Anyone moving crypto-assets from an exchange to a self-custodied wallet has, since the MiCA transition period ended, run into an intermediate step that does not arise on a transfer to another
Anyone moving crypto-assets from an exchange to a self-custodied wallet has, since the MiCA transition period ended, run into an intermediate step that does not arise on a transfer to another exchange: the provider wants to know whether the destination address really belongs to you. This is neither obstruction nor a house rule. It is an obligation under the European transfer of funds regulation, set out in Article 14(5) of Regulation (EU) 2023/1113. It bites above €1,000, and it falls on the provider, not on you.
The consequence for you is nonetheless a very practical one. When a withdrawal deadline is running, when an exchange is winding down or a token is pulled from trading, you want your balance moved to your own wallet quickly. That is exactly the moment proof of ownership inserts itself, and depending on the method chosen it costs you minutes or several hours. Knowing beforehand what may be demanded, and what your wallet needs to be capable of, saves that time.
The term everything turns on is defined in Article 3(20) of Regulation (EU) 2023/1113. A “self-hosted address” is a distributed ledger address that is not linked to a crypto-asset service provider, nor to an entity established outside the Union providing comparable services.
What matters is therefore not the physical form of the wallet but whether a service provider sits behind the address. A hardware wallet falls under the definition, a software wallet on your own machine does too, and so does a paper address whose key you have never stored digitally. The deposit address of a second exchange, by contrast, is not a self-hosted address, even where it has been assigned to you personally. On a transfer between two exchanges the two houses pass the prescribed information to each other; the question of proof never arises there.
The wording is short and unambiguous in its aim. On a transfer to a self-hosted address, the originator’s crypto-asset service provider collects the prescribed information on originator and beneficiary, retains it, and ensures that the transfer can be individually identified. Where the amount exceeds €1,000, the substance is added: the provider then takes appropriate measures to establish whether that address is owned or controlled by the originator.
Two points here are routinely skimmed over. First, the regulation speaks of “ownership or control” and not of proof of identity; what is being tested is the link between you and one specific address, not your person all over again. Second, Article 14(8) sets a hard sequence: the provider shall not allow a transfer to be initiated or executed before full compliance with the article is assured. As long as the proof is missing, the withdrawal does not go out. That is why a withdrawal sometimes sits in the queue with no visible error.
The €1,000 threshold applies solely to the qualified determination of ownership or control. The information requirement itself has no lower limit. Under Article 14(1), the information on the originator includes the name, the distributed ledger address, the account number of the crypto-asset account and the address including the country, together with the number of an official personal document and the customer identification number, or failing that the date and place of birth. Paragraph 2 requires the corresponding information on the beneficiary.
On a transfer to your own wallet you are both parties in one person, originator and beneficiary. That is why the process feels unremarkable from where you sit: the exchange already holds the data and enters it itself. The rule only becomes visible above the threshold, because a step is added there that only you can perform. Anyone withdrawing smaller amounts regularly will rarely meet it; anyone clearing out an account will meet it almost every time.
Under Article 14(6) the provider additionally verifies the accuracy of the information on the originator on the basis of documents, data or information obtained from a reliable and independent source. Paragraph 7 makes clear that this verification counts as done where your identity has already been established under the anti-money laundering rules and the data retained. On an account that has been through full verification, that part is therefore settled before you trigger the withdrawal. At an exchange holding a European authorisation it is a precondition of the account in any case, and a look at the comparison of regulated crypto exchanges shows which houses meet that framework for European customers.
The threshold is a euro amount; the transfer consists of crypto-assets. How the two are brought together is governed by the European Banking Authority’s travel rule guidelines (EBA/GL/2024/11), applicable since 30 December 2024. Paragraph 82 records that the provider uses the exchange rate of the crypto-asset to be transferred at the time of the transfer in order to determine its value in euro, irrespective of any transaction fees.
In practice that means the decisive moment is the withdrawal itself, not the point at which you bought, and not the amount net of the network fee. A holding that sat clearly below the threshold at purchase can cross it on the way out. Splitting a withdrawal into several smaller ones is no advisable way around it either, since providers are independently obliged to detect and assess unusual transaction patterns.
Your provider must apply at least one of five verification methods; which one is its own decision. The return leg is governed symmetrically. Under Article 16(2) of the regulation, on a transfer from a self-hosted address the beneficiary’s provider collects the same information and retains it; where the amount exceeds €1,000, it too takes appropriate measures to establish whether the address is owned or controlled by the beneficiary. Paragraph 3 further requires it to verify the information on the beneficiary before making the crypto-assets available.
Anyone bringing holdings back out of self-custody onto an exchange in order to sell there should plan for this. The credit can hang until the proof is in, and it does so precisely in a situation where speed is usually the point. The procedure is the same as in the opposite direction, except that the check now sits on the receiving side.
The regulation says that a check must happen, but not how. Paragraph 83 of the EBA guidelines fills that gap. Providers should apply at least one of five verification methods to assess whether a self-hosted address is owned or controlled by the originator or the beneficiary.
Those named are unattended verification procedures under the EBA guidelines on the use of remote customer onboarding solutions, with the address stated; attended procedures under the same guidelines; sending a predefined amount from or to the self-hosted address to an account of the provider; asking the customer to digitally sign a specific message with the key belonging to the address; and other suitable technical means, provided they allow a reliable and secure assessment.
Which method is used is, under paragraph 84, the provider’s decision, taken on three considerations: the technical capabilities of the self-hosted address, the robustness of the assessment a method can deliver, and the money laundering and terrorist financing risk. Paragraph 85 adds that a combination of several methods should be applied where one alone is not reliable enough. You have no claim on that choice, but you can expect the two middle variants to dominate in practice.
Under this method the provider sets an amount, preferably the smallest denomination of the crypto-asset in question, and you send it from the self-hosted address to an account of the provider. If the payment arrives from exactly that address, control is taken as demonstrated. With bitcoin the smallest unit is a satoshi, which is why the industry often names the procedure after it.
The advantage is that the method works with practically any wallet, since sending is something every wallet can do. The drawback is the time it takes. You need a confirmation on the network in question, and you pay a network fee for it that can exceed the micro-amount transferred many times over. Anyone going through the procedure for the first time should not count on completing the actual withdrawal within the same quarter of an hour.
A second point concerns the order of events. The micro-amount has to come from the address you later intend to use as the destination. With wallets that generate a fresh address for every receipt this is a trap: the address you use for the proof and the address the wallet displays for the withdrawal can diverge. A look at the settings of your hardware wallet before the first proof saves you repeating the whole exercise here.
The second variant common in practice requires no transaction. The provider gives you a text, which you sign in your wallet software with the key belonging to the address in question. What you hand back is the signature, a character string from which it can be derived computationally that it can only have been produced with the matching private key.
The private key never leaves the device in the process. That is the essential difference from anything that sounds like surrendering it, and the reason the procedure is unobjectionable in security terms, as long as you sign only the text specified by the provider. Caution is warranted the other way round, where someone outside a withdrawal you have initiated asks you to sign an arbitrary message or even a transaction. A signature request you did not trigger yourself is not one to approve.
Technically, though, the method is more demanding than the reference transfer, because not every wallet supports signing arbitrary messages and the implementation differs by address type. That is exactly what the first of the three considerations in paragraph 84 of the guidelines is aimed at: the technical capabilities of the address.
Alongside the European regulation, German law adds Section 15a of the Money Laundering Act. It obliges undertakings executing a transfer of crypto-assets whose beneficiary or originator is a self-hosted address to identify and assess the associated risk and to take appropriate risk mitigation measures.
Paragraph 2 lists the minimum that belongs to this, one of the measures being sufficient and a combination possible: collecting, verifying and storing the identity of the beneficiary or originator and of the beneficial owner of the self-hosted address; measures to determine the origin and destination of the crypto-assets to be transferred; enhanced and continuous monitoring of those transactions and of the associated business relationship; or other measures to mitigate and manage the risks.
That explains a line of questioning many experience as intrusive. Where a provider asks you where the crypto-assets are going or where they came from, it is implementing the second of those measures. That is a free-standing obligation alongside proof of ownership and not the same thing. The proof settles who owns the address; the origin question settles what is meant to happen on it.
Once an address has been verified, the provider may whitelist it and skip the check in future. Paragraph 86 of the guidelines describes the relief that keeps the burden manageable day to day. Where the provider has fully satisfied itself that the self-hosted address is owned or controlled by its customer, it should document this in its systems; it may then not need to apply those measures again on later transactions from or to the same address. The guidelines call this whitelisting in as many words.
A condition is attached. A provider using whitelisting should have controls in place to detect changes in the risk and in ownership or control. Where it finds that the risk has changed, or that there are indications the customer no longer owns or controls the address, it should remove it from the whitelist.
For you a plain recommendation on sequencing follows. Getting the proof done once, calmly, before any time pressure arises is considerably more comfortable than catching up on it on the last day of a deadline. Register your destination address early and have it cleared, and the step is behind you when it matters.
Not every wallet handles every method, and the guidelines expressly accommodate this with the technical capabilities criterion. Where a provider demands a signed message and your wallet does not offer the function, the reference transfer is the usual way out. Conversely, a wallet set up purely to receive, holding no balance to cover a network fee, cannot manage the reference transfer.
From that follows a point rarely weighed before buying a device: a wallet that can do both spares you any dependence on the provider’s choice of method. Before setting one up it is worth checking the wallet documentation on two questions: whether signing arbitrary messages is provided for in the companion software, and whether a fixed receiving address can be used.
The proof turns into a scheduling problem the moment a date is on the table. BitMEX, for one, has announced it will cease operating the exchange on 23 September 2026 at 04:00 UTC. Under the same announcement on the company’s own site, risk limits preventing the opening of new positions take effect from 26 August 2026 at 04:00 UTC; from that point the house closes existing open positions itself. Anyone still holding balances there and wanting to move them into self-custody has to fit the proof of ownership into that window, and it is the one step in the sequence that does not depend on the exchange alone.
The same pattern applies to a delisting that runs without the exchange closing. How the sequence of deposit suspension, trading halt and withdrawal deadline hangs together is set out in detail in the cryptoticker piece on delisting at a crypto exchange of 17 August 2026. For planning purposes: proof of ownership belongs at the start of the chain, not at the end.
Where a withdrawal you have initiated sits there with no visible reason, the first place to look is the account notifications, since the request for proof is frequently delivered there rather than by email. If that leads nowhere, the regular route is a formal complaint to the provider, which every authorised provider must operate under MiCA; that procedure is free of charge and tied to no prescribed form.
Three confusions come up regularly, and all three produce false expectations.
Proof of ownership is not a repeat identity check. Your person was established when the account was opened; what is at stake here is solely the attribution of an address. Nor is it a tax event. Moving your own holdings between your own addresses is not in itself a disposal, and the proof changes nothing about that. And it is not a proof of reserves either: proof of reserves concerns whether the exchange holds its customers’ balances, whereas proof of ownership points the other way and concerns your address.
That leaves the point most likely to cause unease. Through the proof the provider learns which address is yours, and a history is attached to that address on the public blockchain. This is a consequence of the rules that cannot be argued away, and at the same time the price of transfers into self-custody remaining possible at all at authorised providers, rather than being blocked outright on risk grounds.
Anyone wanting to read the procedure in full will find the guidelines under reference EBA/GL/2024/11 on the European Banking Authority’s publications page; they have applied since 30 December 2024 and replaced the earlier joint guidelines from 2017.
(As of August 19, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)
