What the account terms say
Whose coins are in an exchange account? Exchange Coinbase’s US user agreement, last updated on October 21, 2026, answers in section 2.7. The crypto in your account is a “custodial asset” held by Coinbase for your benefit, and title “shall at all times remain with you.”
The same section treats those holdings as financial assets under Division 8 of the California Uniform Commercial Code, with Coinbase acting as a securities intermediary.
A detail most users never read sits in section 2.7.4. Coinbase may keep customer crypto in shared blockchain addresses it controls, which can also hold Coinbase’s own assets, and it “shall have no obligation” to create a separate address for you. What separates your coins from everyone else’s is Coinbase’s own ledger, which the agreement says it keeps apart from the accounts it holds for itself.
In the US, the EU and the UK
The three jurisdictions get to the same idea by different routes.
| Jurisdiction | Legal basis | What it requires |
|---|---|---|
| EU | MiCA, Articles 3(1)(17) and 75 | A licensed firm keeps a register of each client’s positions, sends a statement at least every three months, keeps client crypto apart from its own on the ledger and outside its estate in insolvency, and is liable for losses it causes, capped at market value |
| UK | SI 2026/102, new article 9N of the Regulated Activities Order | Safeguarding cryptoassets for others becomes a regulated activity on October 25, 2027, with permission applications allowed before that |
| US | The account contract and state commercial law | Coinbase’s terms place holdings under Division 8 of the California Uniform Commercial Code, which its 10-K says keeps them out of reach of its general creditors |
MiCA’s Article 75 is the most detailed of the three. A crypto-asset service provider must hold clients’ crypto “separately from their own crypto-assets” on the distributed ledger, and its creditors get no recourse to those coins “in particular in the event of insolvency.”
Britain’s version, made on February 4, 2026, defines safeguarding by control. Under the new article 9N, a firm safeguards a cryptoasset if it has control of it “through any means” that would let it bring about a transfer. The test is control of the coins, whatever kind of wallet holds them.
The mistake: reading the balance as cash in a vault
A number in an app can make crypto feel as safe as a bank deposit. The SEC’s investor custody bulletin of December 12, 2025 is blunter. If a third-party custodian is hacked, shuts down or goes bankrupt, it says, “you may lose access to your crypto assets.”
The bulletin also names two practices to ask about. Some custodians lend out deposited crypto, which it calls rehypothecation, and some commingle assets instead of holding them individually.
Product terms can change the picture inside one account. Coinbase’s margin appendix lets its lending arm “rehypothecate” and “commingle” collateral, up to a reuse limit, while a margin loan is open.
Before you leave a balance anywhere, read the custody clause and any product terms that let the firm reuse your coins. In the EU, also look the firm up on the MiCA register.