Self-hosted Wallet Verification Methods: An Overview

Key Takeaways

• Self-hosted wallet verification helps VASPs establish control of a destination address before transferring digital assets to a wallet outside their custody.
• There is no single verification method suitable for every scenario. The right approach depends on security requirements, supported wallets and blockchains, transaction costs and the customer experience.
• Cryptographic proof methods provide stronger evidence of address control than screenshots or video clips, which can be manipulated.
• Automated verification reduces manual work. Methods such as AOPP can simplify verification for both customers and compliance teams.
• Satoshi Tests can incur transaction fees, while manual signing requires compatible wallet software and technical knowledge.
• Wallet ownership verification is only one part of compliance. It does not, by itself, establish the identity of the wallet owner, determine the source of funds or confirm that a transaction is free from sanctions risk.

What Is Self-hosted Wallet Verification?

Self-hosted wallet verification is the process of establishing that a customer controls a cryptocurrency address held outside a virtual asset service provider's (VASP's) custody.

A self-hosted wallet, sometimes called an unhosted or private wallet, allows users to control their own private keys. Examples include mobile wallets such as BlueWallet and Edge, and hardware wallets such as Trezor and Ledger.

When a customer withdraws digital assets from a VASP to a self-hosted wallet, the VASP must assess the destination address and apply the relevant regulatory requirements. Unlike a transfer between two VASPs, the transaction does not involve another regulated service provider that can exchange Travel Rule information with the originating VASP.

The VASP may therefore have limited information about who controls the destination address.

Wallet ownership verification helps address this information gap by providing evidence that the customer controls the address receiving the funds.

Depending on the applicable regulatory framework, VASPs may need to implement technical verification measures when processing transfers involving self-hosted wallets. The precise requirements vary by jurisdiction, transaction type and applicable thresholds.

For VASPs subject to the FATF’s Travel Rule or related national requirements, wallet verification can form part of a broader compliance process.

However, verifying control of an address does not automatically establish the identity of its owner or eliminate the risk of transactions involving sanctioned individuals or entities. VASPs must consider these risks alongside customer due diligence, sanctions screening and transaction monitoring.

What Are the Main Methods of Self-hosted Wallet Verification?

VASPs can use several methods to establish control of a self-hosted wallet. Each offers different levels of security, automation, cost efficiency and accessibility.

The four methods discussed in below are:

1. Address Ownership Proof Protocol (AOPP).

2. Manual signing.

3. Satoshi Test.

4. Visual proof using screenshots or video clips.

These methods are not mutually exclusive. A VASP can offer several verification options to accommodate different wallets, assets and customer requirements.

The sections below explain how each method works with its pros and cons.

1. Address Ownership Proof Protocol (AOPP)

The Address Ownership Proof Protocol (AOPP) automates the process of proving control of a self-hosted wallet address.

Developed by 21 Analytics, AOPP addresses the usability and operational limitations of traditional wallet verification methods. It enables customers to generate and submit cryptographic proof of wallet ownership without manually signing a message or sending cryptocurrency to demonstrate control.

How Does AOPP Work?

AOPP automates the wallet ownership verification process, making it easier for both VASPs and their customers to establish control of a self-hosted wallet address.

Unlike the Satoshi Test, AOPP does not require an on-chain transaction, meaning customers do not incur mining fees for verification. It also avoids the need to reuse wallet addresses for verification purposes. Unlike visual proof methods, which rely on visual evidence, AOPP uses cryptographic proof to verify wallet ownership.

With 21 Travel Rule, customers can verify ownership through the AOPP Portal. In just a few clicks, the proof is generated and submitted to the VASP within seconds, allowing the customer to proceed with the transaction without unnecessary delays.

What Are the Advantages of AOPP?

• AOPP reduces the need for manual intervention by customers and compliance teams.
• Unlike a Satoshi Test, AOPP does not require an on-chain transaction solely to demonstrate wallet control. Customers therefore avoid the associated mining or network fees.
• AOPP provides a cryptographic proof rather than relying on screenshots or video clips that may be manipulated.
• An automated workflow can make verification more accessible to customers who are unfamiliar with technical signing procedures.
• The 21 Analytics AOPP Portal supports more than 540 wallets, including BitBox, Jade, Tronlink, Phantom, Trezor, Ledger and MetaMask. Its multi-chain support covers Bitcoin, Ethereum, Binance Chain, Solana, TRON, Polygon, Avalanche, Gnosis, Arbitrum and Optimism, providing access to a broad range of digital assets.

2. Manual Signing

Manual signing is a cryptographic method of verifying control of a wallet address without sending an on-chain transaction.

How Does Manual Signing Work?

The VASP provides the customer with a message to sign. The customer copies the message into compatible wallet software and signs it using the private key associated with the wallet address being verified.

The VASP then verifies the resulting cryptographic signature to establish that the customer controls the corresponding private key. For verification to be valid, the signature must be correctly linked to the intended wallet address and verification request.

What Are the Advantages of Manual Signing?

• A correctly implemented signature verification process provides stronger evidence of address control than a screenshot or video.
• Customers do not need to transfer cryptocurrency merely to demonstrate control, avoiding associated transaction fees.
• The VASP can verify the signature against the relevant address and message.

What Are the Limitations of Manual Signing?

• The main limitation is wallet compatibility. Not every wallet supports message signing, and some wallets do not allow users to select the specific key associated with the withdrawal address.
• The process can also be difficult for less technical customers. Locating the appropriate signing functionality, copying the correct message and submitting the signature may require additional instructions.
• Consequently, manual signing can increase customer support demands, particularly for VASPs serving customers who use a wide variety of wallets.

3. The Satoshi Test

A Satoshi Test is a transaction-based method of verifying control of a cryptocurrency address.

The customer sends a small, predefined amount of cryptocurrency from the address being verified to a destination specified by the VASP. The VASP uses the resulting transaction as evidence that the customer can initiate a transfer from that address.

Although widely recognised, the method has practical limitations, including transaction fees and potential delays in the verification process.

How Does a Satoshi Test Work?

To complete a Satoshi Test, the customer must initiate an on-chain transaction from the withdrawal address to the destination specified by the VASP. The VASP then checks the transaction to verify that the required transfer has taken place.

While effective, the method can be time-consuming when not fully automated. Compliance teams may need to review transactions and respond to verification requests manually, increasing the operational workload.

What Are the Advantages of a Satoshi Test?

• The method relies on an observable blockchain transaction rather than a customer-provided screenshot.
• Many cryptocurrency users already understand how to send digital assets.
•  The method can be used with compatible wallets and assets that support the required transaction flow.

What Are the Limitations of a Satoshi Test?

• Customers may need to pay network fees to complete the verification. These costs vary by blockchain and network conditions.
• The VASP may need to wait for the transaction to be detected or confirmed before completing verification.
• If the process is not automated, compliance teams may need to identify transactions, match them to verification requests and update the relevant records manually.
• Repeated verification transactions can create additional on-chain activity. Depending on the circumstances, this may encourage address reuse, which can weaken transaction privacy.
  

4. Visual Proof: Screenshots and Video Clips

A visual proof is a wallet verification method in which a customer submits a screenshot or video of their wallet application displaying the address they intend to use for a withdrawal. The VASP’s compliance team reviews this evidence to check whether the displayed address matches the withdrawal address provided for the transaction.

How Does Visual Proof Work?

The customer captures a screenshot or video of their wallet application showing the relevant address and submits it to the VASP.

A member of the compliance team then reviews the evidence and compares the displayed address with the withdrawal address. If the addresses match, the team can approve the address verification, subject to any other applicable checks.

What Are the Advantages of Visual Proofs?

• Most customers can capture a screenshot or video using familiar devices and applications.
• The method does not depend on the wallet supporting a specific cryptographic signing feature.
• VASPs can introduce the process without necessarily integrating a specialised wallet verification protocol.

What Are the Limitations of Visual Proofs?

• Images and videos can be edited or fabricated. A convincing screenshot does not, by itself, establish that the customer controls the private key associated with the displayed address.
• Compliance staff must inspect submissions, compare addresses and decide whether the evidence is sufficient.
• Verification can take longer when submissions are incomplete, unclear or require additional review.
• Manual processing becomes increasingly resource-intensive as transaction volumes grow.
• Repeated requests for visual evidence may encourage customers to reuse addresses, potentially weakening privacy.