|---|
| Asset location | Legal name and status of the broker, bank, custodian, exchange, wallet, or protocol holding each asset. |
| Withdrawal and transfer power | Account permissions or wallet approvals showing whether the service can withdraw cash or securities, change destinations, or transfer crypto without a separate user signature. |
| Key and signing control | Who controls keys, signing devices, recovery phrases, co-signers, smart-contract administrators, or delegated operators. |
| Scope of authority | Whether permission is limited to instructed trading or extends to other disposal, lending, pledging, or account changes. |
| Failure and asset return | Segregation terms, insolvency procedures, return process, and the actual scope and exclusions of any insurance. |
| Transparency and revocation | Accessible agreements and statements, clear fee and conflict disclosures, permission logs, and a way to revoke access without the provider’s cooperation. |
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
