In short
- A wallet does not hold coins the way a purse holds cash. It holds keys that authorise changes to what a public network has recorded.[1]
- In a custodial wallet, a company holds the keys for you. In a non-custodial wallet, you hold them.[1]
- The benefit is control: you can authorise your own transactions "without needing approval from an intermediary". The cost is care: "a high degree of personal responsibility".[1]
- MiCA, the EU regulation on crypto-assets, lists "providing custody and administration of crypto-assets on behalf of clients" among crypto-asset services (Article 3(1)(16)), and Article 59(1) says who may provide crypto-asset services in the Union.[2][3]
Two safes
Think of two safes. In a hotel safe, the hotel can hold a key. In a safe at home, you hold the key.
A custodial wallet works like the first. A non-custodial wallet works like the second.
The key in question is a private key. Ledger Academy, a wallet maker's learning site, describes it as "a long number that is randomly generated when a blockchain address is created" and says it "grants you access to manage the crypto associated with that address".[1]
What a wallet really holds
A wallet does not store coins. The coins are recorded on a public network. In the words of the same source: "What the wallet actually holds are private keys, which allow someone to authorize changes to those assets."[1] Every time a transaction is made, it "must be cryptographically signed using the private key".[1]
So the question is not where the coins are. The question is who holds the key that signs.
Custodial and non-custodial, side by side
| Custodial wallet | Non-custodial wallet | |
|---|---|---|
| Who holds the keys | A third party, on your behalf.[1] | You. |
| Who signs | You log in and request. Ledger Academy says "the cryptographic control remains with the service provider".[1] | Your wallet signs, with your keys. |
| What you rely on each day | The provider's login, service and decisions. | The keys you keep. |
| What you look after | Your login. | Your keys, or the words that open them. |
What changes when you hold the keys
The benefit is control. Ledger Academy says a non-custodial wallet lets you authorise and broadcast transactions yourself "without needing approval from an intermediary".[1] Your balance does not depend on a company's login or opening hours.
The cost is care. Ledger Academy says this level of control "requires a high degree of personal responsibility".[1] The words that open your wallet work like a master key: whoever has them controls the wallet.
Four habits go with holding your own keys.
- Write the words on paper, in order. Do not take a screenshot.
- Keep the paper in a private place.
- Type your recovery phrase only on the Kudu app's own recovery screen, at app.kudu.cash, and only when you restore your wallet or choose a new PIN. Never type it into any other form, message or page. Treat every other request for it, whoever it claims to come from, as a scam attempt.
- Check every address before you send. A send cannot be undone.
What the EU rules say
This section quotes EU texts and authorities. It describes the rules in general.
- Holding keys for others is a crypto-asset service in MiCA. Article 3(1)(17) defines "providing custody and administration of crypto-assets on behalf of clients" as "the safekeeping or controlling, on behalf of clients, of crypto-assets or of the means of access to such crypto-assets".[2] Article 59(1) says: "A person shall not provide crypto-asset services, within the Union, unless that person is" one of the authorised or otherwise permitted categories it then lists.[3] The AMF says that its white list of authorised providers is available on its site: "La liste blanche des PSCA autorisés est disponible sur le site de l'AMF."[4]
- Transfers to and from a self-hosted address can carry duties for the provider on the other side. The EU transfer regulation (Regulation (EU) 2023/1113) says in Recital 38 that its requirements apply to transfers "to or from a self-hosted address, as long as there is a crypto-asset service provider involved".[6] Its Article 14(5) says that for "a transfer of an amount exceeding EUR 1 000 to a self-hosted address", the originator's crypto-asset service provider "shall take adequate measures to assess whether that address is owned or controlled by the originator". Article 16(2) says the same for the beneficiary's provider, for a transfer "from a self-hosted address".[6]
- The EU's three supervisory authorities give advice about wallets and providers. In their press release of 6 October 2025, they recommend that consumers "check the provider of crypto-asset services is authorised in the EU" and "make sure any wallets used to store their crypto-assets are sufficiently secured".[7]
ESMA publishes an interim public register of authorised crypto-asset service providers, last updated 22 October 2026 when we read it.[8]
Questions
Does non-custodial mean that no company is involved?
No. A wallet is one part. The company that issues a token, the network that confirms transactions, and any company that turns a token into cash each have their own part. For USDC on the Stellar network, Circle issues the token and the Stellar network confirms the transactions.
Does it mean that nobody else can affect my USDC?
No. Non-custodial describes who holds the keys of your wallet. The issuer of a token follows its own rules. Circle's redemption policy says redemption is "subject to the identity checks, transactions monitoring verifications and other actions" it lists, and that Circle France "is required to prevent restricted persons from holding Circle Coins".[9]
What does "self-hosted" mean in the EU texts?
Article 3(20) of the transfer regulation defines a self-hosted address as "a distributed ledger address not linked to either of the following": a crypto-asset service provider, or "an entity not established in the Union and providing services similar to those of a crypto-asset service provider".[6]
In the Kudu app
In the Kudu app, the cards that set up your account on the Stellar network say "You sign on this device", and a payment asks for your code on your device.
Related guides
Sources (9)
- Vendor
Ledger Academy, "What Are Custodial and Non-Custodial Wallets?", read 23 October 2026. A wallet maker's learning site, used for plain definitions only. "a long number that is randomly generated when a blockchain address is created"; "without needing approval from an intermediary"; "requires a high degree of personal responsibility".
- Law
Regulation (EU) 2023/1114 (MiCA), Article 3(1)(16) and (17), Official Journal L 150, 9 June 2023. "the safekeeping or controlling, on behalf of clients".
- Law
Regulation (EU) 2023/1114 (MiCA), Article 59(1). Same link.
- Regulator
AMF (France), news item of 5 February 2026 on the end of the transition for crypto-asset service providers, read 23 October 2026. "La liste blanche des PSCA autorisés". Only the white-list sentence is used; the item's own transition date has passed (see the AMF release of 6 July 2026, ref S08).
- Law
Regulation (EU) 2023/1114 (MiCA), Recital 83 (a recital, not an operative article), Official Journal L 150, 9 June 2023. "should not fall within the scope of this Regulation".
- Law
Regulation (EU) 2023/1113 (transfer of funds), Recital 38 and Articles 3(20), 14(5) and 16(2), Official Journal L 150, 9 June 2023. "shall take adequate measures to assess whether that address is owned or controlled by the originator".
- Regulator
EBA, EIOPA and ESMA, "EU Supervisory Authorities warn consumers of risks and limited protection for certain crypto-assets and providers", press release, 6 October 2025, read 23 October 2026. "check the provider of crypto-asset services is authorised in the EU".
- Regulator
ESMA, "Markets in Crypto-Assets Regulation (MiCA)", interim MiCA register, last update 22 October 2026, read 23 October 2026.
- Issuer
Circle Internet Financial Europe SAS, "MiCA Redemption Policy", last updated 15 September 2026, sections 3 and 5.1, read 23 October 2026. "is required to prevent restricted persons from holding Circle Coins".