Is Wallet-as-a-Service Regulated?

Is Wallet-as-a-Service regulated? It depends on whether the provider can unilaterally move clients’ assets. If the provider holds private keys on clients’ behalf and can initiate transfers on its own, that is a custody business in most jurisdictions and requires the relevant license. Under a self-custody model, where clients always retain independent control of their assets, the provider is usually treated as a technology provider and generally does not need a custody license.

Why Does It Come Down to Who Controls the Private Keys?

Regulators in different regions take a very similar approach to defining custody. They don’t look at what the service is called, or whether it uses APIs or MPC. They look at whether, in the normal course of business, the provider can move assets without the client’s consent.

Take MPC as an example. If the provider holds only one key shard, signing requires the client’s authorization, and the client can use a recovery tool to retrieve assets independently, the provider is usually not considered a custodian. Conversely, if the client can’t access its assets without the provider, it may be classified as custody even if the technology is MPC. For more on the difference between custody and self-custody, see What Is the Difference Between Custodial and Non-Custodial Wallets?

How Do Major Jurisdictions Regulate WaaS?

European Union

MiCA defines safekeeping or controlling crypto-assets and their private keys on behalf of clients as a custody service that requires authorization. Recital 83 of MiCA also states that providers of non-custodial hardware or software wallets are not custodians. Custodial WaaS generally needs a CASP license, while for self-custody WaaS it depends on whether the specific architecture gives the provider actual control.

United States

FinCEN’s 2019 guidance distinguishes between two types of wallet providers: custodial wallets that hold funds on users’ behalf are money transmitters that must register and meet anti-money laundering obligations, while non-custodial wallets that only provide software and leave users in control of their funds are not. States have their own rules as well, such as New York’s BitLicense. In addition, the SEC’s proposed custody rule from October 2026 would permit registered investment advisers to self-custody under certain conditions, which could open up more room for self-custody WaaS.

Hong Kong

In December 2025, Hong Kong published consultation conclusions on a licensing regime for virtual asset custodians, with legislation planned for 2026. The test is whether the provider can unilaterally transfer clients’ assets. The conclusions specifically note that MPC, Wallet-as-a-Service, and embedded wallet providers generally do not need a license if clients can transfer assets independently, reconstruct the full private key, or access assets without relying on the provider. Where no recovery tool is provided and clients can’t transfer assets independently, a license may be required.

Singapore

Singapore has brought custody services for digital payment tokens within the licensing scope of the Payment Services Act. Providers that hold private keys on clients’ behalf need a license and must meet requirements such as asset segregation.

What Should Businesses Using WaaS Watch Out For?

For exchanges and payment companies using WaaS, licensing has two layers. The first is the provider’s own status: if you choose custodial WaaS, confirm the provider holds the relevant license where you operate; if you choose self-custody WaaS, confirm you can truly control and recover your assets independently.

The second is the business’s own obligations. Even if the provider doesn’t need a license, a business that manages assets for its users may still need one itself, along with obligations such as KYC, the Travel Rule, and anti-money laundering screening. Before choosing WaaS, confirm the specific licensing path with local legal counsel.

Conclusion

Is Wallet-as-a-Service regulated? The core question is whether the provider can unilaterally move clients’ assets. Custodial WaaS generally requires a license in the EU, the US, Hong Kong, and Singapore, while self-custody WaaS that lets clients always control and recover their assets independently is generally treated as a technology provider. When choosing, consider both the provider’s status and your own compliance obligations.

Want to see how self-custody WaaS helps you keep control of your assets? Explore Safeheron WaaS, or contact the Safeheron sales team to book a one-on-one demo