Who Is Responsible for Compliance When Using a Third-Party Wallet Provider?

Who is responsible for compliance when using a third-party wallet provider? Responsibility remains with the regulated, customer-facing institution that uses the service. Regulators in the EU, the UK, Singapore and Hong Kong have all made clear that outsourcing a function to a third party does not transfer regulatory responsibility along with it. Under the standards of the Financial Action Task Force (FATF), whether the wallet provider itself needs to be regulated depends on whether it controls customer assets.

What Do the EU Rules Say?

The EBA Guidelines on outsourcing arrangements, published by the European Banking Authority (EBA) in 2019, provide that outsourcing a function cannot result in the delegation of management body responsibilities, and that institutions remain fully responsible for their regulatory obligations. The Digital Operational Resilience Act (DORA), which has applied since 17 January 2025, likewise states that financial entities remain at all times fully responsible for complying with their obligations under the regulation, including when using third-party ICT services.

On white labelling specifically, the EBA’s 2025 Report on White Labelling further states that the provider contracting with the customer bears ultimate responsibility for compliance, and is also fully responsible for anti-money laundering and counter-terrorist financing obligations. The report also lists “a lack of transparency about the roles and responsibilities of each party” as one of the risks white labelling poses to consumers.

What Do the UK and Singapore Rules Say?

In its statement on outsourcing and operational resilience, the UK Financial Conduct Authority (FCA) states that firms are responsible for all of their regulatory responsibilities and cannot delegate any part of them to a third party; even where a provider is designated under the critical third parties regime, this does not change the firm’s own accountability.

The outsourcing guidelines of the Monetary Authority of Singapore (MAS) likewise state at the outset that outsourcing does not diminish the obligations of an institution, its board or its senior management.

What Do the Hong Kong Rules Say?

In its guidance on the provision of digital asset custody services by authorized institutions, the Hong Kong Monetary Authority (HKMA) states that ultimate responsibility for any delegated or outsourced activity remains with the authorized institution (AI) itself; if custody is delegated to another provider, it is also the AI’s responsibility to ensure that the provider properly segregates customers’ digital assets. The guidance also restricts which entities custody can be outsourced to, and requires techniques such as key sharding so that private keys are distributed among multiple individuals.

This means that when banks choose wallet or custody technology, they must not only assess the provider’s capabilities but also make sure they themselves can take ultimate responsibility for asset segregation and key management.

Does the Custody Model Affect Who Is a Virtual Asset Service Provider?

Yes. The FATF’s 2021 guidance on virtual assets considers most custodial wallet providers to be virtual asset service providers (VASPs), while providers that only develop or sell unhosted wallet software or hardware generally are not. The guidance interprets “control” as the ability to hold, trade, transfer or spend virtual assets, and notes that control may also exist where an operation requires keys held by others (such as multi-signature arrangements). Countries should also not rely solely on a product’s name or how it describes itself when making a determination.

Therefore, when using a third-party wallet, businesses need to establish who holds the keys or key shards and whether the provider can move funds on its own. This affects not only whether the provider itself is regulated, but also the business’s own custody model and licensing needs. White-label crypto wallets and how to choose a secure Wallet-as-a-Service provider cover the questions to ask when selecting a provider.

Conclusion

Whether through white labelling, outsourcing or third-party technology, regulators in the EU, the UK, Singapore and Hong Kong take a consistent position: the regulated, customer-facing institution retains ultimate compliance responsibility. Whether the wallet provider itself is regulated depends on whether it controls customer assets. Before signing a contract, businesses should clearly set out key control, asset segregation and each party’s responsibilities.