Identity verification for crypto exchanges and custodial wallets

What custodians ask of identity checks after the account is open

An exchange or a custodial wallet holds assets that belong to someone else. The provider has to be able to say whose they are, move them only on that person's instruction, and hand them back to that person when access is lost. Opening an account with a verified person behind it is the subject of the crypto and Web3 page, together with duplicate search and screening. This page begins once the account exists and treats the next two duties, moving assets out and giving access back.

In practice the pressure comes from two directions. Customers want a withdrawal to arrive quickly and a lost phone to be fixed without a long wait. The provider wants to be certain that speed does not become the route by which a thief takes over an account. A check that can be repeated cheaply, at the moments that carry risk, lets the provider be strict at those moments and light the rest of the time. That is why this page treats the check as something that recurs through the life of an account, not as a gate passed once.

• Ask the same user to verify again before a withdrawal to a destination the account has not used.
• Hold the transfer until the comparison, and the provider's own assessment of the address, are both in.
• Recover access for the person who opened the account and for no one else.
• Decide a failed comparison with a person, and keep the record.

The flow

1. Starting point. The account was opened and the client verified as described on the crypto and Web3 page. The reference face from that session is the one used below.
2. Withdrawal trigger. Your product decides when a withdrawal needs a fresh check, for example the first withdrawal to a new self-hosted address. Collecting the originator and beneficiary information that the rules require is also a step in your own systems. This rule is yours.
3. Fresh session. Your backend creates a session for the same user. A user who starts on a computer can finish on a phone with a QR code, and the returning user is compared with a stored reference face.
4. Address assessment. Your own systems assess whether the destination address is owned or controlled by the client. The platform does not do this.
5. Hold or release. Your product reads the session status or receives a webhook. It releases the transfer only when the comparison and the address assessment are both in. If either is missing, the transfer waits.
6. Failed or incomplete comparison. The withdrawal stays held and a staff member decides the case manually in the dashboard. A second failure, or a decision against the client, is handled by your product rule, for example a restriction of the account.
7. Recovery. A user who lost access starts a session on a phone, or moves to one with a QR code, and the returning user is compared with a stored reference face. Your product decides whether to restore access, and a failed comparison goes to a staff member.
8. Evidence. The session log, reports and export for each withdrawal check and each recovery stay in the dashboard.

Where this differs from the crypto page

The crypto and Web3 page describes opening an account with a verified person behind it. This page starts after that. A custodian has to keep a register in the client's name, has to decide when a withdrawal to a wallet outside the platform needs more than a login, and has to give the assets back to the right person. These are repeat checks on a known account, and the platform's contribution is the comparison with the stored reference face. The decisions the page develops are the trigger, the hold, the failed comparison and the recovery.

Modules used

• Face verification and liveness. A returning user is compared with a stored reference face.
• QR hand-off for recovery and checks that start on a computer.
• Dashboard for the session log, export and manual decisions.
• REST API and webhooks.

Regulatory frame

What two European Union texts say about providers that hold assets for clients. The first four statements are from the Regulation on markets in crypto-assets, whose provisions on crypto-asset service providers apply from 30 December 2024. The last three are from the Regulation on information accompanying transfers of funds and certain crypto-assets, which applies from 30 December 2024.

• Under Article 59(1) of Regulation (EU) 2023/1114, a person does not provide crypto-asset services within the Union unless authorised as a crypto-asset service provider, or unless it is a credit institution, central securities depository, investment firm, market operator, electronic money institution, UCITS management company or alternative investment fund manager that is allowed to provide them under Article 60.
• Under Article 75(1), a provider of custody and administration of crypto-assets on behalf of clients concludes an agreement with each client that includes at least the identity of the parties and the means of communication, including the client's authentication system.
• Under Article 75(2), that provider keeps a register of positions, opened in the name of each client, corresponding to each client's rights to the crypto-assets.
• Under Article 75(6), it ensures that necessary procedures are in place to return crypto-assets held on behalf of its clients, or the means of access, as soon as possible to those clients.
• Under Article 14(5) of Regulation (EU) 2023/1113, for a transfer of crypto-assets to a self-hosted address the provider of the originator obtains and holds the originator and beneficiary information, and for an amount exceeding EUR 1,000 takes adequate measures to assess whether that address is owned or controlled by the originator.
• Under Article 14(8), that provider does not allow the initiation, or execute any transfer, of crypto-assets before ensuring full compliance with the Article.
• Under Article 16(2), for a transfer from a self-hosted address the provider of the beneficiary obtains and holds the same information, and for an amount exceeding EUR 1,000 takes adequate measures to assess whether that address is owned or controlled by the beneficiary.

This block describes the texts, not our service. For information; not legal advice.

Sources

• Regulation (EU) 2023/1114 of the European Parliament and of the Council on markets in crypto-assets, Official Journal text, fetched 27 October 2026.
• Regulation (EU) 2023/1113 of the European Parliament and of the Council on information accompanying transfers of funds and certain crypto-assets, Official Journal text, fetched 27 October 2026.

Next

Try the interactive tour, read the account recovery use case or compare with the payment institutions page.