The short answer
A provider may need to establish who owns or controls an address under the applicable process. That is different from asking the company to surrender the credentials that can move the assets. The travel-rule framework includes self-hosted-address checks; it does not make uncontrolled disclosure of private credentials a sensible evidence practice. [EUR-Lex] [EBA]
Source-linked facts below are distinct from our suggested workflows. Examples are hypothetical; this is not individual legal, tax or investment advice.
The operating distinction
Keep the wallet inventory at the level of entity, purpose, network, public identifier and approval process. Where a control-verification step is required, use the provider’s official method and involve the company’s security owner. Treat unexpected credential requests as an escalation issue.
What to retain
Commercial origin evidence remains a separate layer. A wallet signature does not explain whether the receipt arose from a sale, grant, loan or another transaction. Link the supporting record rather than trying to use one technical proof for every onboarding question.
Method, assumptions and limits
Regulatory facts are linked to primary sources. Suggested workflows are our editorial synthesis; examples and fee scenarios are hypothetical. The mechanical illustration is a conceptual navigation aid, not a prescribed legal funds flow.
This is a dated research edition, not an automatically updated register or live price feed. Check the applicable entity, service, jurisdiction and source version before using the material.
Read the methodologySources & scope
Research snapshot: 12 November 2026. The dated rule, its scope and the legal entity matter. Open the primary source before acting.
- EUR-Lex: Regulation (EU) 2023/1113 — information accompanying transfersEU legislation
- EBA: Travel Rule Guidelines — information accompanying transfersRegulator guidance
- EBA: Guidelines challenging unwarranted de-riskingRegulator guidance