The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →The person or organisation that can authorize an outgoing transaction controls the asset in practice. Start by identifying who holds, operates, or can assemble the private keys, key shares, seed phrase, or other credentials required to sign a transfer. Then read the account or custody contract for withdrawal rights, fees, restrictions, insolvency treatment, and responsibility for losses. A balance shown in an app, a wallet label, or a proof-of-reserves announcement does not by itself establish control or your legal claim.
Control and legal ownership can differ. The exact result depends on the asset, blockchain, service, contract, and country. Verify the named legal entity and applicable regulator for your location before sending funds.
As an Amazon Associate I earn from qualifying purchases.
What “control” means for a crypto asset
Cryptoassets are recorded on a blockchain. A wallet normally does not contain coins in the way a bank account contains a balance; it stores, protects, or accesses the credentials used to authorize transactions.
Private keys authorize spending
A private key is a secret value that can authorize a transaction. A public key or address can receive assets and let others verify transactions, but it does not authorize spending. Anyone who can use the relevant private key can generally propose a transfer according to that blockchain’s rules. If the only copy of a private key or recovery phrase is lost, access may be permanently lost.
#1 Best Overall
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
The U.S. Securities and Exchange Commission’s retail custody bulletin explains these distinctions and describes self-custody as the user controlling the private keys. Its statement, “With self-custody, you have sole control over the access to your crypto assets’ private keys,” is investor education rather than a binding legal rule. Read the bulletin at Investor.gov’s Crypto Asset Custody Basics.
Self-custody is a responsibility, not a product label
In self-custody, you hold the recovery method that can authorize transactions. That might be a seed phrase kept offline, a hardware device used with a signing PIN, or a multisignature arrangement in which several parties hold separate key shares. An app called a “wallet” is not proof that a provider cannot access the keys. Ask who can sign, who can restore the wallet, and whether another party can act without your approval.
Third-party custody changes the control question
With a hosted account, a custodian may hold the keys or key shares while your screen displays an internal balance. The provider may be able to initiate, approve, delay, block, or reconstruct a transfer. You may have a contractual claim against the provider rather than direct control of an on-chain address. The contract determines whether you can demand delivery of specific assets, receive an equivalent amount, or recover only as an unsecured creditor if the provider fails.
A step-by-step control check before you invest
1. Identify the asset, network, and account type
- Write down the exact asset and network. Similar names can exist on different blockchains, and a withdrawal supported on one network may not be supported on another.
- Record where the balance appears. Is it an address you can independently inspect on a block explorer, or only an entry in a platform database?
- Identify the service type. Separate a self-custody wallet, a custodial account, a brokerage or trading interface, a lending arrangement, and a staking or smart-contract position. Each can allocate control and legal rights differently.
2. Find the person or system that can sign a transfer
Ask for a plain-language description of the signing process. Who creates the transaction? Who supplies the final approval? Can one employee, contractor, automated system, or parent company move assets? Are keys stored in a single device, split among key shares, or held by a subcontractor? Request a written answer and keep it with the account terms.
For a wallet you operate, create a small test transaction to an address you control. The goal is not to prove legal ownership; it confirms that you can use the recovery method and understand the network, fees, and confirmation process before committing a large amount. Never send a private key or seed phrase to someone who claims to be verifying ownership.
3. Test recovery without exposing secrets
Confirm that the recovery phrase or other backup can restore the same wallet on an appropriate, trusted device or compatible software. Do this privately and offline where possible. Do not photograph or upload the phrase, and do not type it into a website, support chat, form, or screen-sharing session. A provider that asks for your seed phrase is asking for the credential that can control the funds.
For a multisignature or threshold arrangement, document how many key shares are required, who holds each share, and what happens if one holder disappears. UK Financial Conduct Authority guidance treats control broadly: a person can have control through arrangements in which several parties hold key shards that together meet the threshold needed to transfer the benefit. The FCA’s definition is specific to its safeguarding framework, not a universal ownership rule. See FCA Handbook PERG 18.6.
4. Identify the exact legal entity
Do not stop at an app name or trading brand. Find the legal entity named in the terms, privacy notice, custody agreement, invoices, and withdrawal instructions. Determine whether the entity operating the interface is different from the entity holding keys or client assets. Record its country of incorporation, service address, and the regulator or registration category it claims.
Rank #2
- Proven security at scale: Over 9 years and millions of cards issued with no known remote hacks, while military‑grade EAL6+ security keeps your private keys locked inside the chip. Your cryptocurrencies stay strongly protected from online attackers.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 14,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Smart backup: Use your second Tangem Wallet as your Backup keys with end‑to‑end encryption; no more papers, pictures. If one card is lost, the remaining can still restore full access, with an optional seed phrase available for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
Ask which law governs the contract and which courts handle disputes. A company can serve customers in one country while the custody entity, assets, and insolvency proceedings are located elsewhere.
5. Read withdrawal rights as an operational test
Check whether you can transfer assets to an address you control, not merely trade an internal balance. Look for:
- minimum withdrawal amounts and network support;
- fixed or variable fees;
- processing windows, review holds, and daily limits;
- identity or source-of-funds checks that can pause a transfer;
- events that allow suspension, conversion, or forced liquidation;
- whether the provider can change these terms without your consent.
A provider may legally hold assets for you yet impose contractually permitted delays or limits. Save the version of the terms that applied when you invested.
Recommended Free Tools
6. Ask what happens during failure
Obtain written answers for four scenarios: insolvency, cyberattack, a frozen withdrawal system, and loss of key access. Ask whether customer assets are segregated from the provider’s own estate, whether records identify each client’s position, and whether insurance covers theft, operational error, or only a narrow set of events. Find out whether an administrator could return the actual assets, an equivalent amount, or only a claim for money.
Questions to send to a custodian or platform
Use this checklist before transferring a significant amount. Keep the replies, the governing terms, and any fee schedule.
- Which exact legal entity is the custodian, and which entity operates the trading interface?
- Who holds the private keys or key shares?
- Who can initiate, approve, block, or reconstruct an outgoing transaction?
- Are keys generated and stored by you or by a subcontractor?
- Are customer positions individually recorded, pooled, or represented only by an internal ledger?
- What legal claim does a customer have to the asset if the provider fails?
- Can I withdraw to a wallet whose signing credentials I control?
- What delays, network restrictions, review holds, and fees apply?
- What happens after insolvency, hacking, a withdrawal freeze, or a lost key?
- What insurance exists, which assets and events are covered, and what exclusions and limits apply?
- What does any audit, attestation, or reserves report cover, and what date and assurance level apply?
The SEC custody bulletin recommends asking how a custodian safeguards assets and keys, who can access them, whether storage is outsourced, what wallet methods are used, what happens if the custodian fails, and what fees apply. Its guidance is available from Investor.gov.
How to judge common assurances
“We have proof of reserves”
A proof-of-reserves report can show that an assessor observed specified assets at a specified time, but its scope and reliability vary. Ask:
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match- What date and assets were included?
- Were customer liabilities measured, or only wallet balances?
- Was the work an audit of financial statements, a limited attestation, or another procedure?
- Who performed it, and how independent was that assessor?
- Could borrowed assets, encumbered assets, related-party balances, or off-chain obligations affect the result?
The SEC warns that proof-of-reserves methods, frequency, assurance, and disclosure differ, and that such work does not provide protections comparable to a financial-statement audit. Treat it as one limited piece of evidence, not proof of solvency or full coverage of customer claims. See the SEC’s crypto-asset securities investor alert.
Rank #3
- Unparalleled Security: Protect your assets with EAL 6+ Secure Element, offering robust defense and complete transparency
- Simple & Secure Interface: Manage your digital assets easily with a clear OLED screen for secure on-device confirmations
- Supports 1000s of Coins & Tokens: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet
- Effortless Asset Management: Monitor and transact seamlessly with Trezor Suite, our intuitive desktop and mobile app
- Enhanced Backup Solution: Multi-share Backup eliminates single points of failure for secure cold wallet recovery
“We are regulated”
Ask “regulated by whom, for which activity, under which entity, and in what country?” Search the regulator’s own register and match the legal name, registration number, and permitted activity. A registration may impose conduct or reporting duties, but it is not a guarantee that an asset will retain value, withdrawals will always be available, or losses will be reimbursed.
The Commodity Futures Trading Commission advises checking relevant registration records before paying for investment advice or sending digital assets to a firm’s or individual’s wallet. Its consumer red-flags guide is at CFTC’s Curious About Crypto? Watch Out for Red Flags.
“Your assets are held in a wallet”
This phrase does not identify the signing authority. Ask who controls the key, whether several parties must cooperate, and whether a provider or contractor can transfer assets without your approval. Under the FCA safeguarding definition, the ability to bring about a transfer of the benefit can establish control through different technical arrangements; merely being able to prevent a transfer is not enough for that particular test. The definition should not be treated as a global rule about ownership.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Self-custody and third-party custody compared
| Question | Self-custody | Third-party custody |
|---|---|---|
| Who authorizes a transfer? | You, or the signers in your chosen multisignature arrangement. | The custodian or its approved signing system, subject to your contract and any customer approvals. |
| Who can recover access? | The person holding the recovery phrase or required key shares. | The provider’s recovery process, which may depend on identity checks, internal controls, or a replacement-key procedure. |
| Withdrawal rights | You can normally send directly if you have the required credentials and network access. | Withdrawals depend on provider limits, reviews, supported networks, fees, and operational availability. |
| Record of assets | On-chain ownership is represented by the address and signing credentials. | Your position may be an internal record, a pooled holding, or a claim governed by contract. |
| Failure and insolvency | There is no custodian to become insolvent, but loss, theft, or signing errors are your responsibility. | Rights depend on segregation, records, insurance, insolvency law, and the custody agreement. |
| Security work | You must protect keys, backups, devices, and transaction approvals. | You delegate much of the operational security but must evaluate the provider, subcontractors, controls, and incident response. |
| Cost and convenience | You may avoid custody charges but pay with setup, transaction, backup, and security effort. | Access can be simpler, but custody, transfer, conversion, or account fees and restrictions may apply. |
A hardware wallet can help a user manage private keys offline, but it does not establish legal ownership, guarantee recovery, eliminate user mistakes, or reveal every person who may control a key. The security result still depends on setup, backup, firmware, transaction verification, and the surrounding custody arrangement.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Jurisdiction-specific checks
United States
SEC and CFTC materials are investor and market guidance for U.S. contexts; they do not turn every crypto service into a regulated bank or broker. Read the provider’s contract and confirm which U.S. entity, if any, is registered for the specific activity. The SEC also published a December 17, 2025 statement on custody of crypto asset securities by broker-dealers; its application depends on the asset, intermediary, and facts. See the SEC custody statement.
United Kingdom
FCA guidance on control and safeguarding applies within the relevant UK regulatory framework. Check the FCA register and determine whether the service’s activity is covered, what protections apply, and which legal entity is responsible. FCA registration is not a promise that your investment cannot fall or that every loss will be recovered.
European Union
For covered crypto-asset service providers, MiCA Article 75 provides a useful reference point. It requires a client agreement describing responsibilities, custody policy, security systems, fees, and applicable law; a register of client positions; and legal segregation of custody assets from the provider’s estate in the client’s interest, subject to applicable law. Read ESMA’s MiCA Article 75 text.
Free tools Windows power users keep installed
One-click scans. No signup required.
MiCA is not a universal rule for every token, decentralised arrangement, overseas provider, or service outside its scope. Confirm whether the provider and activity actually fall within the regime.
Rank #4
- UNPARALLELED SECURITY: Protect your assets with Trezor Safe 5's NDA-free EAL 6+ Secure Element, offering robust defense and complete transparency.
- EFFORTLESS NAVIGATION: Experience seamless crypto management with the vibrant color touchscreen, designed for intuitive and user-friendly interactions.
- ENHANCED USER EXPERIENCE: Enjoy tactile confirmation with Trezor Touch Haptic Engine, making each interaction precise and engaging.
- SUPPORTS 1000s OF COINS & TOKENS: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet.
- EASY ASSET MANAGEMENT: Monitor and transact seamlessly with Trezor Suite, our user-friendly desktop and mobile app
Security practices that preserve control
- Keep the recovery phrase offline and separate from the device used to transact.
- Use a backup plan that your future self or designated successor can understand without giving an attacker online access.
- Verify the destination address and network on the signing device, not only on a potentially compromised computer screen.
- Start with a small transaction and wait for the expected confirmation before sending more.
- Maintain software and device security, but never install wallet updates from unsolicited messages or support accounts.
- Assume that anyone requesting a private key, seed phrase, or signing approval is asking for control.
- For shared custody, document each signer, threshold, replacement process, and emergency contact independently of the provider’s marketing material.
Red flags and what to do next
The provider will not name the custodian
Pause the transfer. A platform that cannot identify the legal entity holding keys or explain the contractual claim leaves you unable to evaluate insolvency and recovery risk.
Withdrawals are suspended without a clear rule
Save screenshots, notices, terms, transaction records, and support replies. Do not pay an “unlock,” “tax,” or “verification” fee to an unverified person promising release. Verify the company through independent regulator records and official contact channels.
Support asks for your seed phrase
Stop communicating through that channel. A legitimate troubleshooting process should not require the secret that can authorize spending. Move remaining assets to a newly generated wallet only after checking the device and recovery process.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →The reserves report shows assets but no liabilities
Do not interpret the figure as proof that every customer claim is covered. Ask for liability scope, encumbrances, dates, methodology, and assurance, then compare the answer with the custody contract.
The service uses several key holders
Ask how many signatures are required, whether any one holder can collude or act alone, how a missing signer is replaced, and which party can change the policy. A threshold arrangement can distribute risk without removing the need to identify all effective signers.
How common exchange custody is—and why the figure needs context
The FCA reported that 72% of cryptoasset users said they stored their cryptoasset with the exchange they bought it from, based on a 2024 YouGov survey cited in consultation paper CP25/14. This is a UK survey result attributed to YouGov, not a current global share of all crypto users and not evidence that any particular exchange is solvent or safe. Read the consultation paper at FCA CP25/14.
A decision checklist before sending money
- Name the exact asset, blockchain network, service, and legal entity.
- Identify every person, system, or key-share group that can authorize or assemble a transfer.
- Confirm whether the balance is on-chain at an address you control or an internal contractual claim.
- Read withdrawal rules, fees, limits, delays, suspension rights, and governing law.
- Understand recovery, insurance, subcontractors, segregation, records, and insolvency treatment.
- Verify regulatory claims in the relevant official register for your country.
- Assess any audit or reserves report by its date, scope, liabilities, methodology, independence, and assurance.
- Perform a small test transfer and secure your recovery method without revealing it.
- Do not invest if basic questions about control, withdrawal, or failure remain unanswered.
These checks cannot eliminate market volatility or every technical risk. They can reveal whether you control the credentials, have a defined contractual claim, or are relying on an intermediary whose failure could interrupt access.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
