The EU’s word for it
EU law calls the destination a “self-hosted address”. Article 3 of the Transfer of Funds Regulation, Regulation (EU) 2023/1113, defines it as a distributed ledger address linked neither to a crypto-asset service provider nor to a similar firm outside the EU. The regulation has applied since December 30, 2024.
What an exchange does when you withdraw
Picture a €1,500 bitcoin withdrawal from an EU exchange to your own hardware wallet. Before the coins leave, Article 14(5) has the exchange collect and keep your details as both sender and recipient, and make sure this one transfer can be identified on its own. Over €1,000? Then it also has to take adequate measures to judge whether you really own or control that address.
Deposits get the mirror rule, in Article 16(2), when coins arrive from a self-hosted address, one piece of the wider Travel Rule.
How does an exchange check? The European Banking Authority’s Travel Rule guidelines tell exchanges to use at least one method. The options include a remote identity check in which the address is displayed, a small predefined amount sent between the address and the exchange’s account, or a specific message signed with the key for that address.
The guidelines say the €1,000 test uses the euro value at the time of the transfer, regardless of fees. Once fully satisfied, an exchange may whitelist the address and need not repeat the check.
The trade-off
Holding your own keys removes the custodian, and with it anyone who could undo a mistake. Wallet maker MetaMask says on its support site that it “cannot recover or control your funds” if you lose your recovery phrase or password.
The US Federal Trade Commission makes the same point in its crypto guidance. If you lose a wallet password or the wallet is stolen, it says, “you’re likely to find that no one can step in to help you recover your funds.”
The verification mistake
None of the EBA’s methods asks you to hand over a recovery phrase. Signing happens in your own wallet software, which returns a signature for the exchange to check.
A “wallet verification” page that wants the words is therefore something else, and a message that sends a link and asks you to connect or verify your wallet appears on the list of warning signs in a Canadian Anti-Fraud Centre bulletin. Before you prove ownership to an exchange, start from inside its own app or website and see which method it uses.