Withdraw cryptocurrency into your own wallet: Why exchanges require proof of address ownership over

Transfer crypto assets from exchanges to self-managed wallets: Proof of ownership you need to know

Since the end of the MiCA transition period, anyone who transfers crypto assets from an exchange to a self-managed wallet has encountered an intermediate step that will not occur when transferring to another exchange: The provider wants to confirm whether the target address really belongs to you. This is neither deliberate provocation nor internal regulation, but an obligation stipulated in Article 14, paragraph 5, of the EU Fund Transfer Regulations (EU) 2023/1113). This obligation applies to transfers exceeding € 1000, and the responsibility lies with the provider, not you.

However, for you, the consequences are very practical. When the withdrawal deadline approaches, an exchange is shutting down, or a token is removed, you want to transfer the balance into your wallet as soon as possible. It was at this moment that proof of ownership appeared. Depending on the method chosen, this process may take minutes or even hours. You can save time by knowing in advance what you may be asked of and what capabilities your wallet needs to have.

Self-custody address: Meaning of terms in the Funds Transfer Regulations

The core definition of this term is found in Article 3, paragraph 20 of Regulation (EU) No 2023/1113. "Self-managed addresses" refer to distributed ledger addresses that are not related to cryptographic asset service providers or entities outside the alliance that provide similar services.

Therefore, what matters is not the physical form of the wallet, but whether there is a service provider behind the address. A hardware wallet fits this definition, so does the software wallet on your own device, and even the paper address where you never store your key digitally. In contrast, the deposit address on the second exchange is not a self-escrow address, even if it has been assigned to you personally. In transfers between two exchanges, the two platforms pass prescribed information to each other; the issue of proof of ownership does not arise there at all.

Article 14 (5): When more than 1000 euros, the exchange must confirm that you have the address

The wording of this clause is short and purposeful. When transferring money to a self-escrow address, the originator's crypto-asset service provider needs to collect and retain prescribed information about the originator and beneficiary and ensure that the transfer is individually identifiable. When the amount exceeds 1000 euros, the substance needs to be added: the provider should take appropriate measures to confirm whether the address is owned or controlled by the originator.

There are two points here that are often ignored. First, the regulation refers to "ownership or control" rather than identification; it verifies your connection to a particular address, rather than re-verifying your identity. Second, Article 14 (8) sets a strict order: providers are not allowed to initiate or perform transfers until the requirements of this clause are fully met. As long as there is no proof, withdrawal cannot be carried out. This is why withdrawals sometimes get stuck in the queue without showing any errors.

Obligations do not stop below € 1000: Information is collected for every crypto transfer

The € 1000 threshold only applies to a qualifying determination of ownership or control. Information requirements per se have no lower limit. According to Article 14, paragraph 1, initiator information includes name, distributed ledger address, account number of encrypted asset accounts, and address including country, as well as official personal identification number and customer identification number, or alternative birth date and location. Paragraph 2 requires corresponding information on the beneficiary.

When transferring money to your wallet, you are both the initiator and the beneficiary. That's why you feel like the whole process is normal: the exchange already holds your data and fills it out. This rule becomes visible only when the threshold is exceeded, because there are more steps that only you can perform. People who frequently withdraw small amounts of money rarely encounter this situation; people who clear their accounts encounter this situation almost every time.

Pursuant to Article 14 (6), providers are also required to verify the accuracy of originator information based on documents, data or information obtained from reliable and independent sources. Paragraph 7 clearly states that if you have passed identity verification under the anti-money laundering rules and the data has been retained, this verification will be deemed completed. Therefore, for accounts that have passed full verification, this part of the work is completed before you trigger the withdrawal. On exchanges with European authorizations, this is itself a prerequisite for opening an account.

Exchange rate at the time of transfer: How to calculate the 1000 euro threshold

The threshold is the amount in euros; the transfer is the crypto-asset. How to convert the two is governed by the European Banking Authority's Guide to Travel Rules (EBA/GL/2024/11), which will apply from December 30, 2024. Article 82 states that providers use the exchange rate of the transferred cryptographic assets at the time of transfer to determine their euro value, regardless of any transaction costs.

In practice, this means that the decisive moment is the withdrawal itself, not the point of time when you make the purchase, nor the amount after deducting network fees. Positions that are significantly below the threshold at the time of purchase may cross the threshold at the time of withdrawal. Splitting withdrawals into multiple small amounts is not a viable way to circumvent it, either, because providers are obligated to independently detect and evaluate abnormal trading patterns.

Your provider must use at least one of five verification methods; it is up to the provider to decide which one to use.

Article 16 (2): Why deposits from one's wallet will trigger the same check?

The payment process is also subject to symmetrical supervision. In accordance with paragraph 2 of Article 16 of the Regulation, the beneficiary provider is required to collect and retain the same information for transfers initiated from a self-escrow address; when the amount exceeds 1000 euros, it should also take appropriate measures to confirm whether the address is owned or controlled by the beneficiary. Paragraph 3 further requires that beneficiary information must be verified before providing cryptographic assets.

Anyone planning to transfer self-managed assets back for sale on an exchange should plan for doing so. The recording of funds may be delayed until certificates are submitted, which happens in scenarios where speed is typically sought. The operating process is the same as for reverse transfer, except that the check is now on the recipient's side.

Five verification methods: What methods are allowed in the EBA Travel Rules Guide

Regulations stipulate that inspections must be carried out, but do not specify how to do so. Article 83 of the EBA Guidelines fills this gap. Providers should use at least one of five verification methods to assess whether the self-managed address is owned or controlled by the originator or beneficiary.

These methods include: unattended verification procedures with a clear address in accordance with EBA's Guidelines for Remote Customer Onboarding Solutions; attended procedures under the same guidelines; sending a preset amount from a self-managed address to a provider account; requiring customers to digitally sign specific messages using a key corresponding to that address; and other appropriate technical means provided that a reliable and secure assessment is achieved.

Under Article 84, it is up to the provider to decide which method to use, taking into account three factors: the technical capabilities of the self-managed address, the robustness of the evaluation that the method can provide, and money laundering and terrorist financing risks. Article 85 adds that if a single method is not reliable, multiple methods should be combined. You don't have the right to choose the method, but you can expect that in practice two intermediate variants (reference transfers and signing messages) will dominate.

Reference transfers: Why exchanges want to see tiny amounts sent from your address

When using this approach, the provider sets an amount, preferably the minimum denomination of the crypto asset, and you then send that amount to the provider's account from a self-escrow address. If the payment happens to come from that address, control of that address can be determined. For Bitcoin, the smallest unit is satoshi, so the industry often names the process after it.

The advantage of this method is that it works with almost any wallet, because sending is a function that every wallet has. The disadvantage is that it takes time. You need to get confirmation on the relevant network and pay network fees, which may far exceed the small amount transferred. People experiencing this process for the first time should not expect to complete the actual withdrawal in the same quarter of an hour.

The second point concerns the sequence of events. The small amount must come from the same address that you intend to subsequently use as the target address. For wallets that generate a new address every time you make a payment, this is a trap: the address you use to prove may be different from the address the wallet displays for withdrawals. Check the settings of your hardware wallet before first certification to avoid repeating the entire operation.

Sign messages: How to sign with a private key without handing in the private key

The second variant common in practice requires no transaction. The provider gives you a piece of text, and you sign it in the wallet software with the key corresponding to the address. What you return is a signature-a string that can be calculated to deduce that it can only be generated by a matching private key.

During this process, the private key never leaves the device. This is a fundamental difference from anything that appears to hand over a private key, and why the process is impeccable in terms of security-provided that you only sign the text specified by the provider. Conversely, if someone asks you to sign arbitrary messages or even transactions in addition to the withdrawals you initiate, you need to be cautious. You have no proactively triggered signature request and should not be approved.

However, this method is technically more demanding than reference transfers because not all wallets support signing any message, and the implementation varies depending on the address type. This is exactly what the first consideration in paragraph 84 of the guide is aimed at: the technical capabilities of the address.

Article 15a of the German Anti-Money Laundering Law: Additional applicable enhanced due diligence

In addition to EU regulations, German law also adds Article 15a of the Anti-Money Laundering Law. It requires companies that perform crypto-asset transfers to identify and evaluate the associated risks when the beneficiary or originator is a self-custodial address, and take appropriate risk mitigation measures.

Paragraph 2 lists the minimum requirements within this range, with one measure or a combination of multiple measures: collecting, verifying and storing the identity information of the beneficiary or originator and the actual beneficiary of the self-escrow address; measures to determine the source and destination of the cryptographic assets to be transferred; enhanced and continuous monitoring of such transactions and related business relationships; or other measures to mitigate and manage risks.

This explains why some questions can feel violated. When a provider asks about where or where your crypto assets are, it is implementing the second measure above. This is an obligation independent of proof of ownership and is not the same. Proof of ownership solves the issue of who owns the address; the issue of origin solves the issue of what is intended to happen on the address.

Once the address is verified, the provider can whitelist it and skip checking in the future.

Whitelist: Why second inspections usually disappear

Guideline 86 describes this mechanism, which makes daily burdens manageable. When the provider has fully confirmed that the self-escrow address is owned or controlled by its customer, it should record this information in its system; thereafter, it may not need to apply these measures again for subsequent transfers to the same address. The guide clearly calls it a white list.

But with one condition. Providers using whitelists should have controls in place to detect changes in risk and changes in ownership or control. If it is found that the risk has changed, or there are signs that the customer no longer owns or controls the address, it should be removed from the whitelist.

For you, a simple sequencing suggestion follows: It is far more comfortable to complete a certificate in advance and leisurely before time pressures arise than to rush to reissue it on the last day of the deadline. Register your target address early and get it cleared so that at the critical moment, the step is complete.

Hardware wallets without signature: When addresses lack technical capabilities

Not every wallet can handle every method, and the guide clearly allows this through technical capability standards. If the provider requires a message to be signed and your wallet does not have this feature, referring to transfers is usually the solution. On the contrary, if the wallet is only set to receive and there is no balance to pay network fees, reference transfers cannot be made.

This raises a question that is rarely considered before purchasing a device: a wallet that supports both methods allows you to choose without relying on the provider's method. Before setting up a wallet, it is worth checking two issues in the wallet documentation: whether the companion software supports signing arbitrary messages, and whether a fixed collection address can be used.

Withdrawal deadline and proof of ownership: Why the combination of the two becomes urgent

When a certain date is set, proof of ownership becomes a scheduling issue. For example, BitMEX has announced that it will stop operating the exchange at 04:00 UTC on September 23, 2026. According to an announcement on the company's website, starting from 04:00 UTC on August 26, 2026, the risk limit limiting the opening of new positions will take effect; from then on, the platform will close all existing open positions on its own. Anyone who still holds a balance and wishes to transfer it to self-custody must complete proof of ownership within this time window, which is the only step in the entire process that is not exchange-dependent.

The same model applies when the exchange is not closed but the tokens are removed. The sequential relationship between deposit suspension, transaction suspension and withdrawal deadline has been explained in detail in relevant articles. As far as planning is concerned: Proof of ownership should be placed at the beginning of the chain, not at the end.

What can you do when a withdrawal is stuck

If the withdrawal you initiate is stuck and there is no obvious reason, you should first check the account notification because certification requests are usually delivered there, not via email. If this fails, the normal route is to formally complain to the provider-every provider authorized by MiCA must establish this complaint process, which is free of charge and has no specified format.

What proof of ownership is not: Distinguishing KYC, tax and proof of reserves

There are three common confuses that all lead to false expectations. Proof of ownership is not a duplicate authentication. Your identity was confirmed when you opened the account; all that matters here is the ownership of the address. It is also not a tax matter. The transfer of one's own assets from one's address to another does not in itself constitute a disposal, and the certificate of ownership remains unchanged. It is also not a certificate of reserves: a certificate of reserves concerns whether the exchange holds customer balances, while a certificate of ownership points in the opposite direction and concerns your address.

This raises the most likely unsettling point. Through proof, the provider knows your address, which is historical on the public blockchain. This is an unavoidable consequence of the rules and the price for making transfers to self-custody still possible at authorized providers rather than being completely prohibited on risk grounds.

Proof of wallet ownership: Summary points

Complete proof before needed. Simply register your wallet's destination address once and pass it through review so that the white list under Article 86 of the EBA Guidelines will take effect. Which devices support message signing, please refer to hardware wallet comparison.

Check which methods your wallet supports. If it can sign the message, the proof takes only a few minutes; if not, it keeps a small balance in its wallet to refer to the network fee for the transfer. For the function set, please refer to software wallet comparison.

The € 1000 threshold is calculated at the time of withdrawal. According to Article 82, the decisive value is the exchange rate at the time of transfer, not your cost basis. Whether your provider applies EU requirements can refer to the comparison of regulated exchanges.

Anyone who wishes to read the full process can find the guide (numbered EBA/GL/2024/11) on the European Banking Authority's publications page; it will be applicable from December 30, 2024 and will replace the previous joint guide from 2017.

(As of August 19, 2026. This article does not constitute investment advice. Price and fee structures may change; please confirm terms with your provider before purchasing.)